GOP Using ‘Smart Badges’ at Convention, Raising Privacy Flags

By Joanne Cleaver 

Tagged so they can be bagged.

Participants in the Republican National Convention next week will wear electronic “smart badges” that document their movements to speed contact-tracing should anyone subsequently develop COVID-19.

Some elements of the scaled-down convention will be held in Charlotte, N.C., Monday through Thursday. Attendees will be assigned badges that communicate with one another to document where the badge-wearers are, and who they move close to, within the confines of the location. 

But the Bluetooth-enabled badges could expose convention attendees to unanticipated privacy invasions by collecting more than location information, said K Royal, associate general counsel at TrustArc Inc., a San Francisco privacy software and consulting firm.

“Depending on the signal strength, the badges will record the other badges it connects to, along with whatever personal information is on the badge, whenever the badges are within proximity of each other,” Royal told Digital Privacy News. 

“This is not the best option for privacy.”

K Royal, TrustArc Inc. consultancy, San Francisco.

But manufacturers of such badges said they only were responsible for the devices — and not for how organizations collected, stored and used the data the badges amassed.

That raises another privacy red flag, Royal said.

“The most private and secure ones only enable local storage.

“Your Bluetooth devices capture other Bluetooth devices in your vicinity, if you’ve opted in, and no names are associated — just device IDs, where you are notified when the other device-ID owner issues an alert,” she explained.

“Based on the information available, it seems that personal information will be associated with each badge — and the contacts made will be stored centrally.”

Tracking People vs. Pallets 

In fact, “smart tag” badges are made by companies that have expertise in tracking pallets and packages, not people.

While manufacturers insist the data generated by the tags does not violate individual privacy, they also say that they only collect the data and hand it over to their customers — who then decide what to do with it.

The lack of an industry standard for data collected on-site is one reason why many companies are installing instead equipment that specifically does not collect individual data, said Michael Lende, president and CEO of Internet of Things Inc.

“People are very uncomfortable with identifiers that track them.”

Michael Lende, Internet of Things Inc.

The Toronto-based company is about to release ThermalPass, a high-volume, no-touch, walk-through device that screens temperatures.

While companies and event hosts need streamlined tools for checking the health of employees and attendees as they re-open for business, they also are keenly aware of the public’s aversion to privacy invasions, he said.

“People are very uncomfortable with identifiers that track them, with everybody seeing what they’re doing,” Lende told Digital Privacy News. “Big Brother watching over you, all the time, is a very unhealthy way to go about it.”

No RNC Response

The Republican National Committee did not respond to repeated requests for comment about the vendor that produced its the tags nor how they would be collecting, analyzing and using any data gathered about convention attendees and staff. 

The Democratic National Convention, which ends Friday in Milwaukee and online, appears to have adopted only traditional scans and contact-tracing methods, according to news reports.

The Democratic National Committee did not respond to a request from Digital Privacy News about whether it was using smart badges or similar technology.

Ramping Up Sales Efforts

Manufacturers of smart badges told Digital Privacy News that the were ramping up efforts to sell their technology to track people instead of things. 

One company, Fleetwood Group Inc., based in Holland, Mich., historically makes manufacturing and logistics-tracking tools and now is pushing its Instant-Trace badge.

The devices “measure the distance between wearers, alerting wearers when they’re too close to one another and allowing employers to understand close-contact instances in the event of COVID-19 exposure, without the use of location or personally identifiable information,” Nick Hayhoe, vice president of electronic sales and information, told Digital Privacy News.

Jason Grant, the company’s president, told a Michigan television station in April that the product developed from applying Fleetwood’s technology to its own challenge of supporting worker safety.

Another smart-badge manufacturer, Kinexon, already has 25,000 users for its people-tracking SafeZone tag, said spokesman Matt Bontorin.

The company, founded in 2012 in Germany and now with offices in Chicago, added SafeZone to its line of industrial and athletics-measuring products.

“When the pandemic happened, we realized that we had the capabilities with our technology to make a difference,” Bontorin said. “We pivoted the same sensor technology for tracking assets to people.”

SafeZone tags are embedded in bracelets or ID tags hanging from lanyards. When two tag-wearers come within six feet of each other, the tags record the encounter.

“If you’re at an event and then someone later tests positive, you’ll want to know if you came into contact with that person.”

Matt Bontorin, Kinexon.

If the six-foot perimeter is breached, the tags blink. If the breach lasts for more than five seconds, the sensors emit an alarm. 

At the end of the workday or event, proximity data is downloaded and can be used how the organization wishes, Bontorin said.

Targeting New Markets

Beyond workplace health-monitoring, Kinexon detects an enthusiastic market for event organizers who want to convene without burdensome manual contact-tracing paperwork.

“If you’re at an event and then someone later tests positive, you’ll want to know if you came into contact with that person,” Bontorin told Digital Privacy News. “You’ll know if you should be tested immediately.” 

However, Trust Arc’s Royal said she suspected that smart badges could be overkill for contact-tracing.  

“Given that it is a convention with about 500 attendees, a default decision could be made that every attendee is exposed if one attendee is sick,” she said.

“All attendees could then be notified of potential exposure.

“This is not the best option for privacy,” Royal told Digital Privacy News, “and in such a venue, doesn’t seem to be required.”

Joanne Cleaver is a business writer in Charlotte, N.C.

Sources (external links):