Radio-Frequency Identification (RFID) and Privacy

1
Radio-Frequency Identification (RFID) and Privacy
February 26, 2004
Ross Stapleton-Gray, Ph.D., CISSP Stapleton-Gray
Associates, Inc. www.stapleton-gray.com
2
What is RFID?

• Active, passive, or hybrid devices

• Queriable by readers from a distance

• Without requiring line of sight

• Responding with data, and perhaps writable as
  well

3
Whats the significance of the Electronic Product
Code (EPC)?

• Initiated at the MIT Auto-ID Center in 1999 and
  now
• administered by EPCglobal for a large user
  community

• A very large namespace that encompasses existing
  
• product code standards

• A clever federated architecture with an Object
  Naming
• Service (ONS)... very Internet-like

• Passive RFID tags readable to perhaps tens of
  feet

4
EPC Timeline
1999 - MIT Auto-ID Center launched June 2003 -
WalMart mandates EPC adoption for
cases pallets by 2005 Sept. 2003 -
EPCglobal created Oct. 2003 - DoD mandates
EPC adoption for most
everything by 2005? Jan. 2004 - EPCglobal
awards ONS to VeriSign Feb. 2004 - Target
follows WalMarts lead
5
Will all this actually work?
RFID has its problems...

• Interference

• Short read ranges

• Lack of feedback

Were a bit skeptical http//www.stapleton-gray.c
om/papers/sk-20031113.PDF
6
What might surprise us?

• What happens when there are a lot of tags?

• What happens when there are a lot of readers?

• A world oozing with data... and many readers
• and writers

• End-consumer applications of RFID?

7
Item-level tagging threat or menace?

• RFID tagging through most of the supply chain
  might
• be happy and helpful for most parties

• Item-level tagging starts to cause tension

• The checkout aisle as ground zero

• How to make a killing in the market?

8
Potential impact on privacy

• If item-level tagging becomes common, lots of
  tags
• will get loose post-purchase

• Lots of RFID tags will be attached to lots of
  other
• things too library books, for instance

• Persistent unique identifiers allow for
  inferences

• Binding of IDs to identity will occur

• Snapshots lots of snapshotswill be captured
• by lots of parties

9
The Sorting Door Project
10
Resources
Would Macy's Scan Gimbels? Competitive
Intelligence and RFID, presented at the RFID
Privacy Workshop _at_ MIT, November 15,
2003. http//www.stapleton-gray.com/papers/ci-2003
1027.PDF Scanning the Horizon A Skeptical View
of RFIDs on the Shelves, whitepaper, November
13, 2003. http//www.stapleton-gray.com/papers/sk-
20031113.PDF RFID, Surveillance and Privacy
blog http//www.stapleton-gray.com/sur
priv/ Or ross_at_stapleton-gray.com