- RSA Security has developed a countermeasure to block
scanning of radio-frequency ID tags, responding to privacy concerns about
the tiny devices that would allow retailers and manufacturers to track
the whereabouts of their goods within a store and beyond.
-
- The blocker tag, which can be placed over a regular RFID
tag, prevents a receiver from scanning information transmitted by a tag
by sending the receiver more data than it can read -- the equivalent of
a denial-of-service attack. RSA doesn't have immediate plans to market
the blocker and is waiting to see whether industry widely adopts RFID technology.
-
- An RFID tag consists of a microchip the size of a grain
of sand attached to an antenna that wirelessly transmits information by
radio whenever it passes an RFID reader. Product manufacturers and stores
want to place the tags on consumer items such as hygiene products, packaged
foods and clothing to manage inventory, track consumer interest in products
and thwart thieves. The devices could also benefit consumers by transmiting
messages to smart appliances in their home. For instance, a tag in a milk
carton could tell a computer-enabled refrigerator when its contents are
running low.
-
- Critics are concerned that tags would let businesses
monitor the movement of people inside and outside stores. The tags can
transmit in different frequencies that can be read from varying distances.
A 13.56-MHz tag, for example, can be read by a device within 10 inches
of the tag, but a 915-MHz tag can be read up to 10 feet away, increasing
the likelihood that a person could be scanned without knowing it.
-
- Katherine Albrecht, director of Consumers Against Supermarket
Privacy Invasion, or CASPIAN, said she was pleased with RSA's efforts to
mitigate privacy dangers and said it was better for consumers to have some
protection than none. But she's concerned that people who don't know the
tags are embedded in items or don't know what the technology is capable
of doing won't know how to protect themselves.
-
- "You could wind up only with the technology elite
equipping themselves with blocker tags instead of working on a solution
to protect everyone," she said. "It's important to not set up
a situation of haves and have-nots when it comes to privacy protection."
-
- Albrecht was also worried that blocker tags would encourage
people to become complacent about surveillance, thinking they could protect
themselves from it at will. But she said the blocker tag would work only
as long as it was legal.
-
- "You could allow surveillance to be created all
around you, thinking the blocker tag would protect you, and then a single
stroke of the pen could render a blocker tag illegal by an executive mandate,"
she said.
-
- The RFID tags combined with access to commercial databases
could give the government great power to monitor people's interests and
activities. For example, Albrecht said, RFID tags in shoes could create
a data trail of who wearers are and where they go.
-
- "Let's say you went to a gun show or to a talk given
by a Muslim cleric or to a peace rally. At present, government agencies
can't bust in and ask everyone to show their ID. But they could send someone
into the event with an RFID reader to identify who is there and who they
are associating with," she said.
-
- Ari Juels, principal scientist for RSA Laboratories,
said that legislation could easily be passed to mandate the use of blocker
tags as well and the public shouldn't curtail technology simply because
it's subject to possible legislative abuse.
-
- This week, RSA demonstrated the blocker-tag prototype,
manufactured by Texas Instruments, at the RSA Conference in San Francisco
to call attention to retail plans, such as one established by Wal-Mart
to tag pharmaceuticals.
-
- Beginning next month, drug companies that supply Wal-Mart's
in-store pharmacies with prescription painkillers and other abusable drugs
will have to place RFID tags on bulk containers used for shipping.
-
- To demonstrate how the tag might work in the future,
RSA set up a makeshift pharmacy at its booth on the exhibition floor. When
visitors wrote their name on a piece of paper and requested a prescription
for pills, they received a medicine bottle filled with jellybeans bearing
an RFID label -- a plain white sticker placed underneath the prescription
label. When the pharmacist placed the bottle in front of a reader, a computer
screen displayed the buyer's name, the medication ordered and the price
paid for it.
-
- But when the pharmacist placed the pill bottle in a bag
with a blocker tag on it, the reader couldn't register information from
the RFID tag on the bottle. The blocker tag consisted of a plain white
label placed on the outside of the bag.
-
- Juels said his group developed the tag blocker to satisfy
the needs of privacy advocates and RFID proponents in a debate that had
become increasingly black and white.
-
- "We wanted something that would answer both the
privacy and utility needs and shift the focus of the debate to show that
sometimes technology can help address other problems introduced by technology,"
he said.
-
- Wal-Mart spokeswoman Sarah Clark said the company intends
to expand the RFID program to include the top 100 suppliers of all of its
products by June 2005. But she said it plans to use the tags only on pallets
and packages in the warehouse, not on individual items that consumers purchase.
She did not rule out individual Wal-Mart products with RFID tags.
-
- "We're not speculating on what's going to happen
in the future," she said.
-
- Wal-Mart said it wants to use the tags because Food and
Drug Administration rules require pharmacies to track these drugs carefully,
which Wal-Mart says the tags will help them do. RFID tags can also help
detect counterfeit drugs that slip into the supply chain.
-
- CASPIAN's Albrecht said her group had no problem with
pharmacies using RFID tags to help prevent counterfeit drugs and to track
inventory -- with the caveat that tags be disabled before packages are
dispensed to customers.
-
- "It's none of our business what Wal-Mart wants to
do to get a product in the store, in the same way that it's not their business
what I do when I leave the store," she said.
-
- RFID tags currently have a built-in "kill"
mechanism that disables their tracking capability when the chip receives
a command. Jues said the self-destruct mechanism still has bugs and doesn't
always work.
-
- He noted, however, that killing a tag would also kill
any benefit consumers might gain from them, such as their communication
with smart appliances.
-
- The RFID blocker tags are not yet available for purchase
by consumers and probably will not be sold for a couple of years -- and
then only if stores begin to embed individual products with RFID tags.
-
- Lawmakers in Utah passed a bill last week that would
prevent stores from using RFID tags to monitor customers. Lawmakers in
California have introduced a similar bill.
-
-
- © Copyright 2004, Lycos, Inc. All Rights Reserved.
-
- http://www.wired.com/news/business/0,1367,62468,00.html
|
