Ferreting Out Fakers

​MOST MAJOR COMPANIES have measures in place to protect their products from counterfeiters. Many of them have methods for examining suspect samples that they receive, and some companies, especially in the pharmaceutical industry, operate their own laboratories to verify authenticity of products. But it is hard for businesses collectively to get an accurate picture of counterfeiting trends, because they are reluctant to share with each other their own counterfeit product experiences. This is where Esfor Security Consulting’s intellectual property forensics lab (where I serve as general manager) comes in.

Located in Istanbul, Turkey, the lab has since its inception in 2001 encouraged companies to donate their counterfeit products so that the lab can attempt to better understand counterfeiters and their methods, and share data on global counterfeiting trends. While Esfor is a commercial enterprise, much of this research is done pro bono.

The most recent findings are that counterfeiters use fairly simple tools to counterfeit high-tech products, and they are so bold as to establish their own global supply chains to perpetrate their schemes. But through diligent research, the lab has been able to use its own tools, working cooperatively with victimized companies, to build a trail of evidence that helps uncover these schemes and catch the perpetrators.

Tools
While some counterfeiters go to the trouble to produce cheap but functional electronics and pass them off as quality components, more and more thieves are finding much lower-tech ways to cheat the system. Whatever the method, it is usually discoverable through detailed analysis.

For example, a pharmaceutical company consulted the lab over suspect pill packages being sold over the Internet. The company believed that the medication was genuine, but the price was so low that they suspected counterfeiters had managed to make nearly perfect fake packaging and were using original tablets to fill the packages.

An initial examination by the lab showed that the packaging was most likely original because the color, the printing technique, and the folding matched those used by the company. However, during the examination process, the lab noticed discoloration and smudging, particularly around the price label section of the boxes. Further analysis, which involved looking at the packaging under different light wavelengths, revealed traces of ink invisible to the naked eye. This ink had been removed via some chemical process. At a certain wavelength, the examiner was able to make out the phrase “Tender Product–Not for Resale” and capture this as a photograph.

It turned out that with this pharmaceutical company, when it sold product to hospitals, it did so in bulk via tenders. To keep those products from getting mixed into regular sales channels, the wholesalers were asked by the hospitals to clearly mark the products so they could not be resold. That was typically done by using a rubber stamp and ink to mark the product “Not for Resale” on or around the price section of the package.

Armed with this information, the lab asked the client to obtain stamp samples applied on regular paper from each wholesaler. Comparing the obtained samples with the suspect sample, the lab was able to determine which wholesaler’s stamp was used on the suspect packaging. The company then went to that wholesaler and found out which tenders they bid and delivered on. In the end, they were able to pinpoint the source of the problem—a hospital dispensary.

In this case, the lab not only helped the company catch the perpetrator, it also identified and exposed a fraud technique, which included using a common household product to take the ink off the packaging. The lab was then able to suggest different inks that could not be removed as easily.

In another incident, a pharmaceutical company suspected a Web site of selling counterfeit products online. Through a local investigative firm, the company found more than 80 Web sites with the same contact numbers, addresses, and account numbers—all involved in the sale of these suspect products. When all of the information from the Web sites was examined with visual-link-analysis software, it appeared that four major groups were running counterfeiting operations separately. To narrow down the suspects further, the company partnered with the lab and law enforcement agencies to make test purchases. The samples were then delivered to the lab under a strict chain of custody.

The lab examined the packaging and the physical aspects of the tablets in question. Then, the lab cataloged the weight, size, color, and surface imperfections of the tablets and the ink colors, printing techniques, logos, and fonts of the boxes, as well as the dye and knife marks left from the cutting and folding of the box during construction. When the findings from the sample analysis were factored into the original analysis, it became clear that all four of the suspect groups were linked, because all samples obtained from these groups during test purchases turned out to be identical counterfeits that came from the same source.

Armed with this knowledge, law enforcement was able to build a case and conduct raids. More than 40 people were arrested and millions of fake tablets were seized.

The lab uses some state-of-the-art pieces of equipment such as a video spectral comparator (for color and shape measurements) and stereo microscopes for close examinations. However, a simple scale is often sufficient. For example, when examining a high-tech electronic board, a lab analyst found that weighing certain miniature screws used to hold the board together could reveal whether one was a fake. If the weight of the screws was not within the range of the weight used by the original manufacturer, the product was counterfeit.

Supply Chain
As counterfeiters work to meet demand in a global marketplace, they are increasingly behaving like regular businesses, moving to form organized supply chains and find partners in other markets that can move larger quantities of counterfeit products. Luckily, for those tracking the counterfeiters, each one of these steps means that the criminals leave identifiable traces. These traces can be found in machinery, in packaging materials, and in information about trade routes and financial transactions. That type of evidence helps the lab identify the source of the counterfeit products and determine the level of production activity and the area of influence.

For example, an automotive company joined forces with the lab last year to start a global project where information on packaging materials from all counterfeit parts found at raids around the world was sent to the lab for examination and cataloging. The parts themselves were not shipped to avoid problems at customs and also to reduce shipping costs. Instead, the company sent high-resolution digital photos of the products.

Data gathered included measurements, paper quality, printing techniques, and color analysis, along with relevant critical data on the companies and individuals believed to be involved in the production or distribution of the counterfeit products. The samples were cataloged and entered into a database. Then all of the data were examined via visual-link-analysis software as well as some custom in-house software.

The lab then determined whether the sample was something that had already been seen or if it was a new counterfeit available on the market. During this stage, it was possible to see the links among products and the suspected players.

Once the lab had built up a database of information on the counterfeits and the packaging, it found that many fraudulent products received from multiple locations had identical counterfeit boxes. These products were found in Dubai, Turkey, and Finland. By following the trail and linking the products, shippers, buyers, and sellers, the lab was able to plot out the network and identify the counterfeiters.

The lab has also been helpful in identifying how counterfeiters adapt to enforcement measures. An example of this is a case in which a computer manufacturer, due to budget constraints and high legal fees, decided not to take legal action against outlets selling counterfeit product unless that seller was attempting to move more than 300 units. The counterfeiters learned about the limit and adapted their practices. The lab helped this company uncover a counterfeiting ring by determining which sellers, some of which were large retail outlets in foreign countries, had shifted from keeping thousands of the company’s products on the shelves to less than 300.

bOne of the main weaknesses in the fight against counterfeits is the lack of cooperation. Due to the competitive nature of the marketplace, many companies cannot bring themselves to join forces with others in their sectors. But keeping counterfeiting incidents segmented by company makes law enforcement efforts more difficult.

The lab has been involved in successful enforcement efforts but cooperation has been critical in these cases.

In a tough economy, fighting counterfeiting is more important than ever. To thwart counterfeiters, companies must partner with law enforcement and other organizations to uncover the latest tactics and find new ways to counter them.

Cengiz Gumustus, CPP, is general manager of Esfor Security Consulting in Istanbul, Turkey.