Security and Risk Management Still Unanswered

Mark,

Anyone with a modicum of intelligence can understand the potential business benefits of a "killer" application like RFID. It does not take a rocket scientist to figure that out.

Where the industry is nearly clueless is in understanding the associated risks. Big Pharma is currently NOT held liable for counterfeits. The court of public opinion may or may not deliver a guilty verdict, but legally they are in the clear.

Once ePedigree becomes the law of the land, that potentially changes EVERYTHING. Big Pharma is now expected to make sure the tracking system is sound, robust, and is stopping counterfeits. Perhaps the liability lies elsewhere in the supply chain, and the associated organization is held liable. These are big unknowns.

Couple that information with the cost of RFID implementation, the KNOWN security pitfalls of MOST RFID systems, and the enormous task of getting everyone to agree on what to do, and we can easily see why nobody is willing to dive into this so quickly.

I recently delivered an oration at an FDA public hearing regarding tracking systems for produce, and I spoke of the need for security. I was directly approached by a uniformed FDA officer who thanked me and said "The FDA is really bad when it comes to anything that is related to information technology, we need to look more closely at security."

So if industry leaders, such as RFID Journal, Supplycape, ABI, etc. are not going to lead the charge for security, who is? The RFID Security Alliance is trying our best to do so, but WITHOUT the support of industry leadership our reach is limited.

Perhaps RFID Journal might consider lending a hand.