US gov't draft report says RFID poses privacy risks

12.06.2006
A panel that advises the U.S. Department of Homeland Security on privacy issues last week called for more work to be done on a draft report critical of the use of RFID technology for security authentication.

The report was prepared by the DHS's Emerging Applications and Technology Subcommittee and was presented to the agency's Data Privacy and Integrity Advisory Committee last week in San Francisco.

The advisory committee is charged with recommending to DHS leaders how the agency should use RFID technology.

The document remains a work in progress, said a DHS spokeswoman via e-mail after the meeting last week. The emerging-technology subcommittee will continue to review public comments on the plan that are submitted through its Web site, she said.

"The subcommittee also will be doing in-depth discussions with program areas within DHS that currently successfully deploy RFID technology for a variety of program purposes," the spokeswoman added.

The draft report had stated that while RFID is useful for tasks like inventory management, the technology should rarely be used to track people. The risks to privacy outweigh the technology's communications and security benefits, the authors said. They recommended that "RFID be disfavored for identifying and tracking human beings."

Howard Beales, chairman of the advisory committee and associate professor of strategic management and public policy at George Washington University, said the draft report has garnered significant public response since its release last month and needs to be updated.

Beales had predicted before last week's meeting that his committee would likely make a formal recommendation on the use of RFID to DHS Secretary Michael Chertoff during a quarterly meeting in September or December.

Overall, Beales said, "I think RFID in general is a very interesting technology, [but] it can raise privacy concerns."

The report notes that some RFID advocates tout the technology as a way of rapidly authenticating individuals and their identification documents. But the risks to the privacy of those carrying RFID tags on documents are considerable, it said.

"Human identification using RFID has serious potential to deprive people of notice that potentially highly specific, detailed information about them is being collected," the draft report found.

One supporter of RFID criticized the report, saying it was one-sided and unjustly critical of the technology. Alan Griebenow, chairman of the RFID special interest group of the Dallas-based Metroplex Technology Business Council, which advocates for the high-tech industry in the Dallas area, said RFID can be used to improve the speed of verification without compromising privacy.

"As long as we apply common-sense principles, as we're doing with video surveillance, then we can apply the technology in a way that citizens are willing to accept," Griebenow said. He noted that cell phones are already being enabled to trace the locations of people who call 911.