It's a Tag, Tag, Tag, Tag World

Radio frequency identification makes big promises. But is it secure?

Imagine a world in which you carry no cash. You fill up your grocery cart and exit the store without emptying it at the checkout counter. How? Every product in your cart carries a tag the size of a silicon chip, rigged with a tiny antenna, and as you push your cart past a digital "reader," every tag radios the price of its item. The reader feeds the grand total to a computer, which in turn sends a message to your bank, asking it to deduct the sum from your checking or credit card account.

Convenient? Quite. But it's not just for your benefit. The grocery store wants to know how popular that brick of Vermont white cheddar you bought really is. Do more people favor the jalapeño Monterey Jack? The radio tags will count every brick so the store manager can decide whether to buy more Jack. That means less money is wasted stocking less popular cheese. It also tells the cheese manufacturer how many bricks to make. In this world of inventory control, in which supplier, retailer and consumer are linked, every penny counts, and the tiny chips make it work smoothly.

This is the promise of radio frequency identification, the next stage in the evolution of digital transmission once marked by the bar code. It's changing the way the government does business. Retailers, most notably Wal-Mart, already are slapping RFID tags on the goods they sell. But huge government enterprises are using tags, too. The Defense Department now requires that all products it purchases be outfitted with RFID to improve logistics and supply chain management. NASA uses RFID tags to track the movement of hazardous chemicals. And the Food and Drug Administration issued guidelines last year for monitoring prescription medicines with RFID to combat counterfeiting. Total spending by federal agencies on RFID technology is expected to grow, from about $51 million in fiscal 2004 to $112 million in fiscal 2009, according to an analysis by the research firm Input of Reston, Va.

So far, government's tagging has been limited to tracking inanimate objects. But by the end of this year, the State Department hopes to issue passports fitted with RFID tags to U.S. citizens. The goal is to move people through immigration lines at airports and border crossings much faster.

But the notion of tracking people-or even people's documents-has upset some civil liberties groups, and it's here that RFID faces its greatest hurdle. Are the tags and the passport secure enough to keep the holder's photo and personal information from being scooped up in midair by a third party sporting a reader of his own? Skimming, as it's known, could be practiced by identity thieves, terrorists, digital hackers, or law enforcement officers, privacy advocates fear.

State Department officials stress that they'll deal with skimming. Under guidelines written by the International Civil Aviation Organization, RFID tags can transmit only within zero to 10 centimeters of a reader, says Kelly Shannon, a spokeswoman for State's Bureau of Consular Affairs. Theoretically, that might make it hard to steal passport data. "Skimming is going to be addressed" before State issues RFID-tagged passports, Shannon says. "It's not going to be a problem." That optimism may be premature. Tests show that skimmers can net data from 30 feet away, according to ICAO spokesman Denis Chagnon.

U.S. officials recognize that just a few acts of skimming would likely undermine the public's faith in the new passports. "We have an elaborate process of testing under way" to secure RFID transmissions, Frank Moss, State's deputy assistant secretary for passport services, said in December. Contractors are testing passport covers that will help shield RFID transmissions.

Privacy concerns are essential variables that agencies must consider when deciding whether to use RFID. Rajat Paharia, once a senior designer with Palo Alto design company Ideo, and operator of the technology blog rootburn, has created a three-pronged model showing the trade-offs between privacy, choice, and the benefits of RFID.

Paharia takes a common RFID implementation: the "fast lane" automated tags that drivers use to avoid stopping at tolls. An RFID tag in the car is read at the booth, and deducts the toll from the driver's account. That means the car can be tracked-a loss of privacy-but the consumer can choose whether to use the tag. He could pay cash, but that would require stopping at the booth. Speeding through accrues tremendous time-saving benefits. Thus, RFID tags in cars offer limited privacy, much choice and much benefit.

Another model, the placement of RFID tags on boxes of razor blades in a grocery store, gives consumers little choice, because they rarely know the product is tagged. The loss of privacy is low-RFID tags reveal only which brand of blade buyers prefer. There's little benefit to the consumer-the store uses the RFID tags to track inventory and save money. So, little choice, some privacy and little consumer benefit.

Paharia's model can be applied to passports. Holders have little choice about whether to use the RFID tags since they will become standard. As for privacy, Shannon says the new passports will not transmit more data than the document holds. Additionally, State says that the benefits will be high. Holders will move through lines more quickly, and the government will have more assurances that passport holders are who they claim to be, because the photo will be digitally matched to the holder's face using a biometric scan. So, the passports, in theory, will offer little choice, a modicum of privacy and much benefit.

This won't squelch the privacy debate, however. The American Civil Liberties Union and others have weighed in heavily against RFID-tagged passports. In the meantime, when not presenting them at border crossings, Shannon says concerned passport holders can protect their documents by wrapping them in metallic foil, which blocks radio transmissions. Reaching back to RFID's retail roots, she adds, only half joking, that while people wait for the new protective holders, they can fend off skimmers by carrying a passport in an empty foil Doritos bag.