Congressional Record: March 23, 2004 (Senate)
Page S2989-S2990
RFIDS AND THE DAWNING MICRO MONITORING REVOLUTION
Mr. LEAHY. Mr. President, today I outlined some of the privacy
challenges we will soon face as new micro monitoring technologies begin
to proliferate in our society. I spoke in particular about
breakthroughs in Radio Frequency Identification, also known as RFID.
My remarks were offered at Georgetown University Law Center, during a
conference on the legal and technological challenges of video
surveillance. Micro monitoring is a subject that deserves the attention
of the Senate and of the American people, and I ask unanimous consent
the text of my address be printed in the Record in the interest of
advancing this discussion.
There being no objection, the material was ordered to be printed in
the Record as follows:
The Dawn of Micro Monitoring: It's Promise, and its Challenges to
Privacy and Security
In our post-9/11 world, technology often has been our
crucial but silent partner in helping us to ramp up our law
enforcement and national security capabilities. We in this
city are profoundly aware of the new risks we face. But we
also need to do it right. The public does not want false
assurances, nor do they want to be unduly alarmed. What the
American people want is to actually be safer. And we still
have a way to go in accomplishing that.
Tension Between Liberty And Security
In our constitutional system there is always tension
between liberty and security and never more so than since
September 11th. One of the difficult challenges we face is to
strike the right midpoint. Our constitutional checks and
balances are intended to help us do that.
The video technologies you are discussing today offer tools
that are better, faster and smarter, on scales of magnitude
that are unprecedented. As an advocate of emerging
technologies who also has a keen interest in them, I watch
these breakthroughs with great interest.
I have sought to find ways to encourage the commercial
sector to create new products and opportunities, and I have
promoted use of new technologies by law enforcement agencies,
while also protecting consumer privacy and constitutional
freedoms. That was the balance I sought to strike in my work
on CALEA and in other legislation that blends law
enforcement's needs, the needs of our robust technology
sector, and the privacy interests of the American people. The
hands-off approach to the Internet that I have favored is
another example, and right now I am working with others to
extend the Internet tax moratorium, to keep the Internet free
from discriminatory and multiple state and local taxes.
On The Cusp Of A Micro-Monitoring Revolution
The marriage of information-gathering technology with
information storing technology, manipulated in increasingly
sophisticated databases, is beginning to produce the defining
privacy challenge of the information age. Modern databases,
networks and the Internet allow us to easily collect, store,
distribute and combine video, audio and other digital trails
of our daily transactions. We are on the verge of a
revolution in micro-monitoring the capability for the highly
detailed, largely automatic, widespread surveillance of our
daily lives.
RFIDs
And one of the most dramatic and dazzling new challenges we
all will be facing soon is the emergence of a relatively new,
surveillance-related technology called radio frequency
identification--R-F-I-D for short.
RFID tags are tiny computer chips that can be attached to
physical items in order to provide identification and
tracking by radio. Their potential invasiveness is obvious
from their size, which already is surprisingly small. And
they will only get smaller.
In their basic function, RFID chips are like barcodes,
which by now are ubiquitous in our stores and offices and
crime labs and manufacturing plants.
Barcodes On Steroids
But RFID chips are like supercharged barcodes--barcodes on
steroids, if you will. They are so small they can be tagged
onto almost any object. They do not have to be in open view;
RFID receivers just have to be within the vicinity--at a
security checkpoint, in a doorway, inside a mailbox, atop a
traffic light. And RFID chips can carry a lot more
information than barcodes. Some versions are recordable so
that they can carry along the object's entire history.
RFID chips are more powerful than today's video
surveillance technology. RFIDs are more reliable, they are
100 percent automatic, and they are likely to become more
pervasive because they are significantly less expensive, and
there are many business advantages to using them. RFIDs seem
poised to become the catalyst that will launch the age of
micro-monitoring.
I have followed RFID technology for some time and have
welcomed its potential for many constructive uses. I have
supported the use of RFIDs in a Vermont pilot program for
tracking cattle to curtail outbreaks, like mad cow disease,
and our Vermont program
[[Page S2990]]
is now being emulated for a national tracking system. RFID
technology may also help thwart prescription drug
counterfeiting, a use the FDA encouraged in a recent report.
Leading retailers like Wal-Mart and Target--as well as the
Department of Defense--are requiring its use by suppliers for
inventory control. Fifty million pets around the world have
embedded RFID chips. Of course, many of us already have
experience with simpler versions of the technology in ``smart
tags'' at toll booths and ``speed passes'' at gas stations.
But this is just the beginning. RFID technology is on the
brink of widespread applications in manufacturing,
distribution, retail, healthcare, safety, security, law
enforcement, intellectual property protection and many other
areas, including mundane applications like keeping track of
personal possessions. Some visionaries imagine, quote, ``an
internet of objects''--a world in which billions of objects
will report their location, identity, and history over
wireless connections. Those days of long hunts around the
house for lost keys and remote controls might be a
frustration of the past.
These all raise exciting possibilities, but they also raise
potentially troubling tangents. While it may be a good idea
for a retailer to use RFID chips to manage its inventory, we
would not want a retailer to put those tags on goods for sale
without consumers' knowledge, without knowing how to
deactivate them, and without knowing what information will be
collected and how it will be used. While we might want the
Pentagon to be able to manage its supplies with RFID tags, we
would not want an al Qaeda operative to find out about our
resources by simply using a hidden RFID scanner in a war
situation.
Drawing Lines
Of course these are just some of the foreseeable
possibilities, and a lot depends on enhancements in the
technology, reductions in costs, and developments in
voluntary standard-setting, systems and infrastructure to
manage RFID-collected information. But the RFID train is
beginning to leave the station, and now is the right time to
begin a national discussion about where, if at all, any lines
will be drawn to protect privacy rights.
The need to draw some lines is already becoming clear.
Recent reports revealed clandestine tests at a Wal-Mart store
where RFID tags were inserted in packages of Max Factor
lipsticks, with RFID scanners hidden on nearby shelves. The
radio signals triggered nearby surveillance cameras to allow
researchers 750 miles away to watch those consumers in
action. A similar test occurred with Gillette razors at
another Wal-Mart store.
These excesses suggest that Congress may need to step in at
some point. When privacy intrusions reach the point of
behavior that is absurdly out of bounds, we find ourselves
having to deal with such issues as the ``Video Voyeurism
Prevention Act,'' a bill now before Congress that would ban
the use of camera to spy in bathrooms and up women's skirts,
a practice that by now has even been given a name,
``upskirting,'' which I'm sure is as new to you as it is to
most of us in Congress.
Other powerful new technologies are on the horizon, like
sensor technology and nanotechnology. All the more reason to
think about these issues broadly and to establish guiding
principles serving the twin goals of fostering useful
technologies while keeping them from overtaking our civil
liberties.
With RFID technology as with many other surveillance
technologies, we need to consider how it will be used, and
will it be effective. What information will it gather, and
how long will that data be kept? Who will have access to
those data banks, and under what checks-and-balances? Will
the public have appropriate notice, opportunity to consent
and due process in the case mistakes are made? How will the
data be secured from theft, negligence and abuse, and how
will accuracy be ensured? In what cases should law
enforcement agencies be able to use this information, and
what safeguards should apply? There should be a general
presumption that Americans can know when their personal
information is collected, and to see, check and correct any
errors.
These are all questions we need to consider, and it is
entirely possible that Congress may decide that enacting
general parameters would be constructive. It is important
that we let RFID technology reach its potential without
unnecessary constraints. But it is equally important that we
ensure protections against privacy invasions and other
abuses. Technology may also help with the answers--for
example, ``blockers'' that deactivate RFID tags, and software
that thwarts spyware.
Beginning A National Dialogue
There is no downside to a public dialogue about these
issues, but there are many dangers in waiting too long to
start. We need clear communication about the goals, plans and
uses of the technology, so that we can think in advance about
the best ways to encourage innovation, while conserving the
public's right to privacy.
We have seen this time and time again where a potentially
good approach is hampered because of lack of communication
with Congress, the public and lack of adequate consideration
for privacy and civil liberties.
Take for example the so-called CAPPS II program. No doubt
in a post-9/11 world, we should have an effective airline
screening system. But the Administration quietly put this
program together, collected passengers' information without
their knowledge and piloted this program without
communicating with us and before privacy protections were in
place. The result was a recent GAO analysis that showed
pervasive problems in the screening program and admissions
that we are now set back in our efforts to create an
effective screening system.
As another example, the Administration recently funded the
MATRIX program to provide law enforcement access to state
government and commercial databases. This was potentially a
useful crime-fighting tool. But there was insufficient
information about the program and about potentially intrusive
data mining capabilities, and there were unaddressed concerns
about privacy protections. Now 11 out of 16 states
participating in the program have pulled out--many, citing
privacy concerns--thus hampering the effectiveness of the
information sharing program. Again, had some of these issues
been vetted in advance, we may have been able to enhance law
enforcement intelligence.
Just recently, there were reports about the FBI's new
Strategic Medical Intelligence program, in which doctors have
been enlisted to report to the FBI ``any suspicious event,''
such as an unusual rash or a lost finger. The goal of
preventing bio-terrorism is important. But there are many
unanswered questions about the program's privacy protections
and its ability to identify truly suspicious events and not
unrelated personal medical situations. Hopefully, this
program will not be hampered by lack of communication and
oversight.
I have written oversight letters to the Justice Department
and to the Department of Homeland Security on all of these
issues and am waiting for their responses.
I want to make sure that mistakes like those are not
repeated, especially with RFID technology, where there is so
much potential value. That is why I asked to speak with you
today, to begin the process of encouraging public dialogue in
both the commercial and public sectors before the RFID genie
is let fully out of its bottle.
This is a dialogue that should cut across the political
spectrum, and it should include the possibility of
constructive, bipartisan congressional hearings. The earlier
we begin this discussion, the greater the prospects for
success in reaching consensus on a set of guiding principles.
When several of us from both parties banded together years
ago to found the Congressional Internet Caucus, we were
united by our appreciation for what the Internet would do for
our society. Years later, we remain united, we remain
optimistic, and partisanship has never interfered in the
Caucus's work.
That is the spirit in which I hope a discussion can now
begin on micro-monitoring.
Thank you for your interest in these cutting-edge issues,
and thanks for this opportunity to share some ideas with you.
____________________
