1. ESO response to EU RFID Mandate M/436
Presentation to CEN TC225
Paul CHARTIER Representing ETSI
© ETSI All rights reserved

2. Contents ETSI and the STF machine Summary of goals of Mandate 436
Phase 1
Phase 2
Role of ERM
RFID ecosystem
Next steps
In ERM and ETSI TBs
In ESO response to M436

3. About ETSI
ETSI produces globally-applicable standards for Information and Communications Technologies (ICT), including fixed, mobile, radio, converged, broadcast and internet technologies and is officially recognized by the European Commission as a European Standards Organization. ETSI is a not-for-profit organization whose more than 700 ETSI member organizations benefit from direct participation and are drawn from 62 countries worldwide. For more information, please visit:

4. About CEN
CEN is the European Committee on Standardization (
The CEN members are the 31 National Standardization Bodies of the EU, EFTA and Croatia
CEN’s scope
~ same scope as ISO, the International Standards Organization
Complementary to scope of ETSI and CENELEC, with of course some areas of mutual interest (an example is RFID)
Over experts of all fields are active in CEN work (including the work in the national mirror groups)
Over EN’s exist today, with about new publications every year
Vienna Agreement with ISO – parallel adoption of ENs and International Standards

5. About CENELEC
CENELEC is the European Committee for electrotechnical standardization (
The CENELEC members are the 31 National Committees of the EU, EFTA and Croatia (same geographic spread as CEN)
58 Technical Committees and 14 Sub-Committees
6 500 technical experts
> CENELEC standards
Dresden Agreement with IEC – parallel adoption of ENs and International Standards
CEN and CENELEC are supported since 1 January 2010 by a common CEN- CENELEC Management Centre

8. ETSI facts & figures
Standards production (estimate for 2010 and 2011)

9. About ETSI Specialist Task Forces (STF)
STFs are teams of highly-skilled experts working together over a pre-defined period to draft an ETSI standard under the technical guidance of an ETSI Technical Body and with the support of the ETSI Secretariat.  The task of the STFs is to accelerate the standardization process in areas of strategic importance and in response to urgent market needs. For more information, please visit:
The work carried out here is co-financed by the EC/EFTA in response to the EC’s ICT Standardisation Work Programme.

10. ETSI – Specialist Task Forces

11. EU Mandate 436
The Mandate addresses data protection, privacy and information security aspects of RFID. It complements the existing legal framework but does not substitute it.
The objective of the first phase is to prepare a complete framework for the development of future RFID standards.
Assumes that there is no existing framework, or if there is that it is deficient

12. The role of ESOs and STFs in M/436
Mandate 436 has been accepted by the 3 ESOs
ETSI
CEN
CENELEC
A single STF has been established, hosted by ETSI and under ETSI’s rules
The STF is responsible for gathering together the coordinated ESO response to phase 1 that provides a plan for phase 2

13. Structure of ESO/STF response
1 technical report
ETSI TISPAN Work item DTR-07044
Analysis and justification for recommendations
Recommendations for phase 2 – new standards and gap closure
Open consultation with stakeholders
Other impacted standards groups
User and consumer groups
Privacy interest groups
Coordination by group formed from the 3 ESOs

14. Technical structure of response
RFID system architecture
Taxonomy of terms
Ontology of RFID
With respect to security
With respect to privacy protection
DPP and Security objectives
Consumer aspects including interaction
Activation
Deactivation
Environmental aspects of RFID tags and components
RFID hardware end of life considerations
Data end of life considerations
Privacy Impact Assessment outline
Role of PIAs
Generic versus industry specific PIAs
Recommendations for RFID industry specific PIAs
RFID logos and signage
For consumer awareness
For device marking
Derived requirements from analysis
RFID Logos and signage recommendations
Standards roadmap
Available standards
Gap analysis and recommendations
Analysis
Requirements

15. The RFID ecosystem simplified

16. Role of TC225? Participation in review of the ETSI Work Item
Work item is hosted by TISPAN on behalf of the ESO partners
TISPAN will circulate the document latest draft by means of a link to the “Public” area of ETSI’s web site
Participation in open consultation meeting
Provisionally planned for June 2010
Likely to be more than 1 public consultation meeting before agreement
Agreement to share concerns and comments with the STF charged to develop the joint ESO response to the mandate

17. Some technical points Taxonomy and Ontology
Developed from ongoing work in ITU-T on identity management
Identifying the role played by RFID in the link between people and their behaviour (where behaviour may be represented by the tagged items and the environment they interact with)
Privacy and Data Protection
The role of Privacy Impact Assessment in management of privacy
Logos and signage
As a tool to increase consumer confidence

18. Early considerations for Phase 2 work
Formalisation of taxonomy and ontology
As an ESO standard?
Verification of risks from RFID
Read range verification through controlled penetration testing
As an ESO standard covering method and as a report for results
Intended to answer the hearsay and hype (the science fiction risks)
Formal threat vulnerability and risk analysis
As an ESO report covering the “ecosystem”
Formal recommendation of logos and signs
From requirements stated in phase 1
As an ESO standard involving the Human Factors and User experts groups in the ESOs

19. Next steps?
STF plan to make the TR available for public consultation end of May
Internal discussion with ETSI TBs and ESO WGs throughout development
TISPAN
ERM
M2M
SCP
Human Factors and User groups
CEN TC225
ISO
Public expert groups
DISCUSS and COMMENT

20. Contact: scott at cadzow dot com (Scott CADZOW)
Thanks for LISTENING