more on FDA suggests RFID tagging of drugs

[Dave Farber <dave () farber net>]

Right on
-----Original Message-----
From: Marcel Waldvogel <marcel () wanda ch>
Date: Thu, 19 Feb 2004 15:42:39 
To:dave () farber net
Cc:Steve Bellovin <smb () research att com>
Subject: Re: [IP] FDA suggests RFID tagging of drugs

Dave, Steve,

My interpretation of the appropriate sections in the FDA document seem 
to use the RFID only passively: it will return its unique electronic 
product code (EPC) for each query, and not using a challenge-response 
scheme. My interpretation seems to be further supported by the 
comparison of RFID to 2-D bar codes, which certainly are passive. Such a 
use allows for easy copying of the EPC to counterfeit drugs. When the 
system is to be used offline (which could be a goal; this is not 
stated), it might even be possible to generate unique-looking EPCs.

Without a cryptographic challenge-response scheme, which would break 
compatibility to other RFID systems and probably be too expensive to 
manufacture, it does not provide any protection against counterfeiting. 
It only makes customers carrying drugs easily identifyable, which will 
aid in discrimination, tracking, and profile-building.

In summary, I expect the system to be completely BAD (Broken As 
Designed). But nevertheless, I find it fascination how easily and 
frequently even educated people attribute almost-magical properties to 
technology.

-Marcel
http://marcel.wanda.ch/

Dave Farber wrote:

> Delivered-To: dfarber+ () ux13 sp cs cmu edu
> Date: Wed, 18 Feb 2004 22:25:01 -0500
> From: Steve Bellovin <smb () research att com>
> Subject: FDA suggests RFID tagging of drugs
> To: dave () farber net
>
> The FDA has released a report calling for the RFID tagging of
> pharmaceuticals to help defend against counterfeiting.  The word
> "privacy" barely occurs in the report -- there's simply a reference to
> HIPAA -- and it is not listed among the important unresolved issues.
>
> The report is at http://www.fda.gov/oc/initiatives/counterfeit/report02_04.html
>
>
>               --Steve Bellovin, http://www.research.att.com/~smb
>
> -------------------------------------
> You are subscribed as marcel () interesting-people l wanda ch
> To manage your subscription, go to
>  http://v2.listbox.com/member/?listname=ip
>
> Archives at: http://www.interesting-people.org/archives/interesting-people/
>
>  

-------------------------------------
You are subscribed as interesting-people () lists elistx com
To manage your subscription, go to
  http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/