Calif
. Makes Another Run at RFID Regulation”>
California legislators have voted once again to derail security and privacy issues with checks on RFID technology, this time with a bill that will prohibit the forced implantation of an identification device—including RFID chips and so-called chipless, invisible RFID tattoos—under the skin.
The bill, passed by the California Senate 28-9 Aug. 30, has until mid-September to be signed into law or vetoed by Gov. Arnold Schwarzenegger. Given Californias size and political muscle, the bill could have an impact on radio-frequency identification legislation in other states. It also points to potential problems down the road for RFID.
The ban on coerced implantations of RFID chips, introduced by state Sen. Joe Simitian, is not the first RFID legislation to hit Schwarzeneggers desk. In October 2006, Schwarzenegger vetoed a separate bill proposed by Simitian that was designed to limit the use of RFID in state and local documents.
At the time, Schwarzenegger said he was “concerned that that the potential laws provisions [were] overbroad and may unduly burden the numerous beneficial new applications of contactless technology.” He pointed to two areas of concern—that early legislation might limit innovation, and that the federal government, under the REAL ID Act, had not yet released new technology standards for government ID cards. Any legislation from California, he said, could impose requirements that would contradict federal mandates.
Resistance to RFID lingers despite successes. Click here to read more.
The REAL ID Act, attached as a rider on a military spending bill, was signed into law in 2005. It stipulates that all states must redesign their drivers licenses by 2008 to include a common machine-readable technology, a move many say signals the advent of a national RFID-chipped identification card. In March, after months of wrangling and anti-RFID protests from states, the Department of Homeland Security released its proposed regulations for Real ID. The preliminary regs—a good indication of the final regulations, due any time—call for states to utilize 2-D bar-code technology rather than RFID.
With the Real ID question out of the way, a major part of Simitians battle to get this latest bill signed is put to rest. But there is still the question of squelching innovation that Schwarzenegger raised earlier. Those innovation concerns are not addressed in Simitians bill, but in separate bills that are still in Californias assembly.
“This is one of five bills I have dealing with the use of RFID technology,” said Simitian, in Sacramento, Calif. “As a Silicon Valley legislator [I believe] the technology is great, but you have to be thoughtful of when and where you use it.”
The additional four bills address different aspects of RFID implementation, and amount to the separated pieces of the original California bill. One calls for a three-year moratorium on the use of RFID in California drivers licenses. Another would put a similar three-year moratorium on the use of RFID in K-12 student identification cards.
A third looks to mandate security and privacy provisions in RFID-chipped ID documentation required by state and local governments. That bill would do two things: Require that people are informed that the technology is present and spell out what citizens can do to protect their privacy, and impose technological requirements that amount to password protection and—in cases where personal information is on the chip—use of encryption and mutual authentication technologies.
Another bill imposes criminal charges for skimming and unauthorized access to tags and the disclosure of codes that are in the encryption process.
Page 2: Calif. Makes Another Run at RFID Regulation
Bellwether Legislation for Other
States”>
The bill vetoed by Schwarzenegger last year was considered by many to be bellwether legislation for other states considering RFID legislation. The American Civil Liberties Union backed Simitians 2006 bill. Since the 2007-08 bills are essentially the same effort broken into smaller parts, its likely their passage could have a similar impact.
“We have put much of our effort into getting California to pass this legislation,” Tim Sparapani, legislative council for the national ACLU office, in Washington, said in a September 2006 interview with eWEEK. “We think the bill draws the right lines. RFID can be incredibly useful when shipping certain goods, but not when used to track people.”
Sparapani said that California is where a large percentage of the U.S. population lives. If a controversial bill is passed there, other states tend to take notice. The thought is, said Sparapani and others, that if California passes legislation that mandates some basic privacy and security practices around RFID, others states and industries will follow suit.
If this most recent bill becomes a law, California will join Wisconsin and North Dakota as states that have already banned forced RFID implementation. Other states could move a little faster with the passage of similar legislation, Simitian said.
“When a state the size of California weighs in, it attracts attention,” he said. “And the fact that I am a Silicon Valley legislator speaks a lot.”
However, while Simitians most recent effort is getting a lot of support from Californias media outlets—the Los Angeles Times, The Orange Country Register, The Press Enterprise and San Jose Mercury News have come out in favor of the bill—the RFID industry is not offering its support of it.
“Frankly I am surprised and disappointed that industry wouldnt back the bill,” said Simitian. “I thought this is one where we ought to find common ground.”
He said he sees several possibilities where RFID implantable chips could be used as a coercive device. “In a hospital where technology is implanted, the bill says it can only be done with the knowledge and consent of the patient,” Simitian said.
On Sept. 4, VeriMed, of Delray Beach, Fla., announced that more than 90 Alzheimers patients and caregivers received the VeriMed RFID implantable chip as part of the companys Patient Identification Project with Alzheimers Community Care, a voluntary, two-year, 200-patient project to evaluate the effectiveness of the VeriMed Patient Identification System in managing the records of Alzheimers patients and their caregivers. The other possibility addressed in the bill is a government entity—the state of California, for example—making CalWorks benefits contingent on recipients getting chipped.
Another clear potential for chip implantation coercion is in the military, law enforcement or prison populations, where the technology could be required for identification.
“RFID does a great job of identifying a document, but not necessarily the document holder. There is an incentive to take that to the next level with subdermal implants,” said Simitian.
In 2004, the U.S. Food and Drug Administration approved the first human implantable RFID chip, called VeriChip. About the size of a grain of rice, the VeriChip is designed to be implanted in the fatty tissue of a persons arm and, for starters, carry a persons medical history. But the VeriChip is also being looked at by countries around the world that are interested in using the implantable chip as a source of identity. The attorney general of Mexico and 18 staff members have been implanted with the chips, according to media reports, as have about 170 Mexico City law enforcement officials, who hope to be tracked if they are ever kidnapped.
Last year VeriChips Board Chairman Scott Silverman held informal meetings with U.S. Navy and Air Force leaders to suggest a feasibility study of its VeriMed system, according to media reports. Its not clear if the studies are under way. A VeriChip spokesperson was unavailable at press time.