Leahy on RFID and Micro-Monitoring...
Remarks Of Senator Patrick Leahy
The Dawn of Micro Monitoring: It's Promise, And Its Challenges
To Privacy And Security
Conference On “Video Surveillance: Legal And Technological Challenges”
Georgetown University Law Center
Tuesday, March 23, 2004
First, I want to thank Georgetown University Law Center for hosting this conference. It’s always good to have an opportunity to return to my alma mater. I also thank the Center for American Progress, The Constitution Project and Wilmer, Cutler and Pickering for their roles in supporting this event. As a former prosecutor I am especially glad for the strong representation here from the law enforcement community. Chief Ramsey, good to see you again. And thanks to all the experts who have gathered here today to talk about these timely issues.
People Want To BE Safer
In our post-9/11 world, technology often has been our crucial but silent partner in helping us to ramp up our law enforcement and national security capabilities. We in this city are profoundly aware of the new risks we face. But we also need to do it right. The public does not want false assurances, nor do they want to be unduly alarmed. What the American people want is to actually be safer. And we still have a way to go in accomplishing that.
Tension Between Liberty And Security
In our constitutional system there is always tension between liberty and security – and never more so than since September 11th. One of the difficult challenges we face is to strike the right midpoint. Our constitutional checks and balances are intended to help us do that.
The video technologies you are discussing today offer tools that are better, faster and smarter, on scales of magnitude that are unprecedented. As an advocate of emerging technologies who also has a keen interest in them, I watch these breakthroughs with great interest.
I have sought to find ways to encourage the commercial sector to create new products and opportunities, and I have promoted use of new technologies by law enforcement agencies, while also protecting consumer privacy and constitutional freedoms. That was the balance I sought to strike in my work on CALEA and in other legislation that blends law enforcement’s needs, the needs of our robust technology sector, and the privacy interests of the American people. The hands-off approach to the Internet that I have favored is another example, and right now I am working with others to extend the Internet tax moratorium, to keep the Internet free from discriminatory and multiple state and local taxes.
On The Cusp Of A Micro-Monitoring Revolution
The marriage of information-gathering technology with information storing technology, manipulated in increasingly sophisticated databases, is beginning to produce the defining privacy challenge of the information age. Modern databases, networks and the Internet allow us to easily collect, store, distribute and combine video, audio and other digital trails of our daily transactions. We are on the verge of a revolution in micro-monitoring – the capability for the highly detailed, largely automatic, widespread surveillance of our daily lives.
RFIDs
And one of the most dramatic and dazzling new challenges we all will be facing soon is the emergence of a relatively new, surveillance-related technology called radio frequency identification -- R–F–I–D for short.
RFID tags are tiny computer chips that can be attached to physical items in order to provide identification and tracking by radio. Their potential invasiveness is obvious from their size, which, as shown in this picture, already is surprisingly small. And they will only get smaller.
In their basic function, RFID chips are like barcodes, which by now are ubiquitous in our stores and offices and crime labs and manufacturing plants.
Barcodes On Steroids
But RFID chips are like supercharged barcodes – barcodes on steroids, if you will. They are so small they can be tagged onto almost any object. They do not have to be in open view; RFID receivers just have to be within the vicinity – at a security checkpoint, in a doorway, inside a mailbox, atop a traffic light. And RFID chips can carry a lot more information than barcodes. Some versions are recordable so that they can carry along the object's entire history.
RFID chips are more powerful than today’s video surveillance technology. RFIDs are more reliable, they are 100 percent automatic, and they are likely to become more pervasive because they are significantly less expensive, and there are many business advantages to using them. RFIDs seem poised to become the catalyst that will launch the age of micro-monitoring.
I have followed RFID technology for some time and have welcomed its potential for many constructive uses. I have supported the use of RFIDs in a Vermont pilot program for tracking cattle to curtail outbreaks, like mad cow disease, and our Vermont program is now being emulated for a national tracking system. RFID technology may also help thwart prescription drug counterfeiting, a use the FDA encouraged in a recent report. Leading retailers like Wal-Mart and Target – as well as the Department of Defense -- are requiring its use by suppliers for inventory control. Fifty million pets around the world have embedded RFID chips. Of course, many of us already have experience with simpler versions of the technology in “smart tags” at toll booths and “speed passes” at gas stations.
But this is just the beginning. RFID technology is on the brink of widespread applications in manufacturing, distribution, retail, healthcare, safety, security, law enforcement, intellectual property protection and many other areas, including mundane applications like keeping track of personal possessions. Some visionaries imagine, quote, “an internet of objects” – a world in which billions of objects will report their location, identity, and history over wireless connections. Those days of long hunts around the house for lost keys and remote controls might be a frustration of the past.
These all raise exciting possibilities, but they also raise potentially troubling tangents. While it may be a good idea for a retailer to use RFID chips to manage its inventory, we would not want a retailer to put those tags on goods for sale without consumers’ knowledge, without knowing how to deactivate them, and without knowing what information will be collected and how it will be used. While we might want the Pentagon to be able to manage its supplies with RFID tags, we would not want an al Qaeda operative to find out about our resources by simply using a hidden RFID scanner in a war situation.
Drawing Lines
Of course these are just some of the foreseeable possibilities, and a lot depends on enhancements in the technology, reductions in costs, and developments in voluntary standard-setting, systems and infrastructure to manage RFID-collected information. But the RFID train is beginning to leave the station, and now is the right time to begin a national discussion about where, if at all, any lines will be drawn to protect privacy rights.
The need to draw some lines is already becoming clear. Recent reports revealed clandestine tests at a Wal-Mart store where RFID tags were inserted in packages of Max Factor lipsticks, with RFID scanners hidden on nearby shelves. The radio signals triggered nearby surveillance cameras to allow researchers 750 miles away to watch those consumers in action. A similar test occurred with Gillette razors at another Wal-Mart store.
These excesses suggest that Congress may need to step in at some point. When privacy intrusions reach the point of behavior that is absurdly out of bounds, we find ourselves having to deal with such issues as the “Video Voyeurism Prevention Act,” a bill now before Congress that would ban the use of camera to spy in bathrooms and up women’s skirts, a practice that by now has even been given a name, “upskirting,” which I’m sure is as new to you as it is to most of us in Congress.
Other powerful new technologies are on the horizon, like sensor technology and nanotechnology. All the more reason to think about these issues broadly and to establish guiding principles serving the twin goals of fostering useful technologies while keeping them from overtaking our civil liberties.
With RFID technology as with many other surveillance technologies, we need to consider how it will be used, and will it be effective. What information will it gather, and how long will that data be kept? Who will have access to those data banks, and under what checks-and-balances? Will the public have appropriate notice, opportunity to consent and due process in the case mistakes are made? How will the data be secured from theft, negligence and abuse, and how will accuracy be ensured? In what cases should law enforcement agencies be able to use this information, and what safeguards should apply? There should be a general presumption that Americans can know when their personal information is collected, and to see, check and correct any errors.
These are all questions we need to consider, and it is entirely possible that Congress may decide that enacting general parameters would be constructive. It is important that we let RFID technology reach its potential without unnecessary constraints. But it is equally important that we ensure protections against privacy invasions and other abuses. Technology may also help with the answers -- for example, “blockers” that deactivate RFID tags, and software that thwarts spyware.
Beginning A National Dialogue
There is no downside to a public dialogue about these issues, but there are many dangers in waiting too long to start. We need clear communication about the goals, plans and uses of the technology, so that we can think in advance about the best ways to encourage innovation, while conserving the public’s right to privacy.
We have seen this time and time again where a potentially good approach is hampered because of lack of communication with Congress, the public and lack of adequate consideration for privacy and civil liberties.
Take for example the so-called CAPPS II program. No doubt in a post-9/11 world, we should have an effective airline screening system. But the Administration quietly put this program together, collected passengers’ information without their knowledge and piloted this program without communicating with us and before privacy protections were in place. The result was a recent GAO analysis that showed pervasive problems in the screening program and admissions that we are now set back in our efforts to create an effective screening system.
As another example, the Administration recently funded the MATRIX program to provide law enforcement access to state government and commercial databases. This was potentially a useful crime-fighting tool. But there was insufficient information about the program and about potentially intrusive data mining capabilities, and there were unaddressed concerns about privacy protections. Now 11 out of 16 states participating in the program have pulled out – many, citing privacy concerns – thus hampering the effectiveness of the information sharing program. Again, had some of these issues been vetted in advance, we may have been able to enhance law enforcement intelligence.
Just recently, there were reports about the FBI’s new Strategic Medical Intelligence program, in which doctors have been enlisted to report to the FBI “any suspicious event,” such as an unusual rash or a lost finger. The goal of preventing bio-terrorism is important. But there are many unanswered questions about the program’s privacy protections and its ability to identify truly suspicious events and not unrelated personal medical situations. Hopefully, this program will not be hampered by lack of communication and oversight.
I have written oversight letters to the Justice Department and to the Department of Homeland Security on all of these issues and am waiting for their responses.
I want to make sure that mistakes like those are not repeated, especially with RFID technology, where there is so much potential value. That is why I asked to speak with you today, to begin the process of encouraging public dialogue in both the commercial and public sectors before the RFID genie is let fully out of its bottle.
This is a dialogue that should cut across the political spectrum, and it should include the possibility of constructive, bipartisan congressional hearings. The earlier we begin this discussion, the greater the prospects for success in reaching consensus on a set of guiding principles.
When several of us from both parties banded together years ago to found the Congressional Internet Caucus, we were united by our appreciation for what the Internet would do for our society. Years later, we remain united, we remain optimistic, and partisanship has never interfered in the Caucus’s work.
That is the spirit in which I hope a discussion can now begin on micro-monitoring.
Thank you for your interest in these cutting-edge issues, and thanks for this opportunity to share some ideas with you.
Labels: academia-university, access-control, airline, business-case, case-tracking, cattle, cattle-rfid, center, challenges, checkpoint-rfid, computer, conference, course, defense, drug-authentication, fda, gillette, healthcare, history, identity, innovation, legislation, location, matrix, object, object-tracking, ons-object-naming-service, progress-software, project, retailer, rfid-shelves, risks, safety, scanner, silent, smart-shelves, tools, us-government, what-is-rfid