The need to prevent counterfeit drugs from being introduced into the legitimate supply chain is acute. The World Health Organization has said that counterfeit drugs represent more than 10 percent of global sales, and they are responsible for some thousands of deaths each year. The problem is that decades after RFID technology was invented, and years after the U.S. Food and Drug Administration started touting it as the most promising way to authenticate drugs, RFID technology as an anticounterfeiting technology remains just that: "promising"-yet far from proven.

Even as companies like Purdue continue to test the use of RFIDs, it remains unclear whether the technology can ever live up to its promises-not only in the pharmaceutical industry, which is at the leading edge of testing this much-hyped technology, but also anywhere else. The reasons why go far beyond the technology, standards and privacy issues that are most often raised, and into the very nature of what RFID simply is and isn't, and what it will or won't ever be able to deliver to any anticounterfeiting program.

"We see this in other areas of security," says Roger Johnston, team leader of the Vulnerability Assessment Team at Los Alamos National Laboratory, who has done extensive research on RFID technology and concluded that it may not offer any better security than ordinary bar codes. "Providing good security is a tough challenge, and people are looking for silver bullets," he says. "The problem is that if you simply take an RF tag, slap it on and think somehow it'll magically provide security, you'd be quite mistaken."

Why? Here are five reasons. Behind each myth, as you'll see, is a much smaller dose of reality.

Myth 1: RFID tags are anticounterfeiting devices.
Call up most pharmaceutical companies and ask to speak with the group most involved in testing RFID technology, and chances are good the security department will not answer the phone. Consider the RFID efforts currently under way at the country's three largest drug wholesalers. At McKesson, the RFID initiative falls under the pharmaceutical distribution business. At AmerisourceBergen, the point person is in "integrated solutions," which encompasses the testing and implementation of new technologies. And at Cardinal Health, the task falls to healthcare supply chain services, which is part of operations. That's because an RFID tag is first and foremost a tracking device, not a security one.

Even the manufacturers of the RFID tags themselves, Johnston likes to grouse, are not security companies. "They're made by semiconductor companies for inventory purposes," he says.