Cite as 8 N.C. J.L. & Tech. 249 (2007) | Download PDF

Radio frequency identification (“RFID”) has been heralded as the next generation of bar codes, or perhaps more appropriately, “barcodes on steroids,”2 because of its ability to efficiently track a product throughout the supply chain and beyond. RFID uses radio waves to identify products and people.3 In August 2006, Nike, in conjunction with Apple, launched a new product geared towards runners: the Nike+ iPod Sport Kit.4 The $29 kit includes a nickel-sized sensor that may be placed in a Nike+ running shoe, which communicates with a receiver that attaches to an iPod nano5 using RFID.6 When the runner moves, the sensor in the shoe signals the receiver in the iPod, which allows the runner to monitor distance traveled, calories burned and speed achieved.7

Scott Saponas, an avid runner and doctoral student at the University of Washington, was eager to purchase the Sport Kit. He soon realized, however, it could be used for non-athletic endeavors-like surreptitiously tracking the movement of others.8 With the aid of two other graduate students and a computer science professor, Saponas created several inexpensive RFID readers to detect the Nike sensors.9 From a remote location, they were able to detect anyone with a sensor who passed.10 Unfortunately, the Sport Kit packaging did not inform the runner that, as she tracks her athletic endeavors, others may be tracking her movements.11

RFID technology is not the stuff of science fiction novels. It is here today and ready to be employed on a massive scale. Without regulation, RFID will be used to track both products and people. While some uses will undoubtedly be innovative, others have the potential to be nefarious. As such, consumers have a right to know if the product they purchased is RFID-tagged. This Recent Development discusses both current and future uses of RFID. Part I provides a brief background on privacy as it relates to the use of RFID technology. Part II discusses the privacy implications of widespread RFID use and the necessity of regulation. Part III is an analysis of recent efforts to regulate RFID use. Finally, Part IV concludes the inquiry by proposing and evaluating possible actions consumers can take to prevent lowered expectations and erosion of privacy resulting from the imminent widespread implementation of RFID systems.

I. The Right to Privacy

A. Theoretical Underpinnings

The United States Constitution does not state an express right to privacy; however, the need to protect privacy has been debated for over a century. The modern American concept of privacy was first articulated in 1890 by Samuel D. Warren and Louis D. Brandeis in a Harvard Law Review article entitled “The Right to Privacy.”12 Technological advances, such as the advent of photography and the popularity of tabloid journalism made intrusions into private life both easy and lucrative.13 In support of judicial recognition of a right to privacy, Warren and Brandeis noted:

The design of the law must be to protect those persons with whose affairs the community has no legitimate concern, from being dragged into an undesirable and undesired publicity and to protect all persons, whatsoever; their position or station, from having matters which they may properly prefer to keep private, made public against their will. It is the unwarranted invasion of individual privacy which is reprehended, and to be, so far as possible, prevented. 14

For Warren and Brandeis, the threat to personal privacy posed by technological advances inspired their argument that individuals have a right “to be let alone.”15 Subsequent case law led to a recognition of privacy-related torts and the development of a Constitutional basis for the analysis of certain privacy rights. The Fourth Amendment,16 in particular, has been interpreted to protect individuals from unreasonable invasions of privacy.17

B. Case law

The right to privacy and technological advances often come into conflict. Technology used by the government in criminal investigations has been held to violate Fourth Amendment privacy rights. For example, Silverman v. United States18 involved the use of a “spike mike,” a technologically advanced microphone placed by police in a heating duct to eavesdrop on an incriminating conversation.19 In Silverman, the Supreme Court expanded the reading of the Fourth Amendment and held that it “governs not only the seizure of tangible items, but extends as well to the recording of oral statements, overheard without any 'technical trespass under . . . local property law.'”20

The notion that the Fourth Amendment protects private conversations was revisited in the landmark case of Katz v. United States,21 which also involved the intersection between technology and the right to privacy. In Katz,the government used a bug to overhear a suspect's telephone conversation in a public phone booth.22 The Court held that the Fourth Amendment protected individuals from government eavesdropping in a private conversation, despite the fact that the conversation took place within a public telephone booth.23 The Court reasoned that while the telephone booth was open to the public and located in a public place, the act of shutting the door indicates an expectation that the conversation is private and free from government intrusion.24

Although technological advances often raise privacy issues, not all technological innovations violate the right to privacy merely because they make it possible to track an individual's movements. For example, in United States v. Knotts25 the Supreme Court held that the Fourth Amendment does not apply to a “beeper,” a transmitting device that was technologically advanced at the time, used to track a person's movements in public.26 The beeper in question was surreptitiously attached to a drum of chloroform that was transported in the defendant's car. The Court noted that a person traveling on public highways “has no reasonable expectation of privacy in his movements from one place to another.”27 The Court explained that a beeper merely augmented the police's ability to visually observe a subject in public.28 However, the Court specifically noted that the beeper was not used in any way to monitor movements once the chloroform was taken inside a private residence.29

The line between tracking inside and outside of the home was more clearly defined in United States v. Karo.30 In Karo, the Court held that the government use of a beeper to monitor activity within a private home was a violation of the Fourth Amendment.31 Thus, while the Court has consistently protected private residences from unwarranted search, Fourth Amendment protection beyond the home is hardly guaranteed. The distinction between “in public” and “in the home” is often the determinative factor.

In State v. Jackson,32 a technologically updated variation of Knotts,the Washington Supreme Court considered the constitutionality of the police planting a Global Positioning System (“GPS”) in a vehicle to remotely track its location. The court held that the police needed a warrant in order to attach a GPS device to a car.33 In reaching its conclusion, the court noted that the content of the information gathered could reveal information about a person's “preferences, alignments, associations, personal ails, or foibles.”34

It is important to note that all the above cases involved government surveillance in some form. In United States v. Jacobsen,35 the Supreme Court made clear that when private information is collected by a non-government entity, the government's subsequent use of the information is not a violation of the Fourth Amendment.36 The Court noted, “[o]nce frustration of the original expectation of privacy occurs, the Fourth Amendment does not prohibit governmental use of the now nonprivate information.”37

The implications of this ruling are particularly troubling in the context of RFID. RFID is on the cusp of widespread implementation because it is a highly effective means of tracking products. Scholars forecast that in the near future all people will carry commercial or state issued products that are RFID-tagged.38 Thus, RFID is not just a highly effective means of tracking products; it is also a highly effective means of tracking people. As the ruling in Jacobsen makes clear, once information has been compiled by non-government entities, it can be accessed by corporations or individuals with financial resources who can buy the information, hackers who can steal the information, and/or the government which could subpoena the information. Unless consumers take action now, our identity, whereabouts, preferences, and peculiarities will soon be more easily traceable by corporations, hackers, and the government.

C. What is RFID?

An RFID system has two components: (1) an RFID tag or transponder, which includes a microchip attached to an antenna; and (2) a reader, which translates radio waves reflected from the RFID tag into digital information that can, in turn, be passed on to computers.39 The reader emits “electromagnetic waves.”40 The tag antenna is tuned to receive these waves.41 An RFID tag may be either passive or active. A passive tag draws power from a nearby reader, while an active tag, usually powered by a battery, continuously emits information until the power source expires.42 RFID tags average a few square centimeters in size, but some are miniscule. Hitachi has designed an RFID tag measuring just 0.05 mm by 0.05 mm, which it plans to market by 2010.43 The tiny tag, which is smaller than a grain of sand, may be easily incorporated into paper and currency.44

RFID may be used as an alternative or supplement to barcodes. Unlike products with a bar code, which must individually pass within the line of sight of a reader, multiple RFID-tagged products may be scanned when they come within range of a reader.45 For example, a truck carrying new inventory would have to be unloaded and reloaded to scan each box with a bar code; but, if the products are RFID-tagged, the contents of the truck could be almost instantaneously tallied if driven past an RFID reader.46

Perhaps the most important feature of an RFID tag is its uniqueness. Unlike bar codes that employ the Universal Product Code (“UPC”), by which identical products share the same bar code, RFID employs the Electronic Product Code (“EPC”), which gives each and every product a unique identification.47 For example, whereas a can of Coca-Cola with a UPC would be indistinguishable from any other can of Coca-Cola, a can of Coca-Cola with an EPC is unique and distinguishable from every other one in the world.48 Since EPC uses a ninety-six-bit code, which allows “eighty thousand trillion trillion” objects to each be assigned a unique number, there will be no shortage of numbers available for identification and tracking purposes.49

The majority of consumers are unaware of the presence of RFID in products already sold.50 Currently, no laws or regulations require the government, retailers, or manufacturers to disclose to consumers that the product they carry is tagged with a unique code. As RFID tags become smaller and smaller, it will be very difficult, if not impossible, for even the savviest of consumers to detect a tag unless regulation is passed requiring both proper labeling and a means of deactivating the tag. Failure to take action now will result in tagging and potential tracking on a massive scale.