False reassurance—the real danger behind India's new pharma serialization proposal

India is on the cusp of introducing a new serialization program for domestic pharmaceutical products. Indian officials have designated this new initiative as a track and trace program though it appears from media reports that the proposed mandate will instead be aimed at creating a consumer-based authentication program. The idea is to print a unique serial number on drug packages so that consumers may authenticate the product via an SMS- or call-enabled mechanism to verify the code.

There are serious issues with this approach, which could lead to failure—and more importantly—open the door to counterfeiters who can mislead consumers into believing they have purchased a genuine drug when it is actually a fake.

Serialization is not an effective anti-counterfeiting solution

Serialization provides an excellent foundation for supply chain tracking programs, but evidence shows that it is unsuitable as a product verification tool for consumer-based anti-counterfeiting initiatives—exactly the kind now being envisioned by Indian authorities.

We need to look at the lessons learned from more than a decade of experience—including my own insights from personally working in this field in India. Back in 2007, I introduced the idea of mass serialization to the Indian pharmaceutical industry and helped to develop an SMS-based program for consumers to authenticate a product. Back then, this was the best option available and serialization therefore found an eager market where existing passive technologies such as holograms were already being viewed as ineffective.

But alas, counterfeiters are crafty and soon found ways to circumvent this technology. Brand protection experts have noted that counterfeiters can simply purchase a genuine product and replicate its genuine serial number onto fake products. More sophisticated counterfeiters can reverse-engineer the serialization system and then generate unlimited batches of serial numbers that actually pass through because they exactly mirror the original program.

Additionally, in cases where the serial number is carried within a 2D barcode, counterfeiters across Asia have found ways to hijack the program by creating outright fake barcodes that point to their own servers, delivering comforting messages back to consumers on a fake product.

False peace of mind for the consumer

The program now being contemplated by Indian authorities is susceptible to all of the above perils. What’s more, the greatest danger rests in the open manner by which consumers are required to authenticate the medicine. It has been reported that consumers will be able to enter the serial number on a package by calling or texting it to a printed phone number on the same package. This is commonly known as an open format for authentication and will be the weakest link in the new anti-counterfeiting program.

In this case, counterfeiters can create a parallel program with their own authentication number printed on the fake drug package. The serial number on the package becomes irrelevant because it will always be successfully authenticated. In fact, the return message will contain the reassuring information that would be so misleading—brand name, batch number, expiry date and so on. The consumer is given false peace of mind and thereafter consumes the counterfeit medicine believing it is indeed genuine.

The absolute worst outcome for any anti-counterfeiting platform is to have it hijacked as a gateway to mislead trusting consumers. That is more than a technology failure of technology, it is a failure for government and industry authorities to think through the implications of the inherent loopholes in their program design.

The fight against counterfeiting continues

Any effort to combat the menace of counterfeiting is always welcomed. However, the proposed solution should not introduce new problems that can actually worsen the situation. That is exactly the future—albeit unintended—consequence of the new program being proposed in India.

Although security professionals no longer view serialization as a worthy platform for consumer empowerment programs, there is some good news. The failure of previous technologies, such as holograms and serialization, has paved the way to a new generation of offerings. There has been a continual evolution of anti-counterfeiting technologies over the past decade to now provide an exciting set of innovative solutions.

Rather than rush into deploying a program that is highly vulnerable and would place Indian consumers at great risk, the Drug Controller General of India (DCGI)—the principal authority empowered to create a safe and sustainable system for India—should convene a stakeholder conference that includes policymakers, industry representatives and technology experts to propose and evaluate the latest cutting-edge 3G solutions in the marketplace.

There are now far better ways to defeat counterfeiters and protect consumers—effectively, efficiently, and economically. It is important for India to get this right.