Radio-Frequency Identification (RFID),
Surveillance and Privacy
March 23, 2004
Ross Stapleton-Gray, Ph.D., CISSP
Stapleton-Gray & Associates, Inc.
www.stapleton-gray.com
RFID, Surveillance and Privacy
What is RFID?
• Active, passive, or hybrid RF devices
• Operating on various frequencies, hence with
varying ranges and characteristics
But all:
• Operate in the RF spectrum
• Operate over a distance
• Do not require line of sight
• Can be interrogated for data
RFID, Surveillance and Privacy
A Major RFID Milestone:
the EPC standards
• conceived (and now demanded) by major players:
retailers, manufacturers, and the Defense Department
• owned by EPCglobal (the UCC and EAN International)
• focused primarily on passive RFID tags
• incorporate legacy product code standards
• based on a federated information architecture,
whose root will be run by... VeriSign
RFID, Surveillance and Privacy
Where We Are...
• The EPC debuts, September 2003
• Key players demand RFID tagging at
aggregate (case, pallet) levels:
• Wal*Mart
• Defense Department
• Target, and others
• Trials of item-level EPC tagging
RFID, Surveillance and Privacy
Where We’re Headed...
Some degree of EPC pervasiveness...
• Declining costs of tags... 5¢ each? 1¢ each?
• Even without RFID, the EPC is a powerful thing
• FDA mandates RFID tagging of pharmaceuticals
by 2007
An accumulation of non-retail RFID applications
RFID, Surveillance and Privacy
RFID as a Privacy Problem
• Invisible point surveillance (over a limited range)
• Persistent, if pseudonymous, identity
• “name binding” occurs, and persists
RFID, Surveillance and Privacy
RFID, Surveillance and Privacy
as a Research Field
• What forms of surveillance are possible?
• What will technology enable, on both sides
of the balance?
• Where and when might we see “tipping points?”
• What do the public, and policymakers, need to know?
An opportunity to study non-cooperative RFID
RFID, Surveillance and Privacy
The “Sorting Door” as a
Research Testbed
Why a Door?
• a good approximation of real-world scenarios
• a handy metaphor
• a sufficiently stretchy metaphor
One could envision lots of Doors. So...
RFID, Surveillance and Privacy
The “Sorting Door” as a
Research Testbed (cont.)
A Sorting Door System
• multiple Doors
• shared back-end resources
• global tools and knowledge, and economies of scale
• local tools and knowledge
RFID, Surveillance and Privacy
A “Sorting Door” Architecture
RFID, Surveillance and Privacy
Questions?
Stapleton-Gray & Associates, Inc.
www.stapleton-gray.com
RFID, Surveillance and Privacy