IPL Player
Oct 30, 2004
By Javad Heydary
Part of the ECT News Network
02/03/05 5:00 AM PT

The most important legal aspect of using RFID technology relates to the infringement of individual privacy rights. RFID systems have the potential to track individuals in an unprecedented manner.

The U.S. Department of Homeland Security (DHS) will use RFID chips on a trial basis to track the arrival and return of visitors from abroad. The testing phase, which will begin this spring and is expected to last one year, will occur at selected points of entry across the U.S., and it will complement the current U.S.-VISIT scheme.
The U.S.-VISIT scheme, which entails fingerprinting visitors, has encountered criticism, and to date more than 400 people have been refused entry or arrested as a result of this scheme.

Although the exact way that the RFID chips will be implemented is not yet known, they will be used to track pedestrians and vehicles entering the U.S. This move by the DHS is yet anther example of the growing use of RFID technology.

Business Issues Related to Using RFID

The key business implications related to the implementation of RFID technology relate to (i) cost of implementation; (ii) supply chain management; and (iii) improvements in consumer service.

Despite the fact that the cost of RFID tags is declining, and will continue to decline due to economies of scale, the cost of the tags only represents a very small fraction of the overall cost to implement an RFID system. Currently the cost of passive RFID tags is approximately 40 cents, and if the tags are active, the cost per tag might increase to a few dollars.

The major cost in implementing an RFID system for a business consists of the expenditures related to the data management system and software. A business implementing such a system might end up spending anywhere from 50 percent to 80 percent of the total implementation budget on these costs.

One reason, among others, why the data management expenditures are quite high is that organizations will have to re-engineer their business processes so as to align and configure their existing systems to incorporate the RFID system. System integration from the front to back end will be necessary to achieve the full benefits of RFID technology.

Given that there are significant capital costs in implementing a RFID system, it is easy to see why large retailers such as Wal-Mart, Albertson or Home Depot are leading the initiative.

Supply Chain Efficiency

For those businesses that implement RFID systems, it is expected that these high upfront capital costs will be offset and eventually result in gains due to improvements in the supply chain management system. Businesses incorporating RFID technology expect to achieve significant reductions in costs by having, among other things, a more efficient inventory management system, tracking system and reduced theft or loss.

Aside from the benefit to the consumer of reducing business costs (assuming that these savings will be passed down to consumers to some extent), RFID-enabled businesses, especially those in the retail sector, will be able to provide improved consumer service. This improved service will come in the form of being able to identify consumers' preferences by tracking the types of purchases individual consumers make.

RFID technology, when implemented at the individual item level, provides an enormous amount of data collection. This information can be used in effective ways to identify market and individual purchasing trends. It can also be used to execute very effective and tailored marketing practices and campaigns.

Legal Implications of Using RFID

The most important legal aspect of using RFID technology relates to the infringement of individual privacy
rights. RFID systems have the potential to track individuals in an unprecedented manner. If tags are placed on bags, clothing, cosmetic products, or any single retail item for that matter, information about the item can be linked to the purchaser to provide a more complete consumer profile.

For example, when a RFID tag is read, information from the tag could be linked to a purchaser's financial information if the product was purchased with a credit card or loyalty card. Moreover, it is possible for a reader to read tags covertly without the consumer's knowledge. It is also possible that a reader can be set up to read tags from other stores. This means that a reader might be able to determine the contents in a consumer's purse or bag without the consumer even being aware.

Further and aside from the possibility of tracking consumers in the marketplace at anytime or anyplace, which in itself raises significant privacy concerns, RFID tags can be used to track "sensitive-type" items such as pharmaceutical products or even currency. If tags are left active, government and industry can track how you use your money, and what kinds of pharmaceuticals you take.

This presents significant legal problems as our health, financial and other types of "sensitive" information is not normally allowed to be collected, used or disclosed without our consent.

Children's Privacy

Another privacy concern in using RFID tags relates to children. As most companies such as retailers are aware, children represent a significant segment of the consumer market, even if they are not the ultimate purchaser of products. However, tracking and profiling children raises significant legal problems since different rules regarding the collection, use and disclosure of information apply to children.

Although the issue of tracking and profiling consumers is frequently mentioned when discussing RFID technology, this technology also has enormous legal implications in the area of employee privacy. A RFID system could potentially track the whereabouts of an employee in the workplace at all times. This presents significant concerns as employee privacy might be significantly eroded with the onset of this technology.

In many jurisdictions including most of, if not all of, the jurisdictions in Canada and the U.S., the collection, use and disclosure of RFID data will have to comply with existing privacy laws.

Therefore, when a company amasses data through the use of RFID, it will have to do so in accordance with these laws, which means that they will have to obtain the appropriate consent depending on their local legal requirements for the various kinds of personal information
they are collecting using RFID. It also means that these companies will have to take the appropriate safeguards to protect such personal information.

Based on the foregoing, any organization contemplating the use of RFID should start by ensuring that it is aware of its privacy obligations under different laws before it starts accumulating data that can come back to haunt it later if it has not been collected in accordance with legal requirements.

[font=verdana, arial, helvetica]Javad Heydary, an E-Commerce Times columnist, is a Toronto lawyer licensed to practice in both Ontario and New York and is the managing editor of Lawsof.com. [/font]


IPL Player
Oct 30, 2004
House backs major shift to electronic IDs

Published: February 10, 2005, 5:46 PM PST
By Declan McCullagh
Staff Writer, CNET News.com

The U.S. House of Representatives approved on Thursday a sweeping set of rules aimed at forcing states to issue all adults federally approved electronic ID cards, including driver's licenses. Under the rules, federal employees would reject licenses or identity cards that don't comply, which could curb Americans' access to airplanes, trains, national parks, federal courthouses and other areas controlled by the federal government. The bill was approved by a 261-161 vote.

The measure, called the Real ID Act, says that driver's licenses and other ID cards must include a digital photograph, anticounterfeiting features and undefined "machine-readable technology, with defined minimum data elements" that could include a magnetic strip or RFID tag. The Department of Homeland Security would be charged with drafting the details of the regulation.

Republican politicians argued that the new rules were necessary to thwart terrorists, saying that four of the Sept. 11, 2001, hijackers possessed valid state-issued driver's licenses. "When I get on an airplane and someone shows ID, I'd like to be sure they are who they say they are," said Rep. Tom Davis, a Virginia Republican, during a floor debate that started Wednesday.

States would be required to demand proof of the person's Social Security number and confirm that number with the Social Security Administration. They would also have to scan in documents showing the person's date of birth and immigration status, and create a massive store "so that the (scanned) images can be retained in electronic storage in a transferable format" permanently.

Another portion of the bill says that states would be required to link their DMV databases if they wished to receive federal funds. Among the information that must be shared: All data fields printed on drivers' licenses and identification cards, and complete drivers' histories, including motor vehicle violations, suspensions and points on licenses.

The Bush administration threw its weight behind the Real ID Act, which has been derided by some conservative and civil liberties groups as tantamount to a national ID card. The White House said in a statement this week that it "strongly supports House passage" of the bill.

Thursday's vote mostly fell along party lines. About 95 percent of the House Republicans voted for the bill, which had been prepared by the judiciary committee chairman, F. James Sensenbrenner, a Wisconsin Republican. More than three-fourths of the House Democrats opposed it.

Rep. Eleanor Holmes Norton, a Democrat from Washington, D.C., charged that Republicans were becoming hypocrites by trampling on states' rights. "I thought the other side of the aisle extols federalism at all times," Norton said. "Yes, even in hard times, even when you're dealing with terrorism. So what's happening now? Why are those who speak up for states whenever it strikes their fancy doing this now?"

Civil libertarians and firearm rights groups condemned the bill before the vote. The American Civil Liberties Union likened the new rules to a "de facto national ID card," saying that the measure would force "states to deny driver's licenses to undocumented immigrants" and make DMV employees act as agents of the federal immigration service.

Because an ID is required to purchase a firearm from a dealer, Gun Owners of America said the bill amounts to a "bureaucratic back door to implementation of a national ID card." The group warned that it would "empower the federal government to determine who can get a driver's license--and under what conditions."



IPL Player
Oct 30, 2004
Welcome to the new world

Say NO to the CHIP

Congress Considers Evacuation Tracking
The U.S. House is evaluating tracking technology for possible deployment at Congressional facilities in order to locate House members, staff and visitors during emergencies.
By Claire Swedberg

Feb. 7, 2005—The United States House of Representatives is seeking technology to track people in the event of an emergency. Vendors have until Feb. 15 to submit information about a system that could report on the location of House members, staff and visitors during an evacuation from House-operated facilities. Vendors of radio frequency identification products are among the companies responding to the House's request.

"There are numerous ways to address tracking," says Erik Michielsen, the director of RFID and ubiquitous networks at ABI Research, a consulting firm based in Oyster Bay, N.Y. Few of these methods, however, fulfill the House's high-tech requirements, such as 3-D graphical displays.

ABI's Michielsen "An RFID-hybrid solution would be optimal," Michielsen says. Such a hybrid could combine biometric identifiers with RFID. "We're going to be seeing more of the RFID-biometrics hybrids in the next year," Michielsen predicts, because the U.S. government has shown an interest in that kind of solution.

In its official request for information, posted online on Dec. 2 at FedBizOpps.gov, a government procurement Web site, the House's Office of the Chief Administrator reports that it is seeking "reliable, robust, and rapid accumulation of real-time operationally accessible data" concerning the location and evacuation status of House members, staff and visitors immediately after an emergency event and for a 24-hour period afterward. That includes people who have gathered in assembly areas, those who are in the building and need to report their status, and those who have traveled to a different location. This system would be used only during emergencies and activated during an evacuation of the U.S. Capitol, the House's four main offices (the Cannon, Longworth, Rayburn and Ford buildings), and other smaller House-operated buildings clustered in an area of 0.8 square miles.

Approximately 13,500 legislators and staff work within these facilities. At present, the House lacks a system for keeping track of which people are in the buildings. Although staff members currently have ID badges that incorporate an HID-type proximity RFID transponder, the House has deployed proximity card readers for access only at select places within the House complex, but not at building entrances and exits.

The House is seeking a real-time geographic information system (GIS) that would not only provide a 3-D graphical display of the buildings but also show the current position of all individuals within and around the buildings during an emergency. The system should also be able to indicate which individuals have left the buildings and are now in safe locations.

The tracking system would work in two phases. Phase 1 would determine the location of each House member, employee and visitor and report on building occupancy status during the first hour of an emergency evacuation. Phase 2 would provide similar information for a 24-hour period after an evacuation. The system's overall purpose is to provide timely information to law enforcement and House officials regarding the evacuation process and the safety of its employees, so that these officials can make tactical and strategic decisions. Phase 1 data might also be used by first-responder personnel to help them determine the percentage of people accounted for, building by building, and assist these responders in the use of on-scene emergency resources.

RFID technology would be an obvious solution to meet the House's requirements because RFID has been used in similar applications, according to Michael Liard, director of automatic identification and data collection (AIDC) and RFID at Venture Development Corp., a technology market research firm based in Natick, Mass. For example, Axcess, a Carrollton, Texas, provider of RFID-enabled access-control, asset-management and surveillance systems, has developed a personnel-tracking system much like the one the House is seeking, and is responding to the House's RFI. Sense Holdings, a Sunrise, Fla., supplier of access, security and asset-tracking systems, also offers a real-time RFID solution for tracking people.

GPS is another technology that can be used to track people, assuming they are wearing GPS-enabled ID badges or similar devices, Liard notes. Because the GPS unit inside a badge needs to have a clear line of sight with GPS satellites, however, the technology would work effectively only when people are outdoors. Although a GPS-based system might be less expensive, Liard says, "there would be some limitations. Certainly range and accuracy could become an issue," since GPS tracking does not pinpoint locations as precisely as an RIFD system could.

The Department of Defense has tested the evacuation-monitoring potential of Axcess's people-tracking system, which uses ID badges containing an active RFID tag that can be read by RFID readers deployed in rooms and corridors (see Using RFID to Manage Evacuations). That system can provide emergency personnel with a 2-D graphic display that shows the location of any DOD worker wearing or carrying an ID badge. The badge's tag can transmit its RF signal (either 315 MHz or 433 MHz) through pocketbooks, briefcases or clothing to readers 30 to 100 feet away, according to Axcess CEO Allan Griebenow, and the system can read approximately six ID badges per second.

Axcess's Griebenow "We can solve the majority [of what the House is seeking] today," he says, pointing to similar Axcess systems currently being used by the Department of Defense to track movement of vehicles and personnel at military bases.

The cost of providing the House with the system it seeks could be relatively inexpensive, Griebenow says, depending on how many RFID readers are needed in doorways, halls and underground corridors that connect House buildings. Costs would average $20 per badge for all employees, about $2,000 for each reader, and about $10,000 for the operating software, including the graphical display.

If the House chooses an RFID solution, "this will bring privacy concerns to a whole new level," says Liard, observing that lawmakers will find themselves to be users of a technology that is still under fire from privacy groups. "The debate [about RFID and privacy] will only increase." Privacy concerns, he says, may be one reason the House could be open to a GPS solution. Emergency roadside service provider OnStar, for example, uses GPS tracking to provide assistance to owners of many General Motors vehicles. "People are comfortable with GPS," he says, "while RFID is still shrouded in some controversy."


Parents and Civil Liberties Groups Urge School District to Terminate Use of Tracking Devices

San Francisco - Parents in a northern California public school district and civil liberties groups are urging a school district to terminate the mandatory use of Radio Frequency Identification tags ( RFIDs ) by students. Several civil liberties groups, including the ACLU of Northern California ( ACLU-NC ), Electronic Frontier Foundation ( EFF ), and the Electronic Privacy Information Center ( EPIC ) sent a letter today expressing alarm at the Brittan School District's use of mandatory ID badges that include a RFID device that tracks the students' movements. The device transmits private information to a computer on campus whenever a student passes under one of the scanners. The ID badges also include the student's name, photo, grade, school name, class year and the four-digit school ID number. Students are required to prominently display the badges by wearing them around the neck at all times.

"Forcing my child to be tracked with a RFID device – without our consent or knowledge – is a complete invasion of our privacy," said Michael and Dawn Cantrall. "Our 7th grader came home wearing the ID badge prominently displayed around her neck– if a predator wanted to target my child, the mandatory school ID card has just made that task easier." The Cantralls filed a formal complaint against the Brittan Elementary School Board in Sutter, California on January 30th after meeting with several school officials.

In a letter dated February 7, sent to the Brittan Board of Trustees, the civil liberties groups "urge the school board to recognize the serious safety and civil liberties implications" and call the for the School Board to "terminate this ill-advised test immediately."

"We are sending the letter today because a School Board meeting is scheduled for tomorrow night and we want to make sure that the District reconsiders the issue," said Nicole Ozer, Technology and Civil Liberties Policy Director of the ACLU-NC. "RFID technology is inappropriate for use in schools. The badges jeopardize the safety and security of children by broadcasting identity and location information to anyone with a chip reader and subjects students to demeaning tracking of their movements."

"The monitoring of children with RFID tags is comparable to the tracking of cattle, shipment pallets, or very dangerous criminals in high-security prisons. Compelling children to be constantly tracked with RFID-trackable identity badges breaches their right to privacy and dignity as human beings. Forcing children to wear badges around their necks displaying such sensitive information as their name, picture, grade and school exposes them to potential discrimination since the name of their school may disclose their religious beliefs or social class," said Cédric Laurant, Policy Counsel with EPIC.

Jeffrey and Michele Tatro, parents of a thirteen-year-old student at Brittan Elementary School, added: "It is our goal that no child in the United States be tagged or tracked. We want it to be stopped here, in Sutter California, and we don't want any child to be tracked anywhere. Our children are not pieces of inventory."

"It is dehumanizing to force these children to wear RFIDs, and their parents are rightfully outraged," said Electronic Frontier Foundation senior staff attorney Lee Tien. "We are doing everything we can to support the parents in this fight to protect student privacy."

Get more information about RFIDs in schools.


IPL Player
Oct 30, 2004
MSN to Support Electronic ID Card Technology By Mary Jo Foley, Microsoft Watch
February 2, 2005

Microsoft Corp.'s Belgian subsidiary has launched an electronic ID card pilot program and is looking to integrate authentication for e-ID cards into future versions of the MSN Messenger instant messaging service.

Microsoft Belgium on Monday announced a new Electronic ID Early Adopter program. Under the program, Microsoft will be working with local software vendors to develop e-ID-based applications. Microsoft's MSN division will develop one such application—an authentication service for MSN, according to Microsoft officials.

Microsoft Chairman Bill Gates made the announcement along with the Minister of IT in Belgium, in front of an audience of government and IT officials on Monday.

Information on MSN's work with the Belgian government around e-ID cards was first reported by the www.mess.be Web site.

The government of Belgium is engaged in a program to equip all citizens over age 12 with an e-ID card. According to the Mess.be site, the new e-ID card will replace traditional ID cards for 8 million Belgian citizens by December 31, 2009. Mess.be says the new e-ID cards will include photos, names, nationality, place and date of birth, a national ID number and a validity date, all of which will be stored electronically.

"We hope to learn from our experiences here as we incubate this project so that we can apply learnings to projects in other countries that may have or are currently finalizing their own e-ID plans, or possibly to other products if it makes sense," said an MSN spokesperson.

For now, the e-ID project is focused exclusively on MSN Messenger, and Microsoft "has no other potential applications to announce at this time," the spokesperson said.

Read the full story on Microsoft Watch: MSN to Support Electronic ID Card Technology