Next lines of cell phones have privacy implications
03/17/08 23:08:32

Quick Job Search

You might not know it, but as of January it became illegal in California for companies to require workers to have devices implanted under their skin that would disclose their whereabouts at all times.

Democratic state Sen. Joe Simitian called his legislation a safeguard against "the ultimate invasion of privacy." Gov. Schwarzenegger signed the bill into law in October.

But the same chip-based technology that California won't allow to be forcibly placed under people's skin soon will be ubiquitous in cell phones, which the telecommunications industry believes will be used increasingly as electronic wallets to make purchases.

Virtually all leading cell phone makers are introducing this technology to their handsets. Payments by cell phone are expected to explode over the next few years as more stores are equipped to handle such transactions.

Here's how it'll work: You go to a store, select a pair of khakis and wave your phone in front of a reader at the cash register. The purchase price instantly is deducted from your checking account like a debit card or applied to a credit card account. A record of the purchase also is entered into the store's database.

That's very convenient, and undeniably will be a boon to shoppers, merchants and cell phone companies.

What the technology also means, though, is that all cell phone owners, which is nearly everyone, will be technologically "tagged." In theory, anyone -- or any company or government agency -- with a desire to do so would be able to identify you from as far as 300 feet away and track you as you go about your business.

Your cell phone constantly would be broadcasting your location, along with, possibly, your name, address and other potentially sensitive information.

"The public has been slow to appreciate the privacy implications of this technology," said Simitian, who has other bills in the hopper to address various aspects of what is known as "radio frequency identification," or RFID.

RFID technology has been around since World War II, when transponders were placed in Allied aircraft to distinguish them from German planes. These days, RFID is everywhere.

When workers wave an ID card or fob in front of a reader to enter their office building, that's RFID. When plastic tags are placed on merchandise in supermarkets or retail stores to manage inventory, that's RFID.

RFID tags are starting to be inserted into driver's licenses and passports. Cell phone companies love the technology because they anticipate customers using more minutes and being less likely to switch services once they've turned their handset into an e-wallet.

At the moment, the most common form of RFID tagging in this country is what is known as a "passive" emitter. That means the tag has no independent power source and must be activated by an external scanner, usually within a range of 25 feet.

Increasingly, passive tags are being replaced with tiny battery-operated "active" tags that continuously transmit signals as far as 300 feet. Those signals can be picked up by anyone with an RFID scanner.

Numerous companies have filed patent applications in recent years for use of RFID technology to monitor people's activities. In 2006, for example, IBM received patent approval for a system that, according to the patent application, could be "used to monitor the person through the store or other areas."

That "or other areas" is what spooks privacy advocates. At the moment, there are few limits on how this technology can be used.

"The notion that we're building a surveillance society is very real," said Sophia Cope, a staff attorney at the Center for Democracy and Technology, which focuses on civil liberties in the digital age.

Although she acknowledged the benefits of RFID technology, Cope said it was all too easy to imagine cell phone tags being used to monitor people's activities from morning to night.

It's still early enough in the game for regulators to protect consumers. Some suggestions:

Cell phone makers should be required to produce non-RFID handsets for people with no desire for electronic payments.

Consumers should be clearly informed about what information will be stored on their RFID tags, and should be given the ability to make changes as they see fit.

Sales of RFID scanners should be limited to those with a legitimate need to possess the technology.

Laws should be passed clearly defining the circumstances under which companies and government agencies can track RFID tags and requiring court orders for the technology to be used for surveillance purposes.

David Lazarus writes for the Los Angeles Times. He can be reached at david.lazarus@latimes.com.