RFID, Surveillance and Privacy Radio-Frequency Identification (RFID), Surveillance and Privacy Ross Stapleton-Gray, Ph.D., CISSP Stapleton-Gray & Associates, Inc. March 23, 2004

RFID, Surveillance and Privacy What is RFID? Active, passive, or hybrid RF devices Operate in the RF spectrum But all: Operating on various frequencies, hence with varying ranges and characteristics Operate over a distance Do not require line of sight Can be interrogated for data

RFID, Surveillance and Privacy A Major RFID Milestone: the EPC standards conceived (and now demanded) by major players: retailers, manufacturers, and the Defense Department based on a federated information architecture, whose root will be run by... VeriSign incorporate legacy product code standards focused primarily on passive RFID tags owned by EPCglobal (the UCC and EAN International)

RFID, Surveillance and Privacy Where We Are... The EPC debuts, September 2003 Key players demand RFID tagging at aggregate (case, pallet) levels: Wal*Mart Defense Department Target, and others Trials of item-level EPC tagging

RFID, Surveillance and Privacy Where We’re Headed... Some degree of EPC pervasiveness... An accumulation of non-retail RFID applications FDA mandates RFID tagging of pharmaceuticals by 2007 Even without RFID, the EPC is a powerful thing Declining costs of tags... 5¢ each? 1¢ each?

RFID, Surveillance and Privacy RFID as a Privacy Problem Invisible point surveillance (over a limited range) “name binding” occurs, and persists Persistent, if pseudonymous, identity

RFID, Surveillance and Privacy RFID, Surveillance and Privacy as a Research Field What forms of surveillance are possible? What do the public, and policymakers, need to know? Where and when might we see “tipping points?” What will technology enable, on both sides of the balance? An opportunity to study non-cooperative RFID

RFID, Surveillance and Privacy The “Sorting Door” as a Research Testbed Why a Door? a sufficiently stretchy metaphor a handy metaphor a good approximation of real-world scenarios One could envision lots of Doors. So...

RFID, Surveillance and Privacy The “Sorting Door” as a Research Testbed (cont.) A Sorting Door System local tools and knowledge global tools and knowledge, and economies of scale multiple Doors shared back-end resources

RFID, Surveillance and Privacy A “Sorting Door” Architecture

RFID, Surveillance and Privacy Questions? Stapleton-Gray & Associates, Inc.