RFID issue presents lesson for all

Tuesday, November 1, 2005

I'm sure many of you have read about the incident at Brittan School in Sutter, Calif. It's a snafu that sent a wake-up call to the RFID industry. Here's what happened: Last January, Brittan administrators decided to issue identification tags in RFID badges to students for attendance-taking but they didn't notify parents. When the parents found out, there was an outcry and the school promptly bagged the tags. Plenty of good questions and many unfortunate misconceptions followed: What information did the tags contain and why? What implications does this incident carry for the invasion of privacy, especially for more vulnerable members of our society, such as children and the elderly. A few months later, smart card companies were surprised by a bill in the California Legislature--inspired by this incident-- that could restrict the use of RFID technology in certain applications for three years. In an attempt to influence the public discussion about RFID technology, the ASSA ABLOY Identification Technology Group is tracking legislation and reaching out to the mainstream press, politicians and other stakeholders to educate them about the technology. As a parent, I readily identify with the Brittan parents' objections. I'm among the moms who'd give a big "time out" to anyone who'd deign to tag, track or otherwise, "help me out" with the supervision of my kids without my knowledge. That said, I understand that most RFID technology is not a threat to my privacy or that of my children. I favor investment in RFID and know that RFID tags for kids--with parental consent of course--has its place. Perhaps more important, RFID technology makes our office buildings and other venues safer and easier to use. Who knows what great gifts this technology will bestow on our society in the future? The industry's on the right track with its education outreach and HID's plans to sponsor a privacy summit for stakeholders in December is a great idea. In its outreach efforts, the industry will need to guard against the temptation to gloss over some facts about RFID, however. While most RFID access tags carry no personal information, the technology is capable of tracking whereabouts and of storing personal information. When that's the case, where's the information being stored? Who and under what conditions do individuals, the government and for-profit businesses have access to the information? Where does the manufacturer's responsibility and liability end? Legitimate questions, all of them. The Brittan school made a mistake in not involving parents in their planning. As the security industry presents its pro-RFID message to the general public, it should not make the same kind of mistake. To get the public to listen, we need to tout the many benefits of RFID technology; we also need to create the conditions of trust by acknowledging that some concerns about privacy are legitimate and should be addressed.