RFID and privacy: living in perfect harmony.

• Author: Schmidt, Justin M.

1. INTRODUCTION

   If you have never heard of the acronym "RFID," which stands for "Radio Frequency Identification," remember it, because it will likely become a household term. If you have not seen RFID, it is not surprising, as the device can be about as small as a grain of rice, and research is already in progress to make the technology invisible to the human eye. (1) Very simply, RFID is a device that can be placed on a person, animal, or object, and the RFID device can store information. That information can be identified when the device reacts to radio waves. (2)

   RFID has existed for decades and is a relatively old technology when measured by today's infinitesimal life span for technology. (3) However, RFID only became commercially viable within the last few years as RFID has been slated as a potential replacement for the UPC barcode system. (4) Like many emerging technologies, RFID has the potential to provide great economic benefits for the government, businesses, and consumers while posing a potentially serious threat to consumer privacy and personal security.

   It is difficult to gauge whether RFID has gained more publicity or progress since its introduction into the commercial sector. Recent proposals by several corporate retail titans, who hope to expand RFID into nearly every facet of the retail and supply chains, have caused consumer advocates, privacy advocates, and legislators to join together in a phalanx to defeat, or at least mitigate, RFID's perceived threat to privacy. (5)

   Various remedies have been proposed to allay the inherent privacy concerns surrounding RFID. The remedies range from total bans to legislative restrictions to consumer warning labels. This note will focus on using private regulation and education, current privacy laws, and limited government oversight to diminish the potential privacy and security threats of RFID. This will help ensure that the fledging RFID technology can improve our industries, businesses, and lives, while protecting our personal information.

2. ORIGIN OF RADIO FREQUENCY IDENTIFICATION

   RFID traces its roots to both the radar and the radio. (6) The "identification, friend or foe" ("IFF") transponder, which was used to identify aircraft during World War II, was the predecessor to RFID. (7) While early forms of RFID were developed, tested, and refined from the 1950s through the 1970s, it was not until 1987 when RFID saw its first major commercial use in the form of electronic highway toll collection devices. (8) RFID saw gradual increases in commercial use during the 1990s, however, RFID received an enormous boost in commercial viability as manufacturers, distributors, and retailers envisioned RFID tags eventually replacing the UPC barcode system. (9) Today, the U.S. Patent office has registered over 350 patents related to RFID. (10)

3. RFID OPERABILITY

   RFID belongs to a larger category of electronic identification systems known as automatic identification ("Auto-ID"). (11) Along with RFID, Auto-ID contains several types of identification technologies, such as UPC barcodes, smart cards, along with retinal, voice, finger, and other biometric recognition systems. (12)

   RFID has two main components. The RFID tag or transponder, sometimes also referred to as a RFID chip, consists of a silicon microchip with an attached antenna, which both receives and transmits data. (13) The RFID tag is the data-storage device that can be attached to any object or implanted in humans and animals. (14)

   The second component of the RFID system is an RFID reader. The reader emits radio waves, which are received by the RFID tag. (15) When the RFID tag receives a radio wave from the reader, it sends back the data, which is stored in the tag's memory, to the RFID reader. (16) The RFID reader then relays the collected data from the tag to a computer system installed with identification software. (17) The data stored on an RFID tag can list identification numbers, location, or specifications of the tagged product, such as price, expiration date, color, size, weight, etc. (18) The RFID reader can be a portable, handheld device, similar to a checkout scanner, or it can be permanently affixed. (19)

   1. Active RFID Tags

      There are two basic types of RFID tags: active and passive. Active tags are less common than passive tags, cost more than passive tags, but are much more reliable and have a far greater signal range than passive tags. (20) Active tags' increased signal range is due to its internal power source, or battery. (21) The battery life is often designed to last ten years or more. (22)

      The active tag is typically used when signals are required to be transmitted through metal, like shipping containers, or liquids, since additional power is required to transmit the signal through these materials. (23) The active tag can also store more information than the passive tag. (24) Active tags are considerably larger and more expensive than passive tags, due to their power source and read-write data capability. (25)

      Most active tags are approximately the size of a coin and their price depends on the level of sophistication, while the smallest passive tag is half the size of a grain of sand and costs several cents. (26) The active tags that track containers in the transportation industry can be nearly a half-foot in length and several inches tall. (27) An active tag's signal range is typically over 100 meters. (28) Active tags also have the capability to be combined with sensory devices to track information such as temperature, moisture, light, radiation, and vibrations. (29)

   2. Passive RFID Tags

      Passive tags are used more frequently in the commercial industry because they are less expensive than active tags. (30) The passive tag contains no internal power source. (31) The sole source of power needed to transmit a signal back to the reader is derived from the signal sent from the reader itself. (32) In other words, the passive tag is energized by the radio waves sent from the reader. Passive tags have an unlimited lifespan and can be thinner than a sheet of paper. (33)

      Passive tags almost always have a shorter signal range than active tags, with a typical signal range of approximately three meters or less. (34) The signal frequency that an RFID system (tag and reader together) operates on, determines both the speed and the amount of information that can be communicated, or transferred, between the reader and the tag. (35)

      As a general rule, the higher the frequency is, the faster the data transfer rate and transfer amount is. The distance that a signal can travel from an RFID tag to a reader is primarily determined by the amount of power used to deliver the signal. (36) The general rule for signal distance is: the more power that is used, the farther the signal can travel.

      However, an important distinction exists between the necessary power levels required by passive and active tags. Passive tags require a high level of power from the reader, and the returned signal strength from the tag is much lower than the strength initially delivered from the reader. (37)

      In contrast, an RFID reader can send a weaker signal to an active tag (since there is no need to power the active tag), and the active tag's internal battery sends a high-powered signal back to the reader. (38)

      Additionally, both active and passive tags' signal range (distance) is affected by the tag antenna length, the antenna material composition, the tag size, and by any impediments such as metals or liquids that stand between the reader and the RFID tag. (39) Another limitation on passive tags, as compared to active tags, is that the vast majority of passive tags are read-only, (40) similar to a barcode.

   3. Differences Between RFID and the UPC Barcode

      As the retail industry envisions RFID replacing UPC barcodes, a comparison of RFID tags with UPC barcodes is necessary to properly weigh the strengths and limitations of these two technologies.

      RFID has a number of significant advantages over the UPC barcode. First, barcodes are a "line of sight" application. (41) This means that barcodes must be positioned in a particular manner in order for the barcode to be properly scanned. For instance, think of the countless times you have waited in a checkout line while the clerk was trying to scan an item that simply could not be read by the scanner. This problem may have been the result of improper positioning of the barcode to the scanner or the barcode itself was scratched, faded, wet, or dirty. RFID does not need line of sight. (42) The tag only needs to be within range of the RFID reader, without needing to be specially positioned. (43) RFID tags can be read through water, ice, paint, built-up grime, fog, dust, and most other visually challenging environments. (44) RFID's data can be transferred (read) in these environments in less than 100 milliseconds, which is nearly instantaneous to human perception. (45) Additionally, multiple RFID tags can be read simultaneously and queries can be programmed to have the RFID readers search only for tags based on the requested criteria. (46)

      RFID tags have a much larger information storage capacity than UPC barcodes. UPC barcodes hold 96 bits, while passive RFID tags can hold from 64 bits to over 2 kilobytes. (47) This larger storage capacity not only allows the RFID tag to store more information, but also allows RFID tags to identify the specific, individual item. (48) UPC barcodes can only identify the type of item.

      For example, with UPC barcodes, every Hershey's Bar has the same UPC barcode number (a Hershey's Bar in Chicago has the same UPC barcode number as a Hershey's Bar in Los Angeles). (49) With RFID tags, every individual Hershey's Bar could have its own RFID number. (50)

      An RFID unique number is called an Electronic Product Code ("EPC"). (51) EPC's format is superior to UPC barcode format because EPCs can be used to identify hundreds of trillions of unique items, whereas UPC barcode...