Smart tech or a security concern? Unpacking the use of RFID wristbands at festivals

  • Veröffentlicht
    Wed, Dec 6, 2023, 13:00
  • Teilen
  • We spoke with promoters, providers and attendees about the pros and cons of the cashless technology.
  • Smart tech or a security concern? Unpacking the use of RFID wristbands at festivals image
  • Cashless systems using Radio Frequency ID (RFID) technology are becoming the norm at festivals worldwide, but are they a welcome improvement? Removing the need to carry cash, RFID chips attached to wristbands can be topped-up online, at kiosks or by scanning QR codes. Attendees then tap the wristbands to pay for food, drinks and merchandise. Promoters also partner with RFID providers to help with authorising entry for ticket buyers. An employee of one of these companies, who asked to remain anonymous, said this can cost promoters between thousands and hundreds of thousands of pounds, depending on the size of the event. According to the same source, chip-scanning devices are like "iPhones in hard cases" containing the same technology used in mobile phones to make contactless payments. "It's basically a huge data-mining exercise that will assess spending patterns to ensure sound logistical decisions and a slick consumer experience," they said. "The data isn't sold to third parties." The RFID system also prevents traders "pocketing money that would go to the festival for a percentage cut," they added. But if cashless events don't require cash, why do they provide cash machines? "You know the answer to that," they said. "And people may also need cash when leaving the event." Organisers of one UK festival (who didn't want to be named) told Resident Advisor that they typically accumulate between £50,000 and £100,000 in unclaimed refunds from wristbands. On average, they added, 16 percent of refunds go unclaimed. According to a document seen by RA from RFID tech provider Glownet, profits like these are sold as a key benefit to promoters. However, Glownet spokesperson James Turner said the company encourages promoters to donate unclaimed funds to "charities and good causes" and to use a digital wallet model so people pay for what they buy, therefore "eliminating the need for refunds." RFID has been a game changer for many festivals, including Barcelona festival Sónar, which implemented the technology in 2015. "It was a logical next step after years of using tokens and tickets at the bar–it simplifies processes for our staff and public," a spokesperson told RA. "[Tokens] were easy to lose and caused problems when exchanging them back for cash at the end of the event." One RFID provider, Billfold, provides promoters with wristbands that work like contactless bank cards, allowing people to spend in real time. Speaking to RA, CEO Stas Chijik said bank details are "stored in a PCI-compliant cloud service—not with Billfold, the festival or venue." Names and email addresses are also "anonymised" from the wristband's unique identifying number. Some events have developed their own cashless systems. Tim Raper, cofounder of Tribal Gathering in Panama, discovered RFID at a Dutch festival in 2014 before deploying his own team to create an independent system. Built using open-source software tool Odoo, attendees transfer funds to the event's company account using PayPal and other processors. These funds are then credited to wristbands. Raper said card details aren't held by the festival and consumer habits aren't analysed. Instead, the purpose is to handle complex accounting. "We run three businesses and spend eight hours a day over six months on accounting. Without RFID, it's mind-numbing, soul-sapping work. And regardless of the pros and cons, this tech is here to stay. We either get on-board or we get left behind." But RFID isn't for everyone. France's Hadra Festival tried and tested cashless in 2015 before ditching it when WiFi issues led to failed transactions. "People were also anxious about being tracked and the use of their data," event director Emilie Angenieux told RA. She said RFID isn't in line with the event's values and community spirit. "We live in a complicated world and people need to feel free. Festivals are mini utopias—it's our duty to keep them that way." RA heard from 35 attendees at last year's Boom Festival in Portugal—most reported a positive cashless experience. Former artist manager Megan Carpenter said she found RFID "convenient," while raver Paulita Gaspar said "having money on your wrist saves looking for it and losing things." But not everyone sang its praises: Kathleen Van Geyt said the digitisation of everything was "weird," and it was frustrating when she was unable to use her wristband due to a system error, despite having cash in her pocket. At UK festival Boomtown Fair, some attendees said the cashless system had been manipulated by rogue traders to overcharge attendees. Becca Connel said she paid £30 for a hotdog; Samantha Jane said she paid £28 for three cans of Coke Zero. But a festival spokesperson told RA that refunds are always available because the system leaves a paper trail allowing the possibility "to investigate every disputed transaction reported to us and confirm someone's been overcharged." They added: "On the whole, feedback's been positive on the cashless system and the amount of disputed transactions remains at a handful." The data collated by cashless systems is only accessible to promoters and RFID providers. So why the concern? Mariano delli Santi from UK digital rights campaigning organisation Open Rights Group told RA that the government's proposed Data Protection and Digital Information (DPDI) Bill could violate data privacy. "[The Bill] introduced new grounds for processing data and exemptions from the purpose limitation principle for reasons of law enforcement, national security and other safeguarding measures," he said. "This means data collected with RFID systems could be freely repurposed for any of these reasons and shared with authorities legally." Professor Tom Stoneham runs an MA in applied Ethics and Governance of Data Privacy at the University of York. He believes RFID is a fairly privacy-friendly technology that can't be used to identify users other than in the context of the event. But he said existing laws like Article 8 of the European Court of Human Rights already allows exceptions to the right to privacy. The proposed DPDI Bill, though, would make it easier for companies to benefit commercially from the data they collect. "This does have some relevance to the use of RFID at UK festivals and events if the RFID tags are the only allowed means of payment or access," he told RA. "Then users would be forced to give considerable data to the event organiser and some of the GDPR protections surrounding the ability of that company to exploit that data would be removed." Ultimately, he said, the more data collected, the bigger the privacy risks. He added: "The 'real' danger of laws like DPDI will emerge when private companies replace RFID with biometric IDs–a disaster in comparison because that's when privacy is gone forever." Correction, December 6th: A previous version of this article named the wrong spokesperson for Glownet.
RA