The 5 Myths of RFID

Big pharma's RFID trials aim to keep fake drugs out of your medicine cabinetbut the technology has significant limitations.

For well over two years now, every single bottle of OxyContin that's bound for either Wal-Mart, the world's largest retailer, or H.D. Smith, a midsize drug wholesaler, has been slapped with a special label that's hailed as the solution to the world's counterfeit drug problem.

Hidden inside each ordinary-looking label is a radio frequency ID tag that is supposed to allow Purdue Pharma, manufacturer of the controversial painkiller, to track the drug's progress throughout the supply chainregardless of how many pills are poured into how many bottles and stacked into how many cardboard boxes whizzing by on a conveyor belt. The idea is that distributors could quickly scan all their bottles of OxyContin, learn the complete provenance, or "pedigree," of each one, and reject any that could not be traced back to Purdue.

"It's efficient, it's accurate, it does what we want it to do from a security perspective, and it doesn't bog down the distribution system," says Aaron Graham, VP and CSO of Purdue Pharma, adding that the infrastructure investment for the pilot project was $2 million and each tag costs between 30 and 50 cents.

If what Graham is saying sounds familiar, right down to the numbers he cites, that's because he's been saying the same thing for years. Yet even now, he can offer remarkably little detail about how the system has prevented counterfeit OxyContin from being sold. Purdue, after all, has never had a problem with counterfeit OxyContin. What the company has had instead is a problem with stolen and diverted OxyContin, along with pressure from the government to get better control over a highly addictive drug that has received much more media attention for its abuse than its use.

Indeed, Graham acknowledges that the main security advantage of Purdue's RFID system is that investigators can scan a seized bottle or box of OxyContin and pinpoint exactly where it came from. To really stop counterfeit drugs, Graham says, would require a central information clearing­house where every distributor and pharmacy checked and validated the pedigree of every druga far more complex task than tracking one type of drug going to two different outlets, as Purdue is doing.

The need to prevent counterfeit drugs from being introduced into the legitimate supply chain is acute. The World Health Organization has said that counterfeit drugs represent more than 10 percent of global sales, and they are responsible for some thousands of deaths each year. The problem is that decades after RFID technology was invented, and years after the U.S. Food and Drug Administration started touting it as the most promising way to authenticate drugs, RFID technology as an anticounterfeiting technology remains just that: "promising"yet far from proven.

Even as companies like Purdue continue to test the use of RFIDs, it remains unclear whether the technology can ever live up to its promisesnot only in the pharmaceutical industry, which is at the leading edge of testing this much-hyped technology, but also anywhere else. The reasons why go far beyond the technology, standards and privacy issues that are most often raised, and into the very nature of what RFID simply is and isn't, and what it will or won't ever be able to deliver to any anticounterfeiting program.

"We see this in other areas of security," says Roger Johnston, team leader of the Vulnerability Assessment Team at Los Alamos National Laboratory, who has done extensive research on RFID technology and concluded that it may not offer any better security than ordinary bar codes. "Providing good security is a tough challenge, and people are looking for silver bullets," he says. "The problem is that if you simply take an RF tag, slap it on and think somehow it'll magically provide security, you'd be quite mistaken."

Why? Here are five reasons. Behind each myth, as you'll see, is a much smaller dose of reality.

1. RFID tags are anticounterfeiting devices.

Call up most pharmaceutical companies and ask to speak with the group most involved in testing RFID technology, and chances are good the security department will not answer the phone. Consider the RFID efforts currently under way at the country's three largest drug wholesalers. At McKesson, the RFID initiative falls under the pharmaceutical distribution business. At AmerisourceBergen, the point person is in "integrated solutions," which encompasses the testing and implementation of new technologies. And at Cardinal Health, the task falls to healthcare supply chain services, which is part of operations. That's because an RFID tag is first and foremost a tracking device, not a security one.

Even the manufacturers of the RFID tags themselves, Johnston likes to grouse, are not security companies. "They're made by semiconductor companies for inventory purposes," he says.

True, an RFID tag has potential as a security device, when it's incorporated into a larger scheme. But it's not an anticounter­feiting device in the way that, say, a hologram label is supposed to be. An RF reader cannot simply read information on an RF tageven an encrypted oneand provide its owner assurance that the product is authentic. RFID technology is either a way of facilitating the documentation required to create a drug's electronic pedigree (the record of a drug's journey through the supply chain), or a component of a much more complicated system known as track and trace, which involves communication with the drug's source, or someone who knows it. Which brings us to point number two.

2. RFID technology is necessary to track the movement of legitimate drugs.

At AmerisourceBergen, a complex track-and-trace pilot project is under way that would allow the $61 billion distributor to check the source of any drugs that pass through its distribution facility in Sacramento, Calif. Funny thing is, RFID technology is just one tiny piece of the projectthe one that (hopefully) makes it operate quickly, rather than securely. The component of the technology that actually authenticates drugs is a registry handled by VeriSign, which is known mostly for its digital certificate products.

Shay Reid, AmerisourceBergen's vice president for integrated solutions, explains. Drugs that have RFID tags are read with an RF reader, but the crucial part from a security standpoint is what happens next: two-way communication. "If I am the rightful owner, and VeriSign can verify that I did receive [the product] from an upstream trading partner, then they'll give me a certification number that allows me to further distribute the product downstream," Reid says. "If they can't verify that I am the rightful owner, then the transaction will be refused."

Here's the catch: Typically, products that are marked with RFID tags are also marked with a 2-D bar code, which is similar to a traditional bar code but carries more information. "The 2-D is the backup," Reid explains.

That's because the most common complaint about RFID tags is that they're flaky. Read rates as low as 70 percent have been reported, and accuracy can be especially difficult when liquid medicine or foil wrapping is involved. (To be fair, RFID technology has come a long way in the past couple years, and tests of the latest tags are much more encouraging. Cardinal Health reports that its latest tests showed 99 percent accurate read-rates and no ill effect from liquids or foils.)

For now, however, the 2-D bar code is generally considered a more reliable marker than the RFID tagalbeit one that takes longer to read, because it can't be scanned through packaging material using radio waves.

The crucial point of either marking mechanism is that each container be labeled with a unique, serialized number. That way, once bottle #1894892432 has been received by a pharmacy in Silver City, N.M., a bottle with #1894892432 can't also be authenticated by a pharmacy in Brunswick, Md. Otherwise, counterfeiters could simply churn out fake RF tagsor 2-D bar codes, for that matteras easily as they churn out fake drugs, and there would be no central clearinghouse identifying the duplicates.

3. RFID technology can be used to mark pills, tablets and elixirs themselves.

When RFID boosters praise the technology as the solution to counterfeit drugs, here's one objection that Novartis's James Christian is quick to raise: No one is marking drugs, only the packaging.

"We have had experience with counterfeit product in genuine packaging, and genuine product in counterfeit packaging," says Christian, who is CSO of the $37 billion company based in Basel, Switzerland, which manufactures a variety of prescription and over-the-counter drugs. "The packaging isn't what's important."

What's more, he says, pharmaceutical products are routinely and legally repackaged in both the United States and the European Union. "If a pharmaceutical company invests a great deal of money into putting security devices in packaging, the product could easily be transferred legally to a package with no security device," he says. "And now someone has a collection of genuine packaging with security devices that they might throw away or use in another manner."

In Christian's opinion, at least, changing the rules that govern how legitimate drugs are distributed could be more effective than using RFID technology in defeating counterfeit drugs. This could mean changing repackaging laws or increasing penalties for counterfeiters. Whether any of this would be easier to accomplish, though, is anyone's guess.

4. RFID technology will let consumers verify that they have purchased legitimate products.

The ultimate goal of using RFID technology as part of an electronic pedigree or track-and-trace program is to allow customers to know that the drugs they have in their medicine cabinet are authentic ones. "The benefit is at the consumer endknowing that the product you're getting came from where it should have come from," says Julie Kuhn, vice president of operations, healthcare supply chain services at Cardinal Health, the $81 billion wholesaler based in Dublin, Ohio.

Yet no onenot the FDA, and not any of the pilot programs being done by the private sectoris actually proposing a way for consumers to validate the products. In fact, it seems likely that RFID tags will be disabled before the drugs reach consumers' hands. This is largely because of privacy concerns that, say, stores could use the information on RFID tags to know what bottle of pills a customer has in his backpack.

Even if the United States does eventually have a track-and-trace program that relies on RFID technology, ultimately the consumer will still be relying on something as old-fashioned as an ice-cream soda: trust in the local apothecary.

"Patients put trust in the states licensing the pharmacies, and that pharmacists are only buying legitimate products," says Carmen Catizone, executive director of the National Association of Boards of Pharmacies. "But right now, they can't do that, because they don't have a pedigree" of where the drug came from.

5. The pharmaceutical industry is this close to widespread RFID adoption.

Given all these challenges and limitations, it may come as no surprise that the move to implement RFID technology to secure the nation's drug supply has hit some speed bumps, years after it was first promoted as the Next Big Thing for pharma. The FDA, after delaying for years the deadline for when the industry should have electronic pedigrees in placeones that it says, most likely, will rely on RFID technologyrecently announced its biggest delay of all: It was giving up on setting a deadline.

Back in 2004, explains Ilisa Bernstein, the FDA's director of pharmacy affairs, "we thought there would be widespread use by 2007. We're not there. So rather than setting another deadline, we're leaving it to the stakeholders themselves to come up with a deadline." (An injunction of the Prescription Drug Marketing Act, the 1987 law that allows the FDA to set this regulation, has not helped. For more, see "Legislative Tangle" on Page 20.)

Still, the FDA continues to say (as it has for years) that RFID technology is the "most promising" means of authenticating drugs.

"We keep saying this is a promising solution," Bernstein says. "We want to say that this is a solution, but we're not there yet because people haven't adopted it. There's a lot of work going on behind the scenes, but you have to cross over the line and just jump right in and start doing it."

In the end, it may turn out that both the RFID boosters and the naysayers are right: RFID technology may in fact be the most promising way to mitigate an unsolvable problem. But only time will tell.

"We need more customer validation of the solutions that are being used today," says Michael Liard, a research director at ABI Research who studies RFID. "If companies are finding ROI or business benefits, they're hard-pressed to share those because those are now sources of competitive differentiation. So getting them to communicate the benefits that they're realizing is a challenge that we're going to have to address as an industry."

Copyright © 2007 IDG Communications, Inc.

7 hot cybersecurity trends (and 2 going cold)