[IP] more on FDA suggests RFID tagging of drugs

[Dave Farber <dave@farber.net>]

Right on
-----Original Message-----
From: Marcel Waldvogel <marcel@wanda.ch>
Date: Thu, 19 Feb 2004 15:42:39 
To:dave@farber.net
Cc:Steve Bellovin <smb@research.att.com>
Subject: Re: [IP] FDA suggests RFID tagging of drugs

Dave, Steve,

My interpretation of the appropriate sections in the FDA document seem 
to use the RFID only passively: it will return its unique electronic 
product code (EPC) for each query, and not using a challenge-response 
scheme. My interpretation seems to be further supported by the 
comparison of RFID to 2-D bar codes, which certainly are passive. Such a 
use allows for easy copying of the EPC to counterfeit drugs. When the 
system is to be used offline (which could be a goal; this is not 
stated), it might even be possible to generate unique-looking EPCs.

Without a cryptographic challenge-response scheme, which would break 
compatibility to other RFID systems and probably be too expensive to 
manufacture, it does not provide any protection against counterfeiting. 
It only makes customers carrying drugs easily identifyable, which will 
aid in discrimination, tracking, and profile-building.

In summary, I expect the system to be completely BAD (Broken As 
Designed). But nevertheless, I find it fascination how easily and 
frequently even educated people attribute almost-magical properties to 
technology.

-Marcel
http://marcel.wanda.ch/

Dave Farber wrote:

>Delivered-To: dfarber+@ux13.sp.cs.cmu.edu
>Date: Wed, 18 Feb 2004 22:25:01 -0500
>From: Steve Bellovin <smb@research.att.com>
>Subject: FDA suggests RFID tagging of drugs
>To: dave@farber.net
>
>The FDA has released a report calling for the RFID tagging of
>pharmaceuticals to help defend against counterfeiting.  The word
>"privacy" barely occurs in the report -- there's simply a reference to
>HIPAA -- and it is not listed among the important unresolved issues.
>
>The report is at http://www.fda.gov/oc/initiatives/counterfeit/report02_04.html
>
>
>		--Steve Bellovin, http://www.research.att.com/~smb
>
>-------------------------------------
>To manage your subscription, go to
>  http://v2.listbox.com/member/?listname=ip
>
>Archives at: http://www.interesting-people.org/archives/interesting-people/
>
>  
>

-------------------------------------
To manage your subscription, go to
  http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/