In December 2017, Russian President Vladimir Putin approved a government decision to create a digital track-and-trace system that will cover all industries throughout Russia, from cigarettes and medicines to clothing and baby food.
Anticipating the implementation of Russian Federal Law No. 425-FZ (decree No 1556) on January 1, 2020, more than 29,000 participants serialized more than 40 million packages of more than 9,000 types of medicines as part of a two-year experiment aimed at gauging the ability of pharmaceutical manufacturers to comply with the new law.
This law requires serialization of all prescription and over-the-counter medicines manufactured within or imported into Russia. To comply with the law, pharmaceutical manufacturers will have to apply mandatory unique digital codes (Data Matrix and human-readable codes) on all packaging levels, starting from the sellable unit (primary pack) to the higher packaging levels. The law also requires manufacturers to aggregate the packaging levels and report a variety of critical information throughout the various stages of the manufacturing process.
The main objective of the law is to counteract the production and trafficking of counterfeit drugs. By adopting track-and-trace technology, businesses will be able to mitigate counterfeiting and protect their brand reputation. Digital marking will also allow businesses to increase productivity, improve logistics schemes, grow market share and ultimately boost revenue.
The unique cryptographic approach to serialization is one of the most noteworthy aspects of the new Russian regulation.
In fact, Russia is the only country to adopt a two-part digital code consisting of identification and verification components. The identification portion contains a GTIN and unique serial number, while the verification portion consists of a crypto number and a crypto code produced through a combination of the GTIN and the serial number.
The cryptographic information is protected by an open key encryption algorithm (GOST 34.10–2012), which makes the unique digital code next to impossible to guess and reproduce. It also makes offline authentication possible via a secret algorithm without the need for a database or Internet access.
Given the technical sophistication of the crypto approach, the industry is unsurprisingly under pressure to meet the implementation deadline. The biggest challenges are complex architecture, additional data exchange, and a larger Data Matrix code.
Complex Architecture and Additional Data Exchange
The verification key and crypto code are not generated by the license holders but attributed by the system operator (CRPT). License holders send a request to the CRPT crypto server by uploading the GTIN, serial numbers and other relevant data specified in governmental decree 1556. For every serial number, the cryptographic elements are attached. They need to be downloaded again by the license holders and applied to the Data Matrix code on every sellable pack. Plus, the cryptographic data is reported at numerous stages along the distribution line.
The verification key and crypto code are not generated by the license holders but attributed by the system operator (CRPT). License holders send a request to the CRPT crypto server by uploading the GTIN, serial numbers and other relevant data specified in governmental decree 1556. For every serial number, the cryptographic elements are attached. They need to be downloaded again by the license holders and applied to the Data Matrix code on every sellable pack. Plus, the cryptographic data is reported at numerous stages along the distribution line.
Product verification at the end of the supply chain depends on the print quality of the Data Matrix code. Because an additional 48 characters (four-character crypto key plus 44-character signature) have to be encoded, the Data Matrix is very dense, even if non-mandatory batch number and expiry date are excluded. This means manufacturers will need to ensure that their printing and verification equipment is capable of handling Russian coding requirements.
Choosing the right track-and-trace partner depends on a combination of factors. What you need is a partner that can take you beyond compliance, providing impactful insights and extending value throughout your entire organization. Below are few of the signs to look for:
A good track-and-trace partner will eliminate hidden costs and save you time and money.
Given the technical complexity of the new law’s requirements and the fast-approaching deadline, manufacturers who hope to achieve compliance will need an experienced global partner with a proven track record of success and a solid base in Russia.
Sanjay Sonar
Subject Matter Expert – Traceability
OPTEL