Consumer Reports Looks at RFID

Rock cites companies that have taken a proactive approach to protecting privacy while using RFID. "There was no public uproar," she writes, "when Marks & Spencer, a British retailer, used disposable RFID-tagged paper labels while testing the technology on men's apparel. Customers received brochures about RFID and the promise that the store would make no link between information on the tags and purchasers' identities, even if they paid with credit cards."

Still, Rock says she inadvertently collected evidence that in some cases, industry leaders are dodging privacy issues. She received an e-mail response to a request for an interview with Alien Technology, for instance, that mistakenly included a forwarded response from Linda Prosser, its vice president of corporate marketing. In that forwarded response, the article claims, Prosser suggested its outside PR firm make excuses to avoid contributing to the article if it would be "a privacy story."

This, Rock says, shows that some players in the RFID industry might consider privacy to be "more of an annoyance to be dismissed" than a real concern. Prosser, however, claims Alien was not dodging the privacy issue—rather, she says, her company suggested Rock speak with EPCglobal regarding the issue, which the article did not mention. "When we get inquiries from reporters who want to talk about privacy, we refer them to EPCglobal because we support EPCglobal's privacy guidelines. [EPCglobal] is the best group to address the issue of privacy," says Prosser. "We are the provider of the technology and not the user. A lot of issues around privacy are about the choices that the user makes, relative to privacy, so that user is a better source for that perspective."

Grasso further notes that although the quotes attributed to him in Rock's report are all accurate, the article is "fraught things that aren't true." For example, he says, "They start off by saying the technology will be used to collect info about you [consumers]. That's not true. This technology is about products and not people. It also talks about read ranges as much as 750 feet, but this is for active RFID technology and is not even remotely indicative of the overwhelmingly more common passive tags," which, he points out, have a read range of a matter of feet.

Grasso says the article also focuses on the use of RFID in pharmaceutical companies to save them money, but does not discuss the ways the technology could also be used to cut down on counterfeit drugs, thereby making them safer for consumers.

During the three months she spent investigating and writing the story, Rock states, news reports emerged about ways data encoded to some types of RFID tags can be surreptitiously collected or destroyed (see EPC Tags Subject to Phone Attacks). "As part of our coverage of new credit cards, such as Chase's blink card, we discovered that RFID technology was growing very fast," Rock says, "and we like to stay abreast of any new technology than can impact consumer products."

In writing the article, Rock says she found that privacy concerns are not part of "a grand conspiracy," as some might think. "They [consumer privacy and security] do have to be addressed early on, and they deserve more than lip service."

EPCglobal says it respects the work that Consumer Reports does in attempting to educate consumers. Still, Grasso says, "If this was the only thing people read about RFID technology, they would be scared to death of it—and we don't think that serves consumers or businesses."