Witness Testimony Dr. Sanjay Sarma Associate Professor, Mechanical Engineering Massachusetts Institute of Technology 77 Massachusetts Avenue Building 35, Room 010 Cambridge, MA, 02139 Radio Frequency Identification (RFID) Technology: What the Future Holds for Commerce, Security, and the Consumer Subcommittee on Commerce, Trade, and Consumer Protection July 14, 2004 11:30 AM Chairman Stearns and other members of the subcommittee, thank you for inviting me to testify today. The subject you have chosen is one of great importance to the conduct of business around the world. I am delighted to share my views. When I say that the topic of RFID Technology -- and the EPCglobal Network it makes possible -- is one of great importance for business around the world, I understand the need to be as clear as possible in explaining what I mean by that. I hope that my testimony today will serve that purpose. The new communications network -- a real-time mechanism for providing visibility in the global supply chain -- we are discussing will have a vast impact. It will save billions of dollars and has the potential to save many lives. It has dozens of exciting applications that are already in development - from identifying counterfeit drugs to facilitating product recalls. What I’m talking about is a communications network that will essentially be an "Internet of products." In this network, inanimate objects -- chiefly pallets or cases of manufactured goods -- will have the ability to be identified wherever they are. Much as a dark room becomes luminous when lights are switched on, the historically opaque supply chains on which so much of the world’s economic activity is built will become "visible." At any moment, we will be able to tell where a given shipment is, the history of its movements through the chain, the number of items in the chain, and much more. This system represents an enormous advance over bar code technology, in part because it is not based on lasers and therefore does not require that objects be within the line of sight of the device needed to detect them. Instead, the system relies on radio waves that can be instantly interpreted by a nearby "reader" device with its own antenna. Thus, for example, a truckload of inventory delivered to a retail warehouse could be read at once instead of having to individually identify each pallet and case of product. This system offers huge benefits to manufacturers, retailers, distributors, and -- importantly -- consumers. Manufacturers will be able to track high-value items, reducing shrinkage, and increasing their speed-to-market; they’ll also be able to accelerate and better target their product recalls. Distributors will see their shipping and receiving processes grow in accuracy as they fall in price. Retailers will be able to monitor inventories in real time, enabling them to keep stocks fresh and cut transportation costs. All these improvements will result in substantial benefits for the consumer. Consumers will benefit from increased product availability and faster removal of recalled products. There’s potential for increased cost savings as efficiencies gained throughout the supply chain are passed along to the consumer. The technology also has the potential to save lives. The system can help solve the growing challenge of counterfeit drugs, for example, by offering a drug tracking and tracing capability. Improved food safety is another positive consequence, allowing manufacturers and retailers to implement product recalls swiftly and precisely, avoiding potential health consequences and improving the integrity of the world’s food chain. There will be benefits in the public sector as well, as evidenced by the key sponsorship of RFID by the Department of Defense. DOD understands the potential for more efficient purchasing and supply tracking. Other organizations are running RFID pilots in critical applications like port security. How RFID and EPC Technology Work Radio Frequency Identification (RFID) has been around since World War II, when it was used to identify friendly aircraft. Today it is used in a variety of applications from office security passes to pay-at-the-pump convenience services. But the use of RFID on the scale now envisioned in the EPCglobal Network had to await other advances, such as the computer revolution and the Internet. Because of these advances, it is now possible to store on a microchip a series of zeroes and ones -- digital bits -- that can uniquely identify trillions of different objects -- the way bar codes identify many of today’s products, but with potentially much more information about a particular shipment of products. This unique series of digital bits is called the Electronic Product Code, or EPC. Attach a tiny radio antenna to this microchip and you have an EPC "tag," a cheaper version of a toll pass which, when asked, can signal its assigned number. The tag is not transmitting information actively. Secure devices called readers that comply with global standards developed through EPCglobal send out radio frequency waves that "wake up" the tag for a short period of time, enabling it to transmit information stored on the tag -- namely the Electronic Product Code. The EPC can then be matched to the specific product information contained in a corresponding database, which is accessed through a secure network: the EPCglobal Network. With that link complete, manufacturers and their trading partners have the ability to interpret not only what the tag is directly telling them -- the EPC -- but all kinds of additional background information, such as when it was made and shipped, what lot it came from, and other important information related to the movement of global commerce. The inventory is completely "visible," assuming you have permission to access the data. And, this information can be made as secure as any Internet banking application. Security of the EPCglobal Network is of primary concern. Even in this early stage of development, significant consideration and effort has been given to developing the specifications and standards for implementing security for all aspects of the network. There are already inherent security measures built in to the network. For example, when EPC tags pass through EPC readers throughout the supply chain, the only information collected is the EPC and the time, date and location of the read. Thus, the EPC tag, in and of itself, does not communicate meaningful information. All information associated with an EPC is found in the network and is only accessible to authorized users behind firewalls, encoding and other security measures. The process for capturing information is very similar to that used by today’s bar code technology. What is different is that the technology can capture and distribute information more efficiently. For example, in a warehouse or distribution center environment, multiple tag numbers can be collected at one time through one pass and without manually locating and scanning the tag like bar codes. The EPC tag also allows for greater depth of serialization providing the capacity to uniquely identify one product from another. And finally, the information captured can be shared in a secure manner across existing networks and information systems, enabling companies to identify where products are in the supply chain at any given point in time. The speed at which this information can be captured, shared, and distributed has positive implications for consumers and industry alike. Consider this: the bar code, which was standardized by EAN International and the Uniform Code Council, Inc. (UCC), is scanned more than 10 billion times daily. In the same way the bar code revolutionized the global supply chain, the EPCglobal Network promises to significantly improve the consumer shopping experience and the way organizations move goods from one place to the other. It puts the power of RFID to work to provide better shopping experiences for consumers and to improve efficiency all across the global supply chain. The Auto-ID Center and EPCglobal In 1999, the Uniform Code Council, Inc. (UCC), a not-for-profit standards making body based in Lawrenceville, N.J., which had spearheaded the adoption of bar code technology, joined with Procter & Gamble and The Gillette Co. in helping establish the Auto-ID (Automatic Identification) Center at the Massachusetts Institute of Technology (MIT). Sponsorship of the center soon grew to more than 100 global companies, and research spread beyond MIT to five other great research universities around the world: at the University of Cambridge in the United Kingdom; the University of Adelaide in Australia; Keio University in Tokyo, Japan; Fudan University in Shanghai, China; and the University of St. Gallen in Switzerland. The center’s mission was to develop RFID for use across the global supply chain. The vision was simple: harness the capability of RFID to create a world in which we can effectively track products throughout the supply chain using a single, global network as products move from one company to another, one country to another. The idea behind this vision was to make it as easy for one company to read another company’s "tags" as it is for IBM computers to communicate with Apple machines over the Internet. One focus of the center’s work was the development of the identification system for objects in the system -- the EPC. Another was the development of the entire system in which EPC tags could be used -- the EPCglobal Network. To develop a universal, open network that can be applied across all industries and across all countries -- so that individual objects could be tracked through the entire global supply chain -- requires common standards and a common infrastructure, much as commonality is demanded by the Internet. By November, 2003, enough progress had been made in these efforts to create a new organization, called EPCglobal Inc., with the mission of developing the technical standards pertaining to the EPCglobal Network and driving their adoption across industries and across the world. The Auto-ID Center at MIT evolved into the research-focused Auto-ID Lab, while EPCglobal took on what had been the center’s administrative responsibilities. The formation of EPCglobal signaled the beginning of the road to the commercialization of EPC technologies. EPCglobal is a joint venture of the UCC and EAN International, a global, Brussels-based not-for-profit organization similar in purpose to the UCC, and which played a key role in the adoption of the bar code in Europe. Such parentage provides EPCglobal with a background in user-driven standards development that is unmatched. EPCglobal is supervised by a board of governors drawn from its parent organizations, as well as the faculty of MIT and some of its end users representing multiple industries, from healthcare to high tech to consumer packaged goods. The organization is working collaboratively with end-users (companies implementing the technology) and solution providers (companies building the technology) to build the infrastructure for the EPCglobal Network. It is also providing comprehensive implementation support, including standards development and maintenance, education and training, and certification and compliance programs. The Importance of Global Standards The key to commercializing EPC is the development of global standards. The significance of common standards cannot be overstated. The absence of such standards today is the most prominent barrier to explosive development of the network. In the absence of common standards, organizations could incur high costs to give their products multiple-standards compatibility, leading to higher prices. Creating an open, global network for RFID based on a set of common global technical standards means that companies investing in systems can have confidence that the EPC tags they put on their products can be read by trading partners across the country or around the world. It also means the manufacturers of EPC solutions can make equipment in vast quantities, since that equipment will work with anyone’s system. These economies of scale will reduce equipment prices, giving companies an equal opportunity to reap the enormous benefits EPC can bring. All companies benefit from an open system. A recent Capgemini report estimated that global standards can help boost productivity improvements -- with 1 percent to 3 percent of supply chain costs gained. When you consider that we have a $10 trillion supply chain, you can begin to see the magnitude of what’s at stake. The improvement potential is comparable for both retailers and manufacturers, and applies to companies of all sizes. Subscribers to the EPCglobal Network have the opportunity to participate in the development of network standards. EPCglobal, like its parent organizations, UCC and EAN International, is open and neutral, as well as highly user driven. The standards development process works through a submissions track, which is designed to ensure that business requirements are captured, and a standards track, designed to create them, test and eventually ratify them. Much of the work is done through Working Groups and Action Groups who comprise international users from a variety of industries who are charged with defining business and technical requirements for the EPCglobal Network. Action groups, for example, help develop the foundational building blocks of the EPCglobal Network, working toward the creation of industry standards and commercial adoption. Current action groups that have been established include: -- The Business Action Group, which is comprised of representatives from companies that currently use or plan to use EPCglobal Network technology. The group’s aim is to establish business requirements and use cases across multiple industries to facilitate supply chain efficiency. -- The Hardware Action Group, which develops specifications for key hardware interface components of the EPCglobal Network, including the air, interface protocols between readers and tags. -- The Software Action Group, which creates the system software architecture and system specifications for reader management, middleware, and EPC Information Services, which connect trading partners for secure data queries. This thorough and collaborative standards development process is open and inclusive. The organization leads a neutral, consensus-based process where every company has the opportunity to contribute. Public Policy Considerations For the EPCglobal Network to reach its full potential, certain protections must be built into the system. It is EPCglobal’s position that addressing concerns, such as consumer privacy, is as important as anything the organization is doing. Reflecting that understanding, the sponsors of the network adopted guidelines for use by all companies engaged in the large-scale deployment of EPC. These guidelines are intended to complement the national international laws and regulations dealing with consumer protection, consumer privacy, and related issues. The guidelines state: -- Consumers will be given clear notice of the presence of EPC on products on their packaging. -- Consumers will be informed of the choices they have to discard, disable, or remove EPC tags from the products they acquire. (It is anticipated that for most products, the EPC tags would be part of disposable packaging or would be otherwise easy to discard.) -- Consumers will have the opportunity to easily obtain information about EPC and its applications, as well as information about advances in the technology. Companies using EPC tags at the consumer level will cooperate in appropriate ways to familiarize consumers with the EPC logo and to help consumers understand the technology and its benefits. -- Companies will use, maintain, and protect records generated through EPC in compliance with all applicable laws. These guidelines demonstrate that EPC participants are committed to addressing the issue of consumer privacy and engaging in a constructive and on-going dialogue with interested parties. The overriding goal of the guidelines is to provide a responsible basis for the use of EPC tags on consumer items. Under the auspices of EPCglobal, these guidelines will continue to evolve as advances in EPC and its applications are made and consumer research is conducted. To foster continued dialogue with key audiences about public policy and other important areas, EPCglobal and some of the industry sectors with which it’s working have also formed the EPC Public Policy Steering Committee (PPSC). The committee and its working groups will include representatives of industries and trade associations worldwide, from healthcare, technology, food, consumer products, retail and others. The PPSC owns responsibility for the Consumer Policy Guidelines and will be working closely with industry, consumers, and government leaders to communicate the benefits of the technology, as well as understanding the complex issues surrounding consumer privacy. Conclusion The EPCglobal Network will be focused on the supply chain – and, in the first few years, almost entirely at the case and pallet level, in factories, back-rooms, distribution centers, and warehouses. As the price of implementation falls, EPC applications will spread to the consumer unit level, where it can be used to manage shelf inventory and identify counterfeit products. The savings to the economy will be significant. Accenture, a consulting firm, estimated that RFID could eliminate 15 to 30 percent of missing inventory. Estimates are that the retail industry alone loses more than $50 billion a year to theft, paperwork errors, and vendor fraud. Product counterfeiting costs another $500 billion a year worldwide. At the same time, it’s estimated the technology can increase revenues by 1 to 2 percent, by reducing out-of-stock items. Consumers should benefit from these reduced costs. And, in the case of product recalls, the merchandise can be tracked quickly. Their medicines will more likely be genuine; today, according to the World Health Organization, 7 percent of global pharmaceuticals are counterfeit. As with any technology, however, it is impossible to anticipate the full spectrum of uses to which RFID Technology and the EPCglobal Network will be placed. This testimony has been focused entirely on the supply chain, because that is where the interest primarily now lies and what the current technology is capable of providing. Thank you for the opportunity to present EPCglobal’s position on the many benefits associated with this exciting technology and the organization’s commitment to protecting consumer privacy.