The Emerging Applications and Technology subcommittee of the DHS Data Privacy and Integrity Advisory Committee has released a draft report on RFID technology this week, the contents of which are summarized in stories from Government Computer News and IT News. The executive summary of the report:
Automatic identification technologies like RFID have valuable uses, especially in connection with tracking things for purposes such as inventory management. RFID is particularly useful where it can be embedded within an object, such as a shipping container.
There appear to be specific, narrowly defined situations in which RFID is appropriate for human identification. Miners or firefighters might be appropriately identified using RFID because speed of identification is at a premium in dangerous situations and the need to verify the connection between a card and bearer is low.
But for other applications related to human beings, RFID appears to offer little benefit when compared to the consequences it brings for privacy and data integrity. Instead, it increases risks to personal privacy and security, with no commensurate benefit for performance or national security. Most difficult and troubling is the situation in which RFID is ostensibly used for tracking objects (medicine containers, for example), but can be in fact used for monitoring human behavior. These types of uses are still being explored and remain difficult to predict.
For these reasons, we recommend that RFID be disfavored for identifying and tracking human beings. When DHS does choose to use RFID to identify and track individuals, we recommend the implementation of the specific security and privacy safeguards described herein.
This report is likely to irk DHS, given that it uses or is planning to use RFID in a number of identity-related programs and applications, but hopefully it will stimulate a constructive debate about the appropriate use of RFID technology. And this report lays to rest any doubts or concerns about the independence of this advisory committee.