Cleanup On The Espionage Aisle

[Raoul Duke, Jr.]

From CNN

Goodbye UPC bar codes
Wednesday, July 9, 2003 Posted: 9:09 AM EDT (1309 GMT)



An ant walks among computer chips. Packages with a computer chip smaller than the head of an ant and a thin antenna are expected to start appearing in a few stores this year.

--------------------------------------------------------------------------------

Story Tools



--------------------------------------------------------------------------------

There could be some very invasive uses of these techniques if merchants use the tracking technology to spy on their customers after purchase.
-- Marc Rotenberg, Electronic Privacy Information Center


WASHINGTON (AP) -- Razor blades and medicines packaged with pinpoint-sized computer chips and tiny antennae to send retailers and manufacturers a wealth of information about the products -- and those who buy them -- will start appearing in grocery stores and pharmacies this year.

Within two decades, the minuscule transmitters are expected to replace the familiar product bar codes, and retailers are already envisioning the conveniences the new technology, called "radio frequency identification," will bring -- even as others are raising privacy concerns.

Expired milk reported
A grocery store clerk will know immediately when the milk on the shelf has expired, for example, and replace it before a customer can choose it. Stores could quickly pull from the shelves tainted and damaged products that are recalled or have expired, especially important in health care items.

"It would help you manage your inventory a lot better," says Todd Andrews, spokesman for the Rhode Island-based CVS pharmacy chain that will soon test the chips and antennae on its prescription medicines.

CVS's 4,000 stores fill millions of prescriptions each year but many customers forget to pick them up.

"If you could utilize RFID technology to tell you that a prescription is in the waiting bin, maybe the product could say: 'I've been here 10 days and I haven't been picked up yet.' Then, you could call the patient," Andrews says.

The technology builds upon the UPC (Uniform Product Code) symbol and bar codes that, when read by a scanner, enable manufacturers and retailers to keep up with their prices and inventories. A computer chip smaller than the head of an ant and a thin antenna attached to a bottle, box, can or package will alert retailers and suppliers when a product is taken off a store shelf or moved out of a warehouse. A radio signal is beamed to an electronic reader, which then delivers a message to a computer in the store or factory.

Retailers fund research
CVS, Procter & Gamble and The Gillette Co. are among the 100 retailers and manufacturers that have put up a total of $15 million for research on the new tags at the Auto-ID Center at the Massachusetts Institute of Technology. Other Auto-ID labs at the University of Cambridge in England, Adelaide University in Australia, Keio University in Japan and USG-ETH in Switzerland are also working on the technology.

Radio frequency identification technology is not new. The tiny chips and small antennae already are familiar to workers equipped with security cards that, when waived in front of a receiver, unlock the doors to their offices or relay information about the bearer to a guard.

The technology's potential for sending retailers and others information about consumers is already raising privacy concerns, however.

Potential for spying
Marc Rotenberg, executive director of a watchdog organization, the Electronic Privacy Information Center, said retailers should be required to disable the tags before a consumer leaves a store.

"Simply stated, I don't think most people want their clothes spying on them," Rotenberg said.

Researchers developing RFID tags for products so far have focused on the supply chain and limited the range at which a product could be detected. Once their use becomes universal the cost of the tags could be as little as a nickel each, they say.

Sanjay Sarma, the lead researcher at the Auto-ID Center in Massachusetts, says that by adding more functions to the chip, installing a battery and attaching a longer antenna, a receiver far away could read all the information on a chip, including its exact location.

Alerting consumers, marketers
Homes equipped with receiver-readers could alert consumers when they are running low on orange juice or their prescription for heart medicine is about to expire. Hooked up to a national network like the Internet, the at-home devices could also provide details to marketers about a family's eating and hygienic habits.

Sarma acknowledges that gigantic privacy concerns the technology raises, saying one way to address them would be letting consumers disable the chips once they leave a checkout counter.

"Any technology can be abused and we've got to be prepared, be watchful for the abuse," Sarma said.

Ron Margulis, a spokesman for the National Grocers Association, said the privacy concerns are far outweighed by the benefits of RFID. Retailers, he said, could respond much more quickly to product recalls and prevent people from becoming ill from tainted products.

"You do give up a bit of privacy but the benefit could be that you live," said Margulis.

Maybe I'm wrong here, but haven't we been living without radio transceivers in our groceries for awhile now?

[Ryoga]

Now....once items with these things are common-place, how long do you think it'll take before people start creating elaborate computer viruses that make ovens explode or street-lights stop, only to be defeated by a small boy with a virtual pet?

Megaman.exe, transmit!

*ducks the hail of incoming tomatoes*

[Raoul Duke, Jr.]

How long do you think it will be before hackers break the system and use it to make six-packs of Budweiser cost .59?

[Wicked Pilot]

*ducks the hail of incoming tomatoes*

I won't pelt you if you bring back your comic book guy avatar.

[UltraViolence83]

Oops. Looks like the static electricity generated by my putting on this chipped sweater shorted out the tiny, fragile electronic tag. Oh yeah, don't stand by any microwaves.

[Raoul Duke, Jr.]

Oops. Looks like the static electricity generated by my putting on this chipped sweater shorted out the tiny, fragile electronic tag. Oh yeah, don't stand by any microwaves.

I'm sure whatever they plan to use won't be as fragile as that. All the same, it could start a new trend of kids faking concussions just so they can expose tubes of toothpaste to MRI scans.

[UltraViolence83]

Well if my privacy becomes jepordized in any way by these little critters, I'll do my utmost to destroy them after my purchase.

[Andrew J.]

Looks like I'm going to have to get around to building my home-made EMP bomb sooner rather than later...

[darthdavid]

ponders making 300 lbs of roast beef cost 2.50$.

[Raoul Duke, Jr.]

Looks like I'm going to have to get around to building my home-made EMP bomb sooner rather than later...

Always good in a pinch. (Cookie to whoever gets the movie reference.)

[UltraViolence83]

I'm very certain that these things will be too fragile to be used as spying devices for marketing outside the store. You would also need a shitload of sensors to pick it up out in the open.

Worst comes to worst, I'm sure there'll be other devices out there that can destroy the tags, kinda like proactive police detectors. I will not subject myself to invasions of privacy by the government, other citizens, or in this case businesses.

[Admiral Valdemar]

Looks like I'm going to have to get around to building my home-made EMP bomb sooner rather than later...

Always good in a pinch. (Cookie to whoever gets the movie reference.)

The Ocean's 11 remake?

[phongn]

How long do you think it will be before hackers break the system and use it to make six-packs of Budweiser cost .59?

Have hackers broken into the current system? The price information is stored on the grocer's database; it doesn't matter if you use RFID or UPC scanning to access that.

[Crayz9000]

1. You won't be able to hack the chips and make them have an arbitrary value.

(nevermind, Phong just covered that...)

2. Brief exposure to high-intensity radio waves should completely overload these chips, they're not that big and thus cannot handle much energy. (A microwave gun with the wattage turned down a little would probably work wonderfully...) And as previously mentioned, it would be hard for companies to pick up on these chips without putting receivers in people's houses.

[phongn]

In addition, to address privacy complains some RFID manufactuers are proposing 'self-destructing' tags that are rendered useless after purchase.

[Crayz9000]

Even that self-destructing tag idea has me a little worried, though. If people get used to the idea that the RFID chips will self-destruct after purchase, and thus get complacent, what would happen if a company decides to not self-destruct their chips anymore?

[Raoul Duke, Jr.]

Looks like I'm going to have to get around to building my home-made EMP bomb sooner rather than later...

Always good in a pinch. (Cookie to whoever gets the movie reference.)

The Ocean's 11 remake?

Cookie for you!

[Raoul Duke, Jr.]

How long do you think it will be before hackers break the system and use it to make six-packs of Budweiser cost .59?

Have hackers broken into the current system? The price information is stored on the grocer's database; it doesn't matter if you use RFID or UPC scanning to access that.

No, they haven't -- as far as I know. Still, I'm thinking that UPC systems are harder to access from outside than a system using a radio carrier.

[phongn]

Even that self-destructing tag idea has me a little worried, though. If people get used to the idea that the RFID chips will self-destruct after purchase, and thus get complacent, what would happen if a company decides to not self-destruct their chips anymore?

Indeed an issue. Perhaps there needs to be some sort of clearly labeled signage at the checkout counter or scanner or whatever?

[phongn]

No, they haven't -- as far as I know. Still, I'm thinking that UPC systems are harder to access from outside than a system using a radio carrier.

Why? An RFID interrogator might just send "SKU1089-408A" and the cash register recieves "Wonder Bread $2.00" or something. Such systems should be inherently hardened to prevent any sort of access via the RFID network (which may well be absurdly short-ranged anyways).

[Raoul Duke, Jr.]

...as previously mentioned, it would be hard for companies to pick up on these chips without putting receivers in people's houses.

Television sets would make pretty good relays. Two standard locations for televisions are living room (usually in a central location within the house or within 20 feet of the main entrance) and the bedroom. Anything that passes through the living room (on the way to the kitchen, for example) gets its signal boosted.

Remember, also, the speculation in the article that RFID will be openly expanded into your home, ostensibly to alert you when you're running low on something, etc. If they really do plan on making such an expansion, they'll need booster hardware to achieve it. Large appliances are the best choices for incorporation of the larger transmitters necessary to accomplish that task, openly or covertly.

[Raoul Duke, Jr.]

No, they haven't -- as far as I know. Still, I'm thinking that UPC systems are harder to access from outside than a system using a radio carrier.

Why? An RFID interrogator might just send "SKU1089-408A" and the cash register recieves "Wonder Bread $2.00" or something. Such systems should be inherently hardened to prevent any sort of access via the RFID network (which may well be absurdly short-ranged anyways).

I agree, these systems should be reinforced. My point is that until they are shielded against hacks, a radio-based network is more vulnerable to manipulation or disruption than UPC.

[phongn]

I agree, these systems should be reinforced. My point is that until they are shielded against hacks, a radio-based network is more vulnerable to manipulation or disruption than UPC.

If there's write access from the radio network to the database, which is ludicrious. More likely there will be an RFID detector plugged in where the UPC scanner usually goes.

[Baron Mordo]

Remember, also, the speculation in the article that RFID will be openly expanded into your home, ostensibly to alert you when you're running low on something, etc. If they really do plan on making such an expansion, they'll need booster hardware to achieve it. Large appliances are the best choices for incorporation of the larger transmitters necessary to accomplish that task, openly or covertly.

So basically, you're paying them to spy on you.


No.

[Raoul Duke, Jr.]

I agree, these systems should be reinforced. My point is that until they are shielded against hacks, a radio-based network is more vulnerable to manipulation or disruption than UPC.

If there's write access from the radio network to the database, which is ludicrious. More likely there will be an RFID detector plugged in where the UPC scanner usually goes.

Ludicrous things sometimes happen; but, essentially, I agree. Good point. Write-protection is covered, then -- what about detecting and disrupting an unwelcome RFID network?