The EU’s Track & Trace Smokescreen

When the European Union brought in strict new laws in 2014 forcing tobacco companies to sell their products in packaging plastered with graphic health warnings, many saw it as a win in the fight against smoking.

After years of lobbying and legal challenges from the industry, campaigners hailed the restrictions on how cigarettes are traded and sold, known as the Tobacco Products Directive (TPD), as an important step in combating the bloc’s top cause of early death.

But, behind the scenes, the tobacco companies had managed to secure their own victory.

An OCCRP investigation has found that the world’s top cigarette manufacturers, collectively known as Big Tobacco, spent years trying to control the design of a new system designed to curb the EU’s 10 billion-euro-a-year ($11 billion) black-market tobacco trade. After spending millions developing “track and trace,” the bloc has been left with what some experts say is an ineffective system that hands key functions to companies with ties to the tobacco industry.

Just over nine months after the EU adopted track and trace, it remains unclear if it is working. Even if it were, the penalties imposed by member states are hardly a deterrent. Though anyone caught defrauding the system will have their products seized, in Sweden they face a fine of just one euro and in Germany and the UK, there is no fine or legal penalty at all.

Despite its flaws, the EU’s system looks set to become a template for the rest of the world. In Africa, the tobacco companies are lobbying governments to adopt similar systems. In Asia, governments are turning to Brussels for guidance.

The result, say experts, is that international efforts to stop a trade whose profits are notorious for fuelling organized crime and corruption may be fatally flawed.

“The industry solution will become the Trojan horse,” said Michael Eads, who consulted on the creation of the EU’s system. “It will hide billions and billions of dollars of illicit trade.”

‘Grossly Inefficient’

The illicit trade in cigarettes is a global industry that costs governments an estimated $40 billion in lost revenues a year. It’s so profitable that tobacco is thought to be the world’s most widely smuggled legal substance.

The tobacco industry has long been cashing in. The World Bank estimates every year some 600 billion cigarettes — equivalent to one in every 10 rolled worldwide — end up on the black market. Analysis by the Tobacco Control Research Group at the UK’s University of Bath found that around 60-70 percent of cigarettes traded illegally are produced by the industry itself.

For decades, tobacco companies have been unconcerned about smuggling at best — and complicit in it, at worst — largely because they make the same amount of money for each pack whether it's sold illegally or legally. Smuggled cigarettes often offer smokers a cheap alternative to highly taxed legal cigarettes, which can cost four times as much as an untaxed pack.

In U.S. court documents filed in 2000, the EU accused three tobacco combanies of running “an ongoing global scheme to smuggle cigarettes, launder the proceeds of narcotics trafficking, obstruct government oversight of the tobacco industry, fix prices, bribe foreign public officials, and conduct illegal trade with terrorist groups and state sponsors of terrorism.”

For years, governments tried different ways to clamp down on cigarette smuggling.

Between 1998 and 2008, the Big Tobacco companies — Philip Morris International, British American Tobacco, Japan Tobacco International, and Imperial Brands — were hit with an embarrassing series of public inquiries, legal cases, and billions of dollars in fines for illegally trading their own products. Then in 2004, as part of a $1.25 billion anti-smuggling settlement with the EU, Philip Morris agreed to install a new system to provide more transparency in its supply chain.

That system was based on software called Codentify. It uses a digital marking system that assigns an encrypted 12-character code to cigarette packs and cartons, which in theory allows each one to be traced from the factory to the consumer. The codes can then be verified by comparing them to information stored in a central data bank.

But tobacco experts say the system is full of problems. The codes are visible to the naked eye and don’t include any physical security features, so can be easily compromised. And because Codentify can only verify if a code exists in the data bank, not if it’s genuine, it cannot tell if it has been copied or stolen and printed on a black-market pack.

Critics say these problems mean Codentify is largely ineffective for stopping cigarette smuggling. One analysis by academics at the University of Cape Town found customs would have to carry out over 500 times more inspections every week to catch fraudulent cigarettes using its software than using other methods.

Codentify is “grossly inefficient,” they concluded. “Enforcement officers in a country with a Codentify system would have little chance of detecting large-scale fraud committed under the guise of control.”

Others say the system is open to industry manipulation. Critics claim Codentify is a “black box” which may contain “hidden features known only to the tobacco industry.” One tobacco-control advocacy group representing nearly 500 organizations, the Framework Convention Alliance, argues it would allow cigarette companies to manipulate and hide key data from law enforcement.

Yet despite these flaws — or, perhaps, because of them — the tobacco industry has pushed to make Codentify the industry standard. In 2010, Philip Morris licensed the technology, for free, to its three main rivals. The same year, a paper circulated between them outlined their plan to sell the software to governments and regulators through ostensibly independent companies.

“Governments interested in ‘Codentify’ need to be convinced for themselves that this is a high-quality solution, which works totally under their control… and which is supplied to them by a credible third-party technology company,” reads the leaked internal document, written by an Imperial Tobacco executive.

Even in the face of concerns about Codentify’s independence, functionality, and effectiveness, companies that sell the software and which have ties to the tobacco industry have been put in charge of key parts of the EU’s monitoring system.

‘Completely Useless’

In the UK, which for this year at least is part of the EU’s cigarette monitoring system, track and trace has already proved controversial.

Cigarette packs have to carry at least five security features to comply with the Tobacco Products Directive. But the UK customs authority managing the system, HMRC, drew criticism when it announced plans to use numeric codes on packs that critics say are easily compromised, rather than more sophisticated systems. Kate Pike, a regional coordinator at the UK’s trading standards office, which normally polices cigarette smuggling, says they haven’t been given the right equipment to check them either.

“Track and trace is completely useless, from our point of view. There’s no benefit,” said Pike.

Even if authorities do catch wrongdoers, there is little they can do. While the tobacco majors have been fined billions for smuggling cigarettes, there are no EU-wide penalties for any manufacturers found to be defrauding the system. The UK's law includes no penalties beyond the illicit product being seized and a possible ban on tobacco trading for repeat offenders.

British retailers, meanwhile, say the rules about how data is stored are unclear, there is no plan if the system breaks down, and they haven’t had enough time to comply with the new rules.

EU countries are also having problems. A report from Brussels released in October listed a litany of human and technical errors that are undermining track and trace. Meeting minutes show the system is still going through extensive technical updates, and that fraud alerts and mechanisms to report stolen codes aren’t in place. Manufacturers have told customs officials and the EU’s anti-fraud body, OLAF, that they’re having issues reporting sales through the track-and-trace system.

“From my point of view, it’s too early to establish the effectiveness of the system at this point,” said Allen Gallagher, an academic from the Tobacco Control Research Group at the University of Bath and a partner in the global tobacco industry watchdog STOP.

Anca Toma Friedlaender, director of tobacco control advocacy group Smoke Free Partnership, agreed, saying the lack of transparency around the system means it’s hard to tell if these problems are just hiccups, or a sign of deeper flaws in the software.

A Big Tobacco executive on the other hand — directly contradicting the EU — argues that track and trace is not intended to show if the industry is illegally trading its own cigarettes.

Kerstin Reichmann, head of brand and product regulation at UK-based Imperial Tobacco, said that she didn’t know how packs found with fraudulent or incorrect codes would be treated, but insisted they could not be considered illicit products.

“At the moment, we have not the slightest clue how that's going to work,” she said. “We would strenuously, strenuously defend our position that these products are not illicit.”

‘Fox in Charge of a Henhouse’

More concerning in the long-term, experts say, is Big Tobacco’s influence over the companies that are running key parts of the EU’s system.

An international treaty called the Illicit Trade Protocol mandates that data on the movement of tobacco products must be available to authorities, and that the key operations “shall not be performed by or delegated to the tobacco industry.” Under EU law, authorities are also required to control the system’s most important functions, including printing ID codes on packets and the bloc’s central data bank. They are allowed to outsource them, but not to contractors that are directly or indirectly controlled by the tobacco industry.

But EU documents, leaked internal industry records, and court filings seen by OCCRP, call into question the independence of several companies managing vital aspects of the EU’s track-and-trace system.

From the early days of the EU’s process to implement a track-and-trace system, experts warned that Codentify was too close to the tobacco industry to meet independence requirements. In 2016, Vera Luiza da Costa, who leads the World Health Organisation’s tobacco control work, put it bluntly, telling the Commission it risked “put[ting] a fox in charge of a henhouse.”

In 2018, the International Tax Stamp Association even launched a case against the European Commission, claiming the system violated the bloc’s legal requirements to keep key functions out of the hands of the tobacco industry.

All the while, the tobacco majors were quietly working to shape the EU’s system from within.

In Germany, the bloc’s top cigarette producer, Philip Morris and British American Tobacco worked on a pilot program with the national printing office in 2015 that forms the basis of the system Germany implemented last year. The German printing office declined to say how much the pilot had cost and who paid for it, but said it had been “very good preparation for [the] live operation” and “did not contain any different roles” to the current system.

Pilot programs like this were described in the tobacco industry’s 2010 strategy document as a way to spread the Codentify system. “A pilot will enable us to become proactive in promoting the solution,” it says. “The industry can then move forward ahead of the competition.”

In other states, they partnered with French tech giant Atos to pitch Codentify for them. EU documents show Atos — which for years boasted it was the “technology provider for Codentify” — won contracts to generate identifiers in the UK and the Czech Republic. Its former subsidiary Worldline won contracts to do the same in Denmark, the UK, the Netherlands, and Lithuania, all before it was spun off in May 2019.

Atos confirmed it and Worldline were selected to provide tobacco track and trace in several member states, but said its traceability system is “completely independent of Codentify.”

“Atos doesn’t have any track and trace projects to date,” the company said, without providing further details. Worldline did not reply to a separate request for comment.

In Italy, Fata Logistic Systems, which has helped to develop Codentify, is authorized to distribute cigarettes from Philip Morris’ warehouses to retailers.

The EU is legally bound to ensure that the company managing the secondary central data repository is independent from the tobacco industry. However, this firm, London-based Dentsu Aegis, is owned by a Japanese advertising agency that has represented Japan Tobacco. In 2017, Dentsu Aegis bought Blue Infinity, which helped develop Codentify.

Philippe Castella, who manages Dentsu Aegis’ tracking department, said the company had coded its entire system “from scratch,” without incorporating any Codentify software.

Furthermore, tobacco industry experts at Bath University say seven of the eight companies running the banks of primary supply chain data that have been approved by the bloc also have prior links to the tobacco industry.

More questionable still is the role of a Swiss company called Inexto, owned by the French conglomerate Impala SA. Its CEO, former Philip Morris employee Philippe Chatelaine, and its CTO are listed on the original 2004 Codentify patent.

In 2016, the same year it was set up, Inexto bought the rights to Codentify for just one Swiss franc from a body known as the Digital Coding and Tracking Association, which was registered by the tobacco industry.

Leaked minutes of a call between executives from Inexto, Philip Morris, Imperial Brands, and Japan Tobacco also raises questions about Inexto’s financial independence. EU rules that went into effect in 2018 require that contractors working in track and trace derive no more than 20 percent of their turnover from the tobacco industry. But the agenda of one of the calls from late 2017 says Inexto may need “a new more arms-length services arrangement” to meet them.

Despite these ties, Inexto is already working on hundreds of production lines that supply tobacco products to the EU. While the EU declined to provide documentation of its role, Inexto detailed its EU contracts in a court submission in Pakistan, calling itself a “cornerstone” of the system.

Gallagher said the fact that companies with ties to the tobacco industry are part of the bloc’s track-and-trace system shows its independence criteria are not working.

“No one is saying that the EU system is a lot like Codentify, and that’s the problem,” he said.

“The problem is just that the EU system isn’t independent because organizations involved in the development of Codentify that have links to the industry are involved in the upkeep and maintenance of the EU system.”

Exporting Influence

The impact of smuggled tobacco in Europe is expensive and deadly: 10 billion euros of government revenues disappear each year, while some 700,000 lives are lost to smoking-related diseases.

But Europe is affluent and its smoking rates are falling, so tobacco companies are now turning their sights to other potential growth markets.

In Africa, where the World Health Organization predicts the number of smokers will more than double by 2030, British American Tobacco has already been accused of exploiting weak oversight in war zones like Somalia to boost its sales. Now the company is also trying to convince countries on the continent to follow the EU’s track-and-trace model.

In a 2019 letter obtained by OCCRP, British American Tobacco pitched the EU’s system to Botswana’s revenue service as a good choice for the region and suggested that authorities work with the industry to write similar laws.

“Engagement with manufacturers is key to a successful system to avoid creating loopholes in the system,’’ British American Tobacco’s representatives wrote. “Tobacco industry has a wealth of experience globally on different systems and would be happy to assist in this process.”

They also praised the EU’s methodology, saying the “process of engaging both manufacturers and member states was open and transparent.”

Botswana’s revenue service did not reply to a request for comment for this story.

Some countries are also turning to the EU for advice on how to set up their own tracking and tracing systems.

In a presentation in Taiwan in September, Filip Borkowski, deputy head of a unit managing cross-border tobacco control in the EU’s Directorate-General for Health and Food Safety, lauded the bloc’s system as “a good fit” for all the countries that have signed on to the Illicit Trade Protocol treaty against tobacco smuggling.

Borkowski has traveled the globe, from Latvia to Turkey, to promote the system in a series of presentations to governments and customs authorities. He declined to comment for this article.

Meanwhile, Inexto is also quietly making inroads, recently winning contracts in West Africa, Pakistan, Russia, and Mexico. Taken together with the EU, this means that around a quarter of the countries that are part of the Illicit Trade Protocol have companies with ties to the tobacco industry working on their official track-and-trace system.

At this rate, hopes for an effective global clampdown on cigarette smuggling may soon disappear without a trace.