Big Brother on a Tiny Chip: Ushering in the Age of Global Surveillance Through the Use of Radio Frequency Identification Technology and the Need for Legislative Response

• Jurisdiction: United States,Federal
• Citation: Vol. 6 No. 2004
• Publication year: 2004

Oleg Kobelev⁰

I. Introduction: You Can't Run and You Can't Hide

One of the most controversial provisions of the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act ("USA PATRIOT Act") allows the government to track the books people check out of the library.¹ The critics of this provision argue that allowing the government to monitor what books people read is an unprecedented invasion of privacy that will erode civil liberties and chill free speech.² These critics may be surprised to learn that rapid advances in Radio Frequency technology put the private sector, not the government, on the verge of what can be described as a massive bugging program. The culprit is a tiny microchip called a Radio Frequency Identification ("RFID") tag that can be inserted into everyday household items, thus allowing the government, or, for that matter, virtually anybody with a scanner to track the physical location of every carton of milk, every child's toy, and every pair of socks that consumers buy. Compared to the potential privacy threats stemming from the unrestricted use of these tags, the much feared "sneak-and-peak" provisions of the USA PATRIOT Act look like child's play.

RFID is a technology that allows companies and governments to implant tiny and virtually undetectable microchips or "tags" with antennas into almost any product or animal, including humans. Predicted by MIT researchers to become the most pervasive computer technology in history,³ most RFID tags do not require any external power source and can transmit information via radio waves when the tag enters the reception field of the nearest scanner.⁴ RFID tags are commonly used to store an Electronic Product Code ("EPC") that assigns a unique identifier to every RFID chip, thereby allowing fast, efficient, and cost-effective inventory tracking.⁵

The benefits of RFID technology are obvious. The technology allows for faster checkout times at the grocery store, significant cost-savings for the companies who can now track their inventories more efficiently and at a lower cost, and lower prices for the consumers as companies reduce their overhead costs. The potential dangers of the misuse of the technology, however, are much harder to identify with any precision given the relative infancy of the technology and the lack of response from the industry.⁶

The very real danger that unregulated, unrestricted use of RFID technology poses to privacy is the central theme of this article. The State Department's plans to embed all US passports with RFID chips by late 2005⁷ and the news of the Mexican government implanting their workers with RFID chips as a means of accessing restricted areas inside government buildings⁸ demonstrate the urgent need for closer examination of potential abuses of RFID technology and ways to prevent such abuse.

This Recent Development seeks to accomplish four main objectives. First, it describes the nature of RFID technology, and the risks that RFID technology poses to our privacy by greatly enhancing location-tracking capabilities of the government, the companies that use the technology and ordinary criminals that may abuse it. Second, this Recent Development examines the precise nature of the privacy rights threatened by RFID technology by discussing the concept of location privacy¡ªa new understanding of privacy as freedom of an individual from having his or her movements monitored without their consent. Third, this Recent Development demonstrates that existing constitutional and legislative frameworks are not designed to protect location privacy from unauthorized privacy violations. Finally, this Recent Development proposes legislative solutions, including incorporating the concept of location privacy into the Electronic Communications Privacy Act, regulating RFID technology through the Federal Communications Commission pursuant to its authority over public airwaves, and requiring encryption mechanisms in the RFID tags themselves.

II. Privacy and RFID technology: Big Threat from a Little Bug

The origins of RFID technology lie in the Universal Product Code systems used by manufacturers and retailers to keep track of their inventories.⁹ At its core, RFID technology is a natural progression from the familiar optical bar-code technology currently used in five billion scans a day.¹⁰ The existing optical bar technology incorporates two different standards——a one-dimensional bar code used by most manufacturers and two-dimensional bar codes used by shipping companies such as the United States Postal Service and United Parcel Service ("UPS").¹¹ Unlike these optical codes, RFID auto-identification systems have two critical advantages: Each chip is assigned its own unique electronic identifier (whereas a one-dimensional bar code only allows enough data to identify a broad category)¹² and data can be read outside the line of sight and through objects such as walls. In other words, data can be read even if the chip is stacked inside a box on the top shelf in a warehouse. The items do not need to be scanned manually.

RFID technology is not new——it has been widely used in microchips, the manufacturing of automobiles, and even herding cattle.¹³ The basic design is very simple and consists of two main elements: the RFID tag itself, a microchip with a data storage capability wired to an antenna coil, and an RFID scanner, a transmitter that interacts with the chips' writing to modify the information on the chip. The information from the scanner is generally sent to a computer database that keeps track of the data and associates each code with the product it describes.¹⁴ Another important feature of RFID tags is that they are passive and usually do not require an external power source to keep them operational.¹⁵ The microchip inductively receives power whenever its antenna receives a radio-impulse from the scanner as if the scanner "shouts" to the passive tag, bringing it to life and allowing transmission.¹⁶ While the current range of the scanners is limited to two to five feet on passive tags, this range can be greatly enhanced by developing more powerful and sophisticated scanners or by simply increasing the density of the existing scanners.

The crucial difference between RFID technology "then" and RFID technology "now" is the cost. The recent advances in miniaturization and micro-chip manufacturing have lowered prices so dramatically as to allow RFID chips to currently cost around fifty cents, with MIT's studies projecting the cost to drop to five cents in two to three years.¹⁷ As the price of RFID technology plummets, companies will become more cost-efficient by installing RFID technology into a wider range of products.¹⁸

It is hard to overstate the benefits of implementing RFID tracking technology. Soon companies will have instant 24-hour-a-day information on the location and quantity of each item in their inventory, as well as the movement of those items through distribution channels. In the ideal world, both retailers and manufacturers will have interoperable online databases instantly tracking the movement of every piece of their inventory at all times. Imagine every retailer and manufacturer, no matter how small, having the same inventory management capabilities as the famously efficient Wal-Mart¹⁹ but at a fraction of the cost.

Nonetheless, the great advantages of RFID technology come with a cost, reaffirming Milton Friedman's famous aphorism that there is no free lunch. The downside, or perhaps the consequence, of low-cost RFID technology is the lack of a viable encryption mechanism to protect the data on the chip from unintended use. Low power consumption, slow read rates, as well as the storage and computing capacities of RFID chips all fall far below the requirements for encryption systems used on microchips elsewhere.²⁰ Thus, various "phishing"²¹ techniques that are rapidly gathering steam on the Internet can be modified by computer hackers to extract the contents of RFID chips. It would be even easier for unscrupulous companies to use RFID technology to track customers' buying habits and, as such, conduct their market research cheaply and without the participant's consent. Finally, the government may either commandeer the existing networks or establish their own to conduct its surveillance uninhibited by either legislative or constitutional constraints. Government surveillance may take a variety of forms from matching customers' purchases against computer databases for signs of suspicious activity²² to tracking a person's physical location as a means of electronic surveillance.

The lack of security combined with a low cost of RFID technology has the potential to fundamentally change the way we view privacy, leading to a world in which our physical location is never safe from the prying eye of the government, companies, or a hacker. As RFID technology proliferates, it will literally surround future consumers wherever they go and whatever they do. While RFID technology is only one of a host of other technological devices that could be abused to violate consumers' location privacy,²³ it has three critical differences not found in other technologies that make it a true "¨¹ber-bug": low price, passivity (not requiring external power source), and very small size. While one can conceivably turn off his or her cell phone and disable GPS devices, RFID chips cannot be turned off or even easily found due to their miniature size. Therefore, it is particularly disturbing that no effective constitutional or legal constraints currently exist to protect consumer privacy from the threat that this technology represents.

III. Location Privacy and the Constitution: The Steep Road to Nowhere

The concept of privacy has developed slowly in the United States. While there is no direct mention of the word privacy in the Constitution, common law in both the United States and England sought to punish...