COMMUNICATIONS OF THE ACM December 2006/Vol. 49, No. 12 91 RFID AND THE END OF CASH? Illustration by ROLAND S ARKANY By IAN ANGELL and JAN KIETZMANN RFID-embedded money is likely to mean the end of anonymous transactions and with it one of the last bastions of personal anonymity. Thinking about buying a new car with cash? How about paying school fees? Don’t bother. Such money is not welcome. Western banks today treat all large cash deposits as “suspicious transactions,” covering their backs by immedi- ately reporting cash-loaded customers to the authorities for carrying sums far less than the minimum amounts required by regulations. Governments say “Only the guilty deal in cash.” Consequently, sensible businesses avoid large cash deals. Depositing cash into the banking system means everything is electroni- cally recorded. New anti-money-laundering regulations, especially since the terror attacks of September 11, 2001, identify these deposits as the entry point of an audit trail of suspicious transac- tions. What is going on? COMMENTARY
Transcript
COMMUNICATIONS OF THE ACM December 2006/Vol. 49, No. 12 91
RFID AND THE END OF CASH?
Illustration by ROLAND SARKANY
By IAN ANGELL andJAN KIETZMANN
RFID-embeddedmoney is likely to mean the end of anonymoustransactions andwith it one of the last bastions of personalanonymity.
Thinking about buying a new car with cash?How about paying school fees? Don’t bother.Such money is not welcome. Western bankstoday treat all large cash deposits as “suspicioustransactions,” covering their backs by immedi-ately reporting cash-loaded customers to theauthorities for carrying sums far less than theminimum amounts required by regulations.Governments say “Only the guilty deal incash.” Consequently, sensible businesses avoidlarge cash deals. Depositing cash into thebanking system means everything is electroni-cally recorded. New anti-money-laundering regulations, especiallysince the terror attacks of September 11, 2001, identify thesedeposits as the entry point of an audit trail of suspicious transac-tions. What is going on?
C O M M E N TA RY
security services, and tax collectors—may be given theright, nay the obligation, to invade the privacy of cit-izens with impunity.
How do democratic governments get their citizensto accept a wholesale loss of privacy? The trick is toconvince them that such intrusion is in their own self-interest and may even deliver personal benefits. Somepoliticians seize the moral high ground by stirring upa smokescreen of public outrage against drug traffick-ing, terrorism, corporate greed, pedophilia, and coun-terfeiting. They also make the highly suspect claimthat the pairing of regulation and technology will curethese social ills, protecting the individual from fraudand theft. Unfortunately, this duo comes at a cost. Forexample, of the £250 billion estimated to have beenlaundered through the U.K., the government hasrecovered a mere £46 million, at a cost of £400 million [2].
The USA PATRIOT Act of 2001 and in the U.K.the Regulation of Investigatory Powers Act of 2000and the Proceeds of Crime Act of 2002 were allapproved with atypical haste. Legislators have learnedthe lesson of the 1931 conviction of Al Capone by theU.S. Department of the Treasury. If you can’t catch acriminal in the act, “follow the money” instead. Invertthe burden of proof. The accused (in fact everyone) isguilty until proven innocent, where proof of inno-cence is nothing less than the unconditional surrenderof all personal and financial information. No surprisethat anti-money-laundering regulations, especially the“know your customer” rules, demand that every bankofficial act as a secret policeman for the government.
Should the privacy dissident operate in electroniccash? No. E-cash is hopelessly compromised, withissuers intimidated into insinuating an audit trail inthe encrypted data; it is just a glorified debit card. Per-haps the dissident should stay well away from the gov-ernment-regulated banking system, using onlyhigh-denomination bank notes. Unfortunately, thiswell-used tactic no longer provides the desired level ofanonymity, owing to its convergence with anothertechnology.
RFID’s ability to perform as an auto-identificationtechnology was first utilized by the Royal Air Force inWorld War II to differentiate between friendly andenemy aircraft. Friendly planes were equipped withbulky “active” RFID transponders (tags) energized byan attached power supply and interrogated by anRFID transceiver (reader). Applications today rely onsimilar communication between RFID tag and reader,although the tags (miniscule microchips attached toantennae) are generally “passive,” powered by an elec-tromagnetic field emitted by the reader. Radio signalsinform nearby readers of a serial number stored on the
tag that uniquely identifies any item bearing the tag.So-called “smart tags” are used to track or traceobjects. Worldwide in 2003, they helped keep track ofabout 100 million pets and 20 million livestock [3].
The Auto-ID Center, established in 1999 as anacademic research project at the MassachusettsInstitute of Technology, developed the archi-
tecture for creating a seamless global network of allphysical objects (www.autoidlabs.org/aboutthelabs.html). The technology has since been transferred toEPCglobal (www.epcglobalinc.org), which overseesdevelopment of standards for electronic product code(EPC) tags. These tags are used for every imaginableitem—from clothes to medicine, electronics, food,motor vehicles, books, door locks, and airplanes—revolutionizing logistics and supply-chain and inven-tory management worldwide. For example,Legoland in Denmark uses RFID and 802.11WLAN technology to find lost children [4], andU.S. forces employ Texas Instruments wristbands tohelp track wounded U.S. soldiers and prisoners ofwar in Iraq.
The turn of the century saw substantial gains inthe efficiency of power conversion in circuits, pro-viding power for cryptographic operations. The leastexpensive and least powerful tags (such as basic EPCtags) provide no layers of security. More advancedand costly tags require additional power for cryptog-raphy (such as for static key operations in PINs andpasswords, symmetric key encryption, and crypto-graphic co-processors). These extra levels of securityenable novel opportunities, not only for commercialtransactions but for money itself.
An RF-emitting tag can be small enough to fitinto bank notes so as to uniquely identify each oneas it passes within range of a sensor. The authoritiesclaim its purpose is to combat counterfeiting andidentify money transfers between suspicious parties.RFID readers interrogate multiple tags simultane-ously. Every time notes are passed to or from a bank,RFID readers identify and record them, linking thisdata with the person who presented or receivedthem. The government has the potential to knownot only exactly how much cash is being carriedout/in the door but who is carrying it and who car-ried it previously. By comparing the respective iden-tification numbers to entries in their database (forauthentication purposes, of course), the authoritiescan draw a link between the last recorded holder ofthe note and the current one.
This web of contact information is also incom-plete. It misses out on the numerous cash transac-
COMMUNICATIONS OF THE ACM December 2006/Vol. 49, No. 12 9392 December 2006/Vol. 49, No. 12 COMMUNICATIONS OF THE ACM
Legislators in the West have decidedthat the deregulation of the past decades,particularly concerning money (such asthe loosening of exchange controls), hasgone too far. Despite profiting substan-tially from seigniorage, including theprofit resulting from the difference in thecost of printing money and the money’sface value, governments grudgingly issueexchangeable money; or else other privategroups would. Harking back to Plato andhis moneyless utopian Republic, govern-ments today prefer a perfect society witha nonconvertible currency that (theyclaim) safeguards their economies fromexternal meddling and from losing thewealth of those dissidents who choose toescape what they see as state oppression.New technology raises the spectre of thestate gaining total control over money,achieving this nominal collectivist heavenby destroying the essence of cash—thecornerstone of individual freedom.
This scenario seems paradoxical giventhat global telecommunications is bring-ing about the death of distance. Busi-nesses, along with some individuals, havebecome truly international. Today’s con-vergence of the Internet, mobile technol-ogy, and electronic payment schemesmakes everyone a trader, a global business elite that isof one mind: arbitrage the new opportunities to min-imize their tax liability.
However, most governments are addicted totaxation. Democracies are no exception; howelse could they afford to subsidize the bene-
fits they deliver to preferred voters and contributors?Increased regulation makes the state even more costlyto run, so the tax take must increase. The state is aFaustian pact, where the individual submits to its“legitimate violence” in return for protection andsecurity [12]. The government, from its side of thisbargain, demands ownership of its citizens and themonopolistic right to tax them at whatever levelwhenever it wishes, calling it “balancing the budget.”However, taxing cash is complicated due to its threeinterrelated properties: anonymity, fungibility, andability to store value.
Although credit and debit cards do away with theneed for cash, the amount of cash in circulation isincreasing in almost all countries. As of July 2004,U.S.$730 billion in coins and notes was in circulation
in the U.S., much of the increasedue to the use of ATMs anddemand from abroad [5]. Govern-ments don’t easily give up on theirtax take, developing tactics foreroding anonymity, fungibility,and the ability to store value thatmake cash so attractive to taxevaders.
Cash has no provenance.Unlike with checks and creditcards, it is very difficult in cashtransactions to associate a pur-chaser with a purchase or a partic-ular purchase with otherpurchases. Audit trails have to beseparately and expensivelyimposed. Roman Emperor Ves-pasian 2,000 years ago may havebelieved pecunia non olet (moneydoesn’t stink), but modern govern-ments sense the possibility of cashgiving off the unmistakable odorof each identifiable bearer, makingit a de facto identity card andnegating the personal freedomencapsulated in anonymousmoney.
Although individual banknotes have unique identification
numbers, they are not tracked from the moment ofissue. Indeed, until recently it was too costly to trackthe cash transactions of individuals (even their checksand credit card transactions), except in special high-priority cases. Now there is computerized profiling,data mining, and radio-frequency identification(RFID). The government’s long-term aim may be toturn society into a Panopticon, using it as an analogyfor a prison in which an unseen guard observes allprisoners without them knowing they are beingobserved. By constructing a complete record of thepersonal debits and credits of all its citizens, therebyspinning a web connecting all buyers and sellers, theInternal Revenue Service and its equivalents outsidethe U.S. not only calculate every tax bill but are ableto seize payment from those operating in both theofficial economy and the underground “shadow economy.”
In a democratic regime, this assault on individualfreedom must appear benign so as to avoid populardiscontent. Democracies are obliged to profess supe-rior morality and/or utility in order to convince citi-zens of the rightness of their legitimate violence [12].The enforcers of state power—the police, national
THE MOREDETAILED THE
RECORDING OF RFIDTRANSFERS, THE
TIGHTER THE NETBECOMES, AND
THE MORELIMITATIONS THAT
ARE PLACED ONTHE INDIVIDUAL’S
ABILITY TO REMAINANONYMOUS.
security services, and tax collectors—may be given theright, nay the obligation, to invade the privacy of cit-izens with impunity.
How do democratic governments get their citizensto accept a wholesale loss of privacy? The trick is toconvince them that such intrusion is in their own self-interest and may even deliver personal benefits. Somepoliticians seize the moral high ground by stirring upa smokescreen of public outrage against drug traffick-ing, terrorism, corporate greed, pedophilia, and coun-terfeiting. They also make the highly suspect claimthat the pairing of regulation and technology will curethese social ills, protecting the individual from fraudand theft. Unfortunately, this duo comes at a cost. Forexample, of the £250 billion estimated to have beenlaundered through the U.K., the government hasrecovered a mere £46 million, at a cost of £400 million [2].
The USA PATRIOT Act of 2001 and in the U.K.the Regulation of Investigatory Powers Act of 2000and the Proceeds of Crime Act of 2002 were allapproved with atypical haste. Legislators have learnedthe lesson of the 1931 conviction of Al Capone by theU.S. Department of the Treasury. If you can’t catch acriminal in the act, “follow the money” instead. Invertthe burden of proof. The accused (in fact everyone) isguilty until proven innocent, where proof of inno-cence is nothing less than the unconditional surrenderof all personal and financial information. No surprisethat anti-money-laundering regulations, especially the“know your customer” rules, demand that every bankofficial act as a secret policeman for the government.
Should the privacy dissident operate in electroniccash? No. E-cash is hopelessly compromised, withissuers intimidated into insinuating an audit trail inthe encrypted data; it is just a glorified debit card. Per-haps the dissident should stay well away from the gov-ernment-regulated banking system, using onlyhigh-denomination bank notes. Unfortunately, thiswell-used tactic no longer provides the desired level ofanonymity, owing to its convergence with anothertechnology.
RFID’s ability to perform as an auto-identificationtechnology was first utilized by the Royal Air Force inWorld War II to differentiate between friendly andenemy aircraft. Friendly planes were equipped withbulky “active” RFID transponders (tags) energized byan attached power supply and interrogated by anRFID transceiver (reader). Applications today rely onsimilar communication between RFID tag and reader,although the tags (miniscule microchips attached toantennae) are generally “passive,” powered by an elec-tromagnetic field emitted by the reader. Radio signalsinform nearby readers of a serial number stored on the
tag that uniquely identifies any item bearing the tag.So-called “smart tags” are used to track or traceobjects. Worldwide in 2003, they helped keep track ofabout 100 million pets and 20 million livestock [3].
The Auto-ID Center, established in 1999 as anacademic research project at the MassachusettsInstitute of Technology, developed the archi-
tecture for creating a seamless global network of allphysical objects (www.autoidlabs.org/aboutthelabs.html). The technology has since been transferred toEPCglobal (www.epcglobalinc.org), which overseesdevelopment of standards for electronic product code(EPC) tags. These tags are used for every imaginableitem—from clothes to medicine, electronics, food,motor vehicles, books, door locks, and airplanes—revolutionizing logistics and supply-chain and inven-tory management worldwide. For example,Legoland in Denmark uses RFID and 802.11WLAN technology to find lost children [4], andU.S. forces employ Texas Instruments wristbands tohelp track wounded U.S. soldiers and prisoners ofwar in Iraq.
The turn of the century saw substantial gains inthe efficiency of power conversion in circuits, pro-viding power for cryptographic operations. The leastexpensive and least powerful tags (such as basic EPCtags) provide no layers of security. More advancedand costly tags require additional power for cryptog-raphy (such as for static key operations in PINs andpasswords, symmetric key encryption, and crypto-graphic co-processors). These extra levels of securityenable novel opportunities, not only for commercialtransactions but for money itself.
An RF-emitting tag can be small enough to fitinto bank notes so as to uniquely identify each oneas it passes within range of a sensor. The authoritiesclaim its purpose is to combat counterfeiting andidentify money transfers between suspicious parties.RFID readers interrogate multiple tags simultane-ously. Every time notes are passed to or from a bank,RFID readers identify and record them, linking thisdata with the person who presented or receivedthem. The government has the potential to knownot only exactly how much cash is being carriedout/in the door but who is carrying it and who car-ried it previously. By comparing the respective iden-tification numbers to entries in their database (forauthentication purposes, of course), the authoritiescan draw a link between the last recorded holder ofthe note and the current one.
This web of contact information is also incom-plete. It misses out on the numerous cash transac-
COMMUNICATIONS OF THE ACM December 2006/Vol. 49, No. 12 9392 December 2006/Vol. 49, No. 12 COMMUNICATIONS OF THE ACM
Legislators in the West have decidedthat the deregulation of the past decades,particularly concerning money (such asthe loosening of exchange controls), hasgone too far. Despite profiting substan-tially from seigniorage, including theprofit resulting from the difference in thecost of printing money and the money’sface value, governments grudgingly issueexchangeable money; or else other privategroups would. Harking back to Plato andhis moneyless utopian Republic, govern-ments today prefer a perfect society witha nonconvertible currency that (theyclaim) safeguards their economies fromexternal meddling and from losing thewealth of those dissidents who choose toescape what they see as state oppression.New technology raises the spectre of thestate gaining total control over money,achieving this nominal collectivist heavenby destroying the essence of cash—thecornerstone of individual freedom.
This scenario seems paradoxical giventhat global telecommunications is bring-ing about the death of distance. Busi-nesses, along with some individuals, havebecome truly international. Today’s con-vergence of the Internet, mobile technol-ogy, and electronic payment schemesmakes everyone a trader, a global business elite that isof one mind: arbitrage the new opportunities to min-imize their tax liability.
However, most governments are addicted totaxation. Democracies are no exception; howelse could they afford to subsidize the bene-
fits they deliver to preferred voters and contributors?Increased regulation makes the state even more costlyto run, so the tax take must increase. The state is aFaustian pact, where the individual submits to its“legitimate violence” in return for protection andsecurity [12]. The government, from its side of thisbargain, demands ownership of its citizens and themonopolistic right to tax them at whatever levelwhenever it wishes, calling it “balancing the budget.”However, taxing cash is complicated due to its threeinterrelated properties: anonymity, fungibility, andability to store value.
Although credit and debit cards do away with theneed for cash, the amount of cash in circulation isincreasing in almost all countries. As of July 2004,U.S.$730 billion in coins and notes was in circulation
in the U.S., much of the increasedue to the use of ATMs anddemand from abroad [5]. Govern-ments don’t easily give up on theirtax take, developing tactics foreroding anonymity, fungibility,and the ability to store value thatmake cash so attractive to taxevaders.
Cash has no provenance.Unlike with checks and creditcards, it is very difficult in cashtransactions to associate a pur-chaser with a purchase or a partic-ular purchase with otherpurchases. Audit trails have to beseparately and expensivelyimposed. Roman Emperor Ves-pasian 2,000 years ago may havebelieved pecunia non olet (moneydoesn’t stink), but modern govern-ments sense the possibility of cashgiving off the unmistakable odorof each identifiable bearer, makingit a de facto identity card andnegating the personal freedomencapsulated in anonymousmoney.
Although individual banknotes have unique identification
numbers, they are not tracked from the moment ofissue. Indeed, until recently it was too costly to trackthe cash transactions of individuals (even their checksand credit card transactions), except in special high-priority cases. Now there is computerized profiling,data mining, and radio-frequency identification(RFID). The government’s long-term aim may be toturn society into a Panopticon, using it as an analogyfor a prison in which an unseen guard observes allprisoners without them knowing they are beingobserved. By constructing a complete record of thepersonal debits and credits of all its citizens, therebyspinning a web connecting all buyers and sellers, theInternal Revenue Service and its equivalents outsidethe U.S. not only calculate every tax bill but are ableto seize payment from those operating in both theofficial economy and the underground “shadow economy.”
In a democratic regime, this assault on individualfreedom must appear benign so as to avoid populardiscontent. Democracies are obliged to profess supe-rior morality and/or utility in order to convince citi-zens of the rightness of their legitimate violence [12].The enforcers of state power—the police, national
THE MOREDETAILED THE
RECORDING OF RFIDTRANSFERS, THE
TIGHTER THE NETBECOMES, AND
THE MORELIMITATIONS THAT
ARE PLACED ONTHE INDIVIDUAL’S
ABILITY TO REMAINANONYMOUS.
that only tagged items are secure, andindustry proclaims the convenienceand savings made possible throughmobile RFID readers. It is not surpris-ing that two main supporters of RFIDare the U.S. Department of Defenseand Wal-Mart and are likely to bejoined by the mobile technology sec-tor and others once new revenuestreams are more apparent.
Benefits to major corporations andgovernments will not in and of them-selves generate public acceptance oftagged cash. That acceptance is essen-tial if the technology is to overcomeprivacy objections. Hence the issue ofmobile RFID and tagged bank notes,while contributing to decreasedanonymity, is being marketed to indi-viduals as a self-evident personaladvantage. Once people are proffereda bank note, their mobile phones readthe tag, establish a connection to theauthority’s database, and receive con-firmation of the note’s authenticityand validity and of the legitimacy ofthe bearer. Fraud will decrease dra-matically. As a byproduct of theprocess, the government will obtainyet more information for its databaseof cash transfers from private citizens, as well as fromthe banking, retail, and service sectors. As taggedproduct purchases find their way into our homes, wewill be only a step away from installing indoorreceivers into our shelves, floors, and doorways [1].The net on anonymity will continue to tighten. Thecriticism of Katherine Albrecht, founder and directorof an advocacy group called Consumers AgainstSupermarket Privacy Invasion and Numbering(www.spychips.com), and others have convincedAuto-ID Labs around the world to address the grow-ing concern and work on ways to deal with the pri-vacy issue.
This is just as well, because the databases of tagsand their bearers maintained by various governmentsdon’t stop with money. In the name of homelandsecurity, new U.S. passports will contain standardpassport data in an embedded tag that can trigger therespective name, address, and digital picture.Although not encrypted, security will be warrantedthrough digital signatures [11]. The world’s nationalborders will be equipped with readers, therebyincreasing control of the transnational flow of people.By extension, immigration officials will be able to
identify individual travelers throughthe tagged cash and goods they carry.There will be no more slippingthrough customs without paying dutyor carrying suitcases full of money toSwitzerland.
However, because RFID technol-ogy doesn’t require a physical connec-tion between tag and reader, officialswill be able to validate a person’s iden-tity not only at the port or airport butalso in any public or private spacewithin the limited range of the RFIDtag/readers, all without the expresspermission or even awareness of theperson. As the range at which tags maybe read increases and the technologyimproves, will unreasonable searchand seizure become imperceptiblesearch and seizure?
But it’s not only the governmentwatching from the shadows.Privacy advocates argue that
mobile RFID readers can lead toincreased identity theft, high-techstalking, and commercial data collec-tion [11], perhaps with the intent ofhijacking the seemingly good inten-
tions of RFID-tagged goods and cash. Indeed, retail-ers are concerned that thieves equipped with mobileRFID devices will create new and sophisticated waysof shoplifting. Anarchists have long dreamed of thedestruction of the state by destroying its power toissue and control money. In “chaos attacks,” they hopeto damage tags embedded in cash to render it practi-cally invalid until exchanged at banks for good moneywith valid tags, causing major inconvenience and dis-ruption. Global retail chains (such as McDonald’s),for years targets of environmental activists, would findcollecting and then validating large amounts of cash aconstant headache.
When only fully functioning tagged money will begood money, what happens when a tag is destroyed,whether by accident or on purpose? General access tothe government’s provenance database of money(needed to replace genuinely damaged bank notes)will introduce unimagined levels of complexity intothe system, along with the likelihood of database fail-ure. How do we ensure that thieves do not screen thetagged content of our wallets to find out if we areworth robbing? Innocents will need to engage incountermeasures: wallets will contain RFID shielding
COMMUNICATIONS OF THE ACM December 2006/Vol. 49, No. 12 95
tions not captured by banks, including those thatoccurred as the note was passed hand to hand, start-ing with the party who issued it and ending withwhoever returned it to the bank. To increase the accu-racy of their records, authorities will indeed expectintermediate retail and service outlets to identify cus-tomers, then read and report their tags. Cash registerscan record all transactions, good and bad, legal andillegal, honest and dishonest, and identify notes thatenter their system, flagging those that are either coun-terfeit or no longer accepted as legal tender. The newRFID-based technology gives the authorities thepower to cancel a particular note. The more detailedthe recording of RFID transfers, the tighter the netbecomes, and the more limitations that are placed onthe individual’s ability to remain anonymous.
A 2004 Internet hoax involved $20 bills with anRFID tag in Andrew Jackson’s eye [10]. So it’s all aruse? Not at all. The 10,000-yen bills (~$100) of2004 were to be implanted with Hitachi’s 0.4mm2,60-micron-thick “!-chip” [8], each costing around50 yen [9]. Plausibly, as the price of tags decreases fur-ther, they will be embedded into smaller-denomina-tion bank notes to increase the recording andmonitoring of yet more cash transactions. The Euro-pean Union considered implanting tags in its notes bythe end of 2005, though this is on hold, and theSwedish National Bank has announced a similar idea.Is the U.K. or U.S. next?
No more anonymous cash. But worse, two otherproperties of cash—fungibility and stored value—arealso under attack. Each bank note, whatever itsdenomination, should be as good as any other, butnot if it’s rejected, discounted, or terminated. Byinsisting that only bank notes with operational tagsare legal tender, governments may cancel the cash oftargeted individuals.
What a great method for instantly taxing citizens.Governments calculate the tax owed and take the cor-rect sum straight out of each taxpayer’s pocket by can-celing bank notes, then reprinting and reissuing newones bearing different RFID tags. The possibilities arelimitless. By giving each note an expiration date, gov-ernments may force bearers of cash to spend theirmoney. The government can also hold out the threatof instant devaluation, with the value of a bank notebeing not the numbers printed on the note itself butthe amount coded into the tag, drastically transform-ing the notion of stored value.
Why doesn’t everyone object loudly and publicly?It’s not just ignorance of the technology. A very realopportunity presents itself, as RFID technology findsits way into the home at a price all can afford. Theviral message is going out that the benefits far out-
weigh the hazards through a marketing blitz aimed atgaining widespread public acceptance.
It’s not only that passive RFID tag technology israpidly maturing among a passive (some might sayapathetic) public. Innovators predict huge public
demand for the products of the convergence of per-sonal RFID readers and mobile telephones. Themobile telephony industry senses a killer application.Who wouldn’t pay to locate misplaced keys, specta-cles, gloves, or socks (conveniently tagged by theirmanufacturers)? By marrying an asynchronous readerwith a synchronous mobile phone, the emergentdevice would be able to read and transfer tag dataanywhere in near real time. Connecting phonesand/or tags would make it possible to send andreceive electronic funds. Accessing a tag might alsotrigger a connection to the manufacturer or retailer’sInternet presence through a mobile phone. Applica-tions for mobile phones equipped with RFID readersare endless, promising to introduce huge new revenuestreams to handset manufacturers, application devel-opers, and service providers.
The security infrastructure surrounding this tech-nology, balancing privacy against commercial applica-tions, is a major concern. RFID does not requireline-of-sight for reading tags, operating instead onradio frequency. Hence, private data about peopleand their belongings and shopping behavior can bereceived simply by waving a reader near their clothes,handbags, and other personal items. The size of theirshirts is no longer their personal secret, nor is theamount of cash they are carrying. By collecting tagdata on the person being RF-interrogated, the “datavoyeur” might create a complete commercial, and,worse, personal profile.
One may argue that this problem would be solvedby disabling each tag when it leaves a shop, but this isneither in the interest of the retailer nor, in fact, of thecustomer. Tags will store warranty information (paperreceipts will no longer be accepted) and, more impor-tant, the rights of ownership (a stolen item is easilyidentified). It is thus in the interest of the purchaserto keep tags alive. Furthermore, using RFID-enabledphones in the exchange of goods and money is both aguarantee and a proof of the transfer of ownership.Only a troublemaker would want to destroy or dis-able such useful data.
So there are very real general benefits in RFIDtechnology. However, this does not mean that themixing of cash and mobile RFID will receive strongsupport. As with many new technologies, innovatorspromise utopia; meanwhile, governments may declare
94 December 2006/Vol. 49, No. 12 COMMUNICATIONS OF THE ACM
BY COLLECTINGTAG DATA ON
THE PERSON BEINGRF-INTERROGATED, THE “DATA VOYEUR”
MIGHT CREATEA COMPLETE
COMMERCIAL, AND, WORSE,
PERSONALPROFILE.
that only tagged items are secure, andindustry proclaims the convenienceand savings made possible throughmobile RFID readers. It is not surpris-ing that two main supporters of RFIDare the U.S. Department of Defenseand Wal-Mart and are likely to bejoined by the mobile technology sec-tor and others once new revenuestreams are more apparent.
Benefits to major corporations andgovernments will not in and of them-selves generate public acceptance oftagged cash. That acceptance is essen-tial if the technology is to overcomeprivacy objections. Hence the issue ofmobile RFID and tagged bank notes,while contributing to decreasedanonymity, is being marketed to indi-viduals as a self-evident personaladvantage. Once people are proffereda bank note, their mobile phones readthe tag, establish a connection to theauthority’s database, and receive con-firmation of the note’s authenticityand validity and of the legitimacy ofthe bearer. Fraud will decrease dra-matically. As a byproduct of theprocess, the government will obtainyet more information for its databaseof cash transfers from private citizens, as well as fromthe banking, retail, and service sectors. As taggedproduct purchases find their way into our homes, wewill be only a step away from installing indoorreceivers into our shelves, floors, and doorways [1].The net on anonymity will continue to tighten. Thecriticism of Katherine Albrecht, founder and directorof an advocacy group called Consumers AgainstSupermarket Privacy Invasion and Numbering(www.spychips.com), and others have convincedAuto-ID Labs around the world to address the grow-ing concern and work on ways to deal with the pri-vacy issue.
This is just as well, because the databases of tagsand their bearers maintained by various governmentsdon’t stop with money. In the name of homelandsecurity, new U.S. passports will contain standardpassport data in an embedded tag that can trigger therespective name, address, and digital picture.Although not encrypted, security will be warrantedthrough digital signatures [11]. The world’s nationalborders will be equipped with readers, therebyincreasing control of the transnational flow of people.By extension, immigration officials will be able to
identify individual travelers throughthe tagged cash and goods they carry.There will be no more slippingthrough customs without paying dutyor carrying suitcases full of money toSwitzerland.
However, because RFID technol-ogy doesn’t require a physical connec-tion between tag and reader, officialswill be able to validate a person’s iden-tity not only at the port or airport butalso in any public or private spacewithin the limited range of the RFIDtag/readers, all without the expresspermission or even awareness of theperson. As the range at which tags maybe read increases and the technologyimproves, will unreasonable searchand seizure become imperceptiblesearch and seizure?
But it’s not only the governmentwatching from the shadows.Privacy advocates argue that
mobile RFID readers can lead toincreased identity theft, high-techstalking, and commercial data collec-tion [11], perhaps with the intent ofhijacking the seemingly good inten-
tions of RFID-tagged goods and cash. Indeed, retail-ers are concerned that thieves equipped with mobileRFID devices will create new and sophisticated waysof shoplifting. Anarchists have long dreamed of thedestruction of the state by destroying its power toissue and control money. In “chaos attacks,” they hopeto damage tags embedded in cash to render it practi-cally invalid until exchanged at banks for good moneywith valid tags, causing major inconvenience and dis-ruption. Global retail chains (such as McDonald’s),for years targets of environmental activists, would findcollecting and then validating large amounts of cash aconstant headache.
When only fully functioning tagged money will begood money, what happens when a tag is destroyed,whether by accident or on purpose? General access tothe government’s provenance database of money(needed to replace genuinely damaged bank notes)will introduce unimagined levels of complexity intothe system, along with the likelihood of database fail-ure. How do we ensure that thieves do not screen thetagged content of our wallets to find out if we areworth robbing? Innocents will need to engage incountermeasures: wallets will contain RFID shielding
COMMUNICATIONS OF THE ACM December 2006/Vol. 49, No. 12 95
tions not captured by banks, including those thatoccurred as the note was passed hand to hand, start-ing with the party who issued it and ending withwhoever returned it to the bank. To increase the accu-racy of their records, authorities will indeed expectintermediate retail and service outlets to identify cus-tomers, then read and report their tags. Cash registerscan record all transactions, good and bad, legal andillegal, honest and dishonest, and identify notes thatenter their system, flagging those that are either coun-terfeit or no longer accepted as legal tender. The newRFID-based technology gives the authorities thepower to cancel a particular note. The more detailedthe recording of RFID transfers, the tighter the netbecomes, and the more limitations that are placed onthe individual’s ability to remain anonymous.
A 2004 Internet hoax involved $20 bills with anRFID tag in Andrew Jackson’s eye [10]. So it’s all aruse? Not at all. The 10,000-yen bills (~$100) of2004 were to be implanted with Hitachi’s 0.4mm2,60-micron-thick “!-chip” [8], each costing around50 yen [9]. Plausibly, as the price of tags decreases fur-ther, they will be embedded into smaller-denomina-tion bank notes to increase the recording andmonitoring of yet more cash transactions. The Euro-pean Union considered implanting tags in its notes bythe end of 2005, though this is on hold, and theSwedish National Bank has announced a similar idea.Is the U.K. or U.S. next?
No more anonymous cash. But worse, two otherproperties of cash—fungibility and stored value—arealso under attack. Each bank note, whatever itsdenomination, should be as good as any other, butnot if it’s rejected, discounted, or terminated. Byinsisting that only bank notes with operational tagsare legal tender, governments may cancel the cash oftargeted individuals.
What a great method for instantly taxing citizens.Governments calculate the tax owed and take the cor-rect sum straight out of each taxpayer’s pocket by can-celing bank notes, then reprinting and reissuing newones bearing different RFID tags. The possibilities arelimitless. By giving each note an expiration date, gov-ernments may force bearers of cash to spend theirmoney. The government can also hold out the threatof instant devaluation, with the value of a bank notebeing not the numbers printed on the note itself butthe amount coded into the tag, drastically transform-ing the notion of stored value.
Why doesn’t everyone object loudly and publicly?It’s not just ignorance of the technology. A very realopportunity presents itself, as RFID technology findsits way into the home at a price all can afford. Theviral message is going out that the benefits far out-
weigh the hazards through a marketing blitz aimed atgaining widespread public acceptance.
It’s not only that passive RFID tag technology israpidly maturing among a passive (some might sayapathetic) public. Innovators predict huge public
demand for the products of the convergence of per-sonal RFID readers and mobile telephones. Themobile telephony industry senses a killer application.Who wouldn’t pay to locate misplaced keys, specta-cles, gloves, or socks (conveniently tagged by theirmanufacturers)? By marrying an asynchronous readerwith a synchronous mobile phone, the emergentdevice would be able to read and transfer tag dataanywhere in near real time. Connecting phonesand/or tags would make it possible to send andreceive electronic funds. Accessing a tag might alsotrigger a connection to the manufacturer or retailer’sInternet presence through a mobile phone. Applica-tions for mobile phones equipped with RFID readersare endless, promising to introduce huge new revenuestreams to handset manufacturers, application devel-opers, and service providers.
The security infrastructure surrounding this tech-nology, balancing privacy against commercial applica-tions, is a major concern. RFID does not requireline-of-sight for reading tags, operating instead onradio frequency. Hence, private data about peopleand their belongings and shopping behavior can bereceived simply by waving a reader near their clothes,handbags, and other personal items. The size of theirshirts is no longer their personal secret, nor is theamount of cash they are carrying. By collecting tagdata on the person being RF-interrogated, the “datavoyeur” might create a complete commercial, and,worse, personal profile.
One may argue that this problem would be solvedby disabling each tag when it leaves a shop, but this isneither in the interest of the retailer nor, in fact, of thecustomer. Tags will store warranty information (paperreceipts will no longer be accepted) and, more impor-tant, the rights of ownership (a stolen item is easilyidentified). It is thus in the interest of the purchaserto keep tags alive. Furthermore, using RFID-enabledphones in the exchange of goods and money is both aguarantee and a proof of the transfer of ownership.Only a troublemaker would want to destroy or dis-able such useful data.
So there are very real general benefits in RFIDtechnology. However, this does not mean that themixing of cash and mobile RFID will receive strongsupport. As with many new technologies, innovatorspromise utopia; meanwhile, governments may declare
94 December 2006/Vol. 49, No. 12 COMMUNICATIONS OF THE ACM
BY COLLECTINGTAG DATA ON
THE PERSON BEINGRF-INTERROGATED, THE “DATA VOYEUR”
MIGHT CREATEA COMPLETE
COMMERCIAL, AND, WORSE,
PERSONALPROFILE.
material for personal security reasons,and people will carry RFID blockersor tag jammers to disrupt transmis-sion of information to scanningdevices.
We will soon be living in a world oftags, with different ones serving differ-ent purposes. EPC tags will storeGlobal Trade Identification Numbersto give each item a unique identifica-tion number. RFID-tagged items willbe as ubiquitous as barcoded productsare today but be even more pervasive.However, unlike barcodes, multipleRFID tags can be read simultaneously,each distinctively identifying thebearer at once without the need forline-of-sight or direct contact betweenreader and tag. Each of us will be awalking mountain of tags, and it willbe impossible to isolate them all frombeing read. Moreover, due the conver-gence of the pervasive mobile tele-phone and RFID readers, everyonewill be able to obtain all manner ofinformation about everyone else—from passports, clothes, personal data,and, in particular, cash.
Will the convergence of money, mobile tele-phony, and RFID inexorably lead to theend of cash as we know it? Is this “the
complete delivery of the individual to the tyranny ofthe state, the final suppression of all means of escape,not merely for the rich, but for everybody” [7]? Possi-bly. The technology will ensure that personal creditdevices no longer come in the shape of cards but astags in keychain fobs, stickers, and implants. Cash aswe know it will be an anachronism. RFID develop-ments in the name of supply-chain management andnational security will complement the worldwideflood of tags. The public will be ready—enthusiasti-cally armed with RFID-reading mobile phones toscan items in shops and the money they handle, aswell as information about one another.
Can the stampede of privacy-invading mobiletechnology along Friedrich Hayek’s Road to Serfdom[7] be stopped? After all, money does not have to becreated legal tender by governments. Due to lowtransaction costs, organizations can issue money, pos-sibly as a percentage of their equity. To a certainextent this is already happening with large-denomina-tion bonds, but new technology introduces the
potential for use in small denomina-tions—real cash money. MaybeHayek’s vision of the “denationalisa-tion of money” [6] will become a reality. As a substitute for govern-ment-issued bank notes, we mayinstead just deal in yet another,untagged currency to maintain ouranonymity.
REFERENCES1. Albrecht, K. Supermarket cards: The tip of the
2. Bawden, T. U.K.’s bid to trace dirty money is‘pathetic.’ Times Online (Mar. 15, 2005); busi-ness.timesonline.co.uk/article/0,,8209-1525951,00.html.
3. Booth-Thomas, C. The see-it-all chip. TimeOnline Edition (Sept. 14, 2003);www.time.com/time/globalbusiness/article/0,9171,1101030922-485764,00.html.
4. Collins, J. Lost and found in Legoland. RFIDJournal (Apr. 28, 2004); www.rfidjournal.com/article/articlview/921/1/1/.
5. Federal Reserve Bank of New York. How Cur-rency Gets into Circulation. Aug. 2004; newyork-fed.org/aboutthefed/fedpoint/fed01.html.
6. Hayek, F. The Denationalisation of Money. Insti-tute of Economic Affairs, London, 1976.
7. Hayek, F. The Road to Serfdom. University ofChicago Press, Chicago, 1972.
8. Hitachi. The World’s Smallest RFID IC. Hitachi,Ltd., Tokyo, 2004; www.hitachi.co.jp/Prod/mu-chip/.
9. Leyden, J. Japan yens for RFID chips. The Regis-ter (July 30, 2003); www.theregister.co.uk/2003/07/30/japan_yens_for_rfid_chips/.
10. McCullagh, D. RFID Industry Tries to Debunk ‘Exploding $20 Bill’Myth. Association for Automatic Identification and Mobility, Inc.,Warrendale, PA, Mar. 18, 2004; www.prisonplanet.com/031804_RFID_industry_tries_to_debunk_exploding_$20_bill_myth.html.
11. Singel, R. American passports to get chipped. Wired.com news (Oct.21, 2004); www.wired.com/news/privacy/0,1848,65412,00.html.
12. Weber, M. Politics As a Vocation. Hackett Publishing Co., Indianapo-lis, IN, 2004.
Ian Angell ([email protected]) is a professor of information systems in the Department of Management in the London School ofEconomics. Jan Kietzmann ([email protected]) is a researcher in theDepartment of Management in the London School of Economics.
Permission to make digital or hard copies of all or part of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor profit or commercial advantage and that copies bear this notice and the full cita-tion on the first page. To copy otherwise, to republish, to post on servers or to redis-tribute to lists, requires prior specific permission and/or a fee.
