New Identification Technology Raises Concerns over Privacy
[Sorry, the video for this story has expired, but you can still read the transcript below. ]
TOM BEARDEN, NewsHour Correspondent: A new, far-reaching — and to some disturbing — technology is hidden inside the metal boxes astride this clattering conveyor belt in an Arkansas warehouse. It’s called RFID, for radio frequency identification.
Each one of these cartons has a low-cost electronic tag pasted on the outside. When the tags pass through a radio field created by the antennas, they’re energized, sending back a unique number that can be read and stored in a computer. RFID can help sort merchandise, keep track of inventory, dispatch shipments to outlying stores.
Some of America’s biggest retailers are starting to take advantage of that potential, but RFID can be used to identify more uniquely personal items, too, like prescription drug bottles, even individual human beings themselves.
Sayan Chakraborty is chief technology officer for SkyeTek, a Colorado firm that makes RFID tags and readers so tiny that they can be put in places never before possible.
SAYAN CHAKRABORTY, Chief Technology Officer, SkyeTek: This is an RFID tag. So this has a little microchip, has a little antenna. You can stick it on clothes. This would be a clothing style tag right here.
TOM BEARDEN: And an ID bracelet?
SAYAN CHAKRABORTY: Yes, it’s used for patient safety application, so when you show up at the hospital, it will be embedded with some data about you, your patient ID number, perhaps your blood type.
TOM BEARDEN: Another reader there?
SAYAN CHAKRABORTY: This is a scanner for events, and it goes along with this ticket printer, developed by one of our customers. And this actually outputs event tickets with RFID tags embedded in them. So the main goal here is to prevent cloning so that I can’t show up with my RFID-enabled ticket from the Super Bowl, only I bought from a scalper down the street.
TOM BEARDEN: But with RFID a growing presence in people's lives, Paula Bruening foresees a problem in protecting people's privacy. She's a lawyer with the Center for Democracy and Technology, a public interest group.
PAULA BRUENING, Center for Democracy and Technology: I think that raises concerns that individuals are going to be in a position where these tags that they're carrying in various devices that they carry, in their clothing, could potentially be read by a variety of readers in a variety of environments.
It's not clear yet whether that is ever going to come to pass. We don't know, but I think that is something that we really need to address.
TOM BEARDEN: Most RFID chips today are found in the so-called supply chain, keeping track of products. Professor Bill Hardgrave at the University of Arkansas's Sam Walton College of Business built this laboratory system to test RFID tools and applications. For example, more and more warehouses scan merchandise even as it's being unloaded from a truck.
BILL HARDGRAVE, University of Arkansas: Here's a reader here. It's got two antennas, and we'll have one on each side of the door. And these things -- each of these antennas kind of creates about an eight-foot RF field for this product to pass through. These products or the tags on them don't talk until they enter this field, get charged up, report back the data. And then as soon as they leave that field, they're dormant again.
TOM BEARDEN: Other readers are mounted on forklifts. There are even handheld readers for places forklifts can't go. Unlike the familiar barcodes that identify products to supermarket scanners, RFID labels don't have to be seen to be read. And while barcodes can only identify a class of products, RFID could be used to identify each individual package of a product.
Several retailers, including Wal-Mart, are rapidly expanding their use of RFID and requiring their suppliers to start tagging all cases and pallets of merchandise. Hardgrave's studies found that RFID allowed Wal-Mart to keep store shelves full 30 percent more efficiently and thereby substantially increase profits. He foresees even more benefits when the tags become cheap enough to put on every item.
BILL HARDGRAVE: Contact-less checkout, that's kind of the utopia, right, for the retailer and for the consumer. You take the product off the shelf, you put it in the cart, you wheel it through the portal as you go out the door, it sees everything, it charges your credit card, takes it off your debit card, you wheel it out to your car, and you take it out. It couldn't be any easier. I mean, to me, that's great when we get to that point, but we're a ways off.
A safety device
TOM BEARDEN: Retired Naval Commander Daniel Hickey has an RFID chip about the size of a large grain of rice in his right arm. He paid Dr. Jonathan Musher $200 to inject it under his skin.
The VeriChip, as it's called, can be read just like the chips on the warehouse boxes. When scanned, it sends out a 16-digit number. The number corresponds to Hickey's file in an encrypted database maintained by the VeriMed Company. Hickey can list allergies, prescription medications, and contact information.
DANIEL HICKEY, RFID Chip Implant Patient: If something happened, I got in an automobile accident or something, I had to go to an emergency room and I'm unconscious, how do they know what drugs I'm taking? How do they know who to call? They don't know anything. And this chip in my arm allows them to contact my next of kin and let them know.
TOM BEARDEN: Hickey says he paid for the chip implant primarily for the peace of â??mind it offers, even though only about 100 hospitals in the U.S. have the readers so far. One of them is Suburban Hospital in Maryland. The chief of the emergency room, Dr. Bob Rothstein, recently acquired a VeriChip reader, and hospital staffers have learned how to use the system.
DR. BOB ROTHSTEIN, Suburban Hospital Emergency Department: It's sometimes difficult to establish a rapport, get information from patients, and find out what we need to know in a very short period of time to be able to handle emergencies. We see people who wander in off the street or who are picked up by the police found wandering and they're unconscious, they're unable to give us a history, and sometimes the information in their past medical history is very important.
TOM BEARDEN: With the encouragement of the Food and Drug Administration, Pfizer recently began tagging individual bottles of Viagra to help combat drug counterfeiting.
And the State Department is introducing an RFID chip into new U.S. passports. It replicates the printed information and is touted as providing additional security.
Some scientists envision a time not too many years off when most objects in the world will be RFID-embedded and could be organized or located through computers. The "Internet of Things," it's being called.
Although most individual tagging isn't yet cost effective, civil libertarians and manufacturers alike feel that level of identification could cause real concerns about personal privacy.
SAYAN CHAKRABORTY: When RFID tags were simply replacing barcodes and they can only be read, the number of security threats were actually quite small. But as RFID tags have matured, they've added more memory, and they've become writable, and now you can modify or add data to them, the number of security threats has increased a thousand fold.
TOM BEARDEN: James Van Bokkelen found out just how easy it can be to hack the chips, like the one in the key card that he uses to unlock the door to his computer security firm. The hacker was radio engineer Jonathan Westhues, who showed us an RFID decoder he built for a couple of hundred dollars. He used the custom-built circuit board and a coil of wire to read the key card and record the information on his laptop computer.
JONATHAN WESTHUES, Radio Engineer: I'm going to read the information off that card in exactly the same way that the reader attached to the doorframe would. And once I've done that, I basically know everything that there is to know about this card. So I've already written code actually to handle the particular format that this card is using, so I can just demodulate that now, decimate and de-mod. So that looks good.
TOM BEARDEN: Westhues essentially cloned the key card and could then play back its signal and open the door. He worked with Van Bokkelen's full cooperation, but says he could easily have done it clandestinely.
JONATHAN WESTHUES: You can clone these cards from as far away as you can read these cards. For a credit card-size tag, it's easy to imagine brushing by someone in the subway and reading the card without ever removing it from their wallet.
TOM BEARDEN: The State Department's Frank Moss says the new passports can't be cloned that way.
FRANK MOSS, Deputy Assistant Secretary of State: We introduced in the cover, which wraps around through the book, an anti-skimming material. As long as this book is closed or mostly closed, no one can even identify that there's a chip in it.
Now your passport must be opened, must be presented to a reader, which calculates a key, which unlocks the data on the chip. Each time the chip is queried, it actually reports back with a different number so the ability to track someone from location to location around the world becomes impossible. Every session that the chip has, has a new identification number.
TOM BEARDEN: But there's fear that RFID chips might someday be used to track people without their knowledge. Some security experts say information on the new passport could be cloned the same way Westhues cloned the key card, and potentially used to identify Americans at an airport. The State Department says encryption in the chip prevents that from happening.
Wal-Mart and other firms have promised not to use RFID to collect personal information and to inform consumers when individual products are tagged. A few employers are already requiring workers to have RFID chips implanted if they are to be allowed access to high-security data. And the chairman of the VeriChip Corporation recently suggested his product could be offered on a voluntary basis as a way of identifying immigrants and guest workers.
CHAIRMAN OF VERICHIP CORPORATION: In the immigration application, the registration of a guest worker legitimately here in the United States, that could be used at the border, but it could also be used for enforcement purposes at the employer level.
TOM BEARDEN: What if you don't want it in your body? Do you have a choice?
CHAIRMAN OF VERICHIP CORPORATION: Absolutely. It's an election at the part of the immigrant or an election on the part of the government, when we ultimately define what that technology is.
PAULA BRUENING: When you start talking about injecting RFID chips under people's skin, I think that is something that is going to require a very robust and very open public policy debate, because I think that that is the kind of question that really goes to the core of individuals' fears about this kind of a technology. I don't like to use the word Orwellian very often, because I think it's overused when you talk about privacy, but I think this is one of those places where that word perhaps might be applicable.
TOM BEARDEN: Do you think some of these advocacy groups might be fearmongering?
BILL HARDGRAVE: To some degree, yes. But I don't want to label them too broadly, because, again, I think it's good that we have those groups that are raising those issues. I mean, some of the things that they talk about, yes, they may be far-fetched or science fiction at this point, but, you know, who knows? Technology advances rapidly, and we've got to keep our eye on those things.
TOM BEARDEN: In the meantime, the chips used for RFID are getting ever more powerful. Just this August, new chips hit the market promising more memory that could hold more user-programmed data.