Results: RFID and Identity Management in everyday life - ITAS

Aim and methodology
This research aims to provide insight into how users and owners/maintainers of different
environments manage identity. Identity Management is understood as how a person, interacting
with an information system, defines what is known and not known about him/her to the system and
how this relates to how this is defined by the owner of the system.
Research questions
In order to reach this aim, the following research questions are formulated:
• In what kinds of settings are RFID systems used to identify people?
• What purposes do the RFID systems serve?
• What kind of information is stored on the chip and database of the RFID system?
• How do users and owners of the system, consciously or unconsciously, influence what kind of
personal information is known?
• What are the tradeoffs of providing more or less personal information?
• What choices are available to the users and owners of the RFID-systems in interacting with the
system?
Methodology
Being still relatively invisible in the public debate, RFID is difficult to investigate through quantitative
methods. A survey by Cap Gemini for example ‘RFID and Consumers’ (2005), showed very few
European citizens even know what RFID is, let alone have formed an opinion on it. Only 20% had
ever heard of RFID and the respondents who could state an opinion needed much additional technical
explanation. As the awareness is still low and the net sample of actual experience will be too small,
surveys can merely scratch the surface of how users actually deal with smart environments. The case
study method therefore applies more to this issue, as it can both provide a broad view of the situation
as well as a more in-depth analysis of what actually happens once people use RFID systems.
A case study is defined as a qualitative description and analysis of an event, specified in time and
place, with specified actors (organisations or individuals). In theory, a single case study can be the
base of empirically based claims. In order to analyse the use of RFID in different contexts, we need a
broader empirical base by performing a number of case studies. To strike a balance between both
empirical depth and broadness, we use a funnel approach, which starts with a broad variety of lessdetailed
case studies to survey the area and funnel down to a small number of cases to be investigated
more thoroughly. In our research, we distinguished four levels:
Level 0 case: Description of function of a specific RFID application (e.g. access, payments), where
and when it is used by who in what kind of setting (e.g. public transport, leisure).
Level 1 case: Level 0 + desk research (reports, websites, newspapers, etc.) to describe users and
maintainers and possible Identity Management issues.
Level 2 case: Level 1 + additional inquiry through e-mail or phone contact.
Level 3 case: Level 2 + site visit to observe users and hold interviews with people involved.
7