The Radio Frequency Identification (RFID) concept has created some major privacy issues. With RFID, companies can save time and money by being able to track products from their creation, to their purchase at a retail store, and beyond. It is the “beyond” part that has so many people upset about the inherent piracy issues of RFID. Before delving into those concerns, one needs an understanding of the technology. RFID systems have been used for quite some time. Only recently has their true potential been realized. An RFID system is a small tag that is affixed to an object to allow that object to be tracked. Once this tag has been turned on or energized, it will send information about itself when a reader queries it. This tracking can take place wherever there is a reader ready to query the tag. This means other companies can read RFID tags from their suppliers. There also is the ability to add to these tags; if one company buys a product from another and wants to insert some of its own data into the tag, they can. Another RFID innovation that has been discussed prevents something almost all of us likely have done. How many people have ended up with a pink load of white laundry? Some washing machine manufacturers have talked about using RFID tags embedded inside clothing to prevent the red sock from getting into the load of white laundry. How about never reading tags for washing items again? The same manufacturers have talked about having washing machines set themselves based on the clothing item’s RFID tag.
Most RFID systems today have a write-once tag, which means that erasing or modifying RFID information is unlikely. When the price of modifiable RFID tags come down in price, a new integrity threat will emerge, called RFID modification. Today, with RFID, companies can track their products and amass amazing amounts of data. There are so many ways to use RFID. Retail companies use RFID to perform automated inventory. Car manufacturers use them to tag special-order vehicles. Logistics companies use them to track package movement. There are even more usages that are created everyday; for an example of just how massive the push for RFID is, think about this: some companies have started to look at taking data from the RFID to feed financial reports, so investors know at any given time how many units were sold or shipped per quarter. This information could have a direct result on the price of stock. This could then, in turn, affect the way stock trading is performed in the future. Just imagine if a stockbroker could see in real-time the number of units a company is selling. Now that we have a good idea of how RFID works, let us look at the inherent risks and threats involved with its use.
When discussing RFID, the first thing that comes to mind is the concern over privacy. In a world where the products one consumes transfer information to anyone willing to listen, the opportunity to market, trend, and collect data about us becomes a real concern. Some people have talked about many things relating to RFID, from the wild conspiracy theories to real issues that affect everyone on an every-day basis. To understand these concerns, one can look at a couple of examples that range from wild conspiracy theories to those that affect almost everyone every day.
Using RFID, people with access to the right information assets can track individuals based on what they have purchased. If someone buys a can of soda from one store and then walks into another store, the second store’s readers might pick up that can. If someone wanted to find a person and had the resources, he or she could find the RFID tag ID number and cross-reference that with a credit card system or company database. This would allow a simple object to become a tracking device. This is highly inconceivable today; although inconceivable or not today, it is technically possible.
Another privacy concern that affects almost everyone is the ability to read and use information from product tags not belonging to the reader’s organization. To put this into context, imagine walking into a store with a bag or purse. When you walk in, card readers at the door energize all the items inside your bag. Then these items send all their information to the reader. The store now has a record of your purchases, not from that store but just in general. Everything inside your bag that has a UPC would have an RFID. These records could include over-the-counter medications, feminine products, and a number of other things that many people consider private. To make things worse, the salesperson might be given this information to get an idea about your purchasing habits.
