T[racer]{.smallcaps} D[etection Technology Corp.]{.smallcaps}

***[Products and Services for Corporate and Government
Security]{.smallcaps}***

> [235-O Robbins Lane]{.smallcaps}
>
> [Syosset, N.Y. 11791]{.smallcaps}

516 - 932 -- 2200 Fax: 516 - 935 - 8382

**ANSWERS TO SELECTED QUESTIONS CONCERNING TECHNOLOGY RELATED TO
POTENTIAL OPTIONS FOR IMPROVING PRESCRIPTION DRUG SECURITY**

**What anti-counterfeiting technologies are currently being used? Are
there any data on which technologies are successful?** As the Task Force
is likely aware, circumvention data are compiled by federal and state
document issuing administrators, as well as, for example the Secret
Service for US currency and Motor Vehicle Administrators in conjunction
with police and other investigative teams. Some security measures have
been in use for over twenty years. However, longevity of usage alone
should not imply success. Many of the "older" technologies, despite
having been periodically circumvented, are still in use. Clearly, in the
pharmaceutical context, one instance of circumvention could result in
serious life threatening consequences. Since September 11, 2001 a number
of new and innovative technologies have come to the awareness of the
end-user communities that merit evaluation. Tracer has conducted
frequent market surveys on other security features that are available.
Exhibits comparing some of these features to Tracer's are included in
Tracer's submission to Docket 2003N-0361 in a PowerPoint file titled
"compet-FDA." Also, please refer to the two Technical Briefs submitted
to Docket 2003N-0361 entitled, "Tracer's Product and System Technology
Compared with Optical Anti-Counterfeit Security Features" and
"Electronic Pedigree for Track and Trace of Pharmaceuticals: Tracer's
Product and System Technology Compared with RFID."

**What, if any, minimum number of anti-counterfeiting technologies
should be utilized on packaging and labeling? Should any specific
anti-counterfeiting technologies be utilized?**

Tracer's security feature is based on six overt and covert elements that
are easily updated periodically. Therefore, it could form the basis of
an overall security effort for pharmaceutical products. Each item
protected by Tracer's security feature is uniquely identifiable and
authenticated in real time; as the technology is based on random
patterns and matching symbology, it inherently creates a trackable
Electronic Pedigree. Further, the barcode anticipated under the proposed
Drug Barcode Regulation will establish the symbology platform on which
Tracer's security feature can be implemented.

**Should covert technologies always be utilized? Should overt
technologies always be utilized?** At a minimum, we believe that at
least one overt, one covert and one tamper evidence feature should be
included in pharmaceutical labeling and packaging. Tracer's approach is
based on a combination of six overt and covert elements. However, in
this regard, we refer to the approach taken by the American Association
of Motor Vehicle Administrators that provided guidance on minimum
standards of security for future drivers' licenses based on their
description of the "threats" and whether the feature was machine
readable or not, noting that AAMVA did provide immediate guidance to
adopt OVD's now. There also seems to be a sense that solutions should be
rotated and updated periodically. While rotating and updating is a way
to stay ahead of the counterfeiters, a pharmaceutical company could
determine that it is in its interests to use one form of security
feature over another. Further, we believe that implementing a "rotation"
system could create added expense to the pharmaceutical companies for
both the security feature and for the infrastructure required to monitor
and track/trace pharmaceutical products.

As mentioned above, we believe that Tracer's approach to counterfeit
protection could form the basis of an overall strategy as it is based on
exploiting random patterns and employing six overt and covert elements
that can be constantly updated without changing the infrastructure
required to perform the authentication or track and trace objectives.
Further, Tracer's security feature is fully combinable with most of the
other security features being considered by the Task Force without
cross-interference.

**Should technologies be utilized on all dosage forms (e.g., APIs,
finished dosage forms) and products or just dosage forms and products at
high risk of being counterfeited? On what dosage forms and products
should taggants, other markers, or unique characteristics be utilized?
All dosage forms and products? High-risk dosage forms and products?\
**From an economic and implementation point of view, once a company
commits to protecting its products with anti-counterfeit security
features, we believe that including those features on all products is a
decision that should be based on that company's assessment of the threat
of counterfeiting across its product line versus cost of implementation
(cost benefit analysis). Further, on a company-to-company basis, we
believe that decisions on protecting products from counterfeiting might
lead to the use of different security features on different products,
and not one uniform solution across a company's entire product line (the
assessment of the risk defining the action taken).

**[Should all products be considered at high risk of being
counterfeited? How can products at high risk of being counterfeited be
identified? Which, if any, of the following criteria should be
considered: (a) potential impact on public health if the product were
counterfeited, (b) any history of, or the potential for, counterfeiting,
tampering, or diversion of the product, (c) wholesale and retail price
of the product, (d) volume of product sold, both on a unit and dollar
basis, (e) the dosage form of the product, e.g., injectable, (f)
approved and unapproved uses of the product, (g) current and potential
misuse or abuse of the product, e.g., "street value", (h) other products
in the class with a history of being counterfeited, (i) the length of
remaining patent life for the product?]{.underline}** Once a company has
committed to a security feature (or set of features) to protect its
products, we would expect that the incremental cost of extending
protection to other products in its line would be minimal. Thus, while
it is possible that a company would protect products that were deemed
"high risk" initially, over time, we believe that all products from a
manufacturer could be protected.

We believe that all products that come under the view of the FDA should
be protected in some manner from counterfeiting, not just prescription
items. Safety and efficacy issues affect products like over the counter
medications, nutraceuticals, as well as a number of health and beauty
aids (there are documented cases of Head & Shoulders shampoo being
counterfeited).

**[Should some anti-counterfeiting technologies only be identifiable by
the manufacturer and/or the FDA?]{.underline}** Tracer believes that
some, if not all of the anti-counterfeit elements should remain secure
and with limitations of broad knowledge. Tracer's anti-counterfeit
security feature employs a combination of overt and covert elements. The
essence of covert security features is that they remain confidential. We
believe that the FDA should guide manufacturers to employ certain
general types of overt and covert security features that inherently
address certain predefined threats (refer to AAMVA). We do not believe
that the FDA should specify which of the available anti-counterfeit
technologies a particular manufacturer uses. Maintaining brand security
is the responsibility of the manufacturer; the potential legal liability
lies with the manufacturer; assuring product safety and efficacy is the
mission of the FDA. In our opinion, to assure safety and efficacy, the
FDA need not know the specific security features being used by a
manufacturer, only that the company certifies that it is addressing the
security threats as outlined.

**[Discuss the advantages and disadvantages and the role of track and
trace technologies, in particular bar codes and RFID.]{.underline}** We
have responded to this issue in a separate Technical Brief entitled
"Electronic Pedigree for Track and Trace of Pharmaceuticals: Tracer's
Product and System Technology Compared with RFID" submitted under DOCKET
No. 2003N-0361.

**[What role should the FDA play in reviewing the use of (i)
anti-counterfeiting technologies incorporated into the packaging and
labeling, (ii) taggants, markers, and other unique characteristics
incorporated into the product itself, and (iii) track and trace
technologies?\
]{.underline}**We believe that the FDA can play a very important role in
providing a forum and guidance for technology and inspection standards,
due diligence and cost control inputs. In providing this guidance, the
FDA, working with the Pharmaceutical companies and vendors of
anti-counterfeit security features, needs to assess the various threats
to brand protection, and identify those technologies that respond to
those threats. This does not mean that the FDA should specify which of
the available technologies be used (again, we see this as a corporate
security issue and decision), but that certain pre-defined security
feature types be employed on the various components of the products,
packaging and shipping materials.

Tracer believes that individual companies will need to determine what
alternative track and trace capability suits their requirements while
adhering to the FDA direction to employ track and trace capability in
their products, labels, packages and shipping materials.

**[Should a database, as described in Technology Option 5 be created? If
so, who should develop the database? Where should it be housed? Who
should have access to the data? Who should be responsible for updating
and maintaining it? Tracking and tracing drugs and biologics throughout
the drug distribution chain may result in the creation of a large
database that includes tracking data from each entity that "handles" the
product. Who should create and maintain such data? Where and how should
the data be housed? Who should have access to the data? How can
appropriate confidentiality be assured?]{.underline}** Tracer already
plans to establish a Secure Data Processing and Storage Facility in a
high-tech business park facility (location previously partially
federally funded) to enable real time comparison of information
contained on identification cards or documents protected by our security
feature as they are presented, as well as the tracking and tracing of
products (and labels) as they move through distribution channels. A
Tracer manager who meets security standards would be in charge of this
secure facility. We intend for the center to service the data
requirements of both our governmental and commercial customers.

For the FDA, Tracer envisions using the data capacity within the same
barcode as proposed in the Drug Bar Code Regulation for its encrypted
security information (relating to the random patterns embodied in each
label, product, package or shipping material). Additionally, supporting
the track and trace objective, the encrypted information of the label,
seal, package and/or products can be linked to another component to
increase security, and can be confirmed at each step within the channel
of distribution by comparing the encrypted information of the scan with
that already in the database, i.e. the Electronic Pedigree. We are
confident that the information from each scan will be easily handled by
the capacity of the Secure Data Processing and Storage Facility. The
facility is equipped with a state-of-the-art telecommunications
infrastructure capable of high-speed connectivity and data transfer
through a 48-strand, single mode, high-speed fiber optic network with
broadband connectivity directly into the AT&T network.

Clearly, the data need to be accessible by the pharmaceutical company's
security team, and would be available remotely through password and
encrypted access. This would ensure confidentiality of the data. Should
a pharmaceutical company, government agency or other commercial entity
adopt Tracer's security feature as an anti-counterfeit measure, we would
create, maintain and manage that data in the secure data center. While
Tracer's Secure Data Processing and Storage facility would be capable of
maintaining, it does not seem realistic at this writing that one data
base would be feasible to accommodate the track and trace information
from other vendors' security features. Of course, it is also possible
that a pharmaceutical company would want to maintain its own database,
regardless of which security feature is employed.

**[Are there additional benefits beyond the ability to detect
counterfeit product that anti-counterfeiting and track/trace
technologies can provide for industry, (e.g., inventory control,
facilitation of product recalls, and identification of theft and product
diversion)?]{.underline}**

Certain anti-counterfeit security features that provide track/trace
capability will also offer the customer (pharmaceutical company) the
ability to perform other functions. With Tracer's security feature,
anticipating the use of a 2D barcode or other symbology like a
datamatrix, there will be ample data richness to not only provide
authentication of the protected items, but also contain the inventory
control information now carried by the existing barcode. There is no
reason to believe that this would not also be the case for
pharmaceutical products and packaging. With Tracer's system, information
such as manufacturer's identification and batch/lot information can be
encoded by our software when creating the initial label (e.g., baseline
scan for Electronic Pedigree). Most importantly, information relating to
the intended destination (potentially to the detail of the customer and
location) can be included in the symbology. This would not only provide
definitive identification of each item, enable detailed track and trace,
but also provide proof positive of any diverted shipment.

As outlined in our Technical Brief comparing the capabilities of
Tracer's patented anti-counterfeiting system for providing an Electronic
Pedigree for Track and Trace applications, and to compare its benefits
to those achievable with RFID

Summary Comparison of Tracer's Technology Platform and RFID

+--------+----------+------------+--------------+--------+------------+
|        | **El     | **Reverse  | **Self-Auth  | **Ena  | **Link     |
|        | ectronic | E          | entication** | bles** | Packaging  |
|        | Pe       | ngineering |              |        | Components |
|        | digree** | Re         |              | *      | by Single  |
|        |          | sistance** |              | *Track | Occu       |
|        |          |            |              | and    | rrence\*** |
|        |          |            |              | T      |            |
|        |          |            |              | race** |            |
+--------+----------+------------+--------------+--------+------------+
| Tr     | YES      | HIGH       | YES          | YES    | YES        |
| acer's |          |            |              |        |            |
| Pl     |          |            |              |        |            |
| atform |          |            |              |        |            |
+--------+----------+------------+--------------+--------+------------+
| RFID   | YES      | LOW        | NO           | YES    | NO         |
+--------+----------+------------+--------------+--------+------------+

\*Occurrence: the number of times the feature is incorporated in an
article or composite of articles.

\*\*Plus manufacturing.

**[Should FDA conduct research on development or evaluation of
anti-counterfeiting technologies? If so what should this research focus
on? How should FDA integrate its research efforts with other public and
private sector efforts? How should "validation" of an
anti-counterfeiting measure or track and trace technology be determined?
Should only "validated" anti-counterfeiting measures be used? Who should
do the validation?]{.underline}** The FDA will play an important role in
helping to "set the standards" against which pharmaceutical companies
will evaluate and incorporate various vendors' security features into
their products, labels, packaging and shipping materials (as mentioned
elsewhere, similar to the process conducted by AAMVA). However, we
believe that the testing of the various security features should be the
responsibility of the individual companies. If objective "validation" is
required, in addition to NIST, there are federal laboratories such as
Sandia National Laboratory (and others) that are equipped to perform
validation and "red teaming" research. Tracer has a pending
[proposal]{.underline}, in which it would create a number of documents
incorporating its security feature, place the encoded information in a
remote database, and then either confirm the validity of each document,
or identify counterfeits. Clearly, any demonstration of any security
feature needs to be supervised and attested by both the customer company
and the appropriate federal agencies or regulatory bodies.