Surpriv: RFID Surveillance and Privacy

The San Francisco Chronicle reports on plans to study amending the tax structures that support highway funding, including shifting from gasoline taxes to taxing miles driven. It might make sense, at one level… the more you drive, the more road you “consume” through wear and tear. But… how to measure that?

High on the list the panel will consider is the per-mile fee that is already the subject of a $1.25 million pilot project in Oregon that will use a special “smart” odometer coupled with a global positioning system in every vehicle, a system invented at Oregon State University.

When the project begins later this year or early next year, every time a volunteer motorist fills up, the odometer’s information will be electronically downloaded and the fee automatically added to the gas purchase price at the pump, just like today’s per-gallon gas taxes. The GPS equipment tells the state when a vehicle has left Oregon, so motorists won’t be charged for those miles. Oregon figures it will charge the volunteers 1.25 cents per mile in taxes.

While one could presumably craft a device that merely spat out “in-state miles driven,” this would have all the hooks required to create the “tell-tale Toyota,” too. While a tax on gasoline is a bit of a crude measure (though it might arguably mean as much to discourage unwarranted gas consumption, as “road consumption”), it feels like the cost of achieving a more accurate tax fit is building in tremendous means for mischief. (Which isn’t to say that GPS won’t likely be a widely-deployed and popular end-user feature in cars, as costs continue to drop and capabilities to improve.)

The Chicago Tribune quotes Paul Saffo on RFID, and relays other speculation on RFID futures:

As more vendors embrace RFID, and volumes ramp up, prices will fall, and technology will improve, [Catalyst International Inc. Vice President Larry] Cinpinski said. He believes vendors will begin incorporating the technology more deeply into their processes starting around 2007.

Eventually, the retail industry expects that all products will have RFID-tagged labels, which will enable customers to gather their goods and walk out of a store without stopping at checkout.

RFID readers will tally the merchandise and charge it to the customer’s account, much as I-PASS users drive past tollbooths without stopping.

The “walk-out check out” meme first hit the small screen with an ad by IBM, “Supermarket,” created by Ogilvy and Mather, in 1999… a rather scruffy guy stalks through the store, stuffing things under his coat… when he exits (and gets scanned, rather laser-like, since RF, uh, doesn’t show up too well on TV!), a security guard intervenes with… “Sir, you forgot your receipt!” (you’d think that if his credit is known, he could be sent a paperless receipt via e-mail?).

But we’ve now presumably got a guy stalking about outside the store, laden with “live” RFID tags… not the best scenario for personal privacy, in the presence of RFID surveillance.

More discussion of using RFID tags on vehicles in Texas, in Computerworld. The advice? “Keep it simple, stupid:”

On the other hand, if an RFID tag responds with just a license plate number, that can be checked against an up-to-date back-end database without human intervention. And the only information exposed by the RFID tag is already displayed on the vehicle’s bumper.

…

What we’d really like is a clear set of RFID best practices. But in the meantime, we’ll just have to remind ourselves to keep the tags as simple as possible and keep the data on them to a minimum. If we must include data, it should be encrypted — but less data is better.

A reasonable approach, but only what’s “displayed on the vehicle’s bumper” isn’t a fixed measure of privacy, given advances in machine vision, and in more rapid access to multiple databases in multiple jurisdictions for multiple purposes.

On the SV_RFID list (Yahoo! Groups), it was asked:
> So who is going to build the infrastructure in order to support RFID? Or are
> we expecting that mesh networks will integrate all of the sensor’s and do this
> by 2015?

My response:

I think your question is akin to asking, in 1990, “Who’s going to build this ‘Internet’ thing?” I think we’ll all be surprised by what all grows…

And I think our “surveillance state” concerns ought to extend to watching out for that same kind of bottom-up integration. I wrote something a while back, commenting on a skeptical view of privacy threats by AIM Global, wherein it was suggested that no way would we see a nationwide, government-constructed RFID surveillance network.

What likely won’ happen is the government sinking $1T into a network. What will happen will be $1T worth of private-sector investment in command, control & communications, which, over time, will become more and more tightly integrated. So, per that posting, all of the banks will want to join in to a common network for anti-crime support. Or all of the highways will be integrated, to smooth and shape vehicular traffic. And malls will collect and barter demographic and traffic information, wherever they might be able to make a marginal buck. And critical transportation hubs will be strewn with government sensors; some of those data will likely be provided to private sector collectors, perhaps swapped for the data the airlines are being pressured for. etc., etc.

Having monitored NSF, DARPA and other DOD awards over the past year or so, there’s a ton of attention going into sensor networks, including autonomous, self-organized ones. By 2015, I don’t think the question will be, “How are all these things going to integrate?,” but, “Anyone remember when all these things weren’t integrated?”

The New York Times discusses the augmented bar code, i.e., using bar codes as unique identifiers and indexes to 3rd-party descriptive content, e.g., linking a particular product to its manufacturer’s environmental policies.

Evocative of Marc Smith’s AURA project at Microsoft Research, and my white paper for CommerceNet.

Who might serve as authorities, though, is a big question… in the NYT article, UC Berkeley’s Dara O’Rourke suggests that this might be a role for “vast product-tracking database available to scanner-wielding consumers,” constructed by the government.

While one can speculate on what the future landscape of RFID tagging might look like, e.g., whether or not item-level tagging will ocurr, and, if so, in what areas and how quickly, there’s another side of the equation: pervasiveness of readers, and the sorts of applications they’re deployed for.

Innovision Research & Technology claims they’ve produced the world’s smallest RFID reader, a near-field RFID reader measuring 12 x 2mm. Obviously suited only to close proximity reading (though perhaps this is what will eventually go into bill-accepting/dispensing devices like vending machines and ATMs and monitor serial tags embedded in currency).

Some cell phones will contain embedded readers; presumably we’ll be seeing more and more easily deployed reader devices as demand from consumer goods-related applications increases.

In an article for StarTribune, Chuck Martin speculates on “extreme marketing:”

Most of the focus on RFID is to use the technology to track things. But with these chips embedded in your clothing, car and cell phone, extreme marketing could work this way: You might have been shopping on the Web for a particular item and decided at that time not to purchase it, though you registered with that site to notify you of future sales.

Later, when walking by the retailer that carries that product, your cell phone signals you to stop and look to your right. There, in the window, is the product you were seeking on the Web.

The retailer knows the location of the product and the location of you. Through global positioning tracking in your phone, the retailer guides you to the counter where the product is displayed. The salesperson has been sent an instant message authorizing a discount. For extreme marketing to succeed, sellers of the goods tracked will have to provide significant and tangible value to potential consumers.

A bit of fantasy speculation (retailers won’t know where you are, at least through GPS, without either your assistance, or the phone company ratting you out), but raising the vision of more-than-chance encounters between people and things. If you could be “painted” with an aura signaling various wants/desires (e.g., I know you’re carrying a copy of a Hemingway book, so might be more inclined than not to consider a vacation in Spain), your surroundings could cue off of that.