Category Archives: Florida

California, certificate authority, digital certificates, Digital Signatures, FIPS, Florida, non-repudiation, pedigree, PKI

Digital Signatures

Digital signatures are commonly mis-understood, but they play an important role in securing the pharmaceutical supply chain. The Florida pedigree regulations allow the use of digital signatures on electronic pedigrees so that they can be “self-authenticated”. That is, so the pedigree can be authenticated on receipt without employing methods that require some kind of communication with each upstream owner of the drug—like phone calls, faxes, emails, etc.

Digital signatures employed in pedigrees can self-authenticate without any kind of communication. This can be a huge timesaver because it can fully automate the detection of improper supply chain behavior. Large volumes of “clean” pedigrees can be processed without human review or intervention with only those that have a problem being presented to a user for manual review and handling.

It’s not necessary to understand the technical details, but understanding some of the non-technical characteristics of digital signature technology is important for those in the pharmaceutical supply chain. Florida encoded the use of FIPS (Federal Information Processing Standards) digital signature standards directly into their regulations. California seems poised to do something similar.

I want to explain digital signatures without getting too technical. That’s hard to do, but here’s a common misconception that is easy to dispel. The term “digital signature” does not mean something that looks like this:

This is a scanned image of a hand written signature (compliments of a spam/scam email I received this morning). You could call this a “digitized signature”, but it is far from a “digital signature”. The digitized signature may mean something to people when the image is displayed so they can see it, but it means nothing to a computer. Nothing more than a photograph. It’s just a bunch of bits.

A true digital signature is one that a computer can make sense out of. The “sense” it can make is to determine whether the signature is valid or not. For that to work, the digital signature has to be composed of data. Here is an example of a long-form demo digital signature in XML format like those found inside DPMS pedigrees. It includes the core signature as well as the signer’s public key for use in decoding the signature, and a certificate that is digitally signed by a certificate authority who is willing to attest to the signer’s identity.

It looks pretty technical, doesn’t it? It is, but don’t get bogged down in the details. The point is, with this type of data, a computer can verify that a known trusted authority (the certificate authority) is positively willing to attest to the identity of the signer and that the public key included is positively from the signer. The computer can then use the public key to verify that the information being signed (not visible in this example) has not been modified since the signer applied the digital signature. All of this can be determined without the computer needing to go elsewhere for additional information.

Probably the most important thing a digital signature provides is the quality of “non-repudiation”. That is, because the certificate authority has pre-identified the signer in a way that can include the review of legal records, and as long as the signer has kept their private key secret, the signer cannot later claim that they did not sign a set of digital information that bears their digital signature. They cannot disclaim it. The signer is tightly bound to the signed data.

That’s a lot more than your bank can tell from the handwritten signature on your checks. Digital signatures are better in almost all respects.

The FDA, other federal government agencies and most U.S. state governments have embraced the use of digital signatures in digital legal documents. In pedigrees, digital signatures provide strong evidence that the information signed can or cannot be trusted. That’s why they are an obvious choice by regulators who want to move beyond paper pedigrees.

In summary, digital signatures provide the following benefits when used in electronic documents:

  • Positive identification of the signer
  • Non-repudiation of the information that is signed
  • Positive confirmation that the signed information has, or has not been modified since being signed
  • Signature validation can be performed without needing to communicate with external entities

The use of digital signatures in DPMS pedigrees is the feature that turns, what would otherwise be just a blob of data, into a standalone legal document that can be easily validated without needing to acquire any other information. It’s what allows DPMS pedigrees to be used as evidence in court for prosecution of counterfeiters, diverters and thieves.

For a more technical description of digital signatures and the PKI (Public Key Infrastructure) technology behind it, start with the definition in Wikipedia.

Now that I have covered digital signatures in general I can move on to discuss their use in specific pedigree approaches. Stay tuned.

Dangerous Doses, Epogen, Florida, illegitimate pharmaceutical supply chain, illegitimate pharmaceuticals, legitimate pharmaceutical supply chain, New York, pharmaceutical supply chain, Timothy Fagan

The Legitimate and Illegitimate Supply Chains

There are a number of important misunderstandings out there related to exactly how illegitimate pharmaceuticals get into the hands of unsuspecting consumers and patients. We need to understand all there is to know about the subject, especially those who are responsible for protecting the public against criminal activity and those who are contemplating new laws aimed at elevating the integrity of the supply chain. In this post, I want to define and differentiate the legitimate and the illegitimate pharmaceutical supply chains.

Extracting the meanings we are looking for, Wiktionary defines the adjective “legitimate” as:

  1. Accordant with law or with established legal forms and requirements; lawful
  2. Conforming to known principles, or accepted rules; valid
  3. (obsolete) Authorized; real, genuine

and the adjective “illegitimate” as:

  1. Illegal; against the law

I don’t think there is any surprise here since these words are in fairly common use, but let’s apply these adjectives to the pharmaceutical supply chain. We could deduce:

The Legitimate Pharmaceutical Supply Chain: The chain of pharmaceutical supply that conforms to known and established legal forms, principles and requirements; the lawful supply chain; the valid supply chain; the real, the authorized, the genuine supply chain.

The Illegitimate Pharmaceutical Supply Chain: The illegal supply chain

Again, no surprises here.

We need one more definition: supply chain.

Wikipedia defines “Supply Chain” as:

“A supply chain is the system of organizations, people, technology, activities, information and resources involved in moving a product or service from supplier to customer. …”

For pharmaceuticals, the supply chain begins with the manufacturer and ends with the consumer, or patient. (For logistical purposes we often talk of our supply chain beginning with the drug manufacturer and ending with the pharmacy, but in actual fact, it ends when the product is irreversibly consumed by the patient.)

We have a single legitimate pharmaceutical supply chain in the United States–filled with complexity, but singular nonetheless. I’ve heard people make the claim that “their [pharma] supply chain is secure”, as if there were many pharma supply chains and it is no concern of theirs if anyone else’s supply chain might not be secure. For security purposes we should treat the U.S. supply chain as a single entity. Martin Luther King famously once wrote, “Injustice anywhere is a threat to justice everywhere”. Similarly, in the pharma supply chain, it could be said that insecurity anywhere is a threat to security everywhere.

Likewise, I believe we have only one significant illegitimate supply chain: the internet. That’s a topic all on its own.

Both the legitimate and the illegitimate supply chains end with the consumer/patient. Interestingly, illegitimate drugs (counterfeit, stolen, diverted, up-labeled, adulterated) can reach the consumer/patient from both the legitimate and the illegitimate supply chains.

Here is perhaps the first surprise in this essay. If we have already separated the legitimate and the illegitimate pharma supply chains, how is it possible for illegitimate drugs to make it into the legitimate supply chain? Wouldn’t they only exist in the illegitimate supply chain?

The answer to the second question is “No”. I selected the adjectives “legitimate” and “illegitimate” for supply chains and for the drugs that pass in them. Just because the adjective is the same doesn’t mean that the subjects are bound to each other.

The answer to the first question is less intuitive. How do illegitimate drugs make it to consumers/patients through the legitimate supply chain? The answer is well documented in Katherine Eban’s book, “Dangerous Doses” already discussed in an earlier post. Look at the case of Timothy Fagan. His parents did not order his Epogen from a website. They bought it (in New York in 2002, prior to the crackdown on criminals in Florida…don’t miss my comments on how much has changed since then) from their favorite national chain pharmacy, a very solid participant in the legitimate pharma supply chain. But the Epogen was “counterfeit” (actually up-labeled and spoiled due to storage at improper temperatures) and Timothy nearly lost his life as the result.

In her book, Eban follows the path of the Epogen from manufacturer to Fagan. It’s a very interesting case. A legitimate drug started out in the legitimate supply chain and it was transformed into an illegitimate drug on its way to the consumer/patient. Did it exit the legitimate supply chain, get transformed by criminals and then get reintroduced, or was the transformation executed by criminals who had infiltrated the legitimate supply chain? The answer depends on whether all of the owners were properly licensed to buy and sell that type of pharmaceutical. If they were, then the drug did not exit the legitimate supply chain. Yes, one or more of the supply chain participants were criminal enterprises, but because they were licensed, they were a legitimate part of the legitimate pharma supply chain at the time.

The point is, individual or groups of criminals can infiltrate the legitimate supply chain at any point (even in big-name companies…read the book!). Once they do, illegitimate drugs can be introduced into the supply chain…easily.

crimes, Dangerous Doses, Florida, pedigree laws

Dangerous Doses

If you have chosen to read this blog but you still haven’t read Dangerous Doses by Katherine Eban, you have made the wrong choice. The book is a great read. It documents the events in the early 2000’s that led the State of Florida to pass the first state pedigree law in 2003. You can draw a straight line between those events and all of the state pedigree laws that came after it. The book is a detailed accounting of crimes that occurred after a few criminals realized that law enforcement and the courts would not take seriously any drug crime that did not involve illegal drugs. But a small group of detectives and a lone prosecutor took them on and eventually brought them to justice. The book alternates between narratives of the crimes, the pursuit of the criminals by the detectives, and Eban’s explanation of how the pharmaceutical supply chain worked back at that time.

But that’s just it. The book was written at a time when things were different than they are now in some very important ways. As I understand it, back then, you could have spent less money on a license to distribute pharmaceuticals than you would if you obtained a license to open a bar. As a consequence, there were thousands of drug wholesalers licensed in Florida. But in 2003 the state toughened its licensing laws, greatly increased the cost of the licenses and increased the penalties for crimes related to wholesale distribution of pharmaceuticals. The HDMA cataloged the significant changes to Florida’s drug distribution regulations as the result of those changes. The number of licensed wholesalers plummeted to only a few hundred in the following years.

Oh, and they passed a pedigree requirement too.

I have to admit that I don’t have a good window into what exactly is going on in the Florida crime scene today but given the heightened awareness in the press of counterfeiting and diversion stories, I have to think that there is not nearly the problem that there was back in 2002, or we would hear about it.

So that pedigree requirement really worked, right? Maybe, but I have to think that the increased licensing fees and other requirements, the increased penalties and the increased interest by the courts are the things that really caused criminals to think twice about getting into that business.

Dangerous Doses is a great book and I still highly recommend it to anyone, especially those like me, who are responsible for working on pedigree, serialization and track & trace systems for companies in the supply chain. But as you read it try to keep in mind, that era doesn’t exist anymore. Since that time many other states have taken comparable steps to strengthen their licensing and toughen penalties. And many of them have also passed some type of pedigree law. Stay tuned for more about some of those laws in later posts.

Do drugs still get counterfeited and sold in the U.S.? Probably, but the criminal activity seems to have moved from the supply chain to the internet where criminals can hide just across the borders. Check your spam folder for the evidence.