1. ICTSB – an outline of recent RFID discussions
Kirit Lathia
Chairman of the ICT Standards Board
I am 4th Chairman of ICTSB. Been chairman for just over 4 years.
My own work is as Head of Standards for BT. In this role I deal with policy towards all sorts of standards from consumer electronics to mobile to access network standards – particularly concentrating on those standards required for the operators to be able to implement the NGN – Next Generation Network.
Also on ETSI Board.

2. What is the ICT Standards Board?
Created in Reaction to convergence of IT, telecoms, broadcasting and entertainment industries
Co-ordination in ICT domain
Involving ESOs and consortia
Provide European focal point for discussion of current issues
ICT Standards Board was created in 1995 following the Genval conference. 10 years old next year.
Interesting that one of the HLRG documents states that ‘Convergence’ will complete in 2010 which means that it’s 2/3 of the way through a 15 year process!
ICTSB is a unique organization combining formal standards bodies with fora and consortia. 2

3. ICTSB Members ANEC CEN CENELEC DVB EBU Ecma International
EFTA Secretariat
EICTA
ETSI
European Commission
ISOC (IETF)
Liberty Alliance
NORMAPME
OASIS
OMA
RosettaNet
The Open Group
TMF
W3C
Red are 3 European Standards Organisations (ESOs)
Blue are Observers – EC/EFTA and User Organisations
Purple are fora and consortia
Green are fora in process of negotiation to join
Mauve are in process of leaving
Constant turnover of members – 4 have left since start: EWOS, EBES, EACEM, DAVIC
Gradually expanded membership – 8 have joined
Still has European focus
Critical mass of standards bodies and fora in ICT space 4

4. What does ICTSB do?
analyses requirements received from any competent source based on concrete market needs
translates these requirements into coherent standards work programmes
allocates work items to members and reviews progress against objectives
ICTSB (and its WGs) do not produce standards
In practise, largely information exchange (+ with Commission)

5. ICTSB and RFID Open meeting held Brussels, 24 October 30+ participants
Objective - more common understanding on “who is doing what” on RFID standardization issues
Initial addresses by Commission (Heads of Unit responsible in DG INFSO and DG ENTR)
Presentations by main standards bodies, ANEC (consumer perspective)
First working group to be set up was EESSI to develop the standards required to implement the EU Electronic Signature Directive CEN and ETSI provided linked working groups to develop standards Work largely complete now
DATSCG was 2nd group. Set up in response to ANEC Consumer Requirement document – 200 recommendations to ICTSB which we didn’t know what to do with so we set up DATSCG to respond
Further working groups on ITS, Smart Houses, Network & Information Security
All ICTSB members can participate in all working groups 7

6. High-level conclusions
Standardization bodies should understand the business process before writing standards;
Consumers should be included in the business process if needed;
Distinction between tags, air interfaces and back offices should be made;
The need for standards was confirmed but the type of standards needed should be further discussed;
Inter-organization communication should be enhanced;
“Who does what” needs to be agreed at an early stage;
Bearing privacy in mind, the collected amount of data should be kept to the minimum. NB Article 3.3 of the R&TTE Directive (99/05) should also be used to address fraud and privacy issues
Ad-hoc group not working group.
CEN provide the Secretariat.
Extra value of having non-ESO (non-ETSI) members to give different perspective
Results not just (or even mainly) relevant to ETSI

7. Future developments
(International) Standards needed in future for open RFID systems
Standards gaps and “internet of things”
Future standards/research collaboration should be improved (project cluster)
GRIFS – Global RFID Interoperability Forum (GS1, ETSI, CEN – watch this space…)
Examples of questions include:
What are the most significant threats and opportunities for ICT standardization today and in the future?
How to facilitate the standardization process without the creation of further entities, and ensuring the timely production of the standards that are needed?
How can we re-intermediate the final end-user, including specific trading communities, to enable full account to be taken of his/her standards requirements?
How can these end-user requirements best be matched with the global generic activities?
How should the quality of the end product be measured?
What role can Governments play, as an industrial policy facilitator?
Should there be a global “Workshop” system – i.e. regional entities similar to CEN/ISSS in Europe, matched with similar facilities in other regions?
Does such a system exist already in the telecommunications field (i.e. the regional standards bodies collaborating through GSC/RAST, etc.)?
How do we persuade the major IT vendor companies to join in many more of these regional activities, even to initiate them?
How do we finance the required consensus platforms?
How do we provide the end-user community with clear, concise and coherent information on the activities of vendor consortia?
How do we improve collaboration between vendor consortia, and between European platforms and these?
Do we need a global association, or should there be several (c/f ISO/IEC/ITU/UN-ECE eBusiness MoU)?
What actually are the key issues to address, e.g. inter-operability, trust and confidence/security, cultural/localisation issues, etc., and what is already being done about them?

8. Business model issues
RFID should be taken in an overall context with other data capture technologies, the issues are similar (RFID is one of many such…)
The business model concerning registration etc may evolve and become more competitive. This will reduce suspicion and encourage uptake
Business model/process needs to include user/consumer requirements
There needs to be a specific assessment of the security and privacy risks prior to deployment of RFID. Classic standards approach to security looks at business model first. In RFID privacy scare issue though we are forgetting the business model! Go back to first principles: what are we trying to protect, for whom etc?
Security/privacy are important, but we also need to ensure prevention of fraud
Examples of questions include:
What are the most significant threats and opportunities for ICT standardization today and in the future?
How to facilitate the standardization process without the creation of further entities, and ensuring the timely production of the standards that are needed?
How can we re-intermediate the final end-user, including specific trading communities, to enable full account to be taken of his/her standards requirements?
How can these end-user requirements best be matched with the global generic activities?
How should the quality of the end product be measured?
What role can Governments play, as an industrial policy facilitator?
Should there be a global “Workshop” system – i.e. regional entities similar to CEN/ISSS in Europe, matched with similar facilities in other regions?
Does such a system exist already in the telecommunications field (i.e. the regional standards bodies collaborating through GSC/RAST, etc.)?
How do we persuade the major IT vendor companies to join in many more of these regional activities, even to initiate them?
How do we finance the required consensus platforms?
How do we provide the end-user community with clear, concise and coherent information on the activities of vendor consortia?
How do we improve collaboration between vendor consortia, and between European platforms and these?
Do we need a global association, or should there be several (c/f ISO/IEC/ITU/UN-ECE eBusiness MoU)?
What actually are the key issues to address, e.g. inter-operability, trust and confidence/security, cultural/localisation issues, etc., and what is already being done about them?

9. RFID and privacy
Privacy standards issues are mostly horizontal, rather than specific to RFID
RFID is a data carrier, not the data itself
Legislation on privacy issues is needed first before standardization
There is some talk about a possible standards mandate
Collection of personal data for security purposes is one thing, commercial misuse another
Data can be mined in some cases (eg US) when EU forbids – this is a societal issue
Companies already have major consumer data, RFID only adds some extra information
IT incontrovertibly allows more manipulation of data, whatever is the societal approach to data privacy
User consent is a key principle (opt-in)

10. RFID and security (1)
Who is responsible for RFID security standardization?
NB German national RFID security publication activity
NIST RFID Guidelines contain general security requirements already (INFSO) – NB US-EU dialogue
Security and privacy are usually bracketed together (but perhaps wrongly) but also are more general than RFID
A one-size-fits-all strategy does not work across the range of possible applications
1. This could be achieved through increased fora hosting as proposed at the ETSI GA ; through a more elaborated co-operation with fora and consortia at the ICTSB level
2. Consortia should see ESOs as natural “next step” for their specifications
3. ESOs should establish collaboration with fora / consortia at the technical level
4. Where consortia lack a regional presence, encourage them to use the ESOs for this purpose

11. RFID and security (2) Basic security requirements:
Prevent unauthorised access
Differentiated access
Unique communication per transaction
RFIDs must not be cloneable
1. This could be achieved through increased fora hosting as proposed at the ETSI GA ; through a more elaborated co-operation with fora and consortia at the ICTSB level
2. Consortia should see ESOs as natural “next step” for their specifications
3. ESOs should establish collaboration with fora / consortia at the technical level
4. Where consortia lack a regional presence, encourage them to use the ESOs for this purpose

12. RFID and security (3) Three aspects (or “subsets”) to consider:
(1) RFID subsystem consisting of transponder (tag) and interrogator (reader);
(2) Enterprise subsystem comprising the local environment of the readers, the middleware that pre-processes the read tag data and the backend systems that process the information in order to conduct the business process;
(3) Inter-enterprise subsystem consisting of the networked infrastructure that provides additional services for cross-organisational communication.
1. This could be achieved through increased fora hosting as proposed at the ETSI GA ; through a more elaborated co-operation with fora and consortia at the ICTSB level
2. Consortia should see ESOs as natural “next step” for their specifications
3. ESOs should establish collaboration with fora / consortia at the technical level
4. Where consortia lack a regional presence, encourage them to use the ESOs for this purpose

13. RFID and registration ISO/IEC JTC1/SC31 dealing with “item management”
Registration authorities – eg NEN – should be used
NB also for mobile telecommunications a unique identifier system exists
PWC Dutch Presidency report “10 Breakthroughs for ICT in Europe” Standardisation is No 2 “Standardise ICT environments in Europe
Too many incompatibilities between what is accepted in individual European countries
ETSI must be a global ICT standards developer or it is lost

14. Definitional issues
Definitions – eg active/passive/”semi-”, battery powered, etc. needed
Vocabulary in JTC1 but also (for sensors) in IEEE
TC225/WG has developed some additional definitions to be submitted to Commission Expert Group and published on CEN web site (link to ICTSB) and input to SC31
Open does not necessarily mean free
“FRAND” and “RAND” are often used inter-changeably
Which bodies conform to this?

15. Other issues
Question of how much of the relevant data is in fact on databases in back offices, ie to which the RFID chip is an access
Inter-organizational requirements are not being addressed fully (c/f general eBusiness transaction problems)
Encryption – should the data be encrypted or should the tag be? Depends on use to which data is to be put, how it is to be stored/used etc.
These require involvement of the ESOs and consortia (ICTSB as independent arbiter?)
Viz delay to recognition of EESSI deliverables
CEN and CENELEC are unable under their current sales and distribution policies to accept this.
5. COPRAS is a good example

16. Extra resources New CEN list of definitions (comments welcome)
ICTSB overview of RFID standards activities (living document)
ICTSB will continue to monitor this issue, may hold further meetings (to avoid too many, maybe with GRIFS events…)
These require involvement of the ESOs and consortia (ICTSB as independent arbiter?)
Viz delay to recognition of EESSI deliverables
CEN and CENELEC are unable under their current sales and distribution policies to accept this.
5. COPRAS is a good example

17. John Ketchell on behalf of Kirit Lathia
Thanks
John Ketchell on behalf of Kirit Lathia
These require involvement of the ESOs and consortia (ICTSB as independent arbiter?)
Viz delay to recognition of EESSI deliverables
CEN and CENELEC are unable under their current sales and distribution policies to accept this.
5. COPRAS is a good example