RFIDs: What's Your Frequency

As RFID technology gets more widely deployed, will security and privacy suffer?

By Simson Garfinkel

May 01, 2004 — CSO — During the next year, hundreds of companies will be forced to deploy technology for automatically tracking the movement of consumer goods using radio waves. Radio frequency identification (RFID) technology has been mandated by both the U.S. Department of Defense andperhaps more importantWal-Mart. Last year both of these organizations stated that their hundred largest suppliers would have to equip every shipment with an RFID tag so that the deliveries could be automatically tracked and recorded by inventory systems.

Meanwhile, the Food and Drug Administration has passed a regulation requiring pharmacies throughout the United States to purchase RFID readers by 2006. The theory is that each case of prescription drugs will carry an RFID tag with a unique serial number that can be looked up automatically in an online database, while counterfeit drugs will not.

From the news coverage that accompanied these announcements, you might think that RFID was some kind of fundamentally new technology. It's not. The idea of using radio signals as a kind of remote identification system was first pioneered during World War II, when Identification Friend or Foe, or IFF, systems were deployed in bombers to prevent them from being shot down by their own militaries.

In the 1970s, scientists at the Los Alamos National Laboratory developed a system that used RFID for controlling access to nuclear materials. Similar technology showed up in the civilian sector in the 1980s as building management companies deployed the first generation of "proximity cards."

Then in the 1990s, electronic toll collection systems like E-ZPass were introduced by highway and transit authorities worldwide; today there are more than 10 million cars with transponders in the United States alone.

Whether they're being used to track the movement of nuclear materials or deduct a $2 toll from your account with the New York State Thruway Authority, all of these RFID systems work more or less the same way. A small electronic circuit in the RFID chip listens for a radio signal from the RFID reader. When the circuit hears this signal, it sends back a coded radio signal of its own. The code contains the chip's identification number and possibly other information. When the reader hears the response, it sends that information to a computer system. Typically, the computer looks up the number in a database, verifies that it is valid and hasn't been stolen, and then performs some sort of action.

RFID chips are usually packaged in small plastic boxes called tags. There are two kinds of tags: active and passive. Active tags contain a microchip, an antenna and a battery. They can work from a distance of dozens or even hundreds of feet, depending on the size of the antenna, the strength of the battery and the portion of the radio spectrum that's being used for the communication. Because batteries have a limited life span, these tags work for only a few years. Passive tags, on the other hand, don't have batteries.

• Print

• Prying Eyes from Above