Tracking your data using RFID

What is RFID?

Radio Frequency Identification, or RFID, is a generic term for technology that uses radio waves to identify people or objects. Information ranging from a simple serial number to more complex data is carried on a microchip with an antenna that can be as small as a grain of sand.

How does it work?

A RFID system consists of a tag — made up of a microchip with an antenna — a reader and a database. The reader sends out electromagnetic waves.

When these waves hit a passive RFID tag antenna, it draws power from them and uses it to power the microchip's circuits. The chip then alters the waves it sends back, which the reader converts into digital data.

Typical "passive" tags — that is, tags that require signals from an outside reader to power the chip — have a limited range, with a typical range of just a metre and a maximum range of around 12 metres. Larger "active" tags with their own battery power can be read from distances of 100 metres or more.

Where is it used?

In more places than you think. RFID tags were originally used to track Allied aircraft in the Second World War so they wouldn't be shot down by friendly fire. The technology was later used to track railway cars and cattle, but as the chips have gotten smaller their uses have multiplied.

Warehouses and big retail chains like Walmart have used RFID as an upgrade over barcode technology to track inventory. Tags can now keep track of everything from store credit cards to merchandise like clothing, diapers, and automobiles. Some countries have put RFID technology in passports and library books. Tags can even be attached to living things, from pets to people.

Can RFID really be used to track me?

The limited range of most RFID tags make them impractical for physically tracking your location, but not impossible. University of Washington researchers in December 2006 said they were able to track a battery-powered RFID device found in the Nike + iPod Sport Kit, a training tool that allows users to follow their workout progress through a device attached to their iPod.

The device reads the information transmitted from a tag with a range of 18 metres located in the running shoe. Researchers took apart the RFID tag and fashioned several machines capable of tracking the user, though all of them required the battery-powered tag to be left on.

But physical tracking is only one aspect of RFID. A greater risk for privacy experts is the information tracking made possible by the chips, including details on a person's spending habits and preferences. While barcodes also store and transfer information, RFID tags are not necessarily visible and may remain active long after a purchase, potentially covert features which raise privacy concerns.

Canada's Privacy Commissioner Jennifer Stoddart issued a report in May 2006 raising concerns about the potential for surreptitious collection of information such as shopping habits from a distance, without the consumer being aware it is happening. There are also security concerns, as RFID chips could be read by anyone close enough and with a reader set to the right frequency.

A research group called CUSP — the Consortium for Security and Privacy — conducted tests of RFID credit cards in December 2006 and found that even with security features they could be read and hacked by outsiders more easily than cards that require physically swiping through a machine.

How ubiquitous are they?

For now, RFID's popularity with business and government is limited by cost. Smaller chips used by Walmart and other stores cost as little as five cents each. But according to a 2005 report by analyst Forrester Research, those numbers are based on high volume purchase of tags, making the technology prohibitive for smaller companies.

Printable tags using semi-conductive polymers are in development and could reduce the cost but aren't currently available commercially.

But use is growing. On Jan. 10, 2007, IBM announced two pilot projects with an Italian division of Honda Motor Corp. and U.S. packaging material manufacturer Plaint that will place RFID chips in scooters and flexible packaging like the bag inside a cracker box.

What provinces in Canada offer driving licences fitted with RFID chips?

Drivers in Quebec, Ontario and B.C. can apply for chip-enhanced licences. These licences can be used instead of a passport when crossing into the U.S. Saskatchewan in March 2009 announced it was cancelling its enhanced licence program, citing privacy concerns.

Are there any security concerns with the 'enhanced' licences in Canada?

In a B.C pilot project, 521 citizens signed up to get licences embedded with a RFID chip. The new licences allow border officials to access information including name, birth date, gender, citizenship, and a digital image of the bearer. An agreement between Canada and the U.S. states that information can only be called up by U.S. officials during a border crossing.

But in February 2009, the Canada Border Services Agency decided to recall the database that was being used by the U.S. Customs and Border Protection agency. CBSA said a review of the project showed the potential for secondary use of the data under the USA Patriot Act, which could allow for the sharing of information with other American security officials.

Does Canada have plans to embed RFID chips into passports?

Canada began issuing special and diplomatic ePassports, embedded with a chip and antenna, in a January 2009 pilot project. Passport Canada plans to roll out ePassports across the country in 2011.