Utah Leads the Way Toward RFID Privacy Legislation

An anonymous reader writes "Wired News reports that Utah's House of Representatives passed the first-ever RFID privacy bill this week, 47-23. Utah state Rep. David Hogue said that without laws to ensure consumer privacy, retailers will be tempted to match the data gathered by RFID readers with consumers' personal information. 'The RFID industry will carry the technology as far as they can,' said Hogue, sponsor of the Radio Frequency Identification Right to Know Act. 'Marketing people especially are going to love this kind of stuff.'"

Doubt it will last

Has RFID users formed their own lobby yet? Retailers have their own. Notice how powerful Walmart is in that respect. They will just lobby the US Congress to create an over-riding law allowing RFIDs to be used as the retailers see fit. Vote smarter next time around and everyone vote!

cool

A tech law in advance of the tech.
That's the way it should be, rather than trying to throw together a hack job after the tech has been around for a while.

Sorry, but

I for one welcome our RFID tag abusing overlords.

Re:cool

If only the proper legislation had been in place before "Ugh! Mog invent wheel!". We could have completely avoided the greatest threat to western civilization: Parking Meters!

Re:cool

You're right. If only the government had stepped in and started heavily regulating the Internet around 1985...

I'm glad to see my Utah legislature taking time out of its busy schedule of banning gay marriage and getting us out of the UN to meddle in technology it doesn't even begin to understand. Gives me a real warm, fuzzy feeling all over.

Not that I wouldn't like to see some sane, well-considered legislation on the subject. But every year, they prove over the course of forty-five days that they're not capable of crafting legislation even remotely like that.

hi. I'm Troy McClure

hi. I'm Troy McClure. You might remember me from such RFID-paranoia movies as "1984 mhz" and "My Radio Receiver Knows what you Did Last Summer"

Is it just me...

or does anyone else feel immediate antagonism when they see Utah mentioned anywhere?

The state has accumulated a lot of bad karma lately. I'm kinda glad Novell is moving out.

Mormons are not enjoying good karma either.

Re:Is it just me...

As a Mormon in Utah, it is frustrating that so much attention is given to the "bad karma", and so little attention is paid to the great things about Utah.

Polygamy is practiced by groups in many states, but Utah gets all of the focus because of the concentration in certain communities (half in Utah, half across the border in Arizona). Additionally, most of that is attributed to the "Mormon church" [lds.org], which hasn't practiced polygamy since it became a state about 120 years ago (at which time it joined the U.S. and polygamy became illegal in Utah. Before that Utah was not in the United States, and polygamy was perfectly legal). So to even associate modern polygamy with the LDS church would be like calling anyone who currently lived in the southern states racist because their states used to practice slavery.

SCO is ~in~ Utah, but in no way reflects the views of Utah or Utahns. I don't hear anyone bagging on California or Virginia because Verisign is there, or Washington state because Microsoft is there.

Utah is a great state with great people, a lot of great companies, incredibly beautiful natural resources that we take very good care of (8 or 9 National Parks, I think more than any other state, and certainly more geologically diverse), and a lot of other things going for it.

To "feel immediate antagonism" toward Utah over a few issues that are really quite unrelated to the state is just a narrow-minded, uneducated, knee-jerk reaction.

Re:Is it just me...

Not to mention the best and insightful press coverage on SCO shenanings have come from Utah newspapers.

I am not mormon but have lived in southern Utah (actually close to Colorado City) and I must say Utah is one of the best states in the union (just bring your own beer)!

Bush's cronies...

Wait. You're saying that I could get one of these little buggers and stick it on someone and know exactly where they are? I'm more worried about the Bush administration's ideas for using this technology than I am about Wal-Mart's. Though I don't want them tracking me either.

I mean who wants your retailer to know when you buy condoms or somethng equally personal. Really, technologically speaking, we are not far from the thought police at all.

Re:Bush's cronies...

Yeah the retailer should never know when you buy condoms, so when you go up to the counter to pay for them rip off the bar code and assure the clerk it's the right one while keeping the condoms in your pocket.

This is really dumb, the store knows when you buy personal items if they have a RFID tag or not. When you go to the counter and pay for the items, hey someone's gonna know! And it kind of tips people off when you carry them in your cart or basket. Also, if you use a CVS card or anything like that they keep track of what you buy and send you flyers and ads home based on that information.

We're not too far from the thought police at all? Where the hell did that come from? RFID tags can't read your mind, if you have one on your body no one's gonna be able to track you from a satellite, it doesn't transmit brain waves. You'd need a reader really close to the device anyway. Not like the CIA is gonna follow you around with a RFID tag reader, that'll defeat the purpose of having the tag installed secretly in the first place.

Re:Bush's cronies...

Incidently... having been a cashier for a bit I can tell you: No one cares when you buy personal kinds of stuff. You wanna buy condoms? Go for it... most people have sex, it's not a big secret. Other than mild amusement when a giggly couple comes thru buying wine and rubbers, I never gave a damn.

One exception, though: Couple cam thru buying wine, condoms, KY, straight razors, rubbing alcohol (!!!), and nothing else. Had a funny look in their eyes... I don't know what they were up to, but the alcohol and razors STILL makes me shudder.

Re:Bush's cronies...

One exception, though: Couple cam thru buying wine, condoms, KY, straight razors, rubbing alcohol (!!!), and nothing else. Had a funny look in their eyes... I don't know what they were up to, but the alcohol and razors STILL makes me shudder.

A friend of mine was participating in a scavenger hunt once. He went to the local Canadian Tire (basically a hardware store, for non-Canadians) with another friend, who happened to be female, and bought, among several things I can't recall, a box of condoms, a lot of Coke, a duck decoy, a for-emergency-use-only CO2 bicycle pump, and a hockey goalie mask.

The cashier gave them a very strange look as they left.

Re:Bush's cronies...

he said technologivally, were not far from the thought police.

Perhaps you have some condoms in your pocket. then every where there is a rfid rader, there is someone who knows what is in you pocket.

You go to the story to buy a couple of things, then suddenly the cart announces there is a sale on condoms. now everyone know you have condoms.

Or perhaps you hacve some mdication you would rather someone didn't know about?
Walk into an interview, and the company know you take diabetis medication. well, better hire someone else because of the insurance risk.

Your in a town that is run by a religeon, and you have some material on you that would be 'against the rules'. suddenly your life just got a lot harder.

the CIA won't have to follow us if the readers are every where, would they?

no they can't read you mind, but they tell the world what you own, and people will infer there own reasons why you would own them. And believe me, nobody is going to infer anything positive.

Re:Bush's cronies...

There's a difference between "Tee-hee, then this one guy came in today and he bought ...." and "Please send Mr. Williams an email informing him that the .... he purchased today will no longer be on sale next week, so he should come in as soon as possible to stock up."

I expect that the biggest discernable change RFID is going to cause is the deliberate modification of personal behavior to prevent this kind of information from being PRESENT so that it cannot be collected.

Stop fighting it.

As good consumers we should welcome the departure of out privacy. It is, after all, a fair trade-off given the great (and personalized!) deals we'll all get in return. So let's all just relax and "go with the flow", shall we?

Thanx for listening,

Consumer 0556672GXX89F2

But what about Orrin Hatch...

Nice for them... Now if they can control what thier senator wants to do on a national level [slashdot.org] then we can talk...

Marketing people really are awful

I wrote a letter to NewEgg, asking them to stop using HTTP Referrer on their site, because I thought it a privacy concern. Their response: "Unfortunately the HTTP Referrer Header cannot be eliminated because it is an essential tool for our Marketing Department used to monitor where we are getting our web traffic from so that we can improve future campaigns to focus on more specific demographics. Please accept our humblest apologies for any inconvenience." I have tried not to shop at NewEgg ever since, because the idea of gathering information on my web viewing habits WITHOUT informing me, and without my consent, really does bother me.

My main point here though is that this is just one example of how marketing people will do ANYTHING to gather information about people. Without a privacy policy, I think the folks in Utah are right, things like RFID will be used to gather personal information about consumers.

Re:Marketing people really are awful

Actually your HTTP Referrer is sent by your browser by its own choice, you can turn it off, and in some browsers even have it smartly decide when to send the referrer and when to keep quiet, it can also send a 'fake' address based on the current one to allow leeching etc.

An RFID tag on the other hand is more like a trojan condom/malware/spyware etc.

Re:Marketing people really are awful

For your particular example, why not just turn off sending referrer information in your browser? The prefbar [mozdev.org] has a nice check box that lets you turn off sending referrer whenever you like.

what's the problem?

mozilla and other browsers allow you to control the referrer sent to sites.

you can make it lie and say you were referred by h0t-chixx0r-sex.com

that will get them wondering 8)

or you can just enter the site manually into your location bar, in which case there is no referrer...

Forgot your tinfoil hat.

You have to understand... companies do not want business from nutjobs like you because you take more time than you're worth. A http_referrer? Are you nuts? Oh wait. You are. That's not your history... it's just the site that you came from. Virtually every single website does this so they can see where their advertising money is spent the best. I don't think that an http_referrer qualifies as doing "anything" to gather info. It's equivalent to walking into a small store and the owner asking where you heard about them. But, like I said, people like you are very few and far between, so anybody with an online business really would be smart to tell you to take a flying leap. Satisfing a handful of paranoid nutjobs at the expense of knowing where their customers come from is a very bad tradeoff. BTW, have you ever thought of defeating their evil schemes by opening a browser and typing "newegg.com"??

Voter issues

Complain all you want, but when voters care, issues happen.

My uninformed opinion of Utah is that there attitude is kinda like.
"We protect our own, you outsiders go away"

Note that there is interest from California, and Massachusetts.
They point out the Senator from Massachusetts sponsored an antispam bill. Even if the bill wasn't perfect, it did pass, and at least he is trying to do something. Perhaps with the right help he can do better with RFID?

Re:Voter issues

Utah has given the tech world many advances, Novell, WordPerfect, Altiris etc.

So, despite the drawbacks of living in Utah, it turns out that Utah is actually one of those stealth components to technology. The University of Utah in particular has been a powerhouse in computer graphics and has produced doctorates from such folks as John Warnock (founder of Adobe), David Evans and Ivan Sutherland (Evans & Sutherland), Tom Stockham who created the field of digital recording, Alan Kay (Xerox PARC and developer of the GUI), now a fellow at Apple computer, Alan Ashton (founder of Wordperfect), Henri Gourard (creator of Gourard shading), Ed Catmul (co founder of Pixar), Jim Clark (co founder founder of Silicon Graphics and Netscape).

I have been quite surprised at the depth of the CS program here and we are working with a number of folks on projects that have great interdisciplinary potential. And it turns out that Utah is a pretty good place to live if you like the outdoors and such.

RFID Locator?

Is there such a thing as an RFID tag locator? Could someone electronically-savvy pitch in on this? Can I have a little device that beeps louder as it gets closer to a tag?

Re:RFID Locator?

> Is there such a thing as an RFID tag locator?

How about an RFID Reader Card for your laptop or PDA? You can get one for $150.00ish US from Syscan International (http://www.syscan.com). It fits a CF slot or PCMCIA with an adapter.

From an article in RFID Journal
http://www.rfidjournal.com/article/articleview/3 93/1/1/
"The read range is just five to 10 cm (two to four inches). But Striefler says the company is working to extend that. 'We hope to increase the power of the chip to improve its read range.' ... The reader can record changes in temperature, time and other data. The initial reader that Syscan is producing works with 13.56 MHz tags based on the ISO15693 and ISO14443 standards. The company is working to produce versions for the ISO 14443A and ISO 14443B standards. It will also create readers for the Sony FeliCa RFID chip, and 125 kHz and 134 kHz frequencies. "

Looks like a bold new frontier for interacting creatively with corporate computer systems.

Laws need to include all future forms of tracking.

Why come out with a new law each time there is a new form of technology? Just make it illegal to use ANY electronic database to surreptitiously track people. This can include facial recognition, RFID, gait recognition, electronic nose systems, cell phone triangulation, licence plate OCR, or any possible unforseen technological advances.

I NEVER thought I'd say this...

but unless others follow suit, I now have a reason to move to...

Utah...

*shudders*

Re:I NEVER thought I'd say this...

Do you like to ski, mountain bike, hike, or camp? Do you enjoy visiting national parks?

If you like any of those things then you might like Utah. If you are not LDS and like those things then even better, because the Mormons aren't doing those things on Sunday. I don't ski on Sunday so I am relying on my friends who do for this info, but they insist that the slopes are nearly empty on Sundays.

Re:I NEVER thought I'd say this...

Utah is *great* for hi-tech jobs and businesses

Ssshhh!

We've got too many people in Utah as it is...

Everyone, ignore that AC and listen up: Trust me, Utah sucks. Lousy weather, absolutely nothing to do other than go to church, drinking is strictly prohibited everywhere, Mormons will hound you day and night, and they won't even let you have more than one wife.

Nope. Stay where you are. It's better there.

Re:I NEVER thought I'd say this...

As a Utahn who absolutely loves living here and raising his family here, I have to agree.

So many people move to Utah (usually from California as far as this post is concerned) because it's a great family-oriented place to live, and the first thing they do when they get here is complain that there isn't enough alcohol (the greatest source of child abuse and spouse abuse ever known to man), gambling (the greatest source of wasted lives ever known to man), and that everything is closed on Sunday (because people are at church or home spending time with their families, which is the reason you moved to this family-oriented state in the first place, isn't it?).

The same road that brought you in will take you back out, and have fun in California!

Utah: A great place to live, despite many efforts by outsiders to make it otherwise...

Well...

We've already seen Budweiser [cnn.com] push for all the info they can get without these tags... I'm sure RFID is soon to follow.

At least they won't be able to invade your spending habits this way, and I'm sure legislation will come to dissallow their current manner of tracking if it deeply affects consumer rights.

Technology like this is beginning to infringe on our privacy though... I wouldn't want everyone to know I bought four pairs of handcuffs and a lether whip around my girlfriend's birth... I mean candy and flowers... yeah

Place tinfoil hat on head

Marketing people especially are going to love this kind of stuff

Is there anything wrong with that so long as somewhere in our future we make sure that information isn't accessed 'inappropriately'?

An example of such abuse it as marketer looking up information an a prospective date, or a baristor using racel profiling digs up information about you that would prejedice a jury.

That's what we all fear...

But if this leads to cheaper and more acurate (and less bothersome) appraisal of market fashions, then that's as appropriate as asking surveying people.

RFID's provide that ability to collect data never before possible. This won't go away because it's just simple too useful.

We of the tinfoil hats must use our energies to combat inappropriate use of information.

The real issue with RF ID is jobs

While the marketoids will try to mine the tags, I do not think that privacy is the biggest problem with RFID. Why is wallmart pushing for the tags so hard? To eliminate labor. Labor is one of their biggest costs. With the tags in place they can eliminate the checkout people, you push your cart through the scanner and up pops your bill on the ATM pad. This also allows them to keep track of what sells and when. With some scanners between each department they can find misplaced items that customers put back on the wrong rack. This would also all but eliminate employee thieft. Only jobs left will be the greeter at the enterace and security at the exit. They have already outsourced janitorial services to fight unionization and I'm sure they'l do the same with a restocking crew and rent-a-cop.

In some ways this is the ultamate offshoring of a service job. The labor of checkout clerk is moved to the chip factory where the tage is made and the shoe factory where the tag is inserted.

Re:The real issue with RF ID is jobs

With the tags in place they can eliminate the checkout people, you push your cart through the scanner and up pops your bill on the ATM pad.

This is precisely why I never have and never will use the 'Self Checkout' lanes at the supermarket, Home Depot, etc. Not only are they eliminating some poor schmo's job, but they're getting ME to do it for them on top. When they start giving me a 10% discount to use those lanes, I'll reconsider. Until then, they can blow me. and forget the argument that the discount is built in... if that were the case the prices at the full service line would be higher. Of course, just like ATMs and bank tellers, I guess that's next. </rant>.

Sorry... just thoroughly disgusted with the system lately.

tangled web of RFID lies

"None of the retail tests of RFID tags invaded the privacy of shoppers in the Wal-Mart stores, Roberti [editor of RFID Journal] said. He also said that RFID chips in building security passes and toll-booth tags have never been used to invade a citizen's privacy."

New Yorkers were conned into installing EZPass toll ID systems around our entire infrastructure by a lying Mayor Giuliani who promised that the logs would be tightly protected, available only by court order and subpoena after due process, evidence discovery, legal confidentiality, all the rights by which we protect ourselves from our governments. Once up and running, it turned out that $50 through any low-rent lawyer could buy the logs from the cops, at first used in divorce cases, and now surely used for whatever pretext is convenient to invade our privacy.

Now the industry continues the lies to propagate their bugs throughout our consumer society. The deployment of the tech is inevitable, their lies as well. But our privacy rights can win, if we maintain zero tolerance for these invasions, and the liars who would have us pay for our own illegal surveillance. Join or promote the Electronic Privacy Information Center (EPIC) [epic.org], or the Electronic Frontier Foundation (EFF) [eff.org], or the American Civil Liberties Union (ACLU) [aclu.org]. The freedom you save will be your own.

TEMPTED?!?!?!?!?

They will absolutely pair the RFID info with personal data. Most retailers will probably do this even if there are laws against it and just hope to not get caught.

Re:TEMPTED?!?!?!?!?

hope not to get caught... well if I accuse them of pairing data with people the burden of proof is on me. How would I get that proof without breaking the DMCA through reverse engineering their system or other benevolent hacks?

Who are we more scared of?

This might keep the marketing dogs at bay but politicians must be having wet dreams at what this could acheave - imaging linking all this data, you basically have a distributed array of people sensors and an extensive log of where any one person has been on tap 24/7. How about installing RFID readers _everywhere_ - put them in airport check-ins, public transport, traffic lights, libraries, schools, the pavement, and you have amazing coverage. You could see what people were buying, reading, eating, wearing, even what underwear they had on and the best thing is it would happen automatically - the computer would build up profiles of people based on what tags were moving around, it would be able to fill in blanks from other databases - eg get on a plane and that set of RFID takes belongs to the name on your passport. Shops would be only too happy to give their database to the government in return for a few favours.

Son-of-a...

Now how am I supposed to keep track of all my wives?

Personal jamming / confuse the system?

What would happen if you just walked around with hundreds of RFID tags all over your body?

At least a negative precedent has been set

Personally, I don't like this at all because of the possibilities of data mining and telemetry, and personal profiling and advertising with that data. It's good to see some eyes without cataracts in the government once in a while, but eventually consumer apathy and corporate rollout will make this a non issue. C'est la vie.

Profound Implications?

RFID detectors could be used on sidewalks to monitor pedestrians and the things they are carrying. And it wouldn't necessarily be government. Anyone could buy a detector and just start compiling data.

Information wants to be free

Oh right, not when it's your information, only when it's a record label's information.

Want to guarantee passage?

Want to guarantee passage of this law? Want to guarantee similar laws get passed elsewhere?

Subject the (senators|congresscritters|Members of Parliment|...) to the effects of life without it.

"Well, Senator Bedfellow, let's see. You bought condoms, yet your wife is out of town. You bought wine. You bought SuuperCalais (large economy bottle). You drove your car through the Expressway to a little hotel."

Remember Matrix

Can you really believe this since this is the very same state that wanted to send information about every citizen in the state to a company in Florida called Matrix. See http://deseretnews.com/dn/view/0,1249,590041052,00 .html

Tech solution to privacy

In the February issue of Circuit Cellar [circuitcellar.com], there's an article on RFID tags and how to make your own. (Alas, it's not one of the freebee articles on their web site. Go kill a tree for a good cause.) And once you understand how something works, it's always easier to shove a potato into the works!

Starting from this, building a RFID reader detector should be easy -- know when someone is scanning for tags. After that, if some reader is looking for tags with data, why not give the poor thing some? LOUDLY. Reading the data off of some existing tags should give you an idea of what format data the reader is looking for, especially if they use any CRCs or such to stop someone from feeding the reader arbitrary data. Then feed them arbitrary data. The best part is that you really aren't transmitting with passive RFID, you're just "echoing" the reader's transmission.

The gizmo used in the project is an Atmel e5551. Google for that and you'll find lots of things to read.

In the end, it doesn't matter

RFID is a red herring. It's needed now simply because our computer technology can't understand what's going on around it without a little help. As soon as computers can understand what they're seeing through a video camera, they'll just *look* at you and your basket and gather the same information. Are we going to ban video cameras in order to protect our privacy?

Instead of arguing about whatever particular technologies happen to be available now, let's jump forward to the final argument. Unless you're inside your house, or some other friendly enclosure, you will be observable - and how can we really complain about anyone just *noticing* what they see and recording information about it, regardless of what their purposes are? I'm not really sure where this question will eventually lead but, in the end, it's the truly relevant question.

Orin Hatch...

... is probably turning over in his grave.

And yes yes I know, but I wish he was.

German Retailer just dropped RFID

The German Retailer Metro just anounced [yahoo.com] that it is dropping RFID tags

Of course it's important in Utah

Think of the implications. You have 14 wives, each with an RFID tag. You can track them coming and going but do you want the government to know about them? Of course not. The mormons had to renouce polygamy as a condition of statehood, wink wink.

I, with my one wife, have no such problems. I know where she is by listening to her periodic yelling at the kids.

RFID ignorance

"They" already tie barcodes to your personal identification. You think Walmart isn't tracking the spending habits for each debit/credit card used? You're kidding yourself. RFID is a better barcode, plain and simple. It is not some magic tracking device that allows a retailer to track your every move any more than they already can. So, put your paranoia away and rest asure that you can still purchase your Playboys with cash and nobody is the wiser.

RTFA

They're pushing for legislation to *protect* our privacy. At least, in the article linked to the story, they are.

FYI

For your information.

"Mormon" is a nick name for members of "The Church of Jesus Christ of Latter Day Saints." Those found to be practiceing plural marrige are excommunicated. I've heard them called mormon fundamentalist, but I don't see anything fundamental about how they practice. This is true, not only in spite of history, but particularly in veiw of it.

And yes, such do exist in Utah.