Josh Stump
CSC 540
25 April 2011
Shopping by Radio: RFID in the Consumer World
In 1974, the world of retail sales was altered forever with the introduction of the UPC barcode.
June 26 of that year marked the first use of IBM’s newly developed barcode scanning system, delivering
a marked increase in both ease and speed at the grocery checkout counter. These twelve digit barcodes
have evolved over the years to describe not only the product, but also the company that produced it.
They support basic individual products, drugs, coupons, shoppers’ cards, and are used for inventory
tracking. More recently, retailers have begun using them to help track the buying preferences of
individual shoppers, allowing them to tailor advertisements and plan future advertising campaigns
(Alfred).
In the same way that UPC barcodes revolutionized the retail industry almost forty years ago,
retailers are now placing hope in RFID, or radio-frequency identification. First envisioned during World
War II, RFID tags are tiny microchips that hold a small amount of data useful to a given industry or
purpose. These tags are read at a distance by a tag reader connected to a central computer system.
Within the retail industry, the tags used vary in size from a grain of rice down to the size of a grain of
sand. While barcode technology has become extremely simple, fast, and mostly error free, it is hoped
that RFID can be more so.
RFID in the Supermarket
Radio-frequency identification has begun its invasion of the retail industry at the supply chain
level, allowing tracking of raw materials from the base suppliers to manufacturing companies. Finished
products can then be tracked to the distributors, and then on to the retailers where they are purchased
by consumers. Beginning at the supplier, RFID is replacing paper and barcodes for tracking shipments, as
well as eliminating the need for ordering altogether. Each part from the supplier ships with an
embedded RFID tag. When the shipment arrives at the manufacturer, the number of parts is added to
the manufacturers part count. Each time one of these parts is removed from the storage area and use to
complete a finished product, the part count is decremented. When the manufacturers part count drops
low enough, a computer system automatically places an order for more parts from the supplier. Not
only does this eliminate the need for humans to perform a manual part count and estimate the need for
parts, it allows the manufacturer to adjust ordering depending on the amount of finished product they
ship. An added advantage is that at no point in this process does any human need to scan a label or
barcode: all of the information is automatically detected as the items pass near a wall or ceiling
mounted tag reader (Sikander).
As the goods leave the manufacturer, pallets of finished product are marked with an RFID tag
and entered into a database. The product is shipped to a distributor, where the pallets are broken up
and the manufacturer’s RFID tags are removed. Goods are placed on new, often smaller pallets, and
labeled with a new RFID tracking tag. These pallets are shipped to retailers, where the products within
are placed in on-site storage or directly on the shelves. Once again, ordering and stocking is handled by a
computer that keeps constant track of the inventory within the store (Sikander).
With products on the shelves, the RFID tags that simplified the supply chain are now coming into
contact with the end consumer for the first time. While there is not currently much support for tags on
the shelves, a few retailers have run trials with “smart shelves.” These shelves contain a tag reader
connected to the store’s central computer, and can instantly detect an item being removed or placed on
the shelf. This means that inventories could be updated literally as soon as an item is placed in a
shopping cart. It would also allow for the store to instantly track items placed on the wrong shelf,
eliminating the need for employees to sweep the store after hours, moving misplaced items back to
their proper locations (Sikander).
Once a shopper has completed his or her shopping trip, the time has come to pay for the
groceries and leave the store. This is the part of the process where the RFID tag truly shows its
advantages over traditional UPC barcodes. In today’s system, a cashier (or the shopper at stores with
self check out) must swipe the barcode of each item over a visual scanner, an improved version of IBM’s
original from the 1970’s. Due to the barcode’s varied locations, there is no easy automated way to scan
them. However, RFID tags embedded in or simply placed on the items allows for them to simply pass
within a certain distance of a tag reader. In this manner, the items can simply be placed on a conveyor
belt and moved past the reader, with the item being automatically added to the order. With an
advanced system using multiple readers, a shopper could simply walk the entire cart through a scanner,
never having to remove anything from the cart, and then simply pay the total.
RFID in Your Wallet
Moving beyond the supply chain, inventory, and the individual shopping cart, RFID tags are also
proving their worth in our wallets. Again these tiny microchips have the ability to streamline our retail
experience. The first use is once again simply a migration from the UPC barcode system: the shopper’s
card, a card that carries no cash value, but allows the holder special access or discounts at a given retail
chain. Examples of these cards include the Kroger’s Plus Card and the Sam’s Club membership card. The
purpose of such a card is simply to link the customer holding it to a membership account holding a small
amount of personal information. At checkout, the RFID chip in one of these cards would be read just like
any of the tags in a shopper’s groceries, being scanned and instantly applying any available discount to
the shopper’s bill.
In the next pocket of a shopper’s wallet is likely a credit or debit card that he or she might use to
pay for the groceries in a cart. Several credit card companies, including Chase and American Express,
have now begun shipping cards with embedded RFID chips. As with the replacement of UPC barcodes,
RFID chips in credit cards remove the need for the card to be scanned or swiped through a card reader.
A card need only be placed close to a tag reader for the number to be transferred and the price of
groceries charged to the card (Johnson).
Resistance and Scandal
RFID has proven its ability to streamline production, simplify the supply chain, eliminate the
need for human ordering, and speed checkout. This technology has the potential to greatly simplify our
daily lives. However, as with many such technologies developed over the years, RFID is meeting
significant resistance both in industry and with the general public. This section will illustrate some of the
perceived dangers involved, as well as go over a few existing cases.
Within the industry itself, much of the worries concerning RFID tags involve errors in the
computer systems. Some within the industry are concerned that allowing computers that much control
over the total operation of the supply chain is simply asking for trouble. However, the main force of
protest against RFID in the retail industry comes from the general public. As with many technologies in
the information age, much of the fear and worry surrounds personal privacy. Many have expressed
concerns with taking traceable RFID tags home with them. The small RFID remain active long after an
item is purchased (unless it is removed or deactivated by an “RFID zapper”), though this seems to be a
fairly baseless fear, as the tags included on merchandise simply identify it in the same way a UPC
barcode currently does. Another concern voiced by consumers is tied to membership cards. Some
retailers have expressed a desire to track the purchases of individual consumers, creating trend reports
and allowing the retailer to send tailored advertisements, much in the way online shopping and social
network site do. Finally, consumers have expressed concern over RFID enabled shelves, mainly
wondering what else might be happening behind the scenes when an item is picked up (Spychips).
As it turns out, consumers’ fear about the RFID enabled shelves have already been validated. In
2003, Wal-Mart and production giant Procter and Gamble were caught secretly testing such a shelving
unit at a Wal-Mart in Broken Arrow, Oklahoma. During the test period, a shelf containing a brand of
lipstick produced by P&G was wired with RFID readers to keep track of the tags within individual
packages of lipstick. Whenever one of the packages was removed from the shelf, a hidden camera
placed near the display was activated, allowing P&G marketing employees in Cincinnati, OH, to observe
the customers’ behavior. This invasion of privacy led to a large, private investigation of many product
lines, revealing RFID tags secretly hidden in several other brands carried by Wal-Mart. Also in 2003,
Italian clothing company Benetton revealed that it would be placing RFID tracking chips, readable from
over 1.5 meters away, into every item of its core clothing line. Needless to say, the public deeply
resented the company’s plan to track their purchases, and the plan was scrapped due to a boycott and
rapidly declining sales (Spychips)(Slashdot).
The main body of consumer worries related to RFID chips, however, lies in tagged credit cards.
Many questions have been raised, including: What information is stored within the tag? Is that data
publicly available to any reader, or is it electronically protected? How strong is any protection within the
card reader? Is there a way to keep the signals from these chips from reaching outside of a wallet?
Could anyone with a small radio scanner access the data on the chip? The answers are simple: The chip
holds the cardholder’s name, card number, expiration date, and special access code. The data on these
chips is encrypted using a 128 bit encryption. The card reader must have valid, company provided
software in order to issue a proper challenge to the card, before attempting to read the actual credit
card data. Yes, carrying your RFID cards in a metal wallet designed to block radio signals will keep your
cards from being scanned by someone holding an antenna to the back of your pants (Johnson).
So then, one must wonder why the answer to the final question is “Yes.” A research team at the
University of Massachusetts at Amherst was able to trick some of the cards with a reader they built. In
2008, a mass produced reader began being sold online for a mere $8. Freely available are simple stepby-step plans to build a far more complex reader capable of on-device decryption for around $30. While
companies like Chase and American Express have had good success with their respective RFID enabled
credit card lines, it merely goes to show that no protection is foolproof (Patel)(OpenPCD).
To prove this, one need look no further than another document that many carry: the passport.
Recently, the British government began issuing passports with embedded RFID tags containing the
carrier’s name, birth date, address, and a digital identification picture. The goal was to greatly reduce
the amount of time a person spent at a border crossing. The chip contained was encrypted with a
stronger encryption algorithm than what is used for credit cards, and it held off the combined efforts of
British hackers for a mere 48 hours after the first passports were issued. The hackers took advantage of
a simple flaw in RFID: the easily captured communication between the RFID tag and the tag reader. By
setting up a scanner a few feet away from the tag reader, they were able to capture the data stream
from the tag to the reader and ignore the need to provide the tag with a unique challenge code (ACM).
The Future
Despite its flaws, RFID remains a viable, emerging field of technology; and new technologies
have a way of running their course whether it is a good idea or not. This begs the question: What is the
future for radio-frequency identification within the retail industry? The two most accepted theories are
that RFID use will either slow and retreat until RFID tags are used only as the successor to the UPC
barcode, or that their use will explode. If the second theory holds true, then we can take a glimpse into a
possible future.
As a customer enters a store, a tag reader checks his or her shopper’s card, greeting the
customer by name as they enter the store. Tag readers in the floor track the customer throughout his or
her shopping trip, placing advertisements on small displays just ahead, tailored to the shopper’s past
purchases, as well as to the items in the cart. Once shopping is complete, the customer simply walks
through a pair of tag readers, the first of which scans all of the groceries and calculates the total cost
owed to the store, while the second gate scans the customer’s wallet and presents a list of credit and
debit cards to charge the amount to. Meanwhile, store clerks are alerted to any items the shopper may
have placed on the wrong shelf during the course of their shopping trip, allowing them to immediately
be returned to the proper location.
In the end, RFID has come a long way since its introduction as a way to recognize friendly planes
during World War II. It may not be the answer to as many problems as we currently believe, but the
technology certainly has its place. Perhaps, with a great deal of tuning and development in the future,
RFID tags may take their place as a truly safe and useful technology. Until then, guard your wallet well.
Or at least wrap it in tin foil.
Works Cited
Alfred, Randy. June 26, 1974: By Gum! There's a New Way to Buy Gum. 26 June 2008. April 2011
<http://www.wired.com/science/discoveries/news/2008/06/dayintech_0626?currentPage=2>.
Johnson, Joel. RFID Credit Cards and Theft: Tech Clinic. 1 October 2009. April 2011
<http://www.popularmechanics.com/technology/how-to/4206464>.
OpenPICC RFID Emulator and Sniffer Project. April 2011 <http://www.openpcd.org/Openpicc.0.html>.
Patel, Nilay. RFID credit cards easily hacked with $8 reader. 19 March 2008. April 2011
<http://www.engadget.com/2008/03/19/rfid-credit-cards-easily-hacked-with-8-reader/>.
Spychips. Scandal: Wal-Mart, P&G Involved in Secret RFID Testing. 10 November 2003. April 2011
<http://www.spychips.com/press-releases/broken-arrow.html>.
Sikander, Javed. RFID Enabled Retail Supply Chain. April 2005. April 2011
<http://msdn.microsoft.com/en-us/library/ms954628.aspx>.
Slashdot. Benetton Clothing to Carry RFID Tags. 12 March 2003. April 2011
<http://slashdot.org/story/03/03/12/0156247/Benetton-Clothing-to-Carry-RFID-Tags>.
Waldo, Jim, et al. A Threat Analysis of RFID Passports. 2009. April 2011
<http://queue.acm.org/detail.cfm?id=1626175>.