Archive for the ‘Privacy Issues’ Category

California and RFID..again

Friday, October 19th, 2007

From the RFID Connections newsletter:California Research Bureau Notice

In response to repeated RFID legislation offerings in the state of California, a California Research Bureau RFID Advisory Committee has been established to investigate issues surrounding RFID. While the draft legislation in the past two years has focused on identification documents and RFID, the report appears to have a broad scope and will discuss RFID in a general sense. The Chairman, Dr. Chris Marxen is collecting written comments through October 30, 2007. If your company has an interest in the success of RFID, and would like to submit comments, please send them to cmarxen(at)library.ca.gov.

Written Comments no later than October 30, 2007.

Many of you will recall that several libraries in California in the last 5 years have had strenuous public outcry about moving to RFID.

NIST report on supply chain RFID security recommendations

Thursday, August 2nd, 2007

Since there is much talk in library RFID circles about how we can broaden the use of RFID tags from just in-library use to further up and down the supply chain, from printers to distributors to libraries to interlibrary loan to discards/recycling, the report summarized in this press release may be of interest to us all.http://www.nist.gov/public_affairs/releases/rfidsecurity.html

To quote:The new NIST publication focuses on RFID applications for asset management, tracking, matching, and process and supply chain control. Its list of recommended practices for ensuring the security and privacy of RFID systems includes:

firewalls that separate RFID databases from an organization’s other databases and information technology (IT) systems;

 

encryption of radio signals when feasible;

authentication of approved users of RFID systems;

shielding RFID tags or tag reading areas with metal screens or films to prevent unauthorized access;

audit procedures, logging and time stamping to help in detecting security breaches; and

tag disposal and recycling procedures that permanently disable or destroy sensitive data.

Some of these recommendations would be pretty hard to implement in a library, since we are working with hundreds to thousands of patrons and public access to our buildings. Many would need to have the cooperation of vendors.

ALA’s Don Wood notes EU will write rules on RFID

Friday, March 23rd, 2007

Citing needs to address public concerns over privacy and data usage, the EU has committed to draft rules on RFID use “before they become widespread” in Europe.  One wonders if they realize how widespread the use is in libraries, or if they only looked at industrial/commercial use.  Anecdotal evidence stateside is that European libraries have invested heavily in RFID technologies.

Globe & Mail article here

Don’s blog comment here, and links to the ALA resolutions relating to RFID.

California’s SB 30 - Update

Monday, January 29th, 2007

Karen Coyle writes to the RFID_LIB list:

“The LibraryLaw Blog has information about a California bill relating to the use of RFID in government issued identification documents.

See: http://blog.librarylaw.com/librarylaw/2007/01/rfid_legislatio.html You can find the bill at: http://www.leginfo.ca.gov/pub/07-08/bill/sen/sb_0001-0050/sb_30_bill_20061204_introduced.html

And the key part is Article 4. I’m going to think about it and will probably write about in in my blog (kcoyle.blogspot.com). It’s complex and has the unfortunately characteristic of attempting to legislate technology while using fairly imprecise language.”

NISO Launches RFID Committee to work on Library issues

Wednesday, April 12th, 2006

Chaired by Dr. Vinod Chachra of VTLS, the group will focus on interoperability of tags and hardware across vendors. He also emphasized that they must encourage “vertical application isolation among different industries. In other words, we do not want CDs purchased at a store to trigger library security gates and library books to set off alarms at grocery stores. Most importantly, we must achieve these goals while protecting personal privacy.”

The NISO announcement states that the product of this group will be a “best practices document [that]will form a part of a larger input document on U.S, requirements for the ISO TC 46 working group developing a standard data model for encoding information on the tag. The group will also coordinate with American Library Association/Book Industry Study Group working group around the interaction of technology and privacy issues. ”

A post to the SYS_LIB list by Cynthia Hodgson of NISO also says that for more information, you can contact NISO at nisohq@niso.org. Interestingly, this announcement was not posted by her to RFID_Lib, though someone else cross-posted it there.

Good to know the work is in progress. We’ll try to keep it in our sights to report on developments.

Work on CA Simitian Bill Continues

Thursday, February 2nd, 2006

SecureID News reports on press conference held by California Senator Joe Simitian for RFID industry professionals.

Simitian, as you may recall, was the author of the state RFID privacy bill which has been stalled since August 2005. According to the article, the bill is still being revised. Simitian was meeting with the industry in order to assauge fears that the bill will affect their business.

ALA Midwinter Report: IFC Draft Guidelines

Tuesday, January 31st, 2006

Kent Oliver introduced the ALA’s Intellectual Freedom Committee session devoted to an open hearing about IFC’s draft of “Guidelines for Implementing RFID in Libraries” from 1:30-3:30 on Saturday 1/21/06 in the Henry B. Gonzales Convention Center, Room 217C.

Kent introduced (me) Jim Lichtenberg, chair of the RFID Working Group, jointly sponsored by ALA and the Book Industry Study Group. I outlined the multi-year process that led to the crea-tion of a Privacy Policy in the use of RFID in the publishing value chain, adopted by the ALA Council on January 19, 2005 in Boston as the “Resolution on Radio Frequency Identification (RFID) Technology and Privacy Principles.” Both OITP, and IFC have played a tremendously supportive role in this long, and occasionally arduous work. I also had an opportunity to announce upcoming meetings with EPCglobal representatives and the RFID Working Group, as well as the NISO RFID Standards’ Committee to take place Monday in San Antonio.

There followed a lively discussion about the role of guidelines in the early days of a technology, highlighted by comments from Daniel L. Walters, executive director of the Las Vegas-Clark County Library District, and current president of the Public Library Association. While support-ing the “well-founded and appropriate” privacy principles of the Council Resolution, Walters stated that the concern of the PLA is that the technology section of the Guidelines as per the current draft, could have a “chilling” effect on libraries who might be interested in exploring or adopting RFID. He opined that this section “prematurely prohibits the uses of RFID,” and that the document “under-represents the benefits of the technology.” The head of the Fayetteville PL noted the extraordinary benefits resulting from their RFID implementation, which has lead to a three-fold increase in circulation.

Some others in the room seconded Walters’ concern about “overly-proscriptive” aspects of the technology sectiom. The implications of this section were almost the sole focus on the 2 hour session.

While supporting the approach to the guidelines generally, I expressed my own concern about the cost of, and the need for, ‘encrypting’ all data on the tag. Currently in US library adoption, all that is carried on a tag is a “dumb barcode,” so even in the highly unlikely event it were read by an unauthorized third party, it remains a meaningless number. Moreover the cost of encrypt-ing data on the RFID tag is significant.

The CEO of the European company, Biblioteca, noted that his company encrypts information on the RFID tags they provide their clients so that there can be no ‘prank’ changes to the informa-tion on the tag. A discussion followed of The Danish Data model for library RFID tags which allows for title and shelf location, to be carried on the tag, as an aid to sorting, shelving, and in-ventory. (This data model was explored in great detail at the NISO RFID Standards’ committee meeting on Monday morning.)

The proposed guideline that would proscribe wireless transmission RFID-related data within the library was also questioned. This was countered, later in the discussion, by the comment that the current lack of security inherent in many library systems and networks carries far more “dan-ger” to patron information than would the use of RFID, even if data were transmitted wirelessly.

In response to these various concerns, it was noted that guidelines, in which IFC has consider-able experience, are always a work in progress and that as technology changes, guidelines will change accordingly. The head of the Berkeley public library cautioned that technology “creeps up on us and that it is essential to be proactive.” The importance of patron and public under-standing was highlighted.

Notwithstanding all the concerns expressed, there seemed to be general recognition of the value of refining these guidelines through another draft. Small lively discussions continued among participants even after the session was formally adjourned.

TI tags get security features

Wednesday, December 14th, 2005

This via PRNewwire:

Texas Instruments is adding security and memory options to its ISO 15693 chips used in library applications. Now libraries can choose tags with 256 bit or 2,048 bit memory (not that 256 bits wasn’t already plenty). Even better, they have added “password protected write functionality” to the tags.

This means that the possiblity of denial of service attacks on tags is lessened. To refresh your memory this type of vandalism occurs when some rogue races the signal between a reader and a tag and overwrites the open memory bits.

The memory on these tags can be compartmentalized into eight blocks which can be programmed with various levels of security.

The full article has more details.

Coyle posts preprint

Thursday, December 8th, 2005

Karen Coyle has made a preprint of her article available for those of you without access to the Journal of Academic Librarianship.

Berkeley City Council asks BPL to Reach Consensus on RFID

Wednesday, November 16th, 2005

The San Jose Mercury News is reporting that the Berkeley City Council has referred the Berkeley Public Library’s RFID controversy to a joint committee of library management and employees in order to reach some sort of resolution. [link requires free registration]

Councilwoman Dona Spring had introduced a motion to have the Council intervene in the ongoing dispute.

Mayor Tom Bates is quoted as saying, “The real issue isn’t RFIDs; it’s the relationship between management and labor.”

I think the mayor has a good point. I’ve always contended that BPL may have minimized their troubles with a better communications program–both externally and internally. I’m not quite sure what the proposed committee will be able to resolve. I seem to recall that their Checkpoint system is already in use. It’s probably too late to do much about it other than remove the system and suck up the loss and that is not likely to happen.

Proceedings available from Rutgers Law Library program on RFID

Friday, November 11th, 2005

A podcast and streaming video of the entire the Nov.4 program RFID: The digital era and privacy, which was given by the Rutgers University Law Library, They also provide a (very) selective bibliography. Speakers included Lee Tien and Leslie Burger.

SFPL wants you … to comment on their RFID report

Friday, October 21st, 2005

The San Francisco Public Library formed a Library Technology & Privacy Advisory Committee to address privacy concerns with emerging technologies. Their initial charge was to specify privacy requirements for RFID technology should the library decide to move forward with an implementation and to provide public education forums on library technology.

As you may recall, the San Francisco city budget committee denied the library’s request for funding for RFID.

The Advisory committee has completed their report on RFID and has requested comments on it. Deadline for submitting your thoughts is November 11, 2005.

OECD takes on privacy

Wednesday, October 12th, 2005

There’s a great article over at CommsDesign about RFID discussions at the Organization for Economic Cooperation and Development (OECD). The organization is calling for industry self-policing when it comes to privacy.

A postdoctoral fellow at Harvard University’s Center for Research on Computation and Society interviewed in the article calls for a “RFID Bill of Rights.” Those of you paying close attention will note the simularities between this proposed Bill and the best practices already being promulgated by ALA and the BISG as well as the Ontario Privacy Commissioner.

new security solution?

Thursday, September 15th, 2005

A short paper about a new approach to RFID tag privacy, brought to us by RFID in Libraries registered user SJE.

I need to look into more so that I understand the technical details before I comment.

More on the end (for now?) of SB 682

Friday, August 26th, 2005

An interesting comment on the SB 682 developments over on Mary’s blog which provides a peek at the mindset of one pro-RFID person.

It’s strongly worded. I’m very interested in the passion displayed at both ends of the spectrum with this debate. However will we develop solutions if phrases like, “they lied,” or “they tried to pull a fast one,” are bandied about? This commenter is similar in tone to Warfield and the other contra RFID voices given so much prominence by the Berkeley Daily Planet.

California bill stalled

Friday, August 26th, 2005

California Senate Bill 682, the Identity Information Protection Act, was tabled by the Assembly Appropriations Committee.

This is a big blow for proponents and indiciative of how much sway the industry lobbyists have.

CLA-IFC on kill tags

Wednesday, August 24th, 2005

Our own Mary Minow posted this on her main blog. The California Library Association Intellectual Freedom Committee has discussed doing a conference presentation on RFID kill tags at the CLA’s upcoming annual conference . The committee considered the necessity of kill and revive tags to ameliorate privacy concerns.

Karen Coyle responds with questions regarding the technological feasability of kill features on the passive tags used in libraries and points out the need for affordable privacy solutions.

I hope the IFC does do a presentation specifically on potential solutions to the privacy issue. It would be a great follow-up to the general RFID panel held at the CLA 2004 conference especially if it dealt with socio-political solutions (such as CA SB 682) in addition to the technological.

There is still a need for a detailed best practices document that libraries can follow.

Update on CA SB 682

Wednesday, August 17th, 2005

The Simitian Identity Information Protection Act of 2005 has been amended once again and re-referred to committee. Based on my cursory reading it appears as if most of the changes this time around are cosmetic fixes to the wording. I’ll need to go through it more carefully to be sure, however.

Description of BPL community forum

Wednesday, August 10th, 2005

Steve Cisler blogged the Berkeley Public Library’s community information forum. He hits the nail on the head when he says:

it’s more of a political issue rather than a technical or financial one.

Cory calls for supporting SB 682

Friday, July 29th, 2005

Cory Doctrow is reccomending that Californians support SB 682, calling it “very sensible.”

The EFF and ACLU are also behind the bill.

Doctrow says that the bill has been watered down by supporters of the RFID industry (well, that’s sort of obvious given the types of things that have been edited out of the original version. See all the amendments at the California legislative information site).

Updates on CA SB 682

Wednesday, July 20th, 2005

There have been two additional amendments to the California Identity Information Protection Act of 2005 since Lori reported on amendments made on 6/15/2005.

The bill still prohibits library cards from containing RFID tags but two amendments will affect California libraries. There is now a sunset provision on the library card ban and universities and community colleges were excused from the restrictions on student identification cards. The details are in sec.1798.10(c) of the bill

(more…)

Update on CA SB 682

Friday, May 20th, 2005

The California Identity Information Protection Act of 2005 (a.k.a. California Senate Bill 682) has passed its Senate readings and has moved on to the State House of Representatives. It also passed its first reading there.

Information is available on the bill and you can subscribe to receive updates.

The bill would make it illegal for government agencies (such as libraries) to issue cards

“containing a contactless integrated circuit or other device that uses radio waves to broadcast personal information or to enable personal information to be scanned remotely, except as specified. “

The original bill has been amended so that,

“its provisions do not apply to existing systems, as defined, in use prior to the effective date of this bill.”

RFID Journal has a good analysis of this amendment. According to that article, the removal of the clause which prescribed that current RFID cards be phased out also removed any of the bill’s fiscal implications. This allowed the bill to go directly to the House without further committee review. It’s also probably why this bill is receiving more bipartisan support than earlier attempts at legislating RFID in California.

Another RFID CD/DVD application

Monday, May 16th, 2005

Anita over at the RFID Weblog has a good article regarding an initiative by UCLA researchers to use RFID for managing copyright on CD/DVD.

Watch this one folks. It’s going to have big implications for digital libraries & archives if its successful.

Singapore adds facial recognition

Monday, May 16th, 2005

CNET Asia is reporting that six of Singapore’s public libraries are getting facial pattern recognition software added to their RFID self-check machines.

If you thought the uproar over privacy for a few bits of book information was intense, imagine what would happen if American libraries started using biometric security.

ALA opposed to Real-ID act

Thursday, May 12th, 2005

As addendum to Margaret’s post about RFID in passports, Internetnews.com is reporting on numerous organizations that are on record as opposing the Real-ID Act. This is the legislation proposes a national driver’s license — and it could very well be RFID enabled. The article quotes Bruce Scheiner of the Counterpane Internet Security:

“Real ID requires driver’s licenses to include a ‘common machine-readable technology.’ This will, of course, make identity theft easier,” Schneier said in a recent blog posting. “Assume that this information will be collected by bars and other businesses, and that it will be resold to companies like ChoicePoint and Acxiom.”

Even worse, Schneier said, the same specification for RFID chips embedded in passports includes details about embedding RFID chips in driver’s licenses, making it an even juicer target for thieves and terrorists.

The ALA Washington Office has a page listing ALA’s official positions official positions on privacy related legislation.

The Act is expected to be signed into law today. If you’re implementing RFID at your library expect to answer more questions from members of your constituency if this story really takes off in the media.

Other 13.56MHz applications

Thursday, May 12th, 2005

This article discusses some additional uses of 13.56 MHz RFID tags, in relationship to the State Deptartment’s recent decision to use RFID in passports, and the ensuing uproar from various quarters, including the ACLU. Probably useful background information for if you get privacy advocates giving you grief about some of the misconceptions they have read in the press about RFID.

http://www.aimglobal.org/members/news/templates/aiminsights.asp?articleid=363&zoneid=26

Thoughts on Warfield & Tien piece

Tuesday, April 12th, 2005

I’ve got a bit of ranting to do about the most recent commentary in the Berkeley Daily Planet from anti-RFID activists Peter Warfield and Lee Tien. Full disclosure: I’m neither pro or con on RFID. I think the privacy concerns are valid and return on investment is poorly documented. Yet, I also believe the technology holds promise for improving service to library users. My fence-sitting advice to librarians considering RFID is “tread carefully.” This shouldn’t be news to anybody that read my fall 2004 netConnect article.

Any decision a librarian makes on RFID should be supported by facts. A list of particulars without context doesn’t do anybody any good. I question the Daily Planet’s ability to be unbiased in their reporting of this ongoing story. Some of Warfield and Tien’s reasoning is specious and should not be left to stand without question.
(more…)

Warfield and Tien at it again

Friday, April 8th, 2005

The Berkeley Daily Planet has published another commentary by anti-RFID activists Peter Warfield and Lee Tien. I’ve got quite a bit to say about it, but I’ll refrain until I can do a bit of fact-checking. I think there are problems with some of their points and good rebuttals to others. Stay tuned.

ALA/BISG continues to meet

Monday, April 4th, 2005

Library Journal is reporting on a February 25 meeting held by the RFID Working Group, which is jointly sponsored by the American Library Association and the Book Industry Study Group.

As always, privacy was a major part of the conversation. It was noted that there is a continuing need for education about the issues in the library community. Our old friend David Molnar discussed the risks and noted that increased standardization, while very necessary, also increases the vulnerability of the tags.

This is going to be a big concern as libraries and book publishers and sellers continue to work together on RFID. Each constituency is concerned with moving books around. As books move through the information chain, how will we deal with the chips? From an economic perspective it makes sense to use the same chips for every industry. Why add labor and additional chips at each point? Libraries could just use the chips already inserted into the book during publication.

Yet, the need for protecting individuals engenders the need for “kill” functions to stop tags once they leave the warehouse or bookstore.

It’s a tricky balance and one where I think we should err on the side of caution. I seem to recall that there is a type of tag which can be put to sleep rather than being killed outright and this may provide the neccessary middle ground.

New Berkeley Library trustee

Tuesday, March 22nd, 2005

The top story in today’s Berkeley Daily planet reports on the appointment of a new trustee to the library board. Ying Lee, who opposes the decision to use RFID, said she didn’t know enough about Jackie Griffin’s plans to comment on the budget.

The article does say that the board will be having a community meeting on April 12 to discuss RFID and proposed staff layoffs.

I’ve been predicting that such a meeting would happen and I’m glad to see that it is. The library needs some good PR. Yes there are privacy issues with RFID. No doubt about it. I think, however, that the media coverage is conflating the issues with the staff layoff situation. If the board is able to get the budget numbers out to the people along with how those numbers were generated/obtained then folks will see that Jackie and the board have made decisions based upon their needs. They are not installing RFID due to technolust or a grand desire to eliminate staff.

Evaulation is going to be the key to long term public acceptance of those decisions. Hard numbers to illustrate the decrease in workers comp costs and qualitative studies about patron satisfaction with customer service will demonstrate that RFID was (or wasn’t?) worth it.