RFID Tags and Privacy Invasion

"The fantastic advances in the field of communication constitute a grave danger to the privacy of the individual"
-Earl Warren

 Technology created to make our everyday lives easier could perhaps be seen as a double edged sword. We create some technology so that we are required to do less to achieve something or get something done. This technology does the work for us, saving us time and energy. But we must never forget that we have now placed that work in the hands of an inanimate object, which does not have moral values, privacy concerns, and responsibility. It simply does as it is designed and/or programmed to do. Which leaves it open to be attacked, misguided, and stolen from.
We, as a people, must always take a step back, look at our technology, and ensure it's effectiveness and security.



One example of consumer technology that offers a large amount of reward and danger is RFID tags, or Radio-Frequency Identification tags. These "tags" can be thought of as a barcode with a radio transmitter embedded into them. They are set to become the replacement for barcode technology. The RFID tags come in many types, with two being the most common, active and passive. Active RFID tags contain a battery within them, and can transmit and receive data autonomously, while passive RFID tags require an external power source to provide them with energy to transmit. The data transmitted from the tags is sent to a reader unit, which is responsible for receiving and transmitting data to and from the tags. The reader unit relays it's data to a database unit for storage and organization. The type of data stored on these tags can vary with what the company would like to know, but it has been reported that most companies store the product ID within the tag.

What are the benefits to using RFID tags? The tags do not require "line of sight" to be accessed, as is required with barcodes, since the barcode must be closely scanned by a machine. The barcode can be damaged easily, thus rendering it unusable, costing the consumer and provider time and energy to track, identify, and possibly replace the product or it's code. RFID tags are usually hidden in some way on the product, so as to not be damaged or be maliciously removed. The tags can have a range from less than a foot, to greater than a football field, depending on the type of tag, if it is active or passive, and it's intended use. Usually, passive tags have much smaller ranges, and the tag's size is also a huge factor. The tags can be used for inventory, allowing for quick and easy monitoring of products as they travel from a supply center to a store, or as they are moved to a shelf for sale. Another hope for RFID tags is the creation of "smart shelves" that will detect what products are currently sitting on the shelf and when the shelf is in need of restocking. This would allow for quick and accurate replacement and restocking of products, and also warn of unusual shelf activity, such as if a consumer removed a dozen cases of expensive products, a possible sign of intended theft.

You may already be using RFID tags. If you have a toll tag, or a little, usually adhesive, label on your car that allows you to drive on tollways without stopping, you are the owner of an RFID tag. Some credit/gas cards contain RFID tags for quick use, and some cell phones also use the technology. So what' the problem with RFID?

 

With the autonomous sending and receiving of data from these tags, privacy is a major concern. The tag sends data indiscriminately, so the data can be intercepted by an attacker and collected for other uses. Certain products, such as medicine, expensive electronics, and other items that their owners wish to keep private may be found and tracked by an attacker. Also, the RFID tag may not deactivate once the product is purchased. The tag may remain active even after you have returned home with the product, and this could even possibly be the goal by the product company. Many security features that can be implemented into the tag to protect the sent and received data increase the cost of production of the tag, and make it unreasonable for use by the company. Thus, less security means cheaper cost. The potential for the theft of information and unwanted tracking of consumers exists, and must be kept in mind when supporting and designing this technology.

How do you feel about buying a product, not knowing what data is bring transmitted from it and where that data is going? How would you feel if that pack of razors or bottle of medicine sitting in your bathroom could broadcast data to the outside world. As it currently exists, the world of RFID tags has the potential to offer great benefit to producers, but also creates a privacy and security threat. Should it be required for products with tags to be labeled with what data is being collected? Should tags be removed from products? Should consumers have the ability to remove or disable tags in their purchased products? These are all questions that should be asked, and should be answered. While technology makes our lives easier, we must always be aware of it, and ensure that it does not take away our privacy.

--------------------------------------------------------------

Information about RFID tags was obtained from an article by Miyako Ohkubo, Koutarou Suzuki and Shingo Kinoshita and was used throughout the entire blog post. It can be read here: [link]

M. Ohkubo, K. Suzuki, and S. Kinoshita. Cryptographic approach to “privacyfriendly” tags. In RFID Privacy Workshop, 2003.