Hidden inside each ordinary-looking label is a Radio-Frequency ID (RFID) tag that is supposed to allow Purdue Pharma, manufacturer of the controversial painkiller, to track the drug's progress throughout the supply chain-regardless of how many pills are poured into how many bottles and stacked into how many cardboard boxes whizzing by on a conveyor belt. The idea is that distributors could quickly scan all their bottles of OxyContin, learn the complete provenance, or "pedigree," of each one, and reject any that could not be traced back to Purdue.

"It's efficient, it's accurate, it does what we want it to do from a security perspective, and it doesn't bog down the distribution system," says Aaron Graham, VP and CSO of Purdue Pharma, adding that the infrastructure investment for the pilot project was $2 million and each tag costs between 30 and 50 cents.

Discuss RFID in the drug industry on CSOonline.com

If what Graham is saying sounds familiar, right down to the numbers he cites, that's because he's been saying the same thing for years. Yet even now, he can offer remarkably little detail about how the system has prevented counterfeit OxyContin from being sold. Purdue, after all, has never had a problem with counterfeit OxyContin. What the company has had instead is a problem with stolen and diverted OxyContin, along with pressure from the government to get better control over a highly addictive drug that has received much more media attention for its abuse than its use.

Indeed, Graham acknowledges that the main security advantage of Purdue's RFID system is that investigators can scan a seized bottle or box of OxyContin and pinpoint exactly where it came from. To really stop counterfeit drugs, Graham says, would require a central information clearing­house where every distributor and pharmacy checked and validated the pedigree of every drug-a far more complex task than tracking one type of drug going to two different outlets, as Purdue is doing.