As COVID-19 swept through Europe in March, the director of Lithuania’s Central Prison Hospital was relieved to receive 3,000 FFP2 respirator masks, the gold standard for filtering out tiny airborne particles, like the coronavirus that causes the disease.
The masks arrived in boxes plastered with the CE mark, the immediately recognizable symbol showing that products have been verified as meeting European standards. This status was backed by documents from one of the continent’s major certification firms. Everything seemed to be in order.
But what hospital officials didn’t know was that the CE marks on the Chinese-made masks were fake, and the documents meaningless. The shipment had been exported by a company whose owner is wanted by the Chinese authorities, and the masks in the boxes had never been tested to European standards.
“We stated that we needed [the] FFP2, FFP3 [standards],” said hospital director Ramunas Silobritas, who was surprised to be informed by an OCCRP reporter that the masks were subject to a Europe-wide alert for being falsely marked.
“These were a match. After we received the face masks, we had no doubts.”
His hospital is not alone. Since the start of the coronavirus pandemic, countries across Europe have been inundated with fake, substandard, and unverified personal protective equipment (PPE), endangering the lives of those who use it.
Some of the most egregious fakes have been sold with falsified paperwork, but much of the influx is due to something else entirely: misleading certification issued by real companies.
An investigation by OCCRP and 16 European media partners found scores of cases in which PPE was sold throughout Europe using documents that make it look like the goods meet the bloc’s complex safety rules. In reality, the papers are legally worthless.
These documents are sold by European companies, including one with a long history in the continent’s safety industry, and can cost tens of thousands of euros each. Sometimes even the purchasers are unaware that the certificates have no legal basis.
The documents often prominently display the CE mark, an official accreditation for goods that meet European Union standards.
It’s only when you get to the fine print do you find wording explaining that the documents do not actually confer the CE designation, that “it’s not an approval of the product, [and that] it’s not meant to be any kind of mandatory document with legal value,” said Dorte Kardel, a Denmark-based compliance consultant familiar with the practice.
The majority of such documents uncovered by reporters were issued by one company: Ente Certificazione Macchine (ECM), a longstanding player in the EU standards certification business based in the Italian city of Bologna. The company was officially sanctioned for misleading practices by Italy’s top accreditation body in early April, but OCCRP reporters have found evidence that has since continued to tout its business certifying PPE.
Reporters found that misleading documentation from ECM and other companies was used to sell PPE in at least 19 countries. This equipment included respirator masks that were later withdrawn from sale and have failed safety standards in independent tests.
Among those that have sold PPE with these questionable documents are people tied to Romanian organized crime. Kangyuan Jiankang Technology, the Chinese company that brought the unverified masks to Lithuania’s prison hospital, also used ECM certificates.
Reporters were able to trace masks sold by the company to countries including Portugal, Malta, and Estonia. In Lithuania, the masks were sold to government institutions in at least 19 separate contracts.
The Fugitive’s Masks
Kangyuan Jiankang Technology is owned by a man named Chen Shukuan, who is wanted by authorities in China’s Fujian province for failing to pay nearly $30,000 related to a series of ongoing legal cases. Court and company registers show courts have imposed asset freezes on several of Chen’s companies. In 2019, Kangyuan Jiankang was also placed on an “abnormal business operations” list by regulators in Fujian province, although it was taken off this list in April 2020.
The trade in misleading certificates allows goods to be sold that could endanger public safety.
In Sweden, independent testing has shown that masks with fake or questionable documentation fail to meet minimum requirements for particle filtration and overall quality more than half the time.
The European Anti-Fraud Office (OLAF), as well as national law enforcement agencies, are currently investigating the fraudulent use of false and misleading certificates for PPE, said OLAF’s director-general, Ville Itälä.
Millions of articles of substandard PPE have already been seized, he said, explaining that the problem could affect all the EU’s 27 member states.
“The products accompanied with fake certificates could be ineffective or even detrimental to health. It doesn’t only concern individual consumers, but also pharmacies, care homes, and large institutional buyers like hospitals or prisons.”
“Gambling with People’s Lives”
At the root of the problem is the challenge of complying with complex European health and safety rules during an unprecedented global health crisis.
Under EU rules, respirator masks and other equipment that protect users from dangerous health risks must meet strict quality standards. These are verified by so-called “notified bodies” — private companies designated by the European Commission to oversee the assessment of products put onto the European market.
But as the pandemic engulfed Europe, much of the buying was being done by people and institutions with no experience in purchasing PPE and little familiarity with Europe’s rules. Prior to the outbreak, most government institutions, and even health services, didn’t regularly buy respirator masks, which are usually used in fields like construction or heavy manufacturing where hazardous airborne particles are common.
“As you can imagine, everybody who wants to earn a quick buck is ready to jump on the opportunity, so since mid-March the number of questions and examples we have received from our members… was just going crazy,” said Henk Vanhoutte, the secretary general of the European Safety Federation, a Europe-wide body representing companies that make, import, and distribute PPE.
This has resulted in institutions purchasing goods with forged CE documents, or gray documents that only specify in the fine print that they do not confer a CE mark.
Since the start of the pandemic, the European Safety Federation has published a running list of companies believed to be using or issuing suspicious certificates. The body receives as many as a hundred inquiries a day from across Europe, Vanhoutte said.
That’s not to say every piece of PPE sold with the documents has turned out to be defective. In some cases, manufacturers and traders appear to have unwittingly bought unnecessary documentation for products that would have passed the verification process anyway, Vanhoutte said.
The company that most frequently appears on the European Safety Federation’s list is also frequently encountered by journalists investigating suspicious mask orders: Bologna-based ECM.
ECM is an official notified body for goods including radio equipment and certain medical devices — but not PPE.
In 2010, ECM was investigated by Italian authorities for certifying protective gear for fencing without the correct accreditation.
The European Safety Federation also provided OCCRP with “certificates of compliance” for PPE produced by ECM from as early as 2012. (Reporters were unable to independently verify whether these documents were produced by ECM or forged by third parties.)
But ECM’s involvement with PPE began in earnest as demand skyrocketed with the advent of the coronavirus pandemic.
Reporters collected and verified at least 66 ECM certificates for PPE issued this year as COVID-19 spread across Europe. In at least 10 cases, goods bearing ECM certificates were later subjected to safety alerts or failed to meet minimum testing requirements, reporters found.
The company’s activities have already attracted sanction. In early April, Accredia, the organization that oversees Italy’s notified bodies, censured ECM for issuing documents designed to “artfully instil in those who receive them the idea that the certificate is compliant with current European legislation."
The company’s actions “could discredit the entire system of accredited certifications,” Accredia wrote in a public statement.
Documents obtained by OCCRP show that ECM continued to tout its misleading certification business even after this public rebuke.
In a draft contract sent to one potential European customer nearly three weeks later, on April 27, ECM offered to create a “secondary verification of CE conformity” for Chinese-made masks in return for a fee of 20,000 euros, to be paid up front. According to the European Safety Federation’s Vanhoutte, this price is comparable to what authorized bodies charge to assess PPE, and would also include the cost of testing the goods.
Kardel, the Denmark-based compliance consultant, said such a “secondary verification” does not exist under European rules.
“ECM is gambling with people’s lives” by issuing certificates without knowing how a product is tested or how it will be used, she said.
In a written response to reporters’ questions, ECM CEO Andrea Secchi said the company had issued “voluntary” certificates in response to requests from its branch in Shanghai, but that its Chinese customers had been made fully aware that they were responsible for securing their own CE marking with the help of a notified body.
“We wish to draw your attention to the fact that our company is NOT responsible for any different, incorrect, improper use or manipulation of the Document, with respect to its nature,” Secchi wrote.
“Our company is also NOT responsible for any non-conformities present on the product, since the production process, modifications, changes, shortcomings of any safety devices are not under our surveillance. ECM Italy is NOT responsible for the product, production, import, distribution, sale, advertising, technical assistance or consultancy, nor does it act as an agent of the manufacturer.”
“Falsify Something that is at Least Legally Valid”
ECM is not the only player in this gray market. Another well-known issuer of misleading documentation is ICR Polska, a Poland-based notified body approved to certify machinery and radio equipment, but not medical supplies or PPE.
Despite this, reporters found ICR Polska has issued documents for imported PPE that say the company “confirms that the product meets the requirements” of European standards.
Further down the page, and in smaller writing, the certificates state that they do not confer a valid CE mark.
Reporters were able to verify at least eight instances in which ICR Polska issued certificates for masks and other PPE that have been sold in countries including the United Kingdom, Austria, and Finland.
The company declined to respond to written questions sent by OCCRP. But in late March, it publicly announced it would no longer issue certification for goods related to COVID-19 and warned that its “voluntary” certificates are not legally required and do not confer a CE mark.
The company also said that all certificates it issued between March 1 and 26 have been withdrawn.
Complicating the picture, there has also been a thriving trade in fake certificates for PPE falsely claiming to have been produced by ECM and ICR Polska.
These certificates have “been copied by people that don’t realize that if you copy or if you falsify something, you better falsify something that is at least legally valid,” said Vanhoutte, of the European Safety Federation.
ICR Polska has announced that fake certificates bearing its name are being circulated. But confusingly, an online verification system used by the company does not distinguish between what it calls “invalid” and “fake” certificates — making it difficult for the public to differentiate between the forgeries and the ones that were actually issued.
In Lithuania, the port city of Klaipeda bought 30,000 respirator masks for doctors and public sector employees from a brand called “Love Surprise,” manufactured by a Chinese company established on February 26 this year. They came with certification supposedly issued by ICR Polska saying the masks had gone through rigorous testing. However, the documents turned out to be forged, and it’s unclear whether the masks ever met quality standards.
The municipal government told OCCRP that its procurement specialist had been misled by the documentation into feeling “certain that the merchandise is good and meets safety standards.” But the Love Surprise masks were never sent out to nursing homes and hospitals as intended because another shipment arrived first, the government said.
Law Enforcement Attention
The use of such fakes has led to law enforcement action. Dutch authorities arrested a man in April for allegedly selling 15,000 defective masks to healthcare providers using forged ECM documents.
OLAF, the European anti-fraud office, told OCCRP it opened its own investigation into both false and misleading documents for PPE in March, working alongside national customs and enforcement authorities in nearly every European country, as well as Interpol.
The U.S. Food and Drug Administration has cautioned the public that certificates from ICR Polska and ECM are not adequate for importing PPE into the U.S.. National bodies such as Sikkerhedsstyrelsen, Denmark’s official body for overseeing product safety, also warned companies not to buy PPE with certificates from ICR Polska or ECM.
Even Chinese authorities have taken notice. The Shanghai Municipal Administration for Market Regulation warned in April that local companies and individuals were selling supposed “fast-track CE certification services” to would-be exporters for exorbitant fees. In fact, buyers simply received useless certificates from companies including ECM, which authorities singled out as a particular offender for having “flooded the market” with sham certificates.
Reporters were also able to document several instances across Europe where buyers believed these certificates conferred a true CE mark.
In Sweden, several regions and towns were sent certificates by ECM and other companies in files that were falsely labeled as “CE” or “CE certificates.”
Sometimes it wasn’t just the documents that were misleading. In an email to one Swedish town, a supplier wrote: “Hello, here is the CE certificate you requested”. And after a hospital had asked for proper documents, a seller replied: "I understand your concerns, I have read about masks with substandard quality... The CE mark and the test report is of course the ultimate assurance you can get that the product fulfils the requirements. I hereby vow to [you] that this is an FPP2 which fulfils all the requirements for an FFP2 mask 😀."
Additional reporting by Sylke Gruhnwald, Adriana Homolova, Migle Kranceviciute, Holger Roonemaa, Aleksandra Denkovska, David Ilieski, Márton Sarkadi Nagy, Anuška Delić, Meta Gantar, Matej Zwitter, Lars Bové, Dennis Mijnheer, Rui Barros, Yanina Korniienko, Ann-Kathrin Wetter, Maximilian Zierer, Staffan Dahllof, and Laurent Schmit.
This story was done in collaboration with Bayerischer Rundfunk / ARD (Germany), the Danish Broadcasting Corporation (DR), Sveriges Television (Sweden), IrpiMedia (Italy), Follow the Money (Netherlands), Investigative Reporting Lab (Macedonia), De Tijd (Belgium), RISE Romania, Oštro (Slovenia), Eesti Päevaleht (Estonia), Profil (Austria), Slidstvo.Info (Ukraine), Atlatszo.hu (Hungary), Público (Portugal), Reporter.lu (Luxembourg) and Siena.lt (Lithuania).
