Overblown RFID Privacy Fears Still Merit Attention

Written by Evan Schuman
September 19th, 2004

September 19, 2004

By , eWEEK

Opinion: Bogus reports on RFID privacy problems are coming back louder than ever. But Evan Schuman argues that the only thing worse than believing those reports would be to ignore them.

As RFID stories start appearing in the consumer media and on the television network news shows, we’re starting to hear the same death and despair stories that were all the rage when the consumer media first discovered the Web.

My personal favorites were the early stories of shock when a reporter found out that government computers had pornographic images on them. That sounded pretty bad, until you realized that it was simply an Internet server that has Usenet newsgroups on it.

In other words, it had literally millions of pages from all over the world on it. That’s like saying your child’s school computer has recruitment ads for al-Qaida on it because it offers Web access.

Then there were those stories about how the Web should be banned or restricted because it puts our children at risk. When obscene phone calls were a common threat, I don’t recall cries to restrict or ban telephone access. People also can mail death threats, so let’s ban or restrict mail and FedEx access.

The silliest of those stories stopped appearing right about the time that consumer reporters started truly spending time on the Web and understanding what it was.

The next time you read or hear one of those “RFID is a 1984 Big Brother privacy threat” stories, remember what those same media organizations were reporting about the Web circa 1995 and 1996.

Two major networks last week reported fears that consumers carrying products with RFID tags could be tracked for miles, from merchant to merchant, seeing where they drove and exactly where the goods went in their house.

Personally, I’m not losing too much sleep over that, given the fact that most retailers today can barely get an accurate, consistent RFID readout when the tag is 2 inches from the reader. True, the technology’s accuracy should improve over the next couple of years and, in fairness, no one is honestly predicting widespread, item-level tagging before 2009 or so.

But how many inches from the readers will RFID be able to scan? And why would any retailer flood a community with thousands of RFID readers all over town, like so many cell towers? (Don’t get me started on how difficult it can be to send and receive consistently strong cell phone signals walking around Manhattan. And if Manhattan isn’t cell-saturated, what are the chances that Dubuque, Iowa, will be? Or for that matter, Sunnyvale, Calif.? But I digress, which I usually do.)

Remember that RFID tags are not like the receivers for GPS (Global Positioning System) units. GPS uses a couple of dozen medium-Earth Orbit communications satellites orbiting thousands of miles above the earth.

By triangulating signals from three of those satellites?and adding that info to data from the wheels and other input?it can allegedly track anything on the planet within 20 meters. Weather, mountains, hills and other factors can interfere with GPS, and military systems reportedly can be much more precise.

No, that’s not what RFID is. RFID needs to be scanned by a reader in fairly close proximity. But even assuming some retailer wanted to track where consumers went with various just-purchased products, and that somehow the retailer invested a few extra billion dollars in making its entire coverage area readable, why collect that kind of information?

One of the big problems with CRM systems today is that retailers have neither the staffs nor the inclinations to use one-tenth of the information they are already collecting. Why gather intrusive information that has no immediate benefit to the business when you’ll never get around to using it anyway? Who’s got that kind of time?

That all said, there are legitimate privacy fears surrounding the amount of data retailers are going to be able to collect in the coming years, and any retail IT exec who treats those concerns blithely is going to find out that it may not be Wal-Mart that will do you in.

As retailers get more sophisticated about multichannel integration and start to do their own triangulation of information about the same consumers, they could go from the catalogue’s toll-free number to various brick-and-mortar locations, and then to trolling on your Web site and perhaps integrating Google and eBay activities … now there is where privacy experts should be sweating.

It’s said that familiarity breeds contempt, but in the retail tech world, familiarity also breeds trust, comfort and that ever-illusive quality known as comprehension. A much bigger privacy threat is the ability for everyone’s cell phone to not only track a consumer’s location much better than RFID can, but to literally be transformed into a super-easy listening device. Just set the phone’s ring to “silent,” and the rest is automatic.

Why no uproar over that privacy risk? Because consumer media representatives and privacy advocates understand and routinely use cell phones, they understand the practical devices and are not afraid of them. This is the same reason those weird Internet scare stories stopped appearing: As consumers started using the Web routinely, it ceased being the Bogeyman and turned into an everyday tool.

When preparing to deal with a privacy strategy?for RFID or anything else?another crucial factor is that perception trumps reality every time, no contest. In classical cinema terms, think of reality as Bambi and perception as Godzilla. (I love the classics.)

Even if the reality is that RFID does not pose any true privacy threat, if your customers all believe that it does, you must treat their fears with respect. Well, maybe “respect” is a bit much. Humoring them might be more apropos.

Think of what happened at U.S. airports shortly after 9/11. Fatigues-wearing National Guard troops armed with automatic weapons patrolled public areas. Most government officials were not expecting terrorists to storm the airport. The show of force was intended to comfort passengers more than anything else.

A similar showing with RFID might be in order. Loudly and frequently declare privacy policies, where you pledge in plain language to not do the things that you never had any intention of doing anyway. Demonstrate the extremely limited range of the readers. (Like that will be difficult.) And allow consumers to opt out of as much as you can.

Few will take you up on the offer, but the gesture of making the offer is almost all that matters.


Comments are closed.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.