But I'll just cover some of the more interesting ones.

California's considering three new laws to regulate RFID chips, so there's been some public discussion around here. A couple of days ago, a flack from a company making the chips got an editorial published in the paper, and offered some smooth reassurances that, basically, "RFID chips are your friends, they will not harm you". Chief among the reassurances is that the data is encrypted, and of course the word "encryption" is a power word that promises magical protection of your data.

Do you know that DVDs are encrypted? Do you know that the encryption was broken shortly after the DVD format was introduced, and that you can download free software from the Net that slices through the encryption like a hot knife through butter to make perfect copies of encrypted DVDs? All true, and both DVD and RFID encryption share the same fatal Achilles Heel: The decryption key must be built into millions of readers. There's no way to keep it confidential. They tried to obscure it by issuing individual keys to manufacturers, but of course the actual video data must be encrypted using a single key, so each DVD has a lookup table that translates the manufacturer's key to the master key. Totally braindead, but the situation intrinsically doesn't allow anything better. Millions of DVD players, millions of RFID readers...the cat will be out of the bag shortly.

Even without the lookup table, DVD encryption would have been broken eventually using brute force. The encryption keys are short, just 40 bits, I think, because longer keys take longer to decrypt, and with encrypted video, you have a ton of data to decrypt and have to do it as fast as possible. RFID chips don't have the same performance requirements, but because the readers will have to be inexpensive handheld devices manufactured by the millions, I wouldn't expect them to use military-grade encryption. If the keys are in the range of about 128 bits, encryption can be broken in a weekend if you have a pool of computers to do it (distributed, like SETI@Home; for example, take over your employer's office computers for a weekend, or distribute a virus to turn PCs into "zombies" to do it for you).

But then, to commit identity theft using an RFID-based identity "document", you don't actually need to decrypt the data. Just ping the chip and record the answer, then play it back. Eventually nobody will bother even looking at the paper version of identity documents, as long as your signal's in order.

Misuse of RFID-based identity documents has huge ramifications, but there are lesser problems associated with other uses of RFID. They're already ubiquitous in retailing, and that's another opportunity for invasion of privacy, because retailers have an incentive to read the RFID tags on merchandise you've purchased at other stores when you carry your bags and packages into their store. Retailers often disable RFID tags after you purchase, but not always; one of the proposed California laws would make deactivation mandatory.

Should you care? Well, it's like the hoary old cliche: "Und so, iff you haff nozing to hide, vhy vould you object to zis surveillance, hmmmm?" Suppose you're at the mall, and first, rent some porn at the video store, then pick up some sexy lingerie at Victoria's Secret. Then you meet up with the spouse and kids at Blockbuster to pick out a kid flick, still carrying the accessories for the second half of the evening. Blockbuster's scanner reads your purchase of the porn, and like Amazon's "if you liked this, you'll also like that" matchup, the clerk rushes up and gushes "Mr. Brosniac, perhaps you'd like a look at our fine collection of 'Barely Legal' teen porn?" Oops.

Or, how would you feel about a market research company driving a truck up and down suburban streets cataloging all the RFID tags it can ping inside the houses and in the trash cans on the street? Tie the recordings to GPS coordinates and they gain personally identifiable information about your purchases.

The question of the police use of remote sensing is controversial. There have been court cases disputing the legality of using infrared imaging to "peer inside" private residences, almost like Superman's X-ray vision. RFID scanners pose the same problem. If a police officer stopped your car and you refused permission to let him search it, would it be permissable to inventory the contents with an RFID scanner? The merchandise itself may not be important, but it will provide information about your recent movements and location, not to mention your taste and proclivities that the police officer might not appreciate. Sometimes the merchandise matters: Buy some booze in a wet county and carry it into a dry county, and a cop at the county line can nab you with an RFID scanner.

In a related vein: In most jurisdictions you don't have to present identification to a police officer unless the officer has a good reason for asking. A driver's license is, technically, just that, and your only legal obligation is to carry it while driving. But if a police officer can just scan your driver's license and passport right in your pocket, you no longer have the right to refuse to identify yourself. Bar code on the forehead, RFID chip in the wallet...is there really that big a difference?

There's a general threat here: Once upon a time, we could keep information private by simply concealing it. What was in your pockets was private, what was in your wallet was private, what was in your shopping bags was private, what was in your home was private. No longer. RFID tags are a Trojan Horse designed to defeat your choice to keep some aspects of your own life private.

Technology is not intrinsically good or bad, it's how people use it that matters. We wouldn't be faced with RFID technology if it didn't benefit some factions of our society, but the question on the table is whether it's good or bad for society as a whole. Do the economic efficiencies for retailers outweigh your right to privacy? Is the convenience it offers the police and the government more important than your right to privacy?

There are some serious questions here that can't be dealt with either by panicking or by sweeping them under the table. The truth is in the middle: RFID chips are not an umitigated blessing, and we'd better choose carefully now.