People-Tracking Experiment Offers Insights Into RFID Privacy Concerns

By Mary Catherine O'Connor

Jan. 11, 2007—Adding RFID tags to conference badges is nothing new. At the annual RFID Journal LIVE! events, for instance, passive inlays are attached to conference badges and used to track room attendance for breakout sessions. Exhibitors can then read the tags to gather new customer contact information.

Few, however, would have expected attendees of last month's Chaos Communication Conference (CCC)—an annual forum for hackers, open-source programmers, social scientists and others interested in life in the digital world—to have carried active 2.45 MHz RFID tags to identify themselves during the three-day event in Berlin. Many CCC attendees would normally be more inclined to try cloning an RFID tag or duping an RFID reader than to voluntarily don a tag, since one of the prevailing sentiments among attendees is that RFID is likely to be used as a tool for surveillance, degrading personal privacy.

The Sputnik badge, used to track people at the show. (Photo: Regine Debatty)

But does it? wondered Milosch Meriac. The computer engineer designed Sputnik, an RFID experiment carried out at the event so attendees could experience RFID tracking first hand. Meriac is the owner of the Berlin-based hardware and software design firm Bitmanufaktur. The Sputnik project offered an opportunity for him to survey attendees who opted to participate in a system able to locate the tags they wore at any time.

"The idea behind the test was to get an idea of what the future might bring," says Meriac, anticipating the day when it's commonplace for people to carry RFID tags, and for some public or private entities to use the technology to track them. Meriac developed the tags and readers—a system dubbed Open Beacon—used for the Sputnik project, and has made the platform's computer code and reference design available as open-source software at OpenBeacon.org. Upon registration, attendees were offered the tags, which they had to purchase for €10 to cover manufacturing costs. Meriac says he brought 1,000 tags to the event and sold all but the 100 he kept for demonstration purposes. Among the 3,000 or so attendees, he says, demand was high for the tags.

After purchasing their tags, attendees could decide the types of personal information that would be associated with their tags' unique ID numbers. Participants could link their own names, as well digital photos of themselves, to their specific tags. If they wanted to, they could also provide contact info. Those who did not want any personal info linked to the device could use a nickname not tied to any personal information in the database. Meriac says most participants took this route.