- cypherpunks-legacy - lists.cpunks.org

[ISN] Japanese Government Bans Security Researcher's Speech
by InfoSec News 15 Nov '04

15 Nov '04

http://www.ejovi.net/archives/2004/11/japanese_govern.html November 12, 2004 [JUKI net is Japan's national ID system. Ejovi performed a security audit of the system for Nagano Prefecture one year ago] Its been a long day. I am greatly disappointed that Soumushou, the Japanese government that maintains JUKI net, prevented me from speaking today at the PacSec security conference. Soumushou prevented my talk by threatening the Japanese event who currently are seeking contracts from the government The Japanese government gave me two options. 1) Do not talk 2) Drastically change your slides to say what they want me to. When I offered to not use slides at all and give my own opinion they told me that I would not be permitted to speak AT ALL. It is obvious to me that they did not have an issue with my slides or presentation. They were afraid that I would draw attention to problems in JUKI net. Soumushou thinks that they can hide from the issues. They think that if they keep people from speaking about the issues, it will go away. I thought I would be immune from such Japanese government pressures however I underestimated Soumushou's ability to manipulate those around me. Soumushou's reason for forbidding me to speak was this "Since we are endorsing the convention we have to right to tell you not to speak" if this is the case, the Japanese government needs only sponsor or endorse ANY event in which they don't agree with and force the organizers to change the content. If this is the case Japan will never make any progress towards a safer environment. What is most upsetting to me is the fact that I HAD NO PLANS TO CRITIZE the Japanese government. My talk was going to be extremely fair and balanced addressing the issues raised by both sides. In fact I invited Soumushou to meet with me directly so that I can address any issues they may have. I told them this on the telephone and by email. Instead they choose to pressure the Japanese representatives of the conference. They never attempted to talk with me directly. Why is this? If they had issues with something I may say why not ask me about it? Why pressure a company they relies on government contracts? Is this fair? The purpose of my talk was to present both sides of JUKI net security systems. I have no vested interest in seeing it fail or in seeing it succeed. I only wanted to recommend how best to make it safer, how best to improve the system. But Soumushou believed that my recommendations on how to improve its security alone would mean that JUKI net has problems and they refused to admit this. I'm sorry to tell them but it does have security problems. The good news is that the technical issues can be easily resolved. However the greatest problem with JUKI net is not technical but Soumushou's inability to even acknowledge that they exist! How can a system become secure if the Japanese government are not willing to listen to someone who points out issues. Today was a sad day for Japan and a frustrating day for me. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] How a guy's gizmo spread fear at Fed
by InfoSec News 15 Nov '04

15 Nov '04

Forwarded from: William Knowles <wk(a)c4i.org> http://www.nydailynews.com/front/story/251774p-215484c.html BY THOMAS ZAMBITO DAILY NEWS STAFF WRITER November 11, 2004 It nearly sparked a financial catastrophe. An electrician's homemade gadget wreaked havoc on the Federal Reserve Bank of New York, causing computer convulsions at a facility that houses the world's biggest cash vault, the Daily News has learned. The foulup short-circuited the career of journeyman electrician John Cravetts, who was fired though he insists he meant no harm. But it could have been much worse, according to papers filed in Manhattan Federal Court. "The results could have been catastrophic," said Barry Schindler, an attorney for the New York Fed. Fed officials say they might have had to shut down computers that process some $2.5 trillion in funds and securities payments and $4 billion in checks every day. Fortunately, backup systems kicked in after the Nov. 17, 2002, incident. The heavily guarded facility in East Rutherford, N.J., is also home to a vault that handles more than $1 billion in currency, coins and food coupons. Cravetts, 62, was canned two weeks after the incident. A surveillance tape caught him using the crude device - two red wires strung between an ordinary household switch and plug. He later filed an age discrimination suit and also charged his firing was retaliation for reporting an electrocution hazard at the facility where he'd worked for almost 10 years. Manhattan Federal judge Harold Baer tossed out Cravetts' claim this week. "I had an unblemished record," Cravetts told The News yesterday. "What I did was in good faith. I did not do anything malicious," added the licensed electrician, who has since found a new job. "What do they think I'm going to do, sabotage it?" Although Fed attorneys presented a near-doomsday scenario in court filings, Fed spokesman Peter Bakstansky downplayed the incident yesterday. "There was no point at which the operations of the Fed were in danger," Bakstansky said. "We stopped him. ... We have a lot of redundancy." Cravetts had been asked to locate circuit breakers on the Fed computers that had not been properly labeled. He used his gizmo to conduct the search, plugging it in and tripping breakers, knocking out power as he went along. Cravetts told The News his superiors knew he used the device. He had made four of them at work. Fed attorneys say he should have used a device that sends a harmless tone back to the breaker and doesn't cause disruptions. Cravetts said that for more than a year, he had asked his bosses to order the manufactured device needed for the job, but they never did. *==============================================================* "Communications without intelligence is noise; Intelligence without communications is irrelevant." Gen Alfred. M. Gray, USMC ---------------------------------------------------------------- C4I.org - Computer Security, & Intelligence - http://www.c4i.org *==============================================================* _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] How a guy's gizmo spread fear at Fed
by InfoSec News 15 Nov '04

15 Nov '04

Forwarded from: William Knowles <wk(a)c4i.org> http://www.nydailynews.com/front/story/251774p-215484c.html BY THOMAS ZAMBITO DAILY NEWS STAFF WRITER November 11, 2004 It nearly sparked a financial catastrophe. An electrician's homemade gadget wreaked havoc on the Federal Reserve Bank of New York, causing computer convulsions at a facility that houses the world's biggest cash vault, the Daily News has learned. The foulup short-circuited the career of journeyman electrician John Cravetts, who was fired though he insists he meant no harm. But it could have been much worse, according to papers filed in Manhattan Federal Court. "The results could have been catastrophic," said Barry Schindler, an attorney for the New York Fed. Fed officials say they might have had to shut down computers that process some $2.5 trillion in funds and securities payments and $4 billion in checks every day. Fortunately, backup systems kicked in after the Nov. 17, 2002, incident. The heavily guarded facility in East Rutherford, N.J., is also home to a vault that handles more than $1 billion in currency, coins and food coupons. Cravetts, 62, was canned two weeks after the incident. A surveillance tape caught him using the crude device - two red wires strung between an ordinary household switch and plug. He later filed an age discrimination suit and also charged his firing was retaliation for reporting an electrocution hazard at the facility where he'd worked for almost 10 years. Manhattan Federal judge Harold Baer tossed out Cravetts' claim this week. "I had an unblemished record," Cravetts told The News yesterday. "What I did was in good faith. I did not do anything malicious," added the licensed electrician, who has since found a new job. "What do they think I'm going to do, sabotage it?" Although Fed attorneys presented a near-doomsday scenario in court filings, Fed spokesman Peter Bakstansky downplayed the incident yesterday. "There was no point at which the operations of the Fed were in danger," Bakstansky said. "We stopped him. ... We have a lot of redundancy." Cravetts had been asked to locate circuit breakers on the Fed computers that had not been properly labeled. He used his gizmo to conduct the search, plugging it in and tripping breakers, knocking out power as he went along. Cravetts told The News his superiors knew he used the device. He had made four of them at work. Fed attorneys say he should have used a device that sends a harmless tone back to the breaker and doesn't cause disruptions. Cravetts said that for more than a year, he had asked his bosses to order the manufactured device needed for the job, but they never did. *==============================================================* "Communications without intelligence is noise; Intelligence without communications is irrelevant." Gen Alfred. M. Gray, USMC ---------------------------------------------------------------- C4I.org - Computer Security, & Intelligence - http://www.c4i.org *==============================================================* _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Certicom Announces Security Builder NSE (National Security Edition)
by R.A. Hettinga 15 Nov '04

15 Nov '04

<http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=109&STORY=/www/story/11-1…> Certicom Announces Security Builder NSE (National Security Edition) Cryptographic toolkit enables government contractors to add security that meets NSA guidelines to protect mission-critical information MISSISSAUGA, ON, Nov. 15 /PRNewswire-FirstCall/ - Government defence contractors got a helping hand today when Certicom Corp. (TSX: CIC), the authority for strong, efficient cryptography, announced Security Builder(R) NSE(TM). This developer toolkit enables organizations to build applications and devices that meet the field-of-use guidelines set out by the National Security Agency (NSA) to protect mission-critical national security information. According to the NSA, there are over one million high-grade devices in the U.S. Government today that will need to be replaced to include security based on Elliptic Curve Cryptography (ECC). At an Internet Engineering Task Force (IETF) meeting on November 11, the NSA presented their requirements for strong security over the next 50 years and further information about their licensing agreement with Certicom for its ECC-based intellectual property. The NSA presentation can be found at http://www.machshav.com/~smb/saag-11-2004/ . In October 2003, the NSA selected elliptic curve cryptography (ECC) as the public-key cryptosystem to meet these new, stronger security requirements under its crypto modernization program. The agency purchased licensing rights for 26 ECC-based patents from Certicom for a particular field-of-use, defined as implementations of ECC that are over GF (p), where p is a prime greater than 2 to the power of 255. "This toolkit is a logical next phase for Certicom as it helps contractors meet the NSA guidelines for protecting the most critical government information. The agency has set out the guidelines and made the crypto licenses available to contractors. We're now providing a tool to help developers integrate optimized security features that meet those guidelines," said Ian McKinnon, president and CEO of Certicom. With this toolkit, organizations can be assured of proven implementations backed by Certicom, a team of cryptographic experts that has focused on optimizing public-key cryptosystems for almost two decades. The Security Builder NSE toolkit covers the technology that was part of the 26 patents licensed by the NSA plus optimized implementations that enable developers to meet the NSA field-of-use guidelines and FIPS 140-2 validation requirements. The toolkit, which is available in C code, includes: - Elliptic curve digital signature algorithm (ECDSA) (FIPS-validated) for digital signatures; - Elliptic curve Menezes-Qu-Vanstone (ECMQV) for key agreement and transport; - SHA-1 and SHA-2 (FIPS-validated) for hashing; - Advanced encryption standard (AES) (FIPS-validated) for strong encryption; - Random number generation (RNG) (also FIPS-validated); - Point compression for size and performance efficiencies; and - Support for Windows and Linux platforms. Security Builder NSE is part of the Certicom Security Architecture, which unifies all of Certicom's existing toolkits across a single API and enables developers to quickly migrate their applications to whichever cryptographic module is required. Pricing and Availability Security Builder NSE will be available in the first quarter of 2005 and priced at a one-time license fee with no royalties starting at US$50,000 per project in the field-of-use plus support and maintenance. A free license for the patents in the NSA field-of-use is available from the NSA or Certicom. About Certicom Certicom Corp. (TSX:CIC) is the authority for strong, efficient cryptography required by software vendors and device manufacturers to embed security in their products. Adopted by the US Government's National Security Agency (NSA), Certicom technologies for Elliptic Curve Cryptography (ECC) provide the most security per bit of any known public key scheme, making it ideal for constrained environments. Certicom products and services are currently licensed to more than 300 customers including Motorola, Oracle, Research In Motion, Terayon, Texas Instruments and Unisys. Founded in 1985, Certicom is headquartered in Mississauga, ON, Canada, with offices in Ottawa, ON; Reston, VA; San Mateo, CA; and London, England. Visit http://www.certicom.com . Certicom, Certicom Security Architecture, Certicom CodeSign, Security Builder, Security Builder Middleware, Security Builder API, Security Builder Crypto, Security Builder SSL, Security Builder PKI, and Security Builder GSE are trademarks or registered trademarks of Certicom Corp. Intel is registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. All other companies and products listed herein are trademarks or registered trademarks of their respective holders. Except for historical information contained herein, this news release contains forward-looking statements that involve risks and uncertainties. Actual results may differ materially. Factors that might cause a difference include, but are not limited to, those relating to the acceptance of mobile and wireless devices and the continued growth of e-commerce and m-commerce, the increase of the demand for mutual authentication in m-commerce transactions, the acceptance of Elliptic Curve Cryptography (ECC) technology as an industry standard, the market acceptance of our principal products and sales of our customer's products, the impact of competitive products and technologies, the possibility of our products infringing patents and other intellectual property of fourth parties, and costs of product development. Certicom will not update these forward-looking statements to reflect events or circumstances after the date hereof. More detailed information about potential factors that could affect Certicom's financial results is included in the documents Certicom files from time to time with the Canadian securities regulatory authorities. SOURCE Certicom Corp. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Want to surf net? Show I-card
by R.A. Hettinga 15 Nov '04

15 Nov '04

<http://www.hindustantimes.com/onlineCDA/PFVersion.jsp?article=http://10.81.…> : HindustanTimes.com Prove identity to surf net in Bangalore Press Trust of India Bangalore, November 15 Advertisement Internet surfers in over 50,000 cyber cafis across Karnataka now need to show an identity proof before browsing the web. With an aim to prevent misuse of the Internet by criminals, the state government has made it mandatory for all such cafes to have a record of net users, failing which the police can impound their licenses. "We are introducing this law to check anti-social elements and anti-national activities. Internet is a great medium for communication, but people can also carry out a lot of such (illegal) activities through it," state IT secretary K.N. Shankaralinge Gowda told here. According to the new norms, a surfer needs to display his/her identity card at the cyber cafi or be photographed by a web camera by the attendant before logging on. Printed From -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Japanese Government Bans Security Researcher's Speech
by R.A. Hettinga 15 Nov '04

15 Nov '04

--- begin forwarded text

1 0

[ISN] How a guy's gizmo spread fear at Fed
by R.A. Hettinga 15 Nov '04

15 Nov '04

--- begin forwarded text

1 0

[Osint] DHS Now Has Non-Disclosure Agreement For *Un*classified Info
by R.A. Hettinga 15 Nov '04

15 Nov '04

--- begin forwarded text To: "Bruce Tefft" <btefft(a)community-research.com> Thread-Index: AcTLBDc4vJyL80TwSZuIiwn1AOddIQACB0Zg From: "Bruce Tefft" <btefft(a)community-research.com> Mailing-List: list osint(a)yahoogroups.com; contact osint-owner(a)yahoogroups.com Delivered-To: mailing list osint(a)yahoogroups.com Date: Mon, 15 Nov 2004 07:13:19 -0500 Subject: [osint] A NON-DISCLOSURE AGREEMENT FOR UNCLASSIFIED INFO] Reply-To: osint(a)yahoogroups.com A NON-DISCLOSURE AGREEMENT FOR UNCLASSIFIED INFO In a momentous expansion of the apparatus of government secrecy, the Department of Homeland Security (DHS) is requiring employees and others to sign legally binding non-disclosure agreements as a condition of access to certain categories of unclassified information. Up to now, non-disclosure agreements have only been used by government agencies to regulate access to classified information. In fact, they are one of the defining features of the national security classification system, along with security clearances and the "need to know" principle. As far as Secrecy News could determine, such classification-like controls have never before been systematically imposed on access to unclassified information. But now at DHS a non-disclosure agreement must be executed in order to gain access to any one of a panoply of new and existing categories of unclassified information, including: "For Official Use Only (FOUO); Official Use Only (OUO); Sensitive Homeland Security Information (SHSI); Limited Official Use (LOU); Law Enforcement Sensitive (LES); Safeguarding Information (SGI); Unclassified Controlled Nuclear Information (UCNI); and any other identifier used by other government agencies to categorize information as sensitive but unclassified." The proliferation of controls on unclassified information signifies a massive increase in government secrecy, particularly since the number of officials who are authorized to designate information in one of these categories dwarfs the number of officials who can create classified information. And while the classification system operates according to certain well-defined rules and limitations, including procedures for review and challenge of classification decisions, the same is not true of the "sensitive but unclassified" domain. Furthermore, there is nothing like the Information Security Oversight Office to monitor and oversee the restriction of unclassified information. (Some types of sensitive but unclassified information are not specifically protected by statute and can still be successfully requested under the Freedom of Information Act. But with Justice Department encouragement, agencies take an expansive view of the scope of the Act's exemptions and access is increasingly uncertain.) The DHS non-disclosure agreement is apparently the first such document crafted in the Bush Administration. It represents a new high water mark in the rising tide of official secrecy. A copy of DHS Form 11000-6, Non-Disclosure Agreement for Sensitive But Unclassified Information, dated August 2004, was obtained by Secrecy News and is posted here: http://www.fas.org/sgp/othergov/dhs-nda.pdf ------------------------ Yahoo! Groups Sponsor --------------------~--> Make a clean sweep of pop-up ads. Yahoo! Companion Toolbar. Now with Pop-Up Blocker. Get it for free! http://us.click.yahoo.com/L5YrjA/eSIIAA/yQLSAA/TySplB/TM --------------------------------------------------------------------~-> -------------------------- Want to discuss this topic? Head on over to our discussion list, discuss-osint(a)yahoogroups.com. -------------------------- Brooks Isoldi, editor bisoldi(a)intellnet.org http://www.intellnet.org Post message: osint(a)yahoogroups.com Subscribe: osint-subscribe(a)yahoogroups.com Unsubscribe: osint-unsubscribe(a)yahoogroups.com *** FAIR USE NOTICE. This message contains copyrighted material whose use has not been specifically authorized by the copyright owner. OSINT, as a part of The Intelligence Network, is making it available without profit to OSINT YahooGroups members who have expressed a prior interest in receiving the included information in their efforts to advance the understanding of intelligence and law enforcement organizations, their activities, methods, techniques, human rights, civil liberties, social justice and other intelligence related issues, for non-profit research and educational purposes only. We believe that this constitutes a 'fair use' of the copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use this copyrighted material for purposes of your own that go beyond 'fair use,' you must obtain permission from the copyright owner. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/osint/ <*> To unsubscribe from this group, send an email to: osint-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Tiny Antennas to Keep Tabs on U.S. Drugs
by R.A. Hettinga 14 Nov '04

14 Nov '04

<http://www.nytimes.com/2004/11/15/health/15drug.html?ei=5006&en=574f3fc72a3…> The New York Times November 15, 2004 Tiny Antennas to Keep Tabs on U.S. Drugs By GARDINER HARRIS he Food and Drug Administration and several major drug makers are expected to announce an agreement today to put tiny radio antennas on the labels of millions of medicine bottles to combat counterfeiting and fraud. Among the medicines that will soon be tagged are Viagra, one of the most counterfeited drugs in the world, and OxyContin, a pain-control narcotic that has become one of the most abused medicines in the United States. The tagged bottles - for now, only the large ones from which druggists get the pills to fill prescriptions - will start going to distributors this week, officials said. Experts do not expect the technology to stop there. The adoption by the drug industry, they said in interviews, could be the leading edge of a change that will rid grocery stores of checkout lines, find lost luggage in airports, streamline warehousing and add a weapon in the battle against cargo theft. "It's basically a bar code that barks," said one expert, Robin Koh, director of applications research at the Auto-ID Labs of the Massachusetts Institute of Technology. "This technology is opening a whole series of opportunities to make supply chains more efficient and more secure." Wal-Mart and the Department of Defense have already mandated that their top 100 suppliers put the antennas on delivery pallets beginning in January. Radio tags on vehicles and passports could become a central tool in government efforts to create a database to track visitors to the United States. And companies are rushing to supply scanners, computer chips and other elements of the technology. The labels are called radio-frequency identification. As in automated highway toll collection systems, they consist of computer chips embedded into stickers that emit numbers when prompted by a nearby radio signal. In a supermarket, they might enable a scanner to read every item in a shopping cart at once and spit out a bill in seconds, though the technology to do that is still some distance off. For drug makers, radio labels hold the promise of cleaning up the wholesale distribution system, where most counterfeit drugs enter the supply chain - often through unscrupulous employees at the small wholesale companies that have proliferated in some states. Initially, the expense of the system will be considerable. Each label costs 20 to 50 cents. The readers and scanners cost thousands of dollars. But because the medicines tend to be very expensive and the need to ensure their authenticity is great, officials said, the expense is justified. Costs are still far too high for individual consumer goods, like the amber bottles that pharmacies use to dispense pills to individuals. But prices are expected to plunge once radio labels become popular, so drug makers represent an important set of early adopters. Privacy-rights advocates have expressed reservations about radio labels, worrying that employers and others will be able to learn what medications people are carrying in their pockets. Civil-liberties groups have voiced similar concerns about ubiquitous use of the technology in the marketplace. But under the current agreement, the technology would not be used at the retail level. The food and drug agency's involvement is crucial because drug manufacturers cannot change a label without the agency's approval. In its announcement, the agency is expected to say that it is setting up a working group to resolve any problems that arise from the use of radio antennas on drug labels. Counterfeit drugs are still comparatively rare in the United States, but federal officials say the problem is growing. Throughout the 1990's, the F.D.A. pursued about five cases of counterfeit drugs every year. In each of the last several years, the number of cases has averaged about 20, but law-enforcement officials say that figure does not reflect the extent of the problem. Last year, more than 200,000 bottles of counterfeit Lipitor made their way onto the market. In 2001, a Sunnyvale, Calif., pharmacist discovered that bottles of Neupogen, an expensive growth hormone prescribed for AIDS and cancer patients, were filled only with saltwater. "We've seen organized crime start to get involved," said William Hubbard, an associate food and drug commissioner. With some drugs costing thousands of dollars per vial, the profit potential is huge, he said. The weak point, Mr. Hubbard said, is the wholesaler system, which ships more than half of the 14,000 approved prescription drugs in the United States. While three large companies - McKesson, Cardinal and AmerisourceBergen - account for more than 90 percent of drugs that are sent through wholesalers, there are thousands of smaller companies throughout the country, many little more than a room with a refrigerator. State pharmacy boards are responsible for regulating drug wholesalers, but most boards do almost nothing to police them. In many states, only a small fee and a registration form are needed to set up shop. A 2003 report by a Florida grand jury found that the state had 1,399 approved wholesalers - one for every three pharmacies in Florida. Radio labels fight counterfeiting by providing a unique identifier that is almost impossible to copy. When pharmacists receive delivery, they should be able to pass a wand over the bottles and, through an online database, check the history of each. Any bottles that have been reported missing or previously sold, have an unusual delivery history or are not recognized by the system will be flagged as suspicious. Makers of prescription narcotics say radio labels could help cut down on the booming trade in stolen pills. "We get calls once a week from state troopers saying they got a guy with one of our bottles," said Aaron Graham, chief security officer for Purdue Pharma, the maker of OxyContin. With radio labels, Purdue will be able to trace those bottles to individual pharmacies. "If that pharmacy was robbed, we'll know for certain that that guy is in possession of stolen property," Mr. Graham said. Radio labels could conceivably help ensure that imported drugs are safe, Mr. Hubbard said. But drug manufacturers are unlikely to put radio labels on drugs sold in other parts of the world for many years, he said. The F.D.A. has been a fierce opponent of legalizing drug imports. "This is about securing the domestic supply," said Tom McGinnis, the F.D.A.'s chief pharmacist. So far, the agency is relying on a nonprofit industry group, EPCglobal, based in Lawrenceville, N.J., to set standards for radio labels. The labels will remain voluntary until 2007. After that, the agency may require the labels and specify which types must be used, Mr. Hubbard said. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

THE ARRIVAL OF SECRET LAW FAS Secrecy News -- 11/14/04
by R.A. Hettinga 14 Nov '04

14 Nov '04

--- begin forwarded text

1 0