RFID's effects on privacy

[one45auto]

Folks who aren't frightened by this technology are simply looking at today - not tomorrow. Just imagine the day when you'll drive through a toll booth or walk underneath an innocent looking street sign, only to be stopped shortly thereafter because they realize you're carrying. Or maybe you'll think of evacuating the city in advance of a hurricane and be told at a checkpoint that you'll have to surrender the firearms they know you've got in your vehicle. That 15' limitation really will be a comfort then, won't it?

Now, just imagine what things could be like if they boosted the range for devices that require no power source. Worried yet? You should be.

 

[cuchulainn]

one45auto: Folks who aren't frightened by this technology are simply looking at today - not tomorrow.

No, I'm looking at the foreseeable future. Frankly, by the time RFIDs advance enough to become a Big Brother worry (if they ever do), some better technology likely will have come along that will be able to track us better.

Do I think we need to worry about privacy and tracking now and in the future? You bet.

Do I think RFID is Big Brother's dream device in this regard. Not at all.

 

[rick_reno]

As some point, even if our worst fears about the government's Big Brother intentions are true, economics takes over.

You must be forgetting "Moores Law", the empirical observation that at our rate of technological development, the complexity of an integrated circuit, with respect to minimum component cost will double in about 24 months.
I enjoyed the opportunity to work for Dr. Moore in the mid-90's, we had
a 3 person team looking at some technology he (Intel) was interested in investing in - he is both brilliant and a nice fellow. Since he made his observation in 1965 it has proven better than true, the timeframe is down to about 18 months.

These devices operate in the wideband 433.5 to 434.5 Mhz and FCC rules limit signal strength and signal duration. The FCC increased signal strength and duration in May of 2004, allowing the scanners to read shipping containers. Users of the technology wanted this to be able to use it at ports, rail yards, etc. "With more than two billion tons of freight traveling through U.S. ports and waterways yearly, ensuring the efficient flow of goods while reducing the possibility of terrorism and fraud is no easy task,” said FCC Chairman Michael Powell, in a statement. “I'm excited by the prospects for improved inventory control, lower costs, and increased homeland security that this technology promises to bring.”

Note the hook into "homeland security", "terrorism". We're safer.

Given this technology is in it's infancy (I believe the current 64bit ID tag at 550 microns is 2nd generation, I've forgotten what the bit length was on the early tags) I expect to see amazing advances in these as they become ubiquitous. I'm retired from doing silicon architecture, but I'll admit I'd enjoy the opportunity to play with this technology.

I don't object to using them for inventory control, tracking, etc. while the object being tracked is in the supplier chain. When it enters the hands of the consumer, the tags should be disabled. Will this happen? Who knows.

 

[cuchulainn]

rick_reno: I expect to see amazing advances in these as they become ubiquitous.

No doubt there will be. But the economics of RFID tracking are not simply about the cost/range of the RFID tags. The networking and labor required for an effective RFID tracking system on a Big Brother scale would be immense. Moore's law doesn't apply to labor.

Further, if the tags do become ubiquitous, imagine the labor/programing that would be needed to sort out the background noise, and then assess what's found.

Look, I'm not putting my head in the sand. I'm simply trying to strike a middle ground between being such an ostrich and being chicken little.

 

[lysander]

Network connectivity is becoming increasingly easier and more prevalent. You have:
City and statewide Wi-Fi nets under construction. Wi-Fi
High speed data connections over power lines. BPL
High Speed wireless over cellphones. Cell Internet
etc., etc.,

In essence every person in America has become a node on a network. As a society we opt into technology without contemplating its negative possibilities. Do you carry a cell phone? It's not too much of a stretch to comtemplate RFID scanners imbedded in your phone...constantly polling for data. Does your state require eletronic toll collection on the highway? Do you have Onstar or a similar service? What about TIVO or Digital Cable? Or an IPOD for that matter? If you think about it for just a minute...I think you'll see that the average American is rarely far away from a potential "node".

Would this require a massive data collection and processing center? Of course. Is it possible? Absolutely. We put men on the moon nearly 40 years ago...the gub'mint can direct funding wherever it chooses...and it can get things done a hell of a lot faster when private enterprise is pushing for a system rollout. In the end it simply becomes a matter of how unobtrusive the "readers" can become, how slowly the public is conditioned to the readers and how many places the government can require the readers.

Off the top of my head:
1) Your insurance company lobbies to have "whole house readers" installed. Rationale: To inventory your possessions in the event of a homeowner's claim.
2) Your vehicle manufacturer lobbies to have a device installed in your car.
Rationale: To track the age of parts for regularly scheduled maintenance.
3) Your children's school board lobbies to have readers installed in the same metal detector units that scan for nail clippers.
Rationale: To keep the kids safe from truancy and the boogeyman.
4) Your local library tags each and every book.
Rationale: To protect inventory.

the list goes on....

You should be able to infer from the examples above some "unintended consequences" from what may seem perfectly innocuous reasons to utilize RFID.

 

[Waitone]

Couple of weeks ago I read a story about a city that wants to use cell phone volume statistics to identify highway blockages. Great example of product extension and how it works.

 

[cuchulainn]

Network connectivity is becoming increasingly easier and more prevalent. You have:
City and statewide Wi-Fi nets under construction. Wi-Fi
High speed data connections over power lines. BPL
High Speed wireless over cellphones. Cell Internet
etc., etc.,

Thus, if we're going to be tracked, it's going to be through our cell phones and our Wi-Fi laptops, not through some RFID tags in our shoes/guns/money.

The government already has more-practical ways than RFID to track us, and they're going to get more. Companies have more practical ways to learn about our buying habits.

It's not RFID we need to be worried about.

 

[Derek Zeanah]

Thus, if we're going to be tracked, it's going to be through our cell phones and our Wi-Fi laptops, not through some RFID tags in our shoes/guns/money.

You're missing the point here:

• The government doesn't track us through our cell phones. Cell providers do, and the government shares that data.
• Government doesn't track our spending habits, credit card companies and banks do. They share.
• Government won't track our RFID purchases for the most part -- it'll be more of the same kind of cooperation. Say, everyone that's got "loss prevention" alarms at their doors gets the newer models which work better, which check every RFID that cross their boundaries against a database. They happen to log everything, and the data gets shared.

As far as I'm aware, newer traffic lights are already wired -- IIRC they're controlled centrally, ane and even use IP networking. I think you're underestimating the degree to which technology pervades our lives, and how quickly it becomes cheap.

Quic example: I just bought a 160 gigabyte HD for $119. Ten years ago was 1995 -- what would it have cost to build a system that could hold 160 gigs back then? How many expensive drives and server-class machines to hold them all? What operating system?

You're saying "too expensive." I'm saying:

• Not for long
• We're dealing with fascism rather than the more direct kinds of totalitarian systems. They use business as part of the "system."

 

[acdodd]

Once again, the technology simply doesn't lend itself to Big Brother stuff. Big Brother would need scanners every ~15 feet for the cheap RFID tags and every ~250 feet for the expensive tags, and that's simply not economically practical.

We've got lots to worry about on guns and on privacy. This isn't one of them, unless there are some major changes to the technology to give the tags better range.

Look at this link.http://www.rfidnews.org/weblog/2005/08/02/michielsen-watch-defcon-hackers/
If a bunch of 20 something hackers can do it how long will it take big brother?

Michielsen Watch: Defcon Hackers
Tuesday, August 2 2005
"A group of twentysomethings from Southern California climbed onto the hotel roof to show that RFID tags could be read from as far as 69 feet. That's important because the tags have been proposed for such things as U.S. passports, and critics have raised fears that kidnappers could use RFID readers to pick traveling U.S. citizens out of a crowd.
RFID companies had said the signals didn't reach more than 20 feet, said John Hering, one of the founders of Flexilis, the company that conducted the experiment.

"Our goal is to raise awareness," said Hering, 22. "Our hope is to spawn other research so that people will move to secure this technology before it becomes a problem.""

AC

 

[cuchulainn]

Derek Zeanah: You're missing the point here:

No, I'm not missing your point. I understand how and why both government and business want to track us. I also fully understand how those desires can lead to abuse. I simply don't see RFID as the threat. The limitations of RFID make it a poor candidate for Big Brother work. When that Brave New World comes, it'll be done with other, better technology.

Then again, maybe it's me. I use one of those key-fobs at the grocery store that gives me discounts, but lets the store track <gasp> which brands of soda and underarm deodorant I use. I haven't lost any sleep yet.

RFID offers less tracking ability of my buying habits than those key-fobs.

Why? Linking a particular RFID tag to a person isn't that easy. If I buy a gizmo with cash, just how is the tag linked to me? It isn’t unless I volunteer personal information. If I buy it with a check or credit/bank card, then the purchase is linked to me regardless of the RFID tag.

As for tracking my movement, RFID simply would require too many scanners to do that effectively.

Could RFID in guns allow gun-unfriendly businesses and facilities to set up gun-free perimeters? Yes -- but not any more effectively than they do now with metal detectors. Actually less effectively because the old, RFID-free guns wouldn’t be caught.

Could RFID be abused, for example, so all new guns must have them and cops (and crooks, for that matter) could use handheld scanners to pick out the armed people walking down the street? Yes it could (although what about all the old, RFID-free guns). If that starts happening, I'll be right with you fighting it. But, I'm not too worried about that hypothetical just yet.

acdodd: A group of twentysomethings from Southern California climbed onto the hotel roof to show that RFID tags could be read from as far as 69 feet.

69 WHOLE feet? Wow.

 

[lysander]

cuchulainn -

So the argument is one of semantics then? I think some of us here are using the term RFID to describe both the current and potential future iterations of the technology. On the other hand...your position is that the current tech is not a threat and seems to based on the RFID tech which exists currently. I tend to agree with you there...current forms of RFID tags and the machines that track them are not terribly sophisticated.

....but its not the current form that I worry about.

I would still contend that it isn't to difficult to link a product with RFID to a specific buyer at all....it just requires a small bit of synergy amongst government and business.

Either way it is a shame that we are slowly being left with 2 options....drop out of the modern world and move to Amish country, or deal with being passively spied upon.

 

[cuchulainn]

lysander: So the argument is one of semantics then?

No, I think that RFID isn't a candidate for development in this direction. There already are numerous technologies better than RFID for spying on us, and which are capable of becoming just a ubiquitous. There surely are even better technologies to come. Why spend the time and resources on developing RFID's spying capabilities when better, farther-along candidates exist?

 

[Waitone]

RFID may not be the technology which collects the data. Rest assured there is a strong movement afoot to link individual purchasers to what they purchase. Consumer marketing used to be an exercise in statistics as companies try to match statistically determined needs with a statistically determined customer base. Consumer marketing is shifting at a fairly rapid rate to the industrial model of marketing where the customer base is defined and the number of participants is finite. Companies will be able to pitch highly refined products and services directly to a qualified core of prospects. The rule of thumb in consumer based marketing is 10% success or effectiveness. Regardless of the measure, apply 10% to it and you won't be far off. Industrial marketing could be represented by the figure of 70%. The difference is knowing the customer base and tailoring products and services to a well-defined client.

What I described is reality. What is developing is the technology to deliver it. We have mass data storage getting increasingly cheaper. We have databases and search capabilities which are developing nicely. We've already been down the road on unique product identifiers (aka UPC labelling). RFID will convert the UPC from a graphical--optical interface to fully electronic. A further advantage is the potential of combining unique product identifiers with specific product identification (aka serial numbers). Whether nor not the capability generates meaningful data remains to be seen. What is not in question is whether of not the desire to collect that kind of data exists.

Has anyone really asked why the Able Danger operation is being flushed? Naughty government officials is the obvious answer. Ongoing intel operations is a good excuse. I'd like to posit another reason. AD makes use of off the shelf technology in separate pieces to collect information of people to a level which would be unnerving should it be known. Information when combined which would paint highly intrusive pictures of actions, beliefs, and intentions. Information which I think is generally available from non-governmental sources. We now know Total Information Awareness program came from somewhere. It appeared right out of the blue. Looks to me like it was based on what Able Danger developed. AD was set up to track terrorists (and government officials if you believe the foil hat crowd), now presto chango the concept becomes a screening initiative.

No, I'm not a paranoid, foil hatter. I am a poor working stiff who has spend decades in marketing, product development, and new business development. What I see developing is consistent with everything I've experienced professionally. I also see what is developing as bad news for individual liberty. . . .and the immediate threat is not the goobermint.

 

[cuchulainn]

Waitone: RFID may not be the technology which collects the data. Rest assured there is a strong movement afoot to link individual purchasers to what they purchase.

That's exactly my point if you reprase it as, "Although there is a strong movement afoot to link individual purchasers to what they purchase, RFID is unlikely to be the technology which collects the data."

I haven't denied the societal trends. I've simply dismissed RFID as being the tool.

Look at it this way: I'm certain that terrorists are trying to figure out ways to take down airliners. I'm also certain that their doing it with Barrett .50s is a very unlikely scenario given the other, better weapons they have access to.

 

[roo_ster]

networked scanners

Think of the networking required to allow tracking that way -- even if limited to highway ramps and Wal-Marts. Do you really think that's practical?

We already have beau coup networks on which RFID data could ride, today. Mate an RFID scanner to a digital cell phone, have it broadcast all the RFID tags it gathers once a minute in a compressed burst & you're there, baby.

Folks who aren't frightened by this technology are simply looking at today - not tomorrow.

No, they are looking at yesterday. The ability to network, store, and crucnh through the data is here. As they said on the Six Million Dollar Man, "We have the technology."

I think you're underestimating the degree to which technology pervades our lives, and how quickly it becomes cheap.

I recall pricing 300GB drives on a Friday and getting a last, final quote form the vendor's web site Monday...only to find that the 320GB drives were now priced at the same level as the 300BG drives were three days prior.

Why? Linking a particular RFID tag to a person isn't that easy. If I buy a gizmo with cash, just how is the tag linked to me?

Unless cash has RFID, too. If you buy with credit/debit cards or checks, you can be linked ot RFID signatures.

As for tracking my movement, RFID simply would require too many scanners to do that effectively

.
Define "effectively." Down to within 10 meters in real time? No, RFID would not be the answer. From stoplight to stoplight with some time latency? Yeah, that can be done.

The cost of an RFID reader and cell phone function would be in the noise when considering the cost of a 4 lane x 4 lane intersection. Most new intersection installations already have devices to detect the presence of vehicles. It would be even less (as a proportion of total cost) for the average on-ramp.

Also, the assumption seems to be that everybody will be tracked everywhere and at all times. Maybe so. But it is more likely (at first) that folks the big.gov are interested in would be the primary targets. Broadcast the ID of the person in qestion to the RFID readers and give those transmissions priority and you get much closer to real-time surveillance.

I would suggest some googling:
net centric warfare
networked operations
fcs
asi

 

[Preacherman]

Linking a particular RFID tag to a person isn't that easy. If I buy a gizmo with cash, just how is the tag linked to me?

Well, consider this... cash may not (at present, anyway) have RFID tags embedded in the notes, but you'll likely be carrying other things (e.g. credit and/or debit cards, ID, keys, etc.) that will have RFID tags attached. If you're standing within a couple of feet of an RFID reader, it doesn't matter that you're paying with cash - the other identifying tags on your person can still be read, and if even one of those tags is linked to your identity (e.g. a drivers license), you're "made" as to what you're buying, and the fact that you prefer to use cash.

Despite all the arguments against RFID being a threat to privacy, I'm convinced that we're seeing only the tip of the iceberg here. If the tags themselves are so cheap and easy to produce and use, then the readers won't be far behind. As a previous poster postulated, one's cellphone could be used surreptitiously by marketers to gather details of all RFID chips it passes, and call in the results at predetermined intervals. One's household appliances can do the same - remember the "smart fridge" connected to the Internet that can order supplies when it runs low? It can also report all RFID tags within range. What about Bellsouth's plan, reported in the original article, to read all RFID tags in garbage? Since their telephone trucks go everywhere, anytime, they can simply correlate the bag of garbage, with its RFID readout, with the address where it's located - and they've tied you to your purchases.

I think that current technology's limitations are temporary, and that this is the first wave of an avalanche of privacy-destroying technology. I hope I'm wrong, but I fear I'm right...

 

[zahc]

This thread reminds me of the scenes in Minority Report where the the main character walks by advertisements that recognize him and call him by name. Everywhere he goes.

 

[Coronach]

I think Preach hit the nail on the head. Regardless of the drawbacks of range and limited functionality, RFIDs have a few strong things going for them:

1. Economy. They're dirt cheap.

2. Life cycle. With no battery required, they last indefinitely.

3. Passivity. All that is needed to read them is a scanner. The carrier does not have to use his cell phone or engage in any specific activity to trigger them.

4. Stealth. They're small, and can be hidden in almost anything.

These traits alone can make them ubiquitous, and therefore usable for some manner of tracking (malicous or benign), regardless of the other drawbacks of the system. Add in the pace of change in the field (especially of wireless connectivity), and I anticipate a very real problem in a few years. I think that, like most such things, it will be gradual at first, and benign at first. It's what comes after that worries me.

Questions:

How can one identify an RFID? Do they make commercially available readers?

How are they disabled, besides placing the object in a microwave?

Mike

 

[cuchulainn]

Preacherman: Well, consider this... cash may not (at present, anyway) have RFID tags embedded in the notes, but you'll likely be carrying other things (e.g. credit and/or debit cards, ID, keys, etc.) that will have RFID tags attached.

If you use cash, how does the scanner tell that you're the buyer -- as opposed to the 37 other people within X-feet of the counter who also have RFID stuff in their pockets. Is the store supposed to set up an 20-foot perimeter around each cash register within which only the customer currently checking out can enter, lest some poor shlub looking through the clearance rack 5-feet away gets mistaken for the buyer because he has an RFID key-fob in his pocket?

As for RFID in cash itself, so what? Given that a bill can change hands as much as a dozen times in a day and hundreds of times in a week, I defy anyone to come up with a realistic way to link a particular bill to a particular user.

The facts are

• If you buy with cash, RFID isn't useful in tracking your purchases (unless you voluteer the info, which doesn't involve the RFID)
• If you buy with check or credit/bank cards, you're giving the info over regardless of the RFIDs.

Preacherman: As a previous poster postulated, one's cellphone could be used surreptitiously by marketers to gather details of all RFID chips it passes, and call in the results at predetermined intervals.

So if I go to the mall, my cell phone will collect information on 3,000,000 RFID tags (no exaggeration) that I pass in stores and on other people -- none of which have anything to do with me whatsoever. And how will marketers/government use such noise-cluttered data?

The cheapness and ubiquitous nature of RFIDs actually argue against their use as spy-tech -- they become too "noisy" for useful data mining.

Preacherman: Since their telephone trucks go everywhere, anytime, they can simply correlate the bag of garbage, with its RFID readout, with the address where it's located - and they've tied you to your purchases.

Of course, for the RFID tags to be tied to me, I would need to purchase the items in a manner that identifies me (credit card, for example). Thus the marketers would already have the data before I even get the items home, much less throw them out. The trucks would be reduntantly collecting information already held. What's the point of such redundancy?

Preacherman: I think that current technology's limitations are temporary, and that this is the first wave of an avalanche of privacy-destroying technology.

Yes, we've got a lot of worries about technology and privacy, I agree. I don't think it will come from RFID.

 

[Old Dog]

Cuchulainn, going back a bit to this statement:

I've simply dismissed RFID as being the tool.

I find I must disagree -- RFID is a fine tool for slowly letting consumers adapt to the concept and use of technology that invades their privacy -- and the fact is, once we as a society become conditioned to, and accept, this technology -- it become that much easier for the general citizenry to accept the more serious technology (that we should be tremendously frightened of) ...

As Waitone indicated, it's all marketing -- gain acceptance of the technology because it makes our lives easier (isn't it great to know the exact latitude and longitude of our UPS shipment at any given second?) and our consumer-driven society will accept any little consequences such as total lack of privacy or anonymity ...

 

[cuchulainn]

Old Dog: I find I must disagree -- RFID is a fine tool for slowly letting consumers adapt to the concept and use of technology that invades their privacy -- and the fact is, once we as a society become conditioned to, and accept, this technology -- it become that much easier for the general citizenry to accept the more serious technology (that we should be tremendously frightened of)

A gateway drug, huh? Yeah, possibly.

On the other hand, we're already conditioned to using privacy-compromising technology -- from our credit cards to our cable-TV boxes to those key-fobs at the grocery store to ON-Star to our cell phones.

We certainly don't need RFID to condition us. That's like worrying about coffee being a gateway drug among a group that already uses marijuana and cocaine.

 

[Old Dog]

I'm not saying we need RFID to condition us ... It's simply another marketing device ... OnStar has been marketed as essentially a glorified cell-phone for use in emergencies ... Most citizens never give a thought about the fact that their cell phones are transmitters or that their credit/debit card and "preferred shopper" cards can be used to track them ... What should be of concern is that the RFID used in the parcel service commercial is probably about the first mass-broadcast ad that clearly demonstrates what the technology is all about. This is the first commercial that actually comes right out and says, hey, look at how accurately we can locate things now, anywhere! Now, this may scare those who already have concerns about invasive technology, but the average consumer obviously cares only about personal convenience.

 

[cuchulainn]

Old Dog: Now, this may scare those who already have concerns about invasive technology, but the average consumer obviously cares only about personal convenience.

And I'm saying that we've got lots bigger worries than RFID. We've been smoking maryjane and crack for awhile now. Who cares of Starbucks is selling coffee on every corner (did you hear the one about a Starbucks opening in the bathroom of a Starbucks)?

 

[Old Dog]

And I'm saying that we've got lots bigger worries than RFID

Exactly. I heartily concur with you on everything. All I'm saying is that perhaps we should be worrying a bit more now that the exploitation of invasive technology is finally being overtly marketed -- and no one cares!

 

[lysander]

Old Dog-

Exactly. I heartily concur with you on everything. All I'm saying is that perhaps we should be worrying a bit more now that the exploitation of invasive technology is finally being overtly marketed -- and no one cares!

Therein lies the rub. I had the opportunity to listen to a presentation made by former congressman Bob Barr about the Patriot Act, privacy, surveillance and the erosion of civil liberties in this nation. I posed the following question:

- How does one propose that we effectively fight the erosion of privacy rights in a nation where our young people and children are being trained almost from birth to accept surveillance as a part of the everyday fabric of their lives? We have parents who watch their children on cams at daycare, an entire segment of our entertainment is devoted to "reality programming", the primary focus of our public schools has shifted away from education and towards indoctrination, our employers read our emails, our various "service providers" monitor our activity and sell the information to other private industry, etc. etc. etc. ad infinitum...

His answer was: "Ummm...yes...that is a challenge."

I didn't expect an answer....I was really just interested in hearing if a former US Attorney and politician (and one who originally voted for Patriot I) had some useful ideas about how we could push back the onslaught.

Cuchulainn has some excellent points about RFID's limiting factors as a 'total surveillance' instrument...but the tech is really in its infancy...and with the public not caring, private industry bucking for it, and Uncle Sugar happy to oblige (provided he gets to peek at whatever he wants) I see quantum leaps in both the performance and implementation of RFID.