BILL ANALYSIS
SB 1078
Page 1
Date of Hearing: June 13, 2006
ASSEMBLY COMMITTEE ON JUDICIARY
Dave Jones, Chair
SB 1078 (Simitian) - As Amended: April 6, 2006
SENATE VOTE : Vote not relevant
SUBJECT : Pupil attendance: electronic monitoring
KEY ISSUES :
1)Should public schools be prohibited from using RAdio frequency
identification (RFID) technology to monitor student's
movements and record attendance?
2)SHOULD THIS BILL INCLUDE A SUNSET PROVISION?
SYNOPSIS
This bill is one of three sponsored by the author that deals
with limiting the use of RFID devices in government-issued
documents. SB 1078, however, was spawned by revelations that a
school in Sutter, California, forced students to wear RFID
devices in order to monitor student movements on campus and
record attendance. According to the author, forcing students to
wear RFID intrudes upon the privacy rights of students and
parents, subjects students to potential stalking, and increases
the threat of identity theft. Whatever small gains are to be
had from the use of this technology is offset by the troubling
message that we send to students when we tag them "like sheep."
Opponents of this bill - mostly representatives of the high tech
industry - claim that the author and sponsor overstate the
threats to privacy and too readily dismisses its benefits to
both schools and students. The analysis recommends
consideration of a sunset so the Legislature can revisit this
issue in the future.
SUMMARY : Prohibits the use of student-issued RFID (radio
frequency identification) devices to monitor students or record
student attendance in public schools. Specifically, this bill :
1)Prohibits a public school, school district, or county office
of education from using any device that uses radio waives
either to transmit personal information remotely or to enable
SB 1078
Page 2
personal information to be read remotely for the purposes of
recording attendance or establishing or tracking the location
of a pupil on school grounds.
2)Defines "personal information" to mean any of the following:
the name, address, telephone number, e-mail address, date of
birth, religion, ethnicity, photograph, fingerprint or other
biometric identifier, school identification number, California
Identification Card number, social security, or any other
unique identifier of the pupil.
EXISTING LAW:
1)Requires school officials to require attendance in all schools
and classes and to record student attendance in a manner
prescribed by the State Board of Education.
2)Provides that no agency may disclose personal information in a
manner that would link the information disclosed to the
individual to whom it pertains, subject to certain exceptions.
Further provides that each agency shall keep an accurate
accounting of the date, nature, and purpose of each disclosure
made pursuant to one of the authorized exceptions. (Civil
Code sections 1798.24 and 1798.25.)
3)Grants to all persons within this state a constitutional right
to privacy, and provides that government may not intrude upon
this privacy unless (a) it is necessary to further a
compelling state interest and (b) there is no feasible and
effective alternative that would have a lesser impact on
privacy interests. (Cal. Const., Art. I, Sec. 1; Academy of
Pediatrics v. Lungren (1997) 16 Cal. 4th 307.)
FISCAL EFFECT : As currently in print this bill is keyed
non-fiscal.
COMMENTS : According to the author, the use of RFID technology
to monitor students' movements on campus and record attendance
violates the privacy rights of students and parents alike, and
it sends the wrong message to our children. This bill grew out
revelations last year that a public school in the small town of
Sutter, California, required students in its K-8 school to wear
badges that used radio frequency identification (RFID)
technology to monitor students' movements and record attendance.
Although all students in all grades wore the badges, the
SB 1078
Page 3
devices were mainly used to track junior high students as they
moved from class-to-class during the school day. The badges
contained an RFID "tag" that could be read by remote "readers"
positioned throughout the school, but in particular in doorways
to record students as they walked in and out of the classrooms.
A local company that manufactured RFID technology provided the
technology to the school. Not only did the company provide the
badges and reading equipment free of charge, it made a donation
to the school.
The experiment went sour when outraged parents organized a
protest and demanded an explanation from the school. Not only
were the students compelled to wear the RFID devices under
threat of suspension, the school never notified the parents
about the experiment with their children until one parent
learned of the policy from her 13-year old daughter. School
officials told the parents the school benefited from the
donations provided by the company. In addition, using RFID to
record student attendance in each class saved teachers time at
the beginning of each class period usually devoted to taking
roll. Parents continued their protest. When a number of
newspapers began to cover the protest, the company pulled the
plug on the experiment. (See e.g., Town Gives Brave New World
an F, Los Angeles Times, Feb. 22, 2005; Firm Cancels ID Deal,
San Jose Mercury News, Feb. 17, 2005; School First in State to
Track Students with Radio ID Tags, Id. Feb. 9, 2005.)
SB 1078 would prevent the use of RFID technology for purposes of
taking attendance or otherwise monitoring the students'
whereabouts on campus. It would not prohibit the use of RFID
technology for other purposes, such as inventory management.
Background: What is RFID and How Does it Work ? Despite the
often jargon-laden language used by both proponents and
opponents, the basic outline of how RIFD technology works is
fairly easy to understand. RFID "tags" can be embedded into
objects, including documents, clothing, and even people. The
tag consists of a microchip (that stores information) and one or
more antennae. Remote "readers" can then read this tag, via
radio waves. The reader constantly emits radio signals. As a
person or object with an RFID tag moves near the reader - the
distance varies depending upon the device - the antennae pick up
the signal and transmit the information stored on the microchip
to the reader. (Some RFID tags are "passive," which means that
they can only be activated by the radio signal; others are
SB 1078
Page 4
"active," which means that they can actively search out readers
in the area.) The reader then typically transmits this
information to a computer database.
In some ways, RFID technology is merely a higher-tech version of
bar code and magnetic strip scanning. However, scanning
typically requires direct contact between the scanner and the
stored information (or at least the magnetic strip or barcode
must be in the direct line of sight of a laser.) RFID readers,
on the other hand, can read the information stored on the RFID
tag remotely, through the use of radio waves. With existing
technology, the reader's capacity may range from an inch up to
several feet. Experts disagree on the potential range of RFID
readers in the future, but most agree that the current
technology allows maximum range of up to as much as thirty feet.
A key issue that divides experts on both sides of the debate,
however, concerns the nature of the information stored on the
RFID tag, and the usefulness of that information to any
unauthorized reader. Sometimes an RFID tag only contains a
random number that has no meaning until it is transmitted by the
reader to a computer database, where the random number is then
matched to other identifiers. However, in some cases RFID tags
apparently contain other information, such as a name, address,
social security number, or bank account number. Experts on both
sides of the debate disagree about the value of "encryption" or
other security measures that make stored information
intelligible only to authorized readers. Moreover, privacy
advocates point out that security measures must address more
than the ability of the reader to access intelligible
information for the tag; they must also address potential
security breaches along the entire transmission process from
tag, to reader, to computer database. Proponents of RFID, on
the other hand, claim that RFID applications are confined to a
closed system of authorized tags, readers, and databases within
that system. So that even if outsiders with remote readers
obtained information from an RFID tag, that information is only
intelligible to persons within the system.
(The above summary of RFID technology, and the contours of the
debate privacy and security issues, is based, in part, on a host
of documents representing the opinions of privacy rights and
consumer groups, industry representatives, and government
agencies. See for example
SB 1078
Page 5
www.privacyrights.org/are/RFIDposition.htm .)
RFID and Legitimate Privacy Concerns : Proponents of RFID
technology claim that privacy advocates and consumer rights
groups have portrayed the threat to privacy in exaggerated, and
even Orwellian terms. This may or may not be so. But policy
advocates and consumer rights groups are not the only ones who
have expressed serious concerns about the impact of RFID on
privacy. The U.S. Department of Homeland Security - certainly
not generally considered a member of the privacy rights camp -
recently issued a report that was highly critical of using RFID
for purposes of human identification and tracking. The report
admitted the very promising applications of RFID in inventory
management - both for private commercial purposes and public
procurement purposes. It also noted possible human
applications, such as the use of RFID to determine the movement
of miners trapped underground or firefighters trapped in a
burning building. "But for other applications related to human
beings," the DHS report concluded, "RFID appears to offer little
benefit when compared to the consequences it brings for privacy
and data integrity." (DHS, The Use of RFID for Human
Identification, supra 2.)
The DHS report noted that, because RFID tags can be read
remotely, they could transmit personal information without
giving any notice to the subjects of RFID identification. In
addition, even if people know that their RFID tag is being read,
they will not know precisely what information is being
broadcast. (Id. at 8.) As such, the DHS unequivocally
recommended, "RFID should be disfavored for human tracking. The
case for using RFID to track materiel has been made fairly well
. . . We are not aware of a similarly strong case for using RFID
to track humans." Offsetting any "small incremental benefits,"
the report concluded, "are arrayed a large number of privacy
concerns." (Id. at 10-11.) Similarly, the U.S. Government
Accounting Office concluded in its report on RFID that "Without
effective security controls, data on the tag can be read by any
compliant reader; data transmitted through the air can be
intercepted and read by unauthorized devices; and data stored in
the databases can be accessed by unauthorized users." (U.S.
Government Accounting Office, Information Security: Radio
Frequency Identification Technology in the Federal Government,
GAO Report 05-551 (May 2005), available at
http://www.gao.gov/new.itmes/d)5551.pdf .)
SB 1078
Page 6
ARGUMENTS IN SUPPORT : According to the author, this bill is
needed because "students who go to school should not be forced
to be tagged and tracked like cattle." In addition to
infringing upon the privacy rights of students and the parents,
experiments like those conducted in Sutter could threaten
students' privacy and safety off campus as well. The author
claims that, absent significant protections, RFID tags would
make students vulnerable to tracking and stalking off-campus.
Furthermore, school-issued RFID tags could be "easily cloned,
allowing others to pose as them or steal their identity."
In addition, the author contends, "when it comes to student
safety, RFID is no substitute for teacher and school staff
responsibility." RFID could create a false sense of security,
making teachers and school staff less vigilant in their own
responsibility to keep track of the children under their charge.
Students could easily figure out ways to subvert the system,
such as giving the tag to friends to carry for them. Also,
because RFID technology may be prone to errors, the attendance
data that schools are required to report to the state could be
misleading, affecting the funding that the state owes to a
particular school district.
The California Federation of Teachers argues that "tracking and
monitoring students by RFID chips threatens to erode the
autonomy our children our supposed to be learning in schools.
In addition, recent government reports indicate that RFID
devices are unreliable for identifying individuals absent other
measures. In schools, these devices could be traded, lost, or
stolen." The Consumer Federation of California also fears that
students will learn the wrong lessons if forced to wear RFID
tags. The California Commission on the Status of Women adds
that RFID tags will pose "a heightened risk for California girls
who are more often victims of sexual assault and stalking."
ARGUMENTS IN OPPOSITION : Although the opponents of this bill
had not submitted letters on the measure to the Committee at the
time of this writing, their past correspondence on prior related
bills and direct communications could be summarized as follows:
In general, opponents of the bill, and in particular the High
Tech Consortium, contend that RFID is "safe, efficient, and cost
effective and enhances the safety and security for users in the
State of California." Technology companies who produce RFID
chips claim that they have an interest in ensuring customers
SB 1078
Page 7
that their privacy will not be breached, and they "work very
hard to enable [their] customers to protect individual
information from inappropriate use." HID Corporation and Indala
Corporation, writing in opposition to last year's SB 682
(Simitian) claims that "There continues to be many
misconceptions and fears about RFID technology, which simply
cannot be substantiated?HID Corp. has over 4 million passive RF
cards in California alone, and never has there been a case of
somebody being tracked."
According to a communication from the High Tech Consortium, many
of the fears growing out of the Sutter school case illustrate
the tendency to exaggerate in light of the particulars of that
case. First, while the author and sponsor raise the specter of
"stalking" students beyond the school grounds, the students
never took the RFID tags off campus. The only persons who could
come close enough to the students with an unauthorized reader
would be persons who were already authorized to be on campus.
InCom Corporation, a California hi tech start up company, also
in opposition, states that "RFID attendance systems are designed
to be used only on school grounds and the tags are designed so
they cannot be read from any great distance. Students pick up
their IDs when they come to school and leave them in their
lockers when they leave."
Second, according to the High Tech Consortium, even if someone
were to get close enough to the student to read the tag, that
person would only read a random number. Under the system in
place in Sutter, the reader sent the random number to the
school's computer database. The school then sent the teacher,
not the reader, the name of the student for purposes of
recording attendance. The computer database would have no
capacity to send information back to the reader.
According to the High Tech Consortium, use of RFID tags in this
very limited way provides for a more efficient method of
recording student attendance and monitoring the student's
whereabouts. Less time devoted to taking roll means more time
devoted to teaching. InCom Corporation notes that "Randy Page,
Director of the Tri Counties (ROP), states that ROP programs are
funded according to each minute a student is in class, and so
ROP teachers are forced to take attendance many times during
class, instead of teaching, in order to secure funding.
Director Page states that RFID attendance systems save huge
amounts of time for ROP teachers, freeing them up to teach."
SB 1078
Page 8
Furthermore, the High Tech Consortium states that the use of
RFID might actually help to guard against stalking or
abductions. For example, if a student is missing, the RFID
technology could help school officials reconstruct the student's
movement on campus, which could provide helpful evidence in
determining what had happened to the child. InCom Corporation
notes that "RFID attendance systems give schools the power to
inform parents within minutes of the start of school if a child
didn't make it to class."
Conclusion : The debate over the potential benefits and dangers
of RFID technology, both in California and throughout the
nation, display a great deal of disagreement over the critical
questions of privacy and security. Nonetheless, there are a few
areas of consensus. For example, both supporters and opponents
of this bill generally agree that there are many useful and very
promising uses of RFID. Disagreements quickly arise, however,
when RFID is used to store personal information or track human
movements. The concerns seem even greater when it comes to
tagging our children, for this implicates not only the child's
privacy rights, but also the equally fundamental child-rearing
rights of parents. Placing RFID tags on pallets destined for
Wal-Mart is one thing; forcing our children to wear them is
something else entirely. For the parents in Sutter, the few
minutes saved by eliminating roll taking was not worth the
price. Without recourse to formal legal or policy arguments,
one parent at the Sutter school put it aptly and prosaically:
"It's creepy."
The Committee May Wish to Consider a Three-Year Sunset Provision
For This Bill : In light of the legislative history of this bill
and the extensive discussions that have already taken place
between the supporters and opponents, the Committee may conclude
it is appropriate to amend the bill to include a three-year
sunset provision. Last year's SB 682 (Simitian), for example,
called for greater security measures for all government-issued
documents containing RFID and a three-year moratorium in four
specific areas: driver's licenses, public schools, public
libraries, and government-issued health benefit cards. In
response to SB 682, the industry sponsored AB 2561 (Torrico),
which calls for a study on existing security standards related
to RFID use. An amended version of that bill recently passed in
the Assembly with a provision stipulating that nothing in the
bill would be construed to suggest that the Legislature must
SB 1078
Page 9
await the study's final report before taking action. In short,
AB 2561 assumed that the Legislature would need to enact interim
standards for RFID use pending receipt of the report, at which
time the Legislature could revisit the issue if necessary. It
would seem fully consistent, with the intent of both SB 682 and
AB 2561, to impose a three-year sunset on this bill.
Recent Related Legislation : SB 682 (Simitian) - 2005: Would
require a 3-year timeout for the use of RFID in four kinds of
government IDs. Would require various security and privacy
protections for other government IDs that use RFID. Assembly
Appropriations Committee (suspense file).
SB 768 (Simitian) - 2005/2006: Would require a 3-year timeout
for the use of RFID in four kinds of government IDs. Would
require various security and privacy protections for other
government IDs that use RFID. Assembly Floor.
SB 433 (Simitian) - 2006: Would prohibit the use of RFID devices
in driver's license and identification cards issued by the DMV.
Being heard in Assembly Judiciary Committee.
SB 1834 (Bowen) - 2004: Would prohibit companies and libraries
from using RFID in order to gather, store, or share
personally-identifiable information. Assembly Business and
Professions Committee (failed passage).
AB 2561 (Torrico) - 2006 (previously analyzed by the Assembly
Judiciary Committee): Would request the California Research
Bureau to conduct a study. Passed off Assembly Floor.
REGISTERED SUPPORT/OPPOSTION :
Support
ACLU (co-sponsor)
Electronic Frontier Foundation (co-sponsor)
Privacy Rights Clearing House (co-sponsor)
California Commission on the Status of Women
California Federation of Teachers
Consumer Federation of America
Opposition
SB 1078
Page 10
Hi-Tech Trust Coalition
InCom Corporation
Analysis Prepared by : Thomas Clark / JUD. / (916) 319-2334