Abstract:
Abstract: Radio Frequency Identification (RFID) is fast becoming a part of our every day lives. RFID provides automated identification that can be deployed to track anything from stock to pets to people. While it is a powerful means of improving businesses’ efficiency, they also provide new avenues of abuse that could potentially be devastating to personal privacy. Exploiting RFID for tracking of customers or citizens poses severe question of ethics that must be addressed for RFID to be of worth to society.
1. RFID – A Brief Description
RFID stands for Radio Frequency Identification, a method of automatic identification that employs the use of transponders called RFID tags. These tags contain information that can be read by interrogating the RFID tag using radio waves of a specific frequency.
Three types of RFID tags exist: passive, semi-passive (or semi-active), and active. Passive RFID tags have no internal power source, but are powered by currents induced in its antenna by querying radio signal. Semi-passive/active tags contain a power source that removes dependence on induced power and thus they can respond more quickly and strongly when queried. Active RFID tags also contain an internal power source, but they broadcast information at set intervals as well and have the ability to store additional information.
Of these three types of RFID tags, passive tags are the most popular because they are inexpensive due to lack of an internal power source. On October 5th 2005, SmartCode Corporation offered a price of 7.2c USD per passive RFID tag for volumes above 10 million [1]. It is speculated that in 2007 the price will drop to as low as 5c USD per tag [2].
To automatically identify an item containing a passive RFID tag, an RFID reader is first used to send radio waves of the correct frequency. The passive RFID tag’s antenna converts the radio waves into electrical current that powers an embedded CMOS microchip. The microchip then transmits data using the antenna, which is then received by the RFID reader and used to identify the item.
When compared with current means of identification, particularly barcodes, RFID has several advantages: it does not require line-of-sight scanning; many tags can be read at once; they carry more information and can thus uniquely identify each individual item; they are more resilient to damage such as tearing; and they can be invisibly embedded. However RFID tags will not soon replace barcodes because barcodes are still the most efficient and inexpensive method for many applications.
Currently RFID tags find applications in logistics, where they are used to track stock or items as it travel through a supply chain; in animal identification of pets and farm animals; and in automatic billing systems such as E-way in Sydney [3]. Other applications are also being explored. These include embedding RFID tags within passports or similar forms of identification to prevent fraud, and embedding RFID tags into medicine packaging to aid people with disabilities.
2. The Benefits flowing from RFID
For companies who utilise RFID in their supply chain systems, the benefits of RFID are in its greater capacity in storing data, non-line-of-sight reading of RFID tags, and many-at-once reading. For example, perishable stock can have RFID tags that not only specify the storage temperature and conditions, but also an expiration date. Then using many-at-once reading, where a single reader can “broadcast” its query to all tags within a set distance and capture their replies, it is very easy to pick out stock that is soon to expire. This stock can then be used or sold promptly to reduce loss due to spoilage. Similarly, many-at-once reading can very quickly produce a count of stock of a certain type, so out-of-stock losses are reduced.
The larger amount of information in an RFID tag also makes tracking of individual items easier. Normally items are tracked per-batch or production run using barcodes. Using RFID tags each item can be tracked individually, reducing losses from items going missing by offering finer control in tracking.
To businesses in general, the benefit flowing from RFID is in greater visibility of their products through providing more information per-tag-per-item. This results in more efficient management of inventories and labour. It is estimated that there will be a 7.5 percent saving in store and warehouse expenses using RFID for suppliers, and $700,000 USD per $1 billion USD of extra revenue for retailers resulting from reduction in out-of-stock items [4].
The benefits of RFID go beyond managing inventories and stock. Because they can store relatively large amount of information, RFID tags have been embedded in medicine packaging that store the current dosage, side effects and so on. This information can then be read by an RFID reader and spoken aloud. This greatly assists those patients with vision impairment. One such system is ScripTalk Talking Prescription [5] that stores the patient’s name, their doctor’s name and phone number, the drug’s name, the dosage, general instructions, warnings, and the prescription number in an RFID tag attached to the medicine. When a ScripTalk reader scans such tags, the information is translated into speech using speech synthesis.
Other benefits flowing from RFID are in identification and tracking of animals, such as pets or cattle. In Australia for example, it is common practice to implant an RFID tag under the skin of new pets, so that if they are lost they can be identified and the owner contacted. Likewise, the Canadian Cattle Identification Agency is using RFID tags to track cattle [6], especially in the event of contamination. The benefits flowing from RFID however extend beyond what is listed here. Many other areas such as remote sensing, localisation, automated payment, document identification and tracking, law enforcement, and fraud prevention also benefit from utilising RFID.
It is expected the benefits of RFID will be felt in more areas as equipment for their manufacturer and utilisation become cheaper. However the use of RFID is not without its costs and ethical issues.
3. The Costs flowing from RFID
The costs of RFID come from the one-off cost of purchasing equipment and the recurring cost of producing RFID tags. The one-off cost include purchase of RFID readers, RFID tag fabricators, and integrating RFID into existing systems. Typically a UHF (Ultra High Frequency) RFID reader will cost $1000 - $3000 USD. A standalone low-frequency reader costs $500 - $750 USD [7]. The estimated total cost of implementing RFID - found in a study by Forrester Research - for a supplier complying with RFID mandate of large-retailers such as Wal-Mart is $9 million USD [8].
Recurring costs of RFID comes from the production and application of labels. These costs depend on the type of the tags, if they are read or read-write, and how often they are applied. Typically an RFID tag that can be printed on to costs from 40c USD and up. Recurring costs may however be higher due to faulty RFID tags. Current failure rates range between 3-5 percent [19].
It is expected that with wider deployment the cost of RFID equipment and tags will decrease. Similarly, it is expected the number of RFID related frauds to increase as well. RFID fraud can be countered to an extent using RFID tags that only respond when supplied with a secret code. However such tags are susceptible to power analysis attacks as demonstrated by Adi Shamir of Weizmann University [11]. Further even strongly encrypted static information can be deciphered due to manufacturer negligence. For example, the Dutch RFID passport prototype had its encryption broken within 2 hours because the encryption keys were generated in a predictable manner [12]. These issues of RFID security will require further research and development before sensitive and critical information - such as those found in passports - can be stored within RFID tags. Such research will incur additional costs.
A potential cost flowing from RFID is in the disposal of RFID tags. Conductive inks and metals used in RFID tags may contaminate the process of recycling paper, as RFID tags are often embedded into the cardboard packaging. Similarly pallets with embedded RFID tags may have adverse effects when they are recycled, as the metallic antennas cannot be broken down. Glass and plastic packaging embedded with RFID tags can also damage recycling equipment [9]. In a study by the Fibre Box Association, it was found that when recycling paper with embedded RFID tags that silver ink used is not easily extracted from the recycled paper, but the amount of silver in waste produced is below regulatory thresholds [10].
4. The Ethical Issues arising from RFID
At the time of writing, there exists no regulatory agency or legislation that defines what constitutes ethical use of RFID, and no standard of practice to protect consumer privacy. Using RFID in this void of regulation requires serious considerations of the ethical issues arising from RFID.
The first major issue is whether or not working RFID tags should travel beyond the point of sale. Because of the tags’ open nature, simply by allowing products with embedded and operational to pass beyond the point-of-sale companies are compromising the privacy of their customers. If one would consider how RFID tags are read, it is clear any third party can easily and invisibly violate consumer privacy. Take for example a shopping trolley full of items with RFID tags. Any one with a suitable RFID reader can query and discover every item in the trolley. Further they can do this unobtrusively by merely walking past. When companies expose working RFID tags to consumers beyond the point-of-sale, they reduce their customers’ privacy. This is unethical practice – consumer privacy belongs solely to consumers, not to be meddled with.
A related issue is whether retailers should advertise the fact an item or packaging contains RFID tags. Currently there are no legislation governing such matters, so the decision rests with the manufacturers and distributors. Consumers may not want sensitive products, such as pregnancy tests to be RFID tagged and thus traceable when in some cases - if credit card is used to purchase the item - it is possible to link a specific purchase to an a credit card [15]. Some customers may not wish to purchase anything containing RFID tags. Ethics require companies make it known to customers exactly what they are purchasing and how it will impact on their privacy. However this issue is likely to be ignored by manufacturers and distributors may not wish to do so for fear of scaring away customers if it is not enforced by law.
The second major issue is the use of RFID for tracking individuals. RFID tags can now be manufactured on the scale of dust particles [13][14]. Such tags can be unobtrusively applied to a person without their consent. Governments may track people using such tags for reasons of law-enforcement. In such cases personal privacy is violated in the interest of law enforcement. The question arises then of whether such violation of privacy is acceptable when using RFID tags which appear ordinary or are invisible. A real world example that approximates this scenarios shows that it is not. When Brittan Elementary School deployed the InClass RFID systems in the form of nametags to track its students to ensure their attendance and safety, the outcry from parents was “completely unanticipated.” The outcry was for these reasons: the nametags were forced onto students through threats of disciplinary action; parents and students were not informed the nametags contained RFID tags; and parents did not want their children tracked [16]. This example serves to show the public is strongly against being tagged and tracked without their knowledge or consent.
Law-enforcement may also use RFID for more than merely tracking of suspect individuals. Because RFID tags can be read at a distance, law enforcement can probe the content of vehicles, containers, and even homes by using a suitably powerful and sensitive RFID reader. For example, an innocent citizen purchases chemicals for their garden or pool, and miscellaneous hardware for handy work around the home. It just so happens the purchased items can be used to construct a bomb. This fact is picked up by law-enforcement when they scan the content of the citizen’s vehicle. The result is potentially the immediate arrest of the citizen, a search of his or her property, and covert surveillance of the citizen. Is this use of RFID acceptable? On one hand it allows law enforcement to arrest criminals in the process of preparing or engaging in a crime, but in doing so it violate the privacy of the general public. Unlike X-ray scans at airports which is consensual and a requirement of passage, such probing of private property is not consensual, and should not be a requirement of being a citizen of a free country. Ultimately such use of RFID requires the sacrifice of the freedom to privacy for security. In the words of Benjamin Franklin, “Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety”
The third major issue is the use of RFID tags as a condition of employment. For security reasons, companies may implant heir employees with RFID tags to securely identify them. On one hand it is very difficult to remove an implanted RFID tag and re-insert it into some one else, providing a fairly secure means of identification. On the other hand this exposes their employees to tracking by any one with a suitable scanner. While some would argue this is no different than having company uniform as a condition of employment, or the use of a swipe card for identification, it must be pointed out that implanted RFID tags differ from these in significant ways. Firstly, implanted RFID tags cannot be easily removed unlike uniforms. Secondly, swipe cards can be left behind when not required while RFID tags cannot be. Thirdly both uniforms and swipe cards can be destroyed easily. Some insight into this issue can be gained by examining a real world example. An undisclosed Ohio company has implanted two of its employees with RFID tags. One of the employees, Mr Darks, expressed no concerns. He believes it cannot be actively used to compromise his privacy because the tag is passive [17]. This belief is based on the fact the implanted tag does is not active and that he cannot be tracked because no RFID tracking infrastructure exists. In his words: “It is not a GPS chip. My wife can’t tell where I am”.
There are many more issues arising from RFID, too numerous to discuss here. Fundamentally the ethical issues of RFID revolve around the issue of privacy. The core concept of privacy is the notion of a boundary between the environment and an individual. To one side of this boundary – environment – is considered “public” [18]. The other side – individual – is “private”. It is a human right to have the ability to control this boundary that separates private from public. Yet the most widely used RFID tags do not provide security measures to restrict reading, nor can their presence be easily detected. Combined with the fact they can be read remotely and secretly, RFID tags allow any third party to cross the boundary that separates the public and private aspects of an individual, thus violating their privacy and stripping them of the power to control what is private.
5. A Personal Assessment of the Worth of RFID
Clearly RFID is of significant worth to businesses. It allows effective control of the supply chain and inventory systems, while providing greater visibility of products. Savings from utilising RFID is likely to be passed on to the consumers.
Yet RFID is not without issues. While consumer benefit monetarily from savings gained by using RFID, they are presented with the risk of having their privacy violated without their consent or knowledge. In the current vacuum of RFID legislation, little is being done to protect consumers’ privacy. If this continues, consumer privacy will become a thing of the past. Thus, for RFID to be truly worthy to consumers, there must first exist legislation that regulate their use.
To governments, particularly for law enforcement, RFID is also of significant worth. Law enforcement can easily and unobtrusively track suspects or a group of suspects by dispersing dust-mote tags into the air. They can also be used to probe the content of homes, vehicles and offices passively, invisibly and without consent. These are powerful tools in keeping peace and order, yet it robs citizens of their right to privacy.
There is no doubt RFID is a powerful technology of worth to select groups. However until legislation governing the use of RFID are formulated and enforced, whether it is a “worthy” technology to society as a whole remains to be seen. The problem is not in its capabilities but in its utilisation and potential for abuse. A powerful technology is worthless when it requires the sacrifice of a fundamental human right, the right to privacy.
6. References
[1] http://www.smartcodecorp.com/newsroom/05-10-05.asp
[2] http://www.rfidjournal.com/article/articleview/796/1/2/
[3] http://www.m4motorway.com.au/html/e-way.html
[4] http://retailindustry.about.com/cs/it_rfid/a/bl_atk111003.htm
[5] http://www.envisionamerica.com/scriptalk.htm
[6] http://www.canadaid.ca/About/FAQs.shtml
[7] http://www.rfidjournal.com/faq/20
[8] http://www.zebra.com/id/zebra/na/en/index/rfid/faqs/costs.html
[9] http://www.tutorial-reports.com/wireless/rfid/environment/recycling.php
[10] http://www.industryweek.com/ReadArticle.aspx?ArticleID=10608
[11] http://www.libertypost.org/cgi-bin/readart.cgi?ArtNum=129505
[12] http://www.mobilemag.com/content/100/102/C6340/
[13] http://www.eetimes.com/news/design/showArticle.jhtml?articleID=179100286
[14] http://www.smartcodecorp.com/newsroom/13-01-04.asp
[15] http://www.technovelgy.com/ct/Technology-Article.asp?ArtNum=20#Security
[16] http://www.wired.com/news/privacy/0,1848,66554,00.html?tw=wn_story_top5
[17] http://news.ft.com/cms/s/ec414700-9bf4-11da-8baa-0000779e2340.html
[18] http://felix.openflows.org/html/FS_Voiding_of_privacy.pdf
[19] http://www.scs-mag.com/index.php?option=com_content&task=view&id=1175&Itemid=88