OPINION
RFID Rights and Wrongs

Every year, the RSA security conference convenes in San Francisco to discuss the latest technology and issues involved in information security. The event still feels a bit like pre-tech bubble days, with free gizmos galore, but the topics, such as identity management, looked to the future. One of the more contentious issues involved the use of RFID, or radio frequency identification tags.

RFID is like a bar code on a cereal box but different in that it has a microchip that listens for a radio query and responds by transmitting a unique code. At one of the panel discussions, security architect Daniel Houser discussed some of the privacy issues that could crop up in the case of poorly rolled out RFID systems. Imagine, for instance, if everyone had RFID chips implanted in their arms or even just attached to their cell phones. "People could know where you are at all times," he said.

More Transparent Future

At the moment, RFID readers have a maximum range of several meters, so it would be difficult for individuals to be globally tracked using the technology. But his point is important. We are entering a world where technology has the potential to expose more of our activities.

Of course, when one considers other technologies already on the market, one realizes that RFID is not the only potential way to log individual movements. People can already be tracked wherever they go by their cell phones, but that hasn't caused panic because, for the most part, only cell phone companies have access to that data.

A similar situation exists with emergency systems that can locate a vehicle remotely and send help or unlock car doors. The real issue is not what the technology can do, but how human agents use it.

For instance, at Brittan Elementary School in Sutter, California, officials forced students to wear photo and RFID tags around their necks at all times. Parents became outraged not only because they felt the school was treating their children like cattle, but also because the school was jeopardizing child safety by putting the names and photographs of the kids directly on the ID tags, where anyone with or without an RFID reader could see them.

Implementation Key

That was poor implementation and security management by the school, but it doesn't mean that RFID chips can't be used in more positive ways. For example, Joseph Krull, an executive at Virtual Corporation who was in attendance at the RSA conference, showed off the small dot on his arm where he recently implanted an RFID chip.

All the chip has on it is a number, so if anyone were to walk by and scan his arm, the only thing exposed would be a long string of digits. The number is connected to his name at a secure database at Verichip, the company that makes the implantable RFID devices, and only authorized personnel can access it.

Information that Mr. Krull chose to attach to his RFID number is his name and address, blood type, allergies, doctor's name and contact info, and a next of kin in case of emergency. Essentially, Mr. Krull's chip is the twentieth century version of a medical bracelet. If he ever winds up at a hospital unconscious, he's hoping the device could help save his life. Using RFID technology in this way could be extremely valuable to society.

Imagine the lives that could be saved if chips give doctors information that patients can't convey because of medical conditions. But just because there are good uses for RFID does not mean that society should be complacent.

Tune In to Society

It was a good sign that parents became outraged at the school's poor use and implementation of RFID technology, and it makes sense that no one would object to Mr. Krull seeking out a more reliable medical bracelet. What these two examples demonstrate is the need for companies that make these technologies to be very careful about the markets they choose and how they go about implementation.

If they don't make sure their products fit with societal expectations of proper information management, they will quickly lose their market and even risk being regulated by government bodies.

InCom Corporation, the company that was in charge of the RFID program at Brittan Elementary School, withdrew from the project this week. This is a good lesson for others involved in the information management space. As technology advances, the importance of information security increases, making conferences like RSA even more significant in the future.