This article was published in Scientific American’s former blog network and reflects the views of the author, not necessarily those of Scientific American
The retail giant Wal-Mart will place radio-frequency identification (RFID) tags on underwear, jeans and other consumer items, according to several news reports, including one today from the Wall Street Journal. Companies have long used such "smart tags" to keep track of the inventory of goods going through the supply chain, but the move by Wal-Mart, the world's biggest retailer, to put them on individual consumer items marks a (not unexpected) shift toward something that privacy advocates have long feared.
That's because RFID tags, which can be read at a distance and hence surreptiously, can provide a lot of personal information even if it does not carry it per se. Katherine Albrecht, a privacy and RFID expert who has been following the issue for years, described in a special privacy issue of Scientific American just how the tags pose new security risks to those who carry them, often unwittingly. Here's an excerpt:
On supporting science journalism
If you're enjoying this article, consider supporting our award-winning journalism by subscribing. By purchasing a subscription you are helping to ensure the future of impactful stories about the discoveries and ideas shaping our world today.
If the idea that corporations might want to use RFID tags to spy on individuals sounds far-fetched, it is worth considering an IBM patent filed in 2001 and granted in 2006. The patent describes exactly how the cards can be used for tracking and profiling even if access to official databases is unavailable or strictly limited. Entitled “Identification and Tracking of Persons Using RFID-Tagged Items in Store Environ ments,” it chillingly details RFID’s potential for surveillance in a world where networked RFID readers called “person tracking units” would be incorporated virtually everywhere people go—in “shopping malls, airports, train stations, bus stations, elevators, trains, airplanes, restrooms, sports arenas, libraries, theaters, [and] museums”—to closely monitor people’s movements.
According to the patent, here is how it would work in a retail environment: an “RFID tag scanner located [in the desired tracking loca tion]... scans the RFID tags on [a] person.... As that person moves around the store, different RFID tag scanners located throughout the store can pick up radio signals from the RFID tags carried on that person and the movement of that person is tracked based on these detections.... The person tracking unit may keep records of different locations where the person has visited, as well as the visitation times.”
The fact that no personal data are stored in the RFID tag does not present a problem, IBM explains, because “the personal information will be obtained when the person uses his or her credit card, bank card, shopper card or the like.” The link between the unique RFID num ber of the tag and a person’s identity needs to be made only once for the card to serve as a proxy for the person thereafter.…
A tracking infrastructure will become increas ingly fruitful to marketers as more people begin carrying, and even wearing, RFID-tagged items. At present, tens of millions of contactless credit and ATM cards containing RFID tags are in cir culation, along with millions of employee access badges. RFID-based public-transit passes, wide ly used in Europe and Japan, are also coming to U.S. cities. IBM’s person tracking unit is still only a patent, but an English amusement park called Alton Towers provides a living illustration of RFID’s tracking potential. On entering the park, each visitor is offered an RFID wristband encod ed with a unique ID number. As people enjoy the attractions, a network of RFID readers placed strategically throughout the park detects each wristband as it comes within range and triggers nearby video cameras. Candid footage of each individual is stored in a file labeled with the wrist band ID number, then made available to the cus tomer on a keepsake DVD at the end of the day.
(You can read the entire article, "How RFID Tags Could Be Used to Track Unsuspecting People," if you have a digital subscription; the title of the print version is "RFID Tag—You're It".)
Wal-Mart has stated it recognizes that issue, but the fact is, it can play Big Brother if it wants to. And if the tagging system proves worthwhile to Wal-Mart, then other retailers are likely to follow, creating many possible points of personal intrusion.
There is a positive note: Wal-Mart is installing the tags so that they are removable. For privacy's sake, let's hope that feature remains permanent.
Image of RFID chip by Maschinenjunge via Wikimedia Commons.