The Trouble with RFID | Posted February 3, 2004
by Simson L. Garfinkel

RFID is such a potentially dangerous technology because RFID chips can be embedded into products and clothing and covertly read without our knowledge. A small tag embedded into the heel of a shoe or the inseam of a leather jacket for inventory control could be activated every time the customer entered or left the store where the item was bought; that tag could also be read by any other business or government agency that has installed a compatible reader. Unlike today's antitheft tags, every RFID chip has a unique serial number. This means that stores could track each customer's comings and goings. Those readers could also register the RFID tags that we're already carrying in our car keys and the "prox cards" that some office buildings use instead of keys.

The problem here is that RFID tags can be read through your wallet, handbag, or clothing. It's not hard to build a system that automatically reads the proximity cards, the keychain RFID "immobilizer" chips, or other RFID-enabled devices of every person who enters a store. A store could build a list of every window shopper or person who walks through the front door by reading these tags and then looking up their owners' identities in a centralized database. No such database exists today, but one could easily be built.

Indeed, such warnings might once have been dismissed as mere fear-mongering. But in today's post-9/11 world, in which the US government has already announced its plans to fingerprint and photograph foreign visitors to our country, RFID sounds like a technology that could easily be seized upon by the Homeland Security Department in the so-called "war on terrorism." But such a system wouldn't just track suspected Al Qaeda terrorists: it would necessarily track everybody--at least potentially.