Informed Consent: Ethical Considerations of RFID

Radio Frequency Identification (RFID) has incubated in relative obscurity for over 60 years, quietly changing our lives with scant attention outside the technology community. First used to identify Allied aircraft in World War II, RFID is now well integrated in building security, transportation, fast food, health care and livestock management.

Proponents hail RFID as the next natural step in our technological evolution. Opponents forewarn of unprecedented privacy invasion and social control. Which is it? That’s a bit like asking if Christopher Columbus was an intrepid visionary or a ruthless imperialist. It depends on your perspective. One thing is clear: As RFID extends its roots into common culture we each bear responsibility for tending its growth.

For Your Eyes Only

RFID functions as a network of microchip transponders and readers that enables the mainstream exchange of more — and more specific — data than ever before. Every RFID transponder, or “smart tag”, is encrypted with a unique electronic product code (EPC) that distinguishes the tagged item from any other in the world. “Smart tags” are provocatively designed with both read and write capabilities, which means that each time a reader retrieves an EPC from a tag, that retrieval becomes part of the EPC’s dynamic history. This constant imprinting provides real-time tracking of a tagged item at any point in its lifespan.

Recognizing the potential commercial benefits of the technology, scientists at the Massachusetts Institute of Technology (MIT) began developing retail applications of RFID in 1999. Install a reader in a display shelf and it becomes a “smart shelf”. Network that with other readers throughout the store and you’ve got an impeccable record of customers interacting with products — from the shelf to the shopper; from the shopper to the cart; from the cart to the cashier, etc.

Proctor & Gamble, The Gillette Company and Wal-Mart were among the first to provide financial and empirical support to the project. Less than five years later RFID has eclipsed UPC bar coding as the next generation standard of inventory control and supply chain management. RFID offers unparalleled inventory control at reduced labor costs; naturally the retail industry is excited.

Katherine Albrecht founded the consumer advocacy group CASPIAN (Consumers Against Supermarket Privacy Invasion and Numbering) to educate consumers about the potential dangers of automatic-identification technology. She warns that “smart tags” — dubbed “spy chips” — increase retailer profits at the expense of consumer privacy.

RFID provides a continuous feed of our activities as we peek, poke, squeeze and shake tagged items throughout the store. Advocacy groups consider this electronic play-by-play a treasure for corporate marketing and a tragedy for consumer privacy.

Albrecht’s apprehension is understandable. However, shopping in any public venue is not private. It’s public. The decision to be in a public space includes a tacit acknowledgement that one can be seen by others. That’s the difference between the public world and the private world.

What if those worlds collide? CASPIAN and other consumer groups are concerned about retailers using RFID to connect public activities with private information. Because each EPC leaves a singular electronic footprint, linking each item of each transaction of each customer with personally identifying information, anyone with access to the system can simply follow the footprints to a dossier of the customer and their purchases.

Again, we must be clear. RFID does enable retailers to surveil consumers and link them with their purchasing histories. As disconcerting as that may be, it is neither new nor unique to RFID. Anyone who uses credit cards agrees to forfeit some degree of privacy for the privilege of buying now and paying later. Credit card companies collect and retain your name, address, telephone and Social Security numbers. This personal information is used to track the date, time, location, items and price of every purchase made with the card?

Don’t use credit cards? Unless you pay with cash, someone is monitoring you too. The now familiar UPC bar codes on nearly all consumer goods neatly catalogue the intimate details of all check and bank card purchases. Cash remains the last outpost for the would-be anonymous consumer. Of course, all things are subject to change. RFID inks may be coming soon to a currency near you, but that’s a discussion for another day.

If RFID is no more intrusive than a curious fellow shopper or a ceiling mounted security camera, what is the downside for consumer groups? If RFID is no more revealing than a bank or credit card transaction, what is the upside for the corporate suits? There must be more.

Indeed, there is. Bear in mind that “smart tags” are uniquely designed to pinpoint tagged items anytime, anywhere from point of origin through point of sale. And, theoretically, beyond.

Ah, the great beyond. RFID’s potential is limited only by our imaginations. And not just our imaginations; the imagination of anyone who has a reader and a transponder. Wal-Mart. Your employer. The government. Anyone.

Everything Costs Something

Members of German privacy group FOEBUD see shadowy strangers lurking in the imagination playground. Their February 2004 demonstration in front of Metro’s RFID-rigged Future Store was intended to raise public awareness of the implications of RFID.

"Because the spy chips are not destroyed at the shop exit, they continue to be readable to any interested party, such as other supermarkets, authorities, or anyone in possession of a reading device (available to the general public)... The antennas used for reading are still visible in the Future Store, but soon they will be hidden in walls, doorways, railings, at petrol pumps anywhere. And we won't know anymore who is when or why spying on us, watching us, following each of our steps." 1

Freedom is Slavery

Dan Mullen would call that an overreaction. Mullen is the President of auto-identification consortium AIM Global. He cautions that unrealistic fear can obscure the very real benefits of RFID: “Many of the concerns expressed by some of the advocacy groups are frankly, inflated. The technology can be set up so that identifying information is associated with the item, not with the people interacting with the item. Tracking individuals? That’s not how the technology is used."

When asked, “Could it be used that way?” Mullen was doubtful. “I don’t think so. Not at this point. And I don’t see a benefit to anyone.” We ’d like to think he’s right, but someone obviously sees a benefit. RFID has been used exactly that way.

Wal-Mart is one of the retailers who have tested photographic “smart shelves” in some of their U.S. stores. The technology did what it was supposed to do — photograph customers who removed tagged items from a display. Unfortunately, Wal-Mart didn’t do what they were supposed to do. Goliath didn’t tell David about the camera.

The most disturbing aspect of the project was Wal-Mart’s emphatic denial that they had secretly photographed their customers. They weren’t confused. They didn’t make a mistake. They chose to lie. It was only after Albrecht exposed the evidence that Wal-Mart finally admitted conducting the pilot tests in an effort to combat shoplifting and employee theft. After all, the argument goes, this type of inventory shrinkage costs U.S. retailers as much as $32 billion each year. 2 Don’t feel too sorry for our friends in blue. The bill for this hefty loss is passed on to you and me).

The public was unmoved by Wal-Mart’s defense, and the project has been aborted. At least for now. Wal-Mart’s smiley face logo belies the arrogance wrought by its success, and we will likely see the photographic “smart shelf” again. Or it will see us, anyway.

Wal-Mart is somewhat like a spoiled child, a casualty of indulgence, who is accustomed to doing quite what he wants when he wants to and rarely anything that he doesn’t. It hardly seems fair to expect the child to accept “no” when he only vaguely recognizes the word, and even less so, it’s finality

Bear in mind that RFID does not create opportunities for consumer profiling. We do. Every time we enter a store we expose ourselves to scrutiny. Every time we purchase goods or utilize a service we are assimilated, Borg-like, into the collective revenue stream. Everything costs something.

Worldwide spending on RFID is expected to top $3 billion by 2008, almost triple the market of a year ago. 3 Wal-Mart’s decree that its top 100 suppliers must be RFID compliant by 2005 told the rest of the world to either get on the train or get off the track. The U.S. Department of Defense has since issued a similar mandate, and falling technology prices coupled with the establishment of uniform RFID communication standards are making it easier for other industries to do the same.

The War on Drugs

It’s no longer enough to just say no to the schoolyard crack jockeys. We have new enemies in the war on drugs. Our increasing reliance on chemical relief — born of a pervasive spiritual poverty as much as our aging demographic— has made us attractive to drug counterfeiters.

Counterfeit drugs are sub-potent or inert imposter pills that are channeled into the prescription drug pipeline and sold as legitimate medication. The World Health Organization estimates that in less-developed countries as many as half of all prescription drugs dispensed are counterfeit. 4 The economic cost to defrauded and dying consumers is staggering. And it is almost meaningless compared to the emotional cost.

In February 2004 the U.S. Food and Drug Administration’s Counterfeit Drug Task Force released its report “Combating Counterfeit Drugs”. FDA Commissioner Mark McClellan directed the group’s six month review of America’s prescription drug channels.

Its conclusion? The supply of prescription drugs in the United States is overwhelmingly safe. The FDA’s complex system of regulatory oversight insures that with rare exception, the pills we pop have been manufactured to the highest standards of purity and potency, distributed safely and dispensed as the doctor ordered.

However, later in the same report McClellan warns that drug counterfeiters are better organized and more technologically sophisticated than ever before. According to McClellan, the FDA’s current system can not meet the evolving challenges of the new century, and he recommends full-scale implementation of RFID technology by 2006. 5

Without question, RFID is a more formidable guardian than our present paper-based drug audit system. The savviest saboteur will find RFID tags extremely difficult to counterfeit and almost impossible to do so at a profit. EPCs afford flawless accountability, which is a distinct impediment to illegal diversions and substitutions. And no doubt every overworked, carpal tunnel-strained pharmacist would welcome RFID’s promise of tighter inventory and simplified service.

Does this justify the enormous expense of a complete system overhaul? Do the benefits outweigh the privacy concerns? Are you comfortable enlisting RFID in the battle against drug terrorism?

Before you decide, consider this: The FDA may incorporate “at least two types of anti-counterfeiting technologies into the packaging and labeling of all drugs, at the point of manufacture, with at least one of those technologies being covert (i.e., not made public, and requiring special equipment or knowledge for detection)...” 6

“Not made public, and requiring special equipment or knowledge for detection”. Hmm... so, RFID tags can be hidden in our prescriptions without our knowledge or consent... and we will be unable to detect or remove them.

Consider, too, that companies in the U.S., Canada, Sweden and Denmark have developed electronic blister packs that monitor pill removal and automatically notify the physician’s computer when a patient has dispensed (or neglected to dispense) the medication as scheduled. 7

Here's a better idea. The FDA should explain how concealing information from me about my prescriptions makes the world a safer place. And then they can explain how spying on your medicine cabinet — and tattling to your doctor — thwarts drug counterfeiting.

The FDA’s prime directive is to protect and advance the public health. They have done this remarkably well for over 140 years at an annual cost to taxpayers of only about $3 per person. 8 When evaluating any policy change the FDA must always preserve that which is most fundamental to its success — indeed, its very existence — the public trust. RFID may prove vital for the continued integrity of our prescription drug pipeline, but never more vital than the continued integrity of the FDA.

RFID is in its spring. These tiny chips, sown by science and nourished richly by corporate support, will burgeon beyond imagination, penetrating our lives like the roots of a willow. This is the time for discourse. This is the time to shore our boundaries. If we cede the opportunity to deliberate, we accept surveillance as a norm. Our indifference will do nothing to stem its growth.

Endnotes1. www.foebud.com2. www.retailindustry.about.com3. Jennifer Maselli, “ABI:RFID Market Poised for Growth,” RFID Journal July 18,2003.4. www.who.int/en/5. www.fda.gov/oc/initiative/counterfeit/report02_04.html6. www.fda.gov/oc/initiative/counterfeit/report02_04.html7. www.idtechex.com8. www.fda.gov

Copyright ©2005 by Dennis and Sally Bacchetta. All rights reserved.