Tobacco industry's track and trace Codentify "seriously flawed"

The tobacco industry's anti-counterfeiting track and trace technology has been slammed by the global tax stamp trade body, which describes it as "seriously flawed" and undermines measures to tackle illicit trade.

The International Tax Stamp Association (ITSA) claims the digital serialised coding technology known as Codentify, "fundamentally fails to deliver the protective measures" stipulated by international regulations, including the World Health Organization Framework Convention on Tobacco Control Protocol and the EU tobacco Products Directive, and that it may in fact act as a Trojan horse to encourage the illicit activity.

Illicit trade in tobacco products is estimated to be US $40bn to $50bn a year.

Codentify is a serialised coding system of digital codes generated by tobacco manufacturers and directly printed on tobacco packaging with the intention of tackling illicit trade by traceability and authentication of the products. According to its developers, each Codentify code is a unique, unpredictable set of 12 letters and numbers that are machine generated.

The system was invented by Philip Morris International in response to anti-illicit-trade obligations imposed by the EU that called for products to be marked with traceable serial codes. It has since been adopted by the industry as a single industry standard, promoted by the four main tobacco companies, although smaller companies do not use the system.

In a position statement, the ITSA claims the tobacco industry is using its "extensive lobbying resources that potentially give it a louder voice than independent providers" to promulgate worldwide government adoption of the "preferred" self-operated Codentify system. Other industry critics, such as the WHO FCTC Secretariat, have also accused the industry of a ploy to make Codentify acceptable to regulatory authorities.

"We strongly believe that any governance model for a secure track and trace system designed to control a particular industry should not be based on trusting that industry, because the underlying conflict of interest means that industry will likely find ways to circumvent those controls," an ITSA spokesperson said.

The slow, selective and inconsistent deployment of Codentify by the tobacco industry "demonstrates a fundamental lack of will to put in place an effective system", the spokesperson added, claiming that there is "no evidence to suggest that the industry wishes to see effective and independent controls put in place".

The ITSA backs up its position by highlighting key control and security issues that disqualify the use of Codentify as a legitimate and secure track and trace solution under international regulations designed to fight contraband and counterfeit tobacco.

The trade body cites Article 8 of the WHO FCTC Protocol as an example, which requires an acceptable track and trace solution be under the control of the government and that duties may not be performed or delegated to the tobacco industry. The EU directive, which calls for a European track and trace system to be implemented before 2019, also rules out self-control. The ITSA claims the tobacco industry contravenes these requirements by developing the Codentify system.

It also argues that Inexto, a newly formed Swiss company to whom ownership of Codentify was transferred in June 2016 to comply with EU rules, is not actually independent but rather relies on a business model based on almost complete dependence on the world's four largest manufacturers, who grouped together to form the Digital Coding and Tracking Association (DCTA).

The ITSA claims the Codentify system not only reinforces oligopoly in the sector, but allows companies to build a "Trojan horse" to manipulate trust-based audit controls and possibly mask illicit practices, such as overproduction, through the duplication of genuine codes.

Furthermore, ITSA believes Codentify does little to hinder the illicit tobacco trade. The digital codes generated by the system can be easily duplicated or cloned and passed off as originals on a counterfeit or genuine pack, while the codes lack any physical high security features and the system uses unsecured equipment to generate the codes, which operators may have a vested interest in misusing.

In the position statement, the ITSA calls for a more secure and effective track and trace programme that combines a serialised unique identifier integrated into a tax stamp with material-based security features. The trade body recommends that the tax stamp would be provided by an independent party such as a government security printer rather than by the tobacco industry.

According to the Tobacco Products Directive, that came into force in May 2016, secondary legislation on the tracing of tobacco products has to be adopted this year so that it may be implemented by 2019.

"We believe that only a combination of authentication and track and trace technologies composed of both physical and digital features and operated by an independent third party, can effectively meet the needs of both the WHO FCTC Protocol and the EU Tobacco Products Directive," the ITSA spokesperson said.

"Since the Codentify solution so clearly and fundamentally does not meet either of these requirements it can never be considered as a potential option under these regulations."