Go Undercover

Oct. 6, 2004
Covert, forensic and overt security strategies will all be critical in protecting your products—but don’t overlook the basics
Locking truck doors is one of many simple
solutions for protecting drug shipments.
Photo courtesy of Stiefel Laboratories.

By Angelo De Palma, Ph.D., Contributing EditorProtecting an ever more complex pharmaceutical supply chain has become one of the industry’s greatest challenges. Drugs worth many times their weight in gold, coupled with huge price discrepancies between U.S. and foreign markets, have spawned illegal profiteering operations that threaten manufacturers and patients alike. The assurance that consumers receive prescribed drugs, at the prescribed dose, at an appropriate price is a cornerstone of the U.S. health system. Counterfeiters, diverters, importers, and compounders skim anywhere from five to ten percent—nobody knows the exact number—off the top of this $200 billion enterprise. The World Health Organization estimates that five to eight percent of the world’s drug supply is counterfeit.

(Anti-)Diversionary Tactics

Differential pricing from one country to another puts pharmaceuticals at high risk of diversion, or “gray marketing,” by which unscrupulous distributors or resellers purchase product intended for one geographic location and resell it into a higher-price region. “It’s a form of illegal arbitrage,” says Henry Kupperman, an attorney and senior managing director at Kroll, Inc. (New York, N.Y.), an investigative and security consulting firm.

Internet ordering of single prescriptions makes diversion even more profitable than in years past, says Kroll, because diverters don’t need to find a wholesale buyer. “Diverters don’t have to ship product back to high-price countries at all before selling it.”

Manufacturers have already taken precautions against early supply-chain diversion by exercising extreme caution in whom they sell to. Controls lose their effectiveness beyond the large distributor level, however, eventually disappearing as product trickles downward.

Know who you’re selling to. Perform background checks on individuals and companies making overseas purchases: Do they have a history of selling diverted product? “Diverted product is usually the result of a distributor who has not been investigated,” Kupperman says.

Deploy a product-level (vs. package-level) tracking system. A good tracking system begins with lot numbers, but should also include at least a serial number and/or barcode. There have been cases where manufacturers knew their product was being gray-marketed, but they couldn’t figure out the overseas source because gray marketers usually repackage.

Institute a mechanism for both announced and unannounced distributor audits, especially for repeat purchasers of large shipments such as hospitals and government agencies. The larger the shipment, the greater the chance of diversion.

Be on the lookout for disproportionately large sales, especially overseas. If it seems too good to be true, it probably is.

Involve your distributors in manufacturing’s efforts to prevent diversion because regulators and law enforcement are more concerned with counterfeiting.

“Gray marketers are very clever—in some ways more devious than counterfeiters,” Kupperman observes. He recalls a case where an overseas diverter convinced a distributor to sell very large quantities of product for distribution in Russia. This individual actually did import the shipment to Russia, but then had it shipped across Siberia to an eastern port—then exported it from there to the more lucrative U.S. West Coast market.

The counterfeiting problem may not be as serious in the U.S. as it is in other countries such as China, where 40 percent of drugs are believed to be fake, and by some estimates, to have caused 192,000 deaths in 2001. Nevertheless, drug manufacturers and FDA are working together to respond to a growing threat that is eroding the implicit trust between pharmaceutical and biopharmaceutical manufacturers, the government and the public. “Counterfeiting put FDA and pharma on the same side for the first time,” says Don McMillan, vice president of marketing at West Pharmaceutical Services (Lionville, Pa.). “It’s changing FDA’s relationship with industry.” The pharmaceutical supply chain is relatively straightforward: manufacturing (including off-site production, packaging, and labeling) feeds distribution (usually more than one level and size), which, in turn, feeds dispensaries, which supply patients or physicians. The hefty dollar values and volumes of the drugs packaged and shipped create illegal profit opportunities at each point along the chain. Major drug firms have taken steps to assure product integrity by selling only to reputable distributors, who by and large follow the same practice with their customers. Further down the value chain, where buyers and sellers multiply exponentially, these practices become more diluted. A Florida grand jury investigating irregularities in that state’s drug distribution channels concluded that the greatest potential for mischief exists with small distributors. Just five percent of our medicines pass through this channel, yet that still translates into a $10 billion market. By the time the drugs reach the level of the consumer, any fraud scenario is possible. Maintaining supply integrity requires balancing risks and cost/benefits, says Richard Lowery, supply chain management practice leader at the risk management advisory firm, Marsh Consulting (New York, N.Y.), whose practice focuses on unsafe products and supply chain disruption. Marsh uses modeling and simulation to calculate sales and availability resulting from any change in the supply chain. “We work through different scenarios to determine what actions to take to manage the supply chain and inherent risk in case something happens,” Lowery explains. “At the end of the day, we’re less concerned with the event itself. You can configure your operational environment so that any type of event, be it terrorism, counterfeiting, loss of a supplier, or a natural phenomenon, has minimal impact.” To their credit, manufacturers began fighting supply-chain criminals years ago, long before tampering and counterfeiting became front-page news. Early security measures included alphanumeric codes and tamper-resistant packaging, seals, and labels. Then came barcoding and machine-readable inks, followed recently by radio frequency identification (RFID) and chemical tagging and analysis. Forward-looking drug manufacturers are mixing and matching these methods, enhancing them through the use of proprietary readers and links to back-end computing and databases.

Physical pharmaceutical security measures come in three flavors:

  • Covert: measures invisible to humans or requiring special equipment for reading or detection, including water marks, inks and fluorescent dyes, as well as RFID and barcoding;
  • Forensic or analytical: techniques, typically involving markers, that require sophisticated analysis;
  • Overt: visible protective measures such as holograms, color-shifting dyes, and water marks, seals, labels, and packaging.
Drug makers are employing all three strategies, simultaneously, recognizing that a multipronged approach is the best way to stay ahead of criminals. They’re also using basic “best practices.” RFID Gets a Look Many pharmaceutical manufacturers are evaluating RFID, which has been widely hyped since FDA touted it last year as “the most promising approach” to track-and-trace. But it will take more than promise to convince all manufacturers that unit costs of up to 50 cents (in quantities of 10 million) and untested back-end technology justify its adoption. At this point, except for situations involving highly controlled or very costly medicines, RFID will likely be used mainly at the pallet- to bulk-container levels. One firm that has succeeded in deploying RFID for single vials is West Pharmaceutical Services. West invested in RFID because it recognized that, for very expensive drugs, counterfeiting occurs primarily at the dose level. “It’s critical that hospitals and pharmacies have the ability to authenticate every dose,” says Don McMillan, vice president of marketing. Towards this end West offers vials, for injectible drugs, in which an RFID chip is embedded inside the plastic portion of a tamper-evident seal. McMillan, who is closely following the RFID-adoption saga as it unfolds, recognizes that successful deployment will depend on the ability to do a lot more than simply put tags on bottles and sell readers to pharmacists. “If you think about product security from all possible vantage points, it’s quite complex. Who will own the data and who will validate the system?” he asks.

Particularly thorny issues include:

  • software validation
  • database population
  • deployment of RFID at different packaging levels
  • data authentication at all points where people access the database
West has used some form of tamper-resistance on its vials for 40 years. Today, it works with security product vendors to develop new approaches using RFID and UV-active ink. West also sets up partnerships between itself, pharmaceutical manufacturers, and security technology vendors on more-sophisticated measures, which remain a well-guarded secret. “Not even people in the drug company know which technologies we’re using,” McMillan says. “That’s the Supply chain management in the retail market pushed the first wave of RFID adoption in the pharmaceutical industry. Wal-Mart’s pharmacies have required that the corporation’s over-the-counter drug suppliers use the technology; companies have responded by implementing electronic product codes (EPC), a type of RFID with no authentication capabilities. Where RFID contains internal memory, EPC offers stripped-down security that relies on back-end databases accessed through a 96-bit identifier or “license plate.” So far, technical difficulties have delayed Wal-Mart’s deployment of EPC twice—moving the rollout date from Spring to Summer 2004, and most recently to January 2005. And implementation is not the only problem with these devices; just like bar codes, they can be copied, experts say. “EPC may be cloned without breaking encryption,” comments Bruce Hudson, program director at Meta Group (Stamford, Conn.), a consulting firm. “EPC may be attractive in warehouses or on receiving docks, but it’s by no means a magic bullet for assuring authenticity.” In addition, EPC suffers from supply chain problems of its own, including a shortage of tags. Data management issues may sink EPC deployment, Hudson observes, and might even doom the technology. He cites questions about data location, network authentication, and providing timely updates. “If you’re investing in EPC now, you may be wasting your money,” he warns.Still Room for Low-Tech SolutionsDespite the omnipresence of high technology, straightforward product identifiers such as numbers and letters still have their place in pharmaceutical supply chain protection. Verify Brand (Minneapolis, Minn.), a product security and authentication services provider, has shown that relatively low-tech identification, when married to a robust back-end authentication service, can go a long way toward assuring product security.

'Security requires

a layered approach

to be successful.

--Kevin Erdman, Verify Brand

Verify’s flagship pharmaceutical security product serializes drug packages through codes which may be authenticated anywhere in the supply chain, including by end-users. Codes, which reside on packaging, are generated through Secure Code Control, a code-generating service that enables the manufacturer or a third-party labeler or packager to print an unlimited number of alphanumeric codes consisting of as few as seven characters. “Length depends only on the real estate available on the label,” explains company president Kevin Erdman. The firm’s Internet-accessible verification services, VeriSure! and VeriTrack!, allow suppliers, distributors, retailers, and even consumers to authenticate verification codes by computer or telephone. Both systems log authentication attempts, continuously analyze information coming in (by product, supplier, and location), and enter data into reports. Like most security measures, Verify Brand’s coding system works best at higher levels of the supply chain. “It gets difficult to deploy on those amber vials,” notes Erdman, who also sees hurdles at the retailer level. “Our product, like all others, is not the solution to product security. Security requires a layered approach to be successful.”Forensics Require the Right ChemistryChemical tagging, labeling, and analytical methods often seem too complex, esoteric, and unwieldy, especially at the point of use, to be useful in critical pharmacy-to-end-user applications. Nevertheless, manufacturers are taking these methods seriously, according to West Pharmaceutical Service’s McMillan. Molecular Isotope Technologies, LLC (Niantic, Conn.) offers a forensic technique based on differential abundance of chemical isotopes. Chemists might be shocked to learn that isotopic abundance varies significantly—and measurably—–from place to place, source to source, and even batch to batch. Normal carbon-13, for example, shows discrepancies of up to 15 parts per trillion, an enormous difference considering the fact that analytical techniques can pick up parts-per-ten-trillion variations.
Plain packaging can disguise expensive product, helping to prevent diversion. Photo courtesy of Stiefel Laboratories. Other common elements in drugs, such as oxygen, hydrogen, and nitrogen, show even greater variation. Deuterium, “heavy” hydrogen, exhibits 500 ppt variation. Molecular Isotope measures the precise isotopic composition of pharmaceutical batches, which allows identification of drug shipments later on to a very high degree of certainty. “We’re exploiting a random number generator called nature,” says CSO John P. Jasper, Ph.D., who admits that, at this point, the method is probably suited only for highest-value or the most commonly thwarted products. Nanotube conductive coatings, films, or inks are used to create a discrete mark or “super UPC code” in Intellimark from MysticMD (Groton, Conn.). Intellimark may be applied to almost any surface, including pharmaceutical blister packs, bottles, and sachets. MysticMD has completed proof-of-concept designs and has working prototypes for Intellimark and another product, nCard, a smart card for personal access security. “With up to seven percent of drugs in the pharmaceutical supply chain counterfeit, this is a problem that demands item-level tracking,” says MysticMD CEO Heidi Douglas. “When you’re talking about that number of items, RFID is simply too expensive.” Intellimark is expected to cost just two cents per package, compared to up to 50 cents per package for RFID. The nanotube-based coatings can fit a lot of information in a very small physical space, says Joel Douglas, MysticMD’s CTO. “Our encoding and printing capture secure information that is readable only by conductivity with multiple verifiers, rendering them tamper-proof." Simple Strategies Often Best Manufacturers should not lose sight of best practices and low-tech packaging and shipping strategies, which can go a long way to securing product, says Byron Wilson, logistics manager at Stiefel Laboratories (Coral Gables, Fla.), a manufacturer of dermatology treatments. His recommendations:
  • Use generic shipping cartons and plain, tamper-evident tape so your packaging doesn’t scream “Valuable!”

  • Work with dedicated, trustworthy carriers. They may be more expensive, but the extra cost pays off in the long run. Avoid delivery companies that stop several times between your loading dock and the distributor, or that mix shipments of your product with those of other companies.

  • Make sure that, when shipping truckloads, the truck is sealed, and ensure that this is indicated on the bill of lading so that your customer can verify that the entire shipment has been sealed during delivery.

  • Ensure that your packing slips are well designed. Packing slips may be old-fashioned, but a well designed ticket can eliminate 90 percent of shipping uncertainties. Make sure customers have access to back-end information that they can match up, either visually or through computer-generated symbology, with information on the slip.

  • Use advanced ship notifications to alert customers of a product shipment and estimated time of arrival, so deviations or delays may be noted and reported.

  • Use pallets for very large shipments. Protect pallet and product with clear stretch wrap in the case of plain boxes, or with opaque wrap when boxes contain either company or product identification.

  • Shipments of commonly abused drugs require another level of security efforts, but there’s no need to panic or over-finesse such shipments. Plain shipping containers and tamper-evident tape can go a long way towards assuring product anonymity during shipping.

  • When shipping narcotics, audit carriers thoroughly. Check with local chambers of commerce, the Drug Enforcement Agency, and local and state police to uncover incidents where product has “fallen off the truck” or otherwise been diverted or stolen. Also investigate terminals the proposed carrier works through for similar warning signs of less-than-complete trustworthiness.


    Ortho Biotech Responds to a Counterfeiting Crisis

    Teamwork and close coordination with FDA allowed Ortho Biotech to design a new secure package, set up and validate new packaging lines and “redress” $1.2 billion worth of Procrit inventory in three weeks

    By Agnes Shanley, Editor-in-Chief

    It was news that no drug company ever wants to hear. In June of 2002, Johnson and Johnson’s (J&J) Ortho Biotech Products (Raritan, N.J.) first got word that vials of suspect Procrit, its blockbuster anemia medication, had surfaced in Texas. FDA’s Criminal Investigations Unit found a supply of product, retailing for about $20 per vial, relabeled as a concentrated version, worth 20 times as much. Later, in Florida, FDA found a cache of Procrit vials containing tap water during an undercover investigation.

    Fortunately, this material had not reached the pharmacy shelves, but Ortho needed to protect a key product, with annual sales of over $3 billion, and it needed to move at breakneck speed.

    John Dempsey, Ortho’s vice president of national accounts and patient advocacy, immediately set up a core team to alert doctors, pharmacists, and patients, and to develop an overall response strategy. FDA was a vital part of this team, which also worked with corporate management and customers.

    Once the first team defined a list of goals and objectives, a second team headed by package development engineer Elizabeth Hansen was set up to “redress” existing inventory. This cross-functional team involved representatives from quality assurance and control, regulatory compliance, manufacturing, packaging, development, engineering, legal and financial departments.

    At its first meeting on June 5, four days after the initial notification, Dempsey laid out the problem scenario to the team: Ortho had $1.2 billion in inventory that couldn’t ship without counterfeit-proof packaging. “We needed to come up with a solution and implement it to redress that inventory, some 2.4 million doses of Procrit, in 20 days,” Dempsey recalls. “The room was quieter than a church. You could have heard a pin drop,” he says.

    Communication and “the right people”

    The team approached this challenge as it would any other critical project with a tight deadline and an important due date, says Hansen. Communication was constant. The team met twice every day, once in the morning to discuss the goals for the day, and in the afternoon to go over the day’s achievements.

    The key was to involve people with the right background,” Hansen says, “and we knew that the solution would involve manufacturing.” The team needed to have a packaging line in place at its distribution center, and it needed equipment for this line.

    Members from project engineering were charged with finding, installing and, where necessary, retrofitting the equipment. Meanwhile, packaging engineers had to develop a counterfeit-proof packaging. Operators had to work efficiently and to ensure that the drug was maintained at the right refrigerated temperature. The system also had to be approved by FDA and validated. Given the timeframes normally required for these activities, the task seemed impossible.

    However, the team’s members solved problems in parallel, moving the project forward. “On the packaging side, we looked at the available technology and ruled out some technologies, such as holograms, which would take too long to develop,” Hansen says. They eventually settled on a solution involving overt and covert features: a package with a closure seal featuring color-shifting ink and a digital watermark.

    Management support was critical

    Corporate management was very supportive, a fact that made it easier for team members to focus on the job at hand, Hansen says. “We were told by senior management that this effort was extremely important and were freed from other tasks to focus our efforts and put the others on a back burner.”

    Manufacturing issues posed major challenges. None of J&J’s existing packaging lines would be able to handle the redress. Two new machines, a bundler and a labeler, were required. Under normal situations, it can take eight to 12 months to source this equipment. Senior Engineer Henry Passerotti and his team found a used labeler in Chicago. A bundling machine was found at another Ortho facility. The labeler had to be retrofit to apply the new package’s closure seal, and the entire system had to be operational within days.

    Another technical hurdle was selecting the best security ink required for the seal. “It’s not an easy ink to run in a typical package printing operation,” Hansen says. “We had to run several tests to ensure that the final formulation was OK. Within one week, we had 10 test runs, and, in every case, we’d determine problems, go back to the laboratory and work with the supplier and adjust the formula.”

    Legal’s participation eased validation

    Validation was simplified by a comprehensive legal brief drafted by Ken Olson, Ortho’s legal representative on the team, and used to make the validation case to FDA. “All we needed to do was dot the i’s and cross the t’s to move to validation,” says Dempsey. The fact that the team worked so closely with FDA from the start was critical to its success, he says.

    J&J already had experience with illegal product tampering after the infamous Tylenol case in the early 1980s. Many of the corporation’s security staff are former law enforcement agents, and the company has strengthened its connections with law enforcement, and with FDA counterfeiting task force members at headquarters and field offices.

    Although the company remains vigilant in protecting its products against counterfeiters, Dempsey and Hansen are proud of their colleagues’ achievements. The first repackaged product lots were ready by July. “Developing a new package design and bringing production online so quickly was unprecedented,” says Dempsey. “We had the right people to do the job.”