[Med-privacy] another on RFIDs

[pmarshall]

  RFID and privacy: Debate heating up in Washington
IDG News Service 6/1/04
Grant Gross, IDG News Service, Washington Bureau

Privacy advocates and some lawmakers are pushing a debate over potential =

privacy abuses from the growing use of radio frequency identification=20
chips as huge retailers such as Wal-Mart Stores Inc. move toward=20
large-scale use of the technology. While a number of privacy groups have =

raised concerns about the potential uses of radio frequency=20
identification (RFID) chips, the U.S. Congress hasn't yet drafted=20
legislation to regulate their use. But the Utah and California=20
legislatures have both considered RFID privacy legislation this year,=20
and the U.S. Federal Trade Commission (FTC) has scheduled a workshop on=20
the uses of RFID and the effect on consumers for June 21. The FTC is=20
asking for written comments about the uses of RFID; the deadline to=20
submit those comments is July 9.

RFID uses small computer chips and antennas that are integrated into a=20
paper or plastic label. Those chips can then be read by an electronic=20
scanner, and unlike barcodes, RFID chips withstand dirt and scratches=20
and can be scanned from distances upward of 25 feet (750 centimeters).=20
Privacy advocates worry that the technology will allow other uses, such=20
as real-time tracking of customers in stores, or even after they leave=20
stores. Privacy advocates see the potential for retailers and other=20
companies to be able to track consumers long after a consumer purchases=20
an item -- for example, a tennis shoe manufacturer scanning a sporting=20
event for the number of people wearing its product.

Those advantages are why large retailers such as Wal-Mart and Target=20
Corp., as well as government agencies such as the U.S. Department of=20
Defense (DOD), are embracing RFID technology as a way to improve their=20
supply-chain efficiency. Wal-Mart, leading the way on RFID adoption,=20
plans to phase in use of RFID, with major suppliers of its north Texas=20
stores required to use RFID chips on pallets and cases by January 2005.=20
The DOD plans to require suppliers to use RFID tags by early 2005.

But early experiments with RFID haven't gone smoothly, at least in the=20
public relations arena. In early 2003, Wal-Mart and The Procter & Gamble =

Co. tested the use of RFID chips on individual packages of lipstick in=20
an Oklahoma store, and the supposedly secret test raised the hackles of=20
privacy advocates everywhere. The RFID chips allowed Wal-Mart to track=20
the customers as they took the lipstick off shelves. Wal-Mart's test of=20
RFID chips on individual products also prompted Senator Patrick Leahy, a =

Vermont Democrat, to suggest that federal legislation may be necessary=20
at some point. He criticized what he called Wal-Mart's "clandestine"=20
testing of RFID. Leahy, speaking at Georgetown University in March,=20
praised the potential of RFID, but also suggested a federal law may be=20
needed before privacy intrusions "reach the point of behavior that is=20
absurdly out of bounds." "The RFID train is beginning to leave the=20
station, and now is the right time to begin a national discussion about=20
where, if at all, any lines will be drawn to protect privacy rights,"=20
Leahy said.

But Wal-Mart says its RFID tests have been less clandestine than critics =

claim. Customers in the Oklahoma store where RFID chips were tested on=20
lipstick were notified with signs on the shelves, said Gus Whitcomb, a=20
Wal-Mart spokesman. After the lipstick test, Wal-Mart decided to focus=20
on the store-room uses on RFID. In the Dallas area, where Wal-Mart's=20
first large scale implementation of RFID is scheduled to go live in=20
early 2005, the retailer has talked repeatedly to the media about its=20
plans to use RFID chips, Whitcomb said. The retailer will use "passive"=20
RFID chips, which require an RFID reader device to transmit information, =

and chips will be placed on cases and pallets, not most individual=20
items, he said. In the cases where large items are shipped with RFID=20
chips, customers will be notified about the chips, he said Asked about=20
concerns that customers picking up individual products could be tracked=20
with RFID chips, Whitcomb downplayed those fears.

"That's all a big hypothetical that we'?re not planning to do in the=20
first place," he said. "We have tried to address the big concerns of=20
privacy advocates."

So far, retailers and other RFID users have time to work out privacy=20
concerns with critics. While Congress has introduced several=20
technology-related privacy bills in the past year, none deal=20
specifically with RFID chips. A Leahy spokesman said this week he's=20
heard of no effort to introduce legislation focusing on RFID and=20
privacy. In November, a group of privacy advocates, including the=20
American Civil Liberties Union and the Electronic Frontier Foundation=20
(EFF), issued a position statement on the use RFID in consumer products. =

The statement called for retailers to give notice to consumers when RFID =

chips are being used, what the purpose is and to have security measures=20
in place verified by third parties. The statement, available at=20
http://www.cdt.org/privacy/031114rfid.pdf, calls on merchants to=20
voluntarily comply with RFID privacy measures, and asks retailers to=20
comply with a moratorium on item-level use of RFID chips until a=20
technology assessment involving consumers and other stakeholders can be=20
completed. The statement asked retailers not to force consumers to buy=20
products with RFID tags and advocated that consumers should be able to=20
remove or disable the tags, but the statement did not advocate federal=20
legislation.

Notifying consumers is a start, but notice alone is not enough, said Ari =

Schwartz, associate director of the Center for Democracy and Technology=20
(CDT), one of the groups signing on to the November privacy statement.=20
"There has to be a way to kill these chips," Schwartz said. The CDT and=20
other privacy groups have brought their concerns to retailers and RFID=20
vendors, and so far, the two sides are making progress, Schwartz said.=20
Most retail uses of RFID so far are limited to stock rooms, and with=20
retailers and vendors open to privacy discussion, Schwartz doesn't yet=20
see the need for federal legislation.

"The question is really what it's used for and how it's done, rather=20
than the technology itself," Schwartz said of RFID. "Most of the benefit =

out there comes on the back end, in the stock room, and most of the=20
privacy concerns come when it leaves the stock room."

Despite the lack of calls for federal legislation, RFID vendors aren't=20
keeping quiet in Washington, D.C.

In late April, Royal Philips Electronics RV hosted a forum on RFID at=20
the National Press Club. Philips, which has shipped more than a billion=20
RFID tags, sees a potential for the technology in the stock room more=20
than on individual products, said Scott McGregor, president and chief=20
executive officer of Philips Semiconductors. Right now, RFID chips cost=20
between US$0.20 and $1 each, making them too costly to use on many=20
consumer products, McGregor said. Current privacy laws should protect=20
consumers against nefarious uses of RFID, added Richard Varn, technology =

policy advisor for the National Retail Federation. He encouraged=20
Congress to focus on broad policy instead of drafting legislation to=20
address every new technology that comes along. "We see a lot of laws=20
existing out there," he said.

But some privacy advocates question if there's been enough of a debate=20
about the uses of RFID as government agencies and retailers move toward=20
large-scale RFID adoption. Lee Tien, senior staff attorney with the EFF, =

decried a move toward what he called a "world of surveillance" during=20
the Philips forum on RFID. "There are a lot of ways the government is=20
looking to use RFIDs, but it's not clear that we've had any kind of=20
discussion in Congress," Tien said.

Grant Gross is Washington correspondent for the IDG News Service.
Copyright =A9 2004 Accela Communications, Inc.