Chips revolution sparking ‘Big Brother’ snooping fears

By Peter Chapman

Date: 13/05/04

SMART new radio technology that could make it easier for companies to keep track of their lost stock - and allow citizens to get more information about the goods and services they want to buy - could be derailed by a knee-jerk reaction from data privacy watchdogs.

That is the warning from a leading scientist developing the next generation of radio-frequency identification tag technology (RFID), which allows tiny chips to be implanted in everything from Prada handbags and Gillette razors to pallets of goods on container ships.

Burt Kaliski, chief scientist of American encryption giant RSA Security, warns that the technology has already been targeted by privacy advocates who have homed-in on its potential as a tool of 'Big Brother' states and corporations who want to spy on their citizens, consumers or commercial rivals.

The basic technology sends out bursts of signals to special readers, allowing users to obtain information about the item in which it is embedded, from its whereabouts to the presence of chemical or biological weapons in an airport.

Kaliski, who is based in Bedford, Massachusetts, admits the systems, dropped by clothing company Benetton after a public backlash, could easily be abused without the right security back-up.

Spies would be able to find out personal information - using anything from recently borrowed library books to the type of medicines someone has purchased - simply by scanning their bags.

Supermarkets could put their own RFID readers in place in a rival's store to check which products it is selling.

Terrorists could even create chaos on roads by throwing out false in-vehicle diagnosis readings - causing cars to grind to a halt.

But Kaliski, in Brussels to explain the issues to European Commission security experts, insists technology is already being developed to make sure RFID is not abused. The aim is to ensure that only people entitled to see information get access to it.

Imposing strict rules on RFID that ignore these developments, could rob the systems of their cost-effectiveness and strangle their development, he argues.

"The risk is that you would discourage many parts of this technology that are beneficial. That is our concern. The message to the authorities is that they should think about the goals - privacy and security - rather than the means of achieving that," he told European Voice.

For example, authorities might opt to disallow RFID at the consumer level or insist that signals be deactivated when a customer leaves a shop.

Banning RFID for consumers would rob them of extras such as better after-sales service or even speedier returns of unwanted goods - where shops could check if a product was, indeed bought at one of their outlets.

Designer label Prada's plans to offer customers a selection of other goods that would match their new purchase would also be scuppered.

The US warning comes as EU authorities and national data-protection agencies in charge of applying the Union's rules come under increasing pressure from citizens' rights groups, anxious to halt the trend of greater intrusions into personal privacy that followed the 11 September 2001 terrorist attacks in the US.

Marco Cappato, an outspoken MEP in the campaign against the EU's recent deal with the US on air-passenger data, has turned his attention to the dangers of RFID-based technology.

The Italian has written to Erkki Liikanen, the commissioner for enterprise and the information society, about potential abuses of privacy at the World Summit on the Information Society last December, hosted by the Swiss-based International Telecommunications Union (ITU).

Badges fitted with RFID were used to control access to restricted areas, at the event.

Liikanen told Cappato he was looking into the issue to see whether the ITU had breached the EU's 1995 data privacy law, which sets Union-wide rules on transfer of data between member states and restricts the use of EU citizens' data in third countries.

Bert Kaliski, the chief scientist of American company RSA Security, visited the European Commission in May 2004 to discuss radio-frequency identification tag technology (RFID) which can be used by companies to keep track of their lost stock. Critics of the technology fear it can be abused with spies being able to find out personal information about shoppers.