Codentify

Codentify is the name of a product serialization system developed and patented by Philip Morris International (PMI) for tobacco product authenticity verification and supply chain control. In the production process, each cigarette package is marked with a unique visible code (also called “Codentify”), that allows authenticating the code against a central server.^[1][2]

In November 2010, PMI licensed the system to its three main competitors, namely British American Tobacco (BAT), Imperial Tobacco Group (ITG), and Japan Tobacco International (JTI), and the four companies together formed the Digital Coding and Tracking Association (DCTA) which works to promote the system in order to replace governmental revenue stamps.^[3] Codentify is branded by its inventors as a “track & trace and product authentication technology”.^[1]

History

In July 2004, Phillip Morris International and the European Union had settled a 12 year long legal dispute concerning cigarette smuggling charges. PMI agreed to pay 1.25 Billion USD to the EU budget and its member states. In addition, PMI was legally obligated to mark its products with trackable serial codes.^[4][5][6] Agreements were subsequently signed with the other three major tobacco companies.

PMI's daughter company, Philip Morris Products S.A. created and patented the Codentify system in 2005.

In late 2010, PMI licensed Codentify to its main competitors BAT, JTI, and ITG free of charge.^[2][3] The four companies, which together account for 71% of global cigarette sales (excluding China), agreed to use the PMI-developed system on all of their products to ensure “the adoption of a single industry standard, based on Codentify.”^[7] The Framework Convention on Tobacco Control (FCTC) immediately voiced concerns that “Codentify should never be used for tracking and tracing purposes as tracking and tracing provisions should be implemented under the strict control and management of governments.”^[8]

In 2011, the four companies formed the Digital Coding and Tracking Association (DCTA) to promote international standards and digital technologies to help governments fight smuggling, counterfeiting and tax evasion. The association was officially launched in 2013.^[9]

According to the DCTA, around 12% of the global cigarette market is illicit, costing national governments more than US$40 billion a year in lost tax revenues^[10] and some say this is a serious underestimate.^[11][12] The agreements between the EU and the four major tobacco companies aim to stem the illicit trade of cigarettes, but are seen by academics in the field as a wholly inadequate deterrent.^[13][14] The EU has since not renewed this deal after MEPs complained that that it was ineffective and inappropriate that governments and tobacco companies have such a deal.^[15]

In June 2016 the DCTA announced that it transferred Codentify to Inexto, an affiliate of the French Group Impala.^[16] This was criticized by leading industry watchdogs such as the FCTC and academics such as Anna Gilmore, who is the director of the tobacco control research group at the University of Bath. She said that “Inexto could not be considered sufficiently independent from the tobacco industry.” Other academics such as Luk Joossens, who is the advocacy officer of the Association of European Cancer Leagues, said the sale was “predictable” and that tobacco companies will now “pretend” that Codentify is no longer part of the tobacco industry.^[17] PMI have rebutted that “Inexto is fully independent from the tobacco industry."^[18]

Technology

The Codentify system is based on a machine-created, unique, human-readable 12-digit alphanumeric code that is printed directly onto every individual product during the manufacturing process.^[19] Factory level encryption keys are stored on a server and allows for the production of a pre-defined number of Codentify codes.^[3]

The code created by the system is described as random, offering 34¹² possible combinations. A range of data can be encrypted into the code such as date and time of manufacture, the machine of manufacture, brand, variant, pack size, pack type, destination market, and price.^[19]

This system presents, however, limitations as it only allows for the verification of the code itself, not however of the product the code is printed on and is potentially open to copying.^[2] A European Commission Assessment Report into Tracking and Tracing notes in section 5.1.2 that in addition to the Codentify code being easily be copied, it also fails to link the cigarette packets to the master cases.^[20]

Criticism

Codentify has been the subject of harsh criticism as a tobacco industry promoted system which is aimed at undermining public health efforts and not capable of curbing the illicit trade of cigarettes^[21] 27 . This criticism has come from academics and pro-health groups^[2] as well as government agencies, including the WHO.^[22]

The WHO FCTC Protocol on the Elimination of the Illicit Trade in Tobacco products states in article 8, section 12 that tobacco tracking and regulation “shall not be performed by or delegated to the tobacco industry”.^[23][24]

Critics of the tobacco industry say Codentify is simply not good enough, “because it focuses too much on production and does not store product codes or track them.”^[2][25]

Heavy criticism has also been launched at the factory-level keys the system uses to provide unique verification codes for the product. Since these secret keys are stored on company and government servers, abuse of privileges on this level would allow criminals to generate additional codes, which would appear to be genuine to the system.^[2][26][27]

The decentralized nature of the system also allows for a variety of other counterfeiting efforts critics say, such as “code recycling”, using codes of products rejected in quality control, “code cloning”, printing the same code on multiple products, and “code migration”, reprinting codes used in one country elsewhere, allowing to reuse genuine codes multiple times.^[26]

Additionally, Action on Smoking and Health (ASH) described the system as a black box created by the tobacco industry that uses unsecured equipment that is vulnerable to code recycling.^[28]

References