Labeling News at the NH RFID Hearing

Kathy, Linda and I had the opportunity to attend a hearing at the NH House Commerce and Consumer Affairs Committee where HB 478 was being discussed. This bill is intended to regulate the use of RFID technology in the state and I was asked to testify by the folks at EPC Global.

This report is based on the notes that Kathy and Linda took. Any of my personal comments are in parentheses.

Rep. Neil Kurk is the sponsor of the bill and began by remarking that this was his third time at this type of hearing. A 2003 version of this type of bill passed the House and vanished in the Senate. He (actually!) read excerpts from the 2005 book “Spychips” by Katherine Albrecht, how within 10 years tracking and tracing items and people would be possible, even remotely, without their knowledge or consent. (I find this hard to believe. This book was inaccurate when first published and has zero relevance now. Amazing that people take this seriously)

Rep Kurk remarked that the impact of RFID technology would change civilization and the way we live, much like the printing press, and would be pervasive and intrusive in our lives. He said RFID is a valuable tool and enables good things, but also comes with the risk of invasion of privacy. The bill would balance the benefits and risks, and reduce loss of personal privacy and government control of our lives. He then discussed some specifics of the bill:

The bill requires notice to inform consumers that a product contains RFID chips. The bill does not specify who is under obligation to provide this notice – retailer, manufacturer, a government agency.
Products with readable devices must be deactivated by retailers upon customer request.
Prohibits human implantation of RFID chips.

Bans states from using remote readable devices to locate an individual without cause. Consumer Notice requires a commonly recognized symbol designed to provide a standard way to show the presence of a remotely readable device and if such device is a radio frequency identification (RFID) transponder, its frequency and data structure. This act will take effect January 1, 2014. (They really think that the public is interested in the class, frequency, and data structure of an RFID tag – sorry guys, interest in this is limited to a small group of geeks.)

Rep. Winters asked why the need to supply the frequency of an RFID chip, and the response was so that the consumer can find a way to deactivate and destroy the tag. (Crazy this idea is, it would be nice to provide all these readers that consumers will be using to deactivate their tags.) Kurk supports the bill because an individual can be unaware of scanning, which is intrusive and violates privacy.

(At this point, a lady testified that she was afraid criminals were planning to use RFID to stalk her children after they go shopping – I confess to not quite understanding her reasoning about this.)

Kathleen Carrol, of HID Global, opposes the bill. She says that passing the bill would bring about higher direct and indirect costs of doing business. RFID would offer more protection against identity theft because smart cards provide more secure access to personal data. She spoke of how passwords are becoming ineffective for security purposes and cited examples.

This bill would prohibit NH DMV from issuing EDL (enhanced drivers license) cards. With this bill cost of a license would increase by an estimated $80 to $150 per driver because drivers would need to purchase a driver’s license plus a “passport” card. She stated that an EDL being read by an unauthorized reader would be impractical for someone looking to steal an identity.

Another speaker (from the NH Card Coalition) spoke of the language used in the bill. Definition of a remotely readable device means more than just RFID, but also bar codes and magnetic stripes on cards. Language should be reworked to cover these issues in addition to RFID. He also noted that some companies are voluntarily putting icons on products to have notice of RFID in products.

(A rather eccentric lady from the NH Civil Liberties Union spoke in favor of the bill. It seems she is a regular at the State House and had to rush off to go to another committee that is dealing with cameras to stop people driving through red lights – now that I do support!)

Speaker for Retail Merchants spoke of the lack of adoption yet of the notification aspect of the EPC Global standards. He is opposed to the state-by-state approach saying that smaller retailers would be taken “out of the stream” of production. Manufacturers, shippers, would bypass New Hampshire because of this bill and this would cause financial hardship. The bill also does not address what to do about notification should consumers purchase from mail order or the internet.

David Husak of Reva Systems, opposing the bill, made some points about how much time is spent just looking for items, and how much RFID would benefit many industries. For example, in healthcare, nurses spent an estimated 25% of their time looking for people, equipment, medicines. The food industry would benefit from being able to track contaminated products back to their source, food spoilage would be reduced, thus saving money and other resources. David mentioned how his organization had installed RFID tracking systems globally, none of which used the technology to transmit any personal or confidential information.

A speaker from the Auto Dealers Association spoke of how this bill would affect businesses that lease cars. Already, LoJack devices are in place to look for cars that are missing. He said not all leased vehicles have tracking devices, mostly the higher-end cars do. Putting an icon or some identification to note the presence of RFID would only make thefts of non-RFID tagged cars increase.

Also in the automotive area, a representative from Hertz told a similar story as to how labeling cars for specific markets would cause them all kinds of problems. Hertz uses LoJack and similar systems to recover stolen property.

Jeffery Fineran represented the pharmaceutical industry and spoke in opposition to the bill. RFID protects against counterfeit drugs. He pointed out that the FDA is the only agency that should able to mandate labeling of drugs, and mandating anything about RFID should be done at the federal level.

Daniel Romm from EPC Global spoke of their concern for privacy but says the “one size fits all” approach to fix a problem that doesn’t exist is not feasible. Mandated notifications is “premature” because RFID technology is still developing and RFID is not universal. Passing this bill at this time would just cause confusion among consumers and businesses.

David Holliday spoke in opposition to the bill. He said that RFID is useful in some applications, but not in all applications. A 96-bit RFID tag can hold only a little bit of data to create a unique number for the product. The problem with privacy and data theft is not really an RFID problem, but a data protection problem, such as the problems that occurred with TJX stores.

David wants real standards put together by real experts with government help. State-by-state mandates would be costly and unworkable. He would like NH to work with organizations like AIM and EPC Global to come up with standards for all. The reason barcoding is successful is because we have global standards.

Bob Pernice from Nashua Corp. spoke of the technical issues that prevent many of the dire consequences threatened in the Spychips book from becoming reality.

Katherine Albrecht spoke in support of the bill. She told of the research she did for her book Spychips. She told of how RFID chips in shoes and underwear could allow anyone with a scanner purchased from WalMart could stand 30 feet away from her and find out the size and color of her underwear. RFID, she says, can be read behind walls (not true!), through wallets, purses, backpacks, etc. She told of how someone with a scanner could ride down the street pointing the device to homes and collect personal data. She spoke of how RFID could endanger people involved with domestic violence issues. Abusers could easily track those they want to harm.

(Katherine was very clever to speak last. Her testimony was full of technical inaccuracies, but the process did not allow anyone to point this out. Her comment about RFID readers embedded in the road that could read tags in her underwear was a high point of the afternoon for me. Obviously, it is not possible to read an EPC Gen 2 tag through a metal car and there is no company either using or planning to use RFID tags in Katherine’s underwear!

Some of her other comments made no sense either – something about using RFID for remote video cameras to watch unfaithful spouses? What on earth is an RFID video camera? Why not just get one of the many cameras already on the market that works happily on an 802.11x network?)

David’s final thoughts:

This committee is said to have been involved in this bill for some years but seems to have very little knowledge of RFID or automatic identification in general. I asked one of the committee members if she had ever seen an RFID label and she said “no”. Luckily I had some with me so next time she will be able to say “yes”.

With all the good information on RFID and Auto ID technology readily available (no, I don’t mean the Spychips book!) there is no excuse for the committee members not to have carried out some research on this.

To be fair, one member, Representative Winter did seem to have a pretty good knowledge of the technology and the industry and did put some good questions to the speakers. The Chairman, Rep. Butler asked a few good questions as well.

In general, the committee members didn’t show much interest. Many didn’t appear at all, apparently because it snowed – come on guys, we live in New Hampshire! Others just seemed to drift in and out of the room. Even the sponsor of the bill, Neil Kurk only stayed long enough to enthrall us with his reading from “Spychips”. I’m sure he had a free lobbyist lunch to attend.   Not very impressive.

In the NH legislature, lobbyists have to wear red badges. It seemed that more than half the people in the building had red badges – we all thought this was disgraceful!

To sum up, it was interesting to see our lawmaking system at work. I can’t imagine that anything that happened would have changed anyone’s mind about the bill.

Hopefully, we will get some good legislation at the Federal level that will allow the benefits of RFID technology while maintaining the level of privacy that we all demand. At least it will save poor Representative Kurk from having to go through this whole process a fourth time.)

Hey – I was posting live updates on Twitter during the hearing. See here.

Update: during the hearing, it was mentioned that a guy named Chris Paget in San Francisco had proven how easy it was to harvest RFID numbers from passports. (Might have been Dr. Albrecht who mentioned Mr. Paget, but I can’t be 100% sure).  Anyway, Mr. Paget has a video on You-Tube showing his exploits that I thought would be of interest. See it here