RFID: promise or peril? It may be easier than ever to track information, but it is causing concerns over privacy and civil liberties.

When Sutter, Calif., came up with a new way to keep track of its students, no one predicted the heated debate it would bring, pitting the forces of high technology against those of privacy and civil liberties.

The Brittan Elementary School wanted to simplify attendance-taking, while also improving student safety. Officials announced last January that students would be required to wear radio frequency identification (RFID) badges around their necks. The badges would contain a chip with the student's name, picture and grade, as well as a 15-digit identification number. The information would be scanned by a teacher's hand-held computer whenever a student walked underneath a classroom door wired by an antennae.

The reaction among the students' parents was immediate. One father said the tagging made his children "feel like a piece of inventory." Several privacy advocate groups as well as the American Civil Liberties Union weighed in. The uproar soon proved to be so negative that the school was forced to abandon the program less than a month after it was launched.

"Sometimes when you are on the cutting edge you get caught," Brittan principal Earnie Graham remarked to one reporter as he recounted the angry phone calls and letters the school's experiment in RFID technology elicited.

Although Brittan's retreat may have ended the rancorous debate over the use of RFIDs in Sutter, it sparked a much larger statewide confrontation.

A MOVE TO CONTROL

Following the events in Sutter, Senator Joe Simitian introduced legislation prohibiting the use of RFID in government IDs, driver's licenses, library cards, student and employee IDs, and government health and benefit cards.

Simitian's measure, which passed the California Senate in May, also prohibits the use of RFIDs in other government-issued IDs unless certain privacy safeguards can be guaranteed.

"I am not trying to ban RFID or its use," says Simitian. "On the contrary, I think it is a marvelous little technology. It is a thing of wonder and has no end of good uses.

"But as is the case with any new technology," the senator says, "it is a question of matching the right technology with the right application, and recognizing both the strengths and challenges that come with it."

And for Simitian that means requiring certain safeguards that make it impossible for criminals to use personal information on an RFID.

WHAT'S EXCESSIVE?

The California lawmaker's rationale for RFID legislation may seem reasonable to those who are new to the issue. But his bill has sparked opposition from technology and industry groups, suggesting the kind of spirited debate that other legislatures may expect should they also take up the issue.

I think it is a very excessive approach," says Rob Atkinson, vice president of the Progressive Policy Institute, a nonprofit think tank in Washington, D.C. Atkinson says that Simitian's bill is the product of a debate being driven "almost entirely by falsehoods put out by people who are anti-technology."

Mark Anthony, director and counsel of technical policy with the American Electronics Association, says his members are so angry over the California legislation--along with similar bills introduced in Massachusetts, New Hampshire and New Mexico-that for the first time in memory the technology industry is united in a common purpose.

"Believe me, this is an industry in which no one can ever agree on anything--standards, environmental issues, product recalls, you name it," explains Anthony. "But on this issue they are linking arms and singing 'Kumbaya.' We are completely opposed to what's going on because we know it can only lead to one thing: the legal banning of an entire technology, and that is something we can never allow to happen."

The ACLU, on the other hand, is strongly in favor of legislation limiting the use of RFID tags and requiring notice of any RFID use, because of the dangers of criminals accessing the private information of individuals. The group is also troubled by the type of information, particularly of a background nature, that might end up on some RFID tags.

"You have to put the RFID in this context," says Barry Steinhardt, director of the ACLU's technology and liberty program. "We are all the time developing new technologies that allow us to track, monitor and catalogue everybody in everyday life. But a lot of the data that will be collected is either downright wrong, or is information making people accountable for sins in their distant past.

"We used to talk about the old permanent record from grammar school following you around for years," continues Steinhardt. "Well, imagine that and everything else about you being available to anyone in the world. RFID is just an enabler of that and a very risky vessel for holding data as well."

RETAIL WONDER

Initially developed in the 1980s as a device for gathering and tracking inventory, RFID has since proved to be both a popular and promising technology for the nation's retailers. Wal-Mart, the largest, has just recently begun its implementation.

"This is really the next generation of bar codes," says Steve Arthur, vice-president of governmental affairs with the Grocery Manufacturers of America. "And its use in improving the efficiency of the supply chain is without equal."

That's because RFID helps retailers track a product at every link in the supply chain, whether its at the shipping, receiving or storage level.

"When you have it at the case and palette level, the palette gets rolled off the truck and from there can be tracked throughout any big distribution center," continues Arthur.

"There can even be readers on a shelf that would be able to tell you the amount of product that is supposed to be there and will automatically send a signal to the manager when the shelves need to be restocked," adds Arthur.

The more efficient RFID makes the supply chain, the better that is for consumers, says Atkinson. "It's a system that if used properly lowers costs by making it less expensive and time-consuming to track industry. That means that the product is going to cost less for consumers."

But even at the retail level, some consumer and privacy groups have voiced concern about various aspects of RFID technology. Nocards.org, launched in 1999, complained about grocery store cards that might contain personal information on a store's customers. Other concerns about "smart shelves" are that the computer that is keeping a visual record of what is being sold can also be linked to the consumer at check-out.

"Really, almost any RFID use is now under attack," says Atkinson, "and that means as it is applied in both the private and public sectors."

ALREADY OUT THERE

According to a recent U.S. Government Accountability Office report, more than a dozen federal agencies are either using RFID or currently have a "specific plan to implement the technology in one or more applications."

Those agencies include the Department of Defense, which uses RFID for keeping track of shipments, and the Department of Homeland Security, for tracking and identifying weapons, baggage and assets on flights.

Plans to use RFID in passports by the State Department, meanwhile, hit a snag. Privacy groups said the "e-passport," which was designed to contain a holder's name, birth date and photo-otherwise known as a biometric identifier-was not secure enough and could be easily accessed by readers at a distance of up to 30 feet.

In response, the State Department pulled back a planned spring release in order to create a new e-passport. It will be protected by what is known as a "Ferriday Cage," which weaves metal threads into the cover, back and spine of the passport, blocking unauthorized scanners from reading RFID's electromagnetic pulse.

At the state and local level, meanwhile, RFID has been used for tracking library books in Illinois; the legal files of a district attorney's office in Marin County, Calif.; and elementary school students as they enter and exit school buses in Spring, Texas, some 20 miles north of Houston.

In the aftermath of Hurricane Katrina, health officials in Mississippi's Harrison County implanted human cadavers with RFID chips in order to speed up the process of identifying victims and passing on information to family members.

But even though RFID supporters say use of the technology for government purposes can only make things more efficient-thereby also responding to a long-time complaint that government is anything but--it is the marriage of government and technology that has most alarmed privacy advocates.

"I really just think the idea of every government agency being able to use this kind of a tracking devise is not a good idea at all," says Lee Tien, senior staff attorney with the Electronic Frontier Foundation.

"There is just something a little weird about the state controlling or regulating what people in the private sector may or may not be doing with RFID technology when in many ways the government could end up being the biggest violator of privacy when it uses RFID in things like driver's licenses and government benefit cards," continues Tien.

FINDING THE BALANCE

Minnesota Senator Steve Kelley, chairman of the Senate Education Committee who for three years headed up the Senate Ad Hoc Committee on Technology, shares the same concerns. Although the use of RFID in both the private and public sectors remains minimal, it is its potential that has him worried.

"However it is being used, the challenge with RFID across a broad range of applications is the same: How do we balance our desire for convenience and efficiency with our need for privacy, especially against surreptitious surveillance," continues Kelley.

Yet Kelley also worries that state lawmakers, in an effort to ensure and enhance privacy, could end up signing off on measures that are too restrictive and burdensome to what he calls a "much-needed industry and technology."

"The more we get into this, the more you are going to hear about the privacy concerns and why we need to require things like encryption and limits on the range of the technology," adds Kelley. "And those are reasonable things to consider. But it might also prove easy to end up with something that calls for the outright banning of the chip, and that is a direction we absolutely should not move in."

Those same concerns have prompted Virginia lawmaker Joe T. May, chairman of the House of Delegate's Science and Technology Committee, to proceed cautiously.

"My own perspective is that we should not do anything--particularly given that this is a very complicated area that many lawmakers are not entirely familiar with-until we are absolutely certain that we will not end up with any unintended consequences," May says.

Senator Kelly chairs a special project at NCSL which is focusing on RFID this year. Delegate May serves as vice chairman. Because the universe of the wireless link is also a place of rapid change, May thinks lawmakers could end up passing what he calls "dead laws," or laws that are quickly out-dated by ever-new improvements in the technology almost as soon as they are signed into law.

May also says that the imposition of state regulations on the industry may make obsolete the very service that RFID is designed to provide. "It is a technology that is supposed to make the logistics chain more efficient. But if you begin to regulate it excessively, it becomes more inefficient, which just destroys the purpose for it in the first place."

Meanwhile, lawmakers who may be contemplating legislation similar to California's should expect to find themselves in the same whirlwind of passionate debate. "This is one of those issues that is very complicated and just gets people upset," says Virginia's May, who says he would never even approach the issue without first "going to our legislative services people and studying up on every angle of it."

"And even when you do that, it is quite clear that whatever approach you end up taking will not satisfy everybody," says May. "There are just too many hardened positions on both sides of the debate for that to ever happen."

RFID--WHAT IT CAN DO

Radio Frequency Identification (RFID) technology can be thought of as a next, generation bar code. A simple RFID tag consists of a microchip and antenna, which when stimulated by a remote "reader," sends back information via radio waves. Like a bar code, an RFID tag identifies the product it is attached to for inventory or purchasing purposes; but an RFID tag can do even more. For example, RFID tags can hold information related to the expiration date of a product, record whether a product has been exposed to excessive heat, or could be used to assist with product recalls. An RFID-tagged product can be tracked as it moves in commerce, providing better ways to identify and meet consumer demand for products.

Current applications of RFID generally do not raise privacy concerns; however, RFID devices could be linked to personally identifiable information, creating apprehensions about government and private sector use of RFID. At least 12 states in 2005 introduced privacy legislation relating to the use of RFID; none of the bills passed.

Some observers believe that privacy concerns being raised by RFID can be addressed through privacy and computer crime legislation that also applies to other current and future technologies. Paula Bruening, Staff Counsel at the Center for Democracy and Technology, in testimony about RFID before the U.S. House Committee on Energy and Commerce, stated that RFID technology "poses significant and novel privacy concerns," but that "technology-neutral privacy baseline legislation could answer many of the basic concerns posted by RFID without creating technology mandates."

Richard Varn, Technology Policy Adviser for the National Retail Federation, believes that the first step for lawmakers is to review existing laws. For example, many states' computer crime laws prohibit access to or use of computer chips and data without permission, and identity theft statutes prohibit obtaining personal information and using it for unlawful purposes. Some states' laws may prohibiting electronic tracking of a person. Varns notes that underneath many new technologies is just a new way to use a database, and that legislators should narrowly tailor their response to concerns about RFID to the difference caused by the technology, not the technology itself.

--Pam Greenberg, NCSL

CURRENT USE OF RFID

Supply chain automation/warehouses-Improves the tracking of supplies, decreases shrinkage and improves inventory management. (U.S. Department of Defense)

Asset tracking--Complies with the federal mandate to track tire sales and baggage. (McCarran Airport, Las Vegas, Nevada)

Medical applications--Complies with federal regulations to track prescription drug distribution, limit counterfeiting and prevent theft. (Massachusetts General Hospital)

Security--Identifies and prevents the unauthorized removal of items from data centers; controls the access, exit and movement in buildings, compounds and networks. (Building Access ID Cards) Retail--Decreases retailers' costs, improves management of inventory, and improves service to customers. (Walmart)

Livestock--Improves the efficiency of livestock handling and tracking of U.S. food supplies from farm to table. (U.S. Department of Agriculture)

Transportation--Improves the payment of tolls or fares. (EZPass)

Libraries, files and archives--Enhances document and item tracking, chain-of-custody control and circulation management. (Maricopa County, Arizona, Library and the District Attorney's Office)

Source: National Electronic Commerce Coordinating Council (NECCC), an alliance of national state government associations dedicated to advancing electronic commerce within the states. A NECCC work group has recently published Government Decision Makers Guide to RFID. For more information, visit www.ec3.org.

Garry Boulard, a frequent contributor to State Legislatures magazine, is a free-lance writer from Albuquerque, New Mexico.