Viewpoint: India’s serialization proposal for pharma is a bad idea. Here's why.

India is again on the cusp of introducing a new serialization program, this time for domestic pharmaceutical products. The current proposal comes a few years after the introduction of a somewhat similar program that was mandated in 2011 for exported medicines. Although details are still emerging, it appears the new system will initially be aimed at the top 300 drugs sold in the country.

Indian officials have designated the new initiative as a track and trace program [1], though it appears from media reports that the proposed mandate will instead be aimed at creating a consumer-based authentication program [2,3]. The idea is to print a unique serial number on medicine packages so that consumers may authenticate the product via an SMS- or call-enabled mechanism to verify the code.

There are serious problems with this approach, which will very likely lead to failure and more importantly, open the door to counterfeiters who can mislead consumers into believing they have purchased a genuine drug when it is actually a fake. In the remainder of this article, I discuss this alarming possibility and describe the conditions that can lead to it.

The failure of serialization as an anti-counterfeiting solution

Whereas serialization provides an excellent foundation for supply chain tracking programs, we now have enough evidence with its alternate use as a product verification tool to declare a firm conclusion as to its unsuitability for consumer-based anti-counterfeiting initiatives — exactly the kind now being envisioned by Indian authorities.

Our learning in this area has accumulated through more than a decade of experience, including my own insights from having worked in this field in India. Back in 2007, I introduced the very idea of mass serialization to the Indian pharmaceutical industry and helped to develop an SMS-based program for consumers to authenticate a product. Back then, this was the best thing available and serialization therefore found an eager market where extant passive technologies such as holograms were already being viewed as ineffective.

But alas counterfeiters soon found crafty ways to circumvent this technology and co-opt it onto fake products. Brand protection experts have noted for several years now that counterfeiters can merely purchase a genuine product and thereafter replicate its genuine serial number onto fake products. More sophisticated counterfeiters can reverse-engineer the serialization system and then generate unlimited batches of serial numbers that actually pass through because they exactly mirror the original program.

And finally, in those cases where the serial number is carried within a 2D barcode, counterfeiters across Asia have found ways to hijack the program by creating outright fake barcodes that point to their own servers, delivering comforting messages back to consumers on a product that is actually fake [4].

False reassurance — the real danger behind India's new program

The program now being contemplated by Indian authorities is of course susceptible to all of the above perils. The real danger, however, rests in the open manner by which consumers are required to authenticate the medicine. It has been reported that consumers will be able to enter the serial number on a package by calling or texting it to a printed phone number on the same package. This is commonly known as an open format for authentication and, in addition to the general problems described above for serialization, actually represents the greatest liability to this program.

It should be assumed at the outset that counterfeiters have themselves made substantial investments in duplicating a well-known product and likely enjoy a lucrative market. The starting point for any brand protection professional is to assume that such persons (or entities) will not be easily deterred, and therefore always to think through the weakest link in a postulated anti-counterfeiting program. The counterfeiter will be doing exactly the same.

In this case, counterfeiters can create a parallel program with their very own authentication number printed on the fake drug package. It is then irrelevant what serial number is actually printed because it will always be successfully authenticated. In fact, the return message will exactly contain the comforting message that would be so misleading — brand name, batch number, expiry date and so on. The consumer is given false reassurance and thereafter consumes the fake medicine with the belief that it was indeed genuine.

It is very likely that the above scenario will be detected and deterred by the authorities at some point. However, by then the damage is done. The absolute worst outcome for any anti-counterfeiting platform is to have it hijacked to provide a gateway for false reassurance to consumers. That is a failure of technology, and more importantly, a failure for authorities in both government and industry to think through the implications of the loopholes that were inherent in their program design.

A new day in the fight against counterfeits

So, what should be done? Clearly taking no action is not an alternative and therefore any effort to combat the menace of counterfeiting is always welcomed. The path to that endeavour should not however introduce new problems that can actually worsen the situation. That is exactly the future unintended consequence of the new program being proposed in India.

Although security professionals no longer view serialization as a worthy platform for consumer empowerment programs, there is some good news. The failure of technologies from the past, such as holograms and serialization, has paved the way to a new generation of offerings. Indeed, there has been a continual evolution of anti-counterfeiting technologies over the past decade to now provide a very exciting set of what I refer to as third-generation or 3G solutions [5].

Rather than rush into deploying a program that is highly vulnerable and would place Indian consumers at great risk, the Drug Controller General of India (DCGI) – the principal authority empowered to create a safe and sustainable system for India – should convene a stakeholder conference that includes policymakers, industry representatives, and technology experts to propose and evaluate the latest cutting-edge 3G solutions in the marketplace.

There are now far better ways to defeat counterfeiters and protect consumers – effectively, efficiently, and economically. It is important for India to get this right.

References

[1] Meeting notice issued by the Directorate General of Health Services

       https://app.box.com/s/3r633m7ubyiajqlacxubsnrgl41miu2g

[2] India baulks at barcoding domestic drugs. Article in SecuringIndustry.com.

       https://www.securingindustry.com/pharmaceuticals/india-baulks-at-barcoding-domestic-drugs-report/s40/a7682/#.WyqcRy_GyWZ

[3] To Spot fake drugs, DCGI may introduce trace and track mechanism for top 300 drug brands. Article in The Indian Express.

       https://indianexpress.com/article/business/business-others/to-spot-fake-drugs-dcgi-may-introduce-trace-and-track-mechanism-for-top-300-drug-brands-5222963/

[4] A gift to the counterfeiter: Serialized QR codes.

       https://app.box.com/s/xps34kjqsu24xucxuhc73xkollqilxll

[5] The evolution of brand protection.

       https://app.box.com/s/czc6dpll0tqq9swzbcjglv4dt6b56g22

Dr Avi Chaudhuri has over 12 years of experience in the field of brand and consumer protection against counterfeit products. His work in this area began when he became the victim of a counterfeit drug while traveling in India.

He began to research all available technologies that could not only defeat the problem, but also empower consumers to verify the authenticity of the drug at the point of sale. He currently works for Systech International and is responsible for spearheading their Asia expansion program.