Originally published on Medium.
A pill press stamps powder into tablets. A good one makes a pill that looks exactly like a real prescription pill, down to the markings. It is the one piece of equipment that turns fentanyl powder into a fake oxycodone.
On 15 September 2026, the House passed a bill about those machines: H.R. 8005, the Stop Pills That Kill Act. It went to the Senate the next day.
The bill is short, and it does one main thing. Every pill press, and every critical part of one, now has to carry a serial number that is “engraved, cast, or otherwise permanently affixed to a nonremovable part.”
Their solution is to put a permanent mark on the press itself.
What the law was before
Pill presses were never unregulated in the United States. They were regulated in the way almost everything in this space is regulated: on paper.
Under the Controlled Substances Act, a machine does not require registration. DEA’s own guidance says so plainly, that there is no registration requirement in the CSA for persons possessing or transacting tableting and encapsulating machines. What the law required instead was that regulated persons, meaning manufacturers, distributors, importers, exporters, and brokers, keep a record of each regulated transaction and report it. A machine moves, a form is filed.
So the government had a file drawer of transactions. What it did not have was any way to connect a press recovered from a clandestine lab in Arizona to a row in that drawer. Critical parts, the dies and punches and tooling that make a press capable of stamping a convincing M30, were not required to carry serial numbers at all.
This is the exact structure the Drug Supply Chain Security Act gives us for medicine, and I have spent a fair amount of this series complaining about it. A chain of custody records, faithfully maintained, describing objects that carry nothing binding them to the records. The paperwork is real. The link between the paperwork and the thing in your hand is an assumption.
For pill presses, that assumption broke in public.
The case that made the argument
The day before the House vote, the U.S. Attorney’s Office for the District of Arizona announced a criminal indictment of LFA Machines DFW, LLC, of Fort Worth, Texas, along with two principal managers, Alastair Mark Sanderson and William Robert Norris, and a former long-time employee, Michael Christian Packard. The Homeland Security Task Force case was investigated by DEA’s Tucson District Office. Six counts: one conspiracy count, two counts of unlawfully distributing chemicals, products and materials, three counts of unlawfully distributing a tableting machine. Four years maximum per count for the individuals, and a corporate exposure of up to $500,000 per count or twice the gross gain.
The allegation is that the company sold presses and binding agent knowing, intending, or having reasonable cause to believe the buyers would use them to manufacture counterfeit pills. Equipment was recovered from clandestine labs nationwide. The defendants are entitled to the presumption of innocence and the case has not been tried.
Notice what the government had to prove to get there. Not that a specific machine, identified by number, moved from a specific seller to a specific lab. It had to prove a mental state at the point of sale. Knowledge. Intent. Reasonable cause to believe. That is a much harder case, and it is the case you are forced to build when the object itself cannot tell you where it came from.
Serialization does not make that case unnecessary. It makes it ordinary. A press pulled out of a lab either matches a reported transaction or it does not, and either answer is useful.
The part nobody is talking about
Here is the detail in H.R. 8005 that I think is the most interesting thing in the bill, and it is the part that should give any serialization enthusiast, including this one, a moment of pause.
The bill does not only require the serial number. It creates two new offences to protect it. One prohibits removing, altering, or obliterating a required serial number. The other prohibits transporting or possessing a machine knowing that its serial number has been removed, altered, or obliterated. Penalties run to eight years, and up to fifteen for aggravated quantities, defined in the bill to include more than a hundred machines.
Read that as a design document rather than as a criminal statute and it says something specific. An engraved serial number has no security properties of its own. It is a mark on a surface. Anyone with an angle grinder can remove it in under a minute, and Congress knows this, which is precisely why the bill has to buy the mark’s integrity separately, in the currency of prison time.
That is not a criticism of the drafting. For capital equipment that costs thousands of dollars, moves rarely, and is handled by people who can be prosecuted, a stamped serial plus a felony for defacing it is a reasonable and proportionate answer. It is how firearms have worked for decades.
But it is worth naming the trade honestly, because the same trade shows up everywhere in traceability. When the identifier carries no security of its own, the system’s integrity is not in the mark. It is in the deterrent, and deterrence only works on people who expect to be caught, which is a description of a legitimate distributor and not a description of a counterfeiter operating from a jurisdiction where your deterrent does not reach.
The alternative is not a better engraving. It is an identifier whose removal is self-evident and whose duplication is computationally hard, so that the answer to “is this the machine the record describes” does not depend on whether anyone was afraid of the penalty.
The argument one shelf over
Now put the bill down and look at the medicine.
DSCSA’s last exemption runs to 27 November 2027, when FDA’s exemption for small dispensers, those with twenty-five or fewer licensed pharmacists and technicians, runs out (FDA extended it by a year in August 2026; 27 November 2026 is the date on which eligibility is assessed, not a cut-off). Manufacturers went live in May 2025. Wholesalers in August 2025. Large dispensers in November 2025. After November 2027, the interoperable electronic system covers effectively the whole legitimate chain. See the DSCSA countdown.
And when it is finished, it will be the most complete pharmaceutical chain-of-custody record ever built in the United States, describing objects that carry a printed two-dimensional barcode, encoding a serial number, on a label.
Every criticism the Stop Pills That Kill Act implicitly makes of the old pill press regime applies to that. The record is excellent. The binding between the record and the vial is a printed rectangle that a competent counterfeiter reproduces perfectly, because reproducing a printed rectangle is not a hard problem. FDA’s December 2025 counterfeit Ozempic alert told patients that one of the distinguishing marks was which side of the label the expiry and lot text sat on. That is where visual authentication has ended up.
Congress just accepted, unanimously, for machines, that a transaction report is not enough and the object needs an identity of its own. The same logic, applied to a dose, is not in any bill I can find.
The sentence that costs us money
We sell authentication hardware, so this is the paragraph where I say the inconvenient thing, and this time it is more inconvenient than usual.
H.R. 8005 is not a sales trigger for us, and anyone in my industry telling you otherwise is selling you something. A pill press is capital equipment. It is large, expensive, rarely moved, handled by identifiable businesses, and serialising one is a completely different engineering and economic problem from serialising a dose that costs cents and ships in millions. An engraved plate is the right answer for a press. We do not have a better one and I am not going to pretend we do.
The second thing is harder to say and matters more.
The pills this bill exists to stop were never in the legitimate supply chain. A counterfeit M30 pressed in a garage and sold over Snapchat never touched a licensed wholesaler, never had a DSCSA record, and would never have carried our chip or anyone else’s. Unit-level authentication protects the legitimate chain. It does not verify a pill a teenager bought from a stranger, and a vendor who lets a grieving parent believe otherwise deserves everything that follows.
So this piece is not a pitch. It is a note that a principle moved.
The Aeroz Angle
What we build is a secure NFC tag that answers a cryptographic challenge tied to that individual item when it is tapped with an ordinary phone. A photograph of the tag is a photograph. A recording of one valid answer does not reproduce the key that produced it.
Against the engraving problem above, that changes one thing and only one thing: the identifier stops being a mark that has to be defended by statute and becomes a property of the object that has to be defended by mathematics. Grinding it off is visible. Copying it is not merely illegal, it is hard.
Where that is worth paying for is the legitimate chain, and specifically at its last metre. DSCSA hands a pharmacist a verified record and a printed barcode. It does not hand them a way to ask the vial itself. Between now and 27 November, every dispenser in the country is being asked to finish building the record. None of them is being asked to close the gap between the record and the object, because no rule requires it and, as of this week, no rule is proposed.
That gap is where the diverted, the refilled, and the relabelled arrive. It is the same gap H.R. 8005 just closed for the machine that stamps the fake.
Congress agreed this month that when you cannot trust the paperwork about an object, you mark the object.
It said so about the press. Say it about the pill.
Aeroz, Making Authenticity Checkable. Visit aeroz.io to learn more & get in contact with our team via [email protected].
2026 Aeroz all rights reserved.