Radio Frequency Tags Invade Privacy, Invite Identity Theft

March 3, 2005 by Nicole Ozer, Technology & Civil Liberties Policy Director, ACLU-NC, The San Francisco Daily Journal

Last month, parents and children in the small, rural town of Sutter, California, learned firsthand about the serious civil liberties and security implications of tiny computer chips called “radio frequency identification tags.”

Children only 5 years old were forced to carry student badges around their necks embedded with radio frequency ID tags. As students walked through a classroom or bathroom door, the computer chip in their student badge transmitted a stored personal identification number to a central school server that tracked and recorded their movements throughout the day.

The school, wooed by the hopes of trying to save a few minutes a week in attendance-taking and promises of royalties from future sales of the product, implemented the program without discussing it with parents or considering its serious privacy, civil liberties, and security implications.

While the school board did not recognize the grave implications of the radio frequency ID program, the parents in Sutter did. They were right to worry that the school district and the company had never provided adequate assurance about how they would protect the children’s personal information and location information from unauthorized access, use, and disclosure.

They were right to fear that the same tags that made it possible for the school to keep track of who a child is and where that child goes at school also made it possible for strangers with access to a chip reader to find out this private identity and location information. They were right to object to having their children grow up in a school atmosphere where children are tagged and tracked and their movements recorded—an atmosphere at odds with fundamental human dignity and basic privacy rights.

And they were right to fight back and stop the radio frequency badges at their school.

Parental pressure ended the program in Sutter on Feb. 15, but the issue goes far beyond the town and its schoolchildren. Radio frequency ID tags are proliferating and the increasing use of this technology—particularly attempts to include these computer chips in identity documents—should concern Californians of all ages.

Radio frequency ID technology originally gained a foothold in the commercial sector as a means to allow real-time monitoring and tracking of inventory moving through the supply chain. As a product containing a chip travels from manufacturing plant to store shelves, chip readers installed along the way emit radio signals that prompt the tag in the product to automatically transmit its stored information: the location of the product, a unique identifier number, or specifics such as price or color.

While businesses initially claimed that their use of such tags was only an attempt to track inventory, they quickly proposed using the tags to continue monitoring the movement of products after purchase by consumers. If businesses are successful in implementing their plans for continued tracking, the chips in the items you buy could provide a detailed and intimate picture of how and when you use products in your private lives.

While the privacy and anonymity concerns associated with consumer radio frequency tags are extremely serious, they may pale in comparison to newer and even more threatening proposals to attach such devices to government identity documents.

Last summer, the federal government announced plans to implant radio frequency ID chips in all new U.S. passports. The chips under consideration have enough memory to be programmed with all of the information currently printed on a passport, including the bearer’s name, home address, birth date, fingerprint and photograph.

Disregarding the severe privacy and security implications of radio frequency ID technology, the federal government currently has no plans to protect the security of any of this private information through encryption. As a result, the data encoded on the chips might easily be scanned from up to a meter away by anyone with a chip reader-- without the knowledge or authorization of the passport holder.

Like the radio frequency badges that may have saved a few minutes a day on attendance procedures in Sutter, such tags in passports may streamline the customs process slightly by allowing people’s data to be scanned rather than read by an agent. But the marginal gains in efficiency cannot justify the heavy costs to personal privacy and security.

The inclusion of radio frequency ID technology would force all Americans to carry a passport that broadcasts our personal information and allows others to surreptitiously track our movements. With fewer controls on government powers since 9/11, and a world that may be more hostile to American citizens, the last thing needed is a passport allowing our movements to be tracked and announcing our nationality as we travel through foreign countries.

Regrettably, the move to include radio frequency tags in passports portends a future in which such devices become a fixture in identity documents. Without efforts to reverse this trend, we may all be forced to carry a host of radio frequency-tagged federal and state documents, including drivers’ licenses, state identification cards, student identification cards, professional licenses, library cards, and medical cards.

Currently, we can travel in public without worrying that somebody can secretly scan our driver’s license or other identification cards in order to discover personal information such as our name or address. But if personal information were encoded on the radio frequency IDs embedded in these documents, any person or entity could use a chip reader to discover this sensitive personal information. The unknown disclosure of information such as names and addresses could increase the risks for abduction and assault.

Storing personal information on radio frequency tags also threatens the economic well-being of Californians by further facilitating the crime of identity theft. Identity theft is rampant in this state; more than 39,000 Californians reported being victims of this crime in 2003 alone. Providing identity thieves with the opportunity to secretly scan and collect personal information from the radio frequency IDS in state identity documents may make this problem even worse.

Most troubling of all from a civil liberties perspective is that such devices in state identity documents would allow the movements of Californians to be tracked on an unprecedented scale. As we move through our daily lives, carrying the identity documents necessary to navigate the modern world, anyone with a chip reader could secretly scan our tagged identification cards through a wallet, pocket, backpack, or purse. Government agents could use readers to sweep up the identities of everyone at a political meeting, protest march, or Islamic prayer service.

A network of automated RFID listening posts on the sidewalks and roads is not at all far-fetched, thus ushering in a true surveillance society in which an individual’s every movement could be tracked and scrutinized by the government.

Two weeks ago, Senator Joe Simitian, D-Palo Alto, introduced legislation that begins to address these critical issues. The Identity Information Protection Act (SB682) prohibits the inclusion of radio frequency IDs in state identity documents—including drivers’ licenses, student badges and medical cards. The passage of SB682 would not only protect Californians from the very real and substantial dangers posed by radio frequency IDs, it would also set an important example for other states and influence the national debate on this vital security and civil liberties issue.

No person should ever be forced to carry an electronic ID tag. It violates fundamental rights to privacy, it is demeaning and it threatens our physical and economic security. Californians need to join the parents in Sutter, stand up for their privacy and security, and fight back against radio frequency IDs. Now is the time to make the Identity Information Protection Act the law in California.