RFID is an excellent technology for object tracking. In this case, we can define an object as a physical asset that occupies 3-dimensional space. This means that the whereabouts of any physical object (including animals and humans) can potentially be tracked within the scope of the RFID infrastructure. As RFID technology development progresses, this scope can become larger and larger.
This fact has raised many questions and concerns from people because of the potential invasion of privacy that can be attributed to RFID technology. But, before we get deeper into the privacy issues and their repercussions, let’s look at a few examples of what privacy advocates and the concerned public claim can go wrong with the use of RFID technology.
Tracking consumers by the products they buy
Consumer and privacy advocates have closely followed the deployment of RFID enabled solutions in the supply chains of major retailers such as Wal-Mart, Tesco, Target and others. They contend that by using the same technology adopted by the retailers to track individual items through their supply chains, consumers could potentially be tracked after buying the merchandise and leaving the retail stores.
Tracking travelers by the passports they carry
The U.S. government has made a decision to implement contactless chips in U.S. citizen’s passports. These chips contain the passport holder’s information as well as a digitized picture of the holder. Initially, the U.S. Department of State’s proposal did not include any security protocols. The information would be contained unencrypted within the passport’s chip. Therefore, anyone with the right reader technology could potentially scan a traveler’s passport, perhaps while still in the traveler’s possession, and obtain personal information. This, it is argued, could help terrorists, thieves or others to determine the traveler’s identity or nationality.
After much negative feedback from the public and different organizations the Department of State changed its proposal and added 3 layers of security:
Encryption: The information would be encrypted in the RFID chip.
Access Control: The key to decrypt the data would be encoded in the passport and could only be obtained by scanning the passport with an optical reader. The passport reader would then decrypt the information using that key.
The passport covers would contain a metallic mesh that would create a Faraday Cage, essentially rendering unreadable the RFID chip when the passport covers were closed.
Security experts still raise a debatable issue relating the fact that the chip’s unique identifier can be read by any reader since this falls below the layer of protection provided by the encryption methodology. This could create an issue of passport traceability.
Tracking readers by the library books they check out
Many libraries, primarily in Europe, have implemented RFID technology in their operation. In the most advanced scenario, the idea is to tag every book in the library with an RFID chip and allow patrons to “automatically” check out the books by means of carrying an RFID tag and making the proper association of books-to-patron as the patrons exit out though the checkout portal. Privacy groups contend that patrons’ right of privacy could be violated by someone with the proper technology within close proximity of the patrons. This would allow the malicious person to determine what books have been checked out by the patron.
The conspiracy theory
The most aggressive privacy concern groups claim that governments could potentially gain access to all commercially controlled RFID databases and, therefore, have full access to the consumer, travel, and general habits of its population. Or governments could achieve this by deploying wide-area RFID infrastructures where all the activities of its citizens could be tracked, from what they buy, to what they read, to where they travel, to what they watch on videos.