Privacy Nonsense Sweeps the Internet

It was inevitable. The moment Wal-Mart announced plans to track some clothing inventory with radio frequency identification (see Wal-Mart Relaunches EPC RFID Effort, Starting With Men's Jeans and Basics and Wal-Mart Takes a New Approach to RFID), there was a wave of articles and commentary on the Internet raising concerns about the privacy implications of the move. The articles were often incorrect, misleading or thoroughly stupid.

Let's begin with factually incorrect. The Wall Street Journal's article on Wal-Mart's plans to tag some clothing items stated, "While the tags can be removed from clothing and packages, they can't be turned off, and they are trackable. Some privacy advocates hypothesize that unscrupulous marketers or criminals will be able to drive by consumers' homes and scan their garbage to discover what they have recently bought" (see Wal-Mart Radio Tags to Track Clothing).

This is both factually incorrect and stupid. The tags are based on the EPC Gen 2 standard, which requires that they have a kill command that would permanently disable them. So the tags can, in fact, be disabled. Wal-Mart does not plan to kill the tags at the point of sale (POS), only because it is not using RFID readers at the point of sale. If, at some point, the retailer decides there is a business benefit to putting readers in POS devices—to speed up checkout, for instance—then the company might well opt to kill the tags, or to switch them into a mode that protects consumers from individuals reading the tags.

Now for the stupid part. Criminals will drive by and determine what you recently bought? Really? So if I'm home with the lights on, I could get robbed because criminals reading RFID tags in my garbage will know I recently bought a pair of Bottega Veneta sneakers for $600? And they'll bypass the empty house down the street with all of its lights off, because my neighbor only bought a pair of Nike Air Force Ones? The folks at The Wall Street Journal need to come down from their posh Manhattan apartments and find out how the real world works: Criminals rob empty houses with easy access to main roads. They look for cash and jewelry, not purchase receipts.

Two years ago, Scientific American posted an article about RFID and privacy, written by Katherine Albrecht, the founder of CASPIAN and a well-known anti-RFID activist (see An Unscientific Article on RFID and Privacy). Perhaps in an effort to seem relevant and current, Scientific American published a comment by Philip Yam on the Wal-Mart news. In it, Yam quoted a section of Albrecht's article dealing with a patent filed by IBM that would enable a retailer using the system to track consumer buying habits in their stores without consumers' knowledge. The patent was filed in 2001, when RFID was still more a concept than a reality, and was approved in 2006.