This article can also be found in the Premium Editorial Download "Information Security magazine: Keep today's threats close and tomorrow's closer."
Download it now to read this article plus other related content.
RFID gives businesses--and bad guys--an easy way to track and change information.
As one of the fathers of the RFID industry, Kevin Ashton never seems to be far from controversy. Three years ago, he helped introduce the Electronic Product Code (EPC), an RFID specification, to the suppliers of Wal-Mart and Best Buy, and the U.S. Department of Defense, which manages the largest supply chain on the planet.
Now, as security experts demonstrate with alarming regularity how easy it is to hack RFID-enabled credit cards and e-passports, Ashton is calling for a new standard from EPCglobal, the EPC standards body, to secure RFID tags on shipping containers, palettes and individual store items.
The new standard, EPC Generation 3, would add the security features suppliers and retailers need to prevent attacks from rogue RFID reader devices, which, along with RFID tags, will become cheap and ubiquitous in the coming years, says Ashton, vice president of marketing at the RFID reader maker ThingMagic. He's also co-founder of the MIT-based Auto-ID Center, a nonprofit collaboration of private industry and academia to develop a global infrastructure for tracking goods via RFID tags.
At first, the idea of replacing barcode labels on individual items--the ultimate goal of the EPC effort--infuriated privacy advocates, who said RFID would allow corporations and governments to spy on consumers bearing radio-tagged products.
Many of Wal-Mart's suppliers also grumbled that EPC was a way for the retailer to improve its supply chain visibility at their expense, since the retailer was requiring that they place RFID tags on their palettes and cases by the end of 2006.
Since then, however, many manufacturers and suppliers have started experimenting with RFID tags as a tool to track their own inventories and their employees.
Ernest Ostro, IT director at GlobalWare Solutions, says that medical device companies and a bike manufacturer using GlobalWare's supply chain management software are using RFID tags as tracking tools. (GlobalWare Philips Medical and Fuji Medical are among GlobalWare's supply chain outsourcing clients.)
GlobalWare is prepared for a future that will include "greater lumps of data" from RFID, says Ostro, from asset tracking and employee ID badges. "We've built hooks into our software for [RFID tags]."
This was first published in January 2007