The federal government plays a role in overseeing Internet pharmacy activity to the extent that these entities engage in interstate commerce or violate federal laws. However, states have traditionally regulated the practice of pharmacy and the practice of medicine. State boards of pharmacy license pharmacists and pharmacies, and state medical boards license physicians and set standards to ensure appropriate care, including standards for writing prescriptions. By violating federal and state laws, rogue Internet pharmacies threaten the public health. No one federal agency is designated as the lead in combating rogue Internet pharmacy activity. Instead, several federal agencies, including FDA, CBP, and ICE, have separate and distinct roles and often work together. Under the Federal Food, Drug, and Cosmetic Act (FDCA), FDA is responsible for ensuring the safety, effectiveness, and quality of domestic and imported prescription drugs that are marketed to U.S. consumers. The FDCA requires that certain drugs be dispensed pursuant to a prescription that is issued by a licensed practitioner. The act also requires drug manufacturers to obtain FDA’s approval before marketing their drugs in the United States. To obtain FDA’s approval, manufacturers must demonstrate to the agency that their drug is safe and effective for its intended use, and meet other statutory and regulatory standards relating to drug purity, labeling, manufacturing, and packaging. Drugs that are manufactured in foreign countries for the U.S. market, including those sold over the Internet, are subject to the same requirements as those manufactured domestically. That is, all prescription drugs offered for import must meet the requirements of the FDCA, including requirements for obtaining FDA approval. Drugs that are unapproved, or do not meet other provisions of the FDCA, such as those listed below, may be subject to enforcement action. Misbranded drugs include those that are sold without a prescription that meets applicable requirements, as well as those whose labeling or container is misleading or does not include required information, such as the name of the drug, adequate directions for use, and cautionary statements. Adulterated drugs include those that differ in strength, quality, or purity from approved products, as well as those that are not manufactured in conformity with good manufacturing practices. Counterfeit drugs include those sold under a product name without proper authorization—where the drug is mislabeled in a way that suggests that it is the authentic and approved product—as well as unauthorized generic versions of FDA-approved drugs that mimic trademarked elements of such drugs. Drugs that do not appear to be in compliance with these provisions may be denied entry into the United States. In addition, those—including Internet pharmacy operators—that cause drugs to be misbranded, adulterated, or counterfeited, as well as those that sell such drugs, violate the FDCA and are subject to enforcement action. Counterfeiting and trafficking or selling counterfeit drugs also violate laws that protect intellectual property rights. DOJ’s Drug Enforcement Administration (DEA) is responsible for enforcing the Controlled Substances Act (CSA), which regulates the possession, manufacture, distribution, and dispensing of controlled substances, such as narcotic pain relievers. DEA is also responsible for enforcing provisions and investigating violations of the Ryan Haight Online Pharmacy Consumer Protection Act of 2008, which amended the CSA to regulate the distribution and dispensing of controlled substances on the Internet. The act requires all entities that sell, or facilitate the sale, of controlled substances online to register and be authorized by the DEA to do so. Entities based in foreign countries are not eligible for registration; it is illegal for consumers to import controlled substances. The act also defines what constitutes a valid prescription for controlled substances, and requires that such a prescription be issued for controlled substances dispensed over the Internet. CBP is responsible for enforcing laws prohibiting the illegal importation of goods into the United States, including prescription drugs that have not been approved by the FDA for the U.S. market, as well as those that are counterfeit or misbranded. Additionally, the importation of prescription drugs by individuals for personal use is illegal, but FDA may exercise its regulatory discretion in determining whether to take enforcement action against such importation.inspections of products presented for import at the border. CBP interdicts and turns suspicious prescription drug shipments over to FDA for CBP coordinates with FDA to conduct examination, and may seize and destroy certain shipments that are deemed to be in violation of applicable laws. ICE is responsible for, among other things, investigating violations of customs and trade laws, including those related to trafficking in counterfeit goods. ICE also operates the National Intellectual Property Rights Coordination Center, the mission of which is to share information across 17 federal government agencies and four foreign regulatory agencies, coordinate enforcement actions, and conduct investigations related to intellectual property theft—including those that occur through rogue Internet pharmacies. USPIS helps prevent the illegal importation of prescription drugs by providing CBP with information about suspicious mail packages entering the United States. USPIS also investigates issues related to the misuse of mail. Other federal agencies are also sometimes involved in investigating rogue Internet pharmacy activity, to the extent that their jurisdiction relates to illicit activities conducted by these entities. The Internal Revenue Service investigates instances of money laundering, which is the act of disguising or concealing illicit funds to make them appear legitimate. The Federal Trade Commission (FTC) may investigate rogue Internet pharmacies to the extent that their websites make false or misleading statements about how they collect and use medical information about consumers, which constitute violations of the Federal Trade Commission Act. In addition, FTC may investigate potential violations of the CAN-SPAM Act of 2003, which imposes limitations and penalties on the transmission of certain unsolicited commercial e-mail, such as those with misleading information in the line identifying the person who sent the message. DOJ’s Federal Bureau of Investigation may investigate rogue Internet pharmacies if their activities defraud health care benefit programs or present a clear public health or safety threat. DOJ prosecutes rogue Internet pharmacies through U.S. Attorneys’ Offices located in 94 federal judicial districts throughout the nation, and through DOJ’s Civil and Criminal Divisions, located in Washington, DC. U.S. Attorneys are the chief federal law enforcement officers for each federal district, and they serve as the nation’s principal litigators under the direction of the Attorney General, working with officials from appropriate federal, state, local, and foreign agencies to prosecute rogue Internet pharmacy cases in their districts. DOJ’s Civil and Criminal Divisions also prosecute such cases, coordinating closely with U.S. Attorneys, particularly in cases spanning multiple districts or international borders. DOJ’s Civil Division has expertise in prosecuting cases involving FDCA violations, and DOJ’s Criminal Division has expertise in prosecuting cases related to trafficking in counterfeit goods and offenses such as money laundering and fraud that are often integral to these criminal operations, as well as expertise in working with foreign law enforcement to obtain evidence or secure the extradition of defendants from other countries. In the United States, prescription drugs must be prescribed and dispensed by licensed health care professionals, who can help ensure proper dosing and administration and provide patients with important information on the drug’s use. To legally dispense a prescription drug, a pharmacist licensed by the state and working in a pharmacy licensed by the state must be presented a valid prescription from a licensed health care professional. In addition, most states require pharmacies located outside their state to obtain a nonresident pharmacy permit prior to dispensing prescription drugs to customers located in that state. Some states regulate Internet pharmacies according to the same standards that apply to nonresident pharmacies. Others require pharmacies to obtain a special license in order to dispense prescription drugs ordered online. The regulation of the practice of pharmacy is rooted in state pharmacy practice acts and regulations enforced by state boards of pharmacy. The state boards of pharmacy also are responsible for routinely inspecting pharmacies, ensuring that pharmacists and pharmacies comply with applicable state and federal laws, and investigating and disciplining those that fail to comply. States also are responsible for regulating the practice of medicine. All states require that physicians practicing in the state be licensed to do so. State medical practice laws generally outline standards for the practice of medicine and delegate the responsibility of regulating physicians to state medical boards. Each state’s medical board also defines the elements of a valid patient—provider relationship, and grants prescribing privileges to physicians and other health care professionals. In addition, state medical boards investigate complaints and impose sanctions for violations of state medical practice laws. Because regulation of the practices of pharmacy and medicine occurs at the state level, definitions and other requirements related to these practices differ from state to state. As a result, there is no uniform, national definition of the term “prescription” that applies to noncontrolled substances. Thus, certain activities, such as prescribing drugs without performing an in-person examination, may be explicitly illegal in one state while another state may not specifically address its legality. Organizations such as NABP and FSMB have established and promoted uniform national standards related to Internet pharmacies for the consideration of state pharmacy and medical boards, as well as for consumers. NABP established the Verified Internet Pharmacy Practice Sites (VIPPS) program to provide a means for the public to identify legitimate Internet pharmacies. This accreditation program identifies those online pharmacies that are appropriately licensed, are legitimately operating via the Internet, and have successfully completed a review and inspection by NABP. FSMB has developed model guidelines regarding the appropriate use of the Internet in medical practice. According to these guidelines, electronic technology should supplement and enhance, but not replace, the crucial interpersonal interactions that are the basis of the physician—patient relationship. These professional standards, however, are not legally enforceable in the absence of state laws establishing such requirements. The Center for Telehealth and e-Health Law (CTeL), an organization that works to overcome legal and regulatory barriers to telemedicine, issued guidance in February 2013 regarding how telemedicine, using two-way audio-video communications, can be used to establish a bona fide physician—patient relationship when prescribing noncontrolled substances. Specifically, the guidance notes that an appropriate examination of the patient by the practitioner must occur prior to the issuance of a prescription, and that audio-only telephone conversations and e-mails cannot be used as a basis for establishing a bona fide practitioner—patient relationship. Rogue Internet pharmacies often sell unapproved prescription drugs— including those that are substandard, counterfeit, and have no therapeutic value or are harmful to consumers. These drugs may be manufactured under conditions that do not meet FDA standards, including unsanitary and unsterile conditions. The drugs sold by rogue Internet pharmacies have been found to contain too much, too little, or no active pharmaceutical ingredient, or the wrong active ingredient. They have also been found to contain dangerous contaminants, such as toxic yellow highway paint, heavy metals, and rat poison. Consumers who have taken prescription drugs purchased from rogue Internet pharmacies have experienced health problems, required emergency treatments, and have died.pharmacies sell prescription drugs without legitimate medical oversight, consumers may be harmed by ingesting drugs that are contraindicated for them, or have interactions with other medications that they are taking. However, adverse events caused by prescription drugs purchased from rogue Internet pharmacies are difficult to detect and quantify. Consumers may purchase drugs from rogue Internet pharmacies because of privacy concerns or to circumvent normal processes for obtaining prescription drugs. As a result, they may be reluctant to report health problems that they experience. Further, it can be difficult to determine whether adverse events are caused by substandard drugs. The role played by drugs from rogue Internet pharmacies may even go unnoticed. For example, when consumers take drugs that have no therapeutic value to treat their diseases, they may not experience adverse events to the drugs themselves, but they derive no benefit. Persistent symptoms may be attributed to their diseases, as opposed to ineffective treatments. Rogue Internet pharmacies violate a variety of federal and state laws. Many ship unapproved drugs into the United States and sell drugs to consumers without a prescription that meets federal and state requirements. Rogue Internet pharmacies also violate other federal and state laws, such as those related to fraud and money laundering, in addition to not complying with industry standards. Although the exact number of rogue Internet pharmacies is unknown, most operate from abroad. According to LegitScript, an online pharmacy verification service that applies NABP standards to assess the legitimacy of Internet pharmacies, there were over 34,000 active rogue Internet pharmacies as of April 2013. Federal officials and other stakeholders we interviewed consistently told us that most rogue Internet pharmacies operate from abroad, and many have shipped drugs into the United States that are not approved by FDA. In doing so, they violate FDCA provisions that require FDA approval prior to marketing prescription drugs to U.S. consumers, as well as customs laws that prohibit the unlawful importation of goods, including unapproved drugs. The prescription drugs that rogue Internet pharmacies sell have included counterfeit, misbranded, and adulterated drugs. Certain rogue Internet pharmacies have also sold dietary supplements that contain prescription drug ingredients, in violation of the FDCA. In addition, some, particularly those abroad, have sold controlled substances to customers located in the United States. As no Internet pharmacies have been approved by DEA to dispense controlled substances to customers in the United States as of May 3, 2013, doing so violates the CSA. Example of a Foreign Rogue Internet Pharmacy Indicted for Illegally Selling Drugs to U.S. Customers In 2012, two operators of a rogue Internet pharmacy based abroad were indicted for allegedly shipping unapproved prescription drugs into the United States, in violation of the FDCA. The shipments allegedly included controlled substances, and the pharmacy owners were also charged with importing controlled substances without authorization, in violation of the CSA. According to DOJ’s indictment, some of the imported drugs were misbranded because the packages did not include adequate directions for the drugs, some of the drugs offered for sale were listed under a different name, and the company fulfilled orders without ensuring that customers had a prescription. The indictment also noted that the operators packaged drug shipments to evade scrutiny by customs officials. For example, drugs were allegedly wrapped with carbon paper and black plastic bags, and packages included false return addresses. To sell drugs to their U.S. customers, foreign rogue Internet pharmacies use sophisticated methods to evade scrutiny by customs officials and smuggle their drugs into the country. For example, they have used intermediary shippers to help disguise the actual source of their shipments, which, according to CBP officials, may increase the likelihood that the shipments get through customs unnoticed. FDA and ICE officials told us that rogue Internet pharmacies have also misdeclared the contents of packages sent via express courier services or cargo shipments, in violation of customs laws. Federal agencies use importation declarations to identify potentially illicit shipments for further examination; as such, misdeclaring the contents of such packages can result in illicit shipments evading additional scrutiny at the border. Further, rogue Internet pharmacies have disguised or hidden their drugs in various types of packaging; for example, CBP has found drugs in bottles of lotion and in tubes of toothpaste. Example of a Licensed Brick-and-Mortar Pharmacy Selling Misbranded Drugs In 2011 and 2012, the owners of a U.S.-based brick-and-mortar pharmacy were convicted of several charges related to selling misbranded prescription drugs for rogue Internet pharmacies. The pharmacy was paid by multiple foreign rogue Internet pharmacies to fill prescriptions that did not meet state medical board requirements for a valid prescription and were sold and distributed in violation of the CSA. The rogue Internet pharmacies paid doctors, or in some cases, lay persons, to review brief online medical questionnaires and authorize the orders. The pharmacy filled orders for drugs, including controlled substances, and shipped them to customers who were usually located in a different state than the pharmacy. Because the drugs were sold without a valid prescription, they were considered misbranded, in violation of the FDCA. Rogue Internet pharmacies also often sell drugs to consumers without a prescription, in violation of FDCA and state requirements, or with a prescription that does not satisfy FDCA and state requirements. According to federal officials, they have done this by advertising that no prescription is necessary or by allowing consumers to purchase drugs after completing a brief online questionnaire that does not meet their state’s requirements for a valid prescription. In some cases, rogue Internet pharmacies have ignored information from these questionnaires and have allowed consumers to make a purchase, regardless of the information disclosed. These actions violate the FDCA requirement that certain drugs be dispensed only with a prescription that is written by a licensed practitioner. In addition, some rogue Internet pharmacies operating from abroad have recruited doctors and pharmacies based and licensed in the United States to fulfill online prescription drug orders in exchange for payment, according to officials from federal agencies and stakeholders. Often, they have targeted doctors and pharmacies that are struggling financially, and have compensated them according to the number of prescriptions they authorize and fill, respectively. In these circumstances, the doctors violate state laws or medical board regulations as well as industry standards, such as those issued by FSMB and CTeL, which require valid patient—provider relationships prior to the issuance of a prescription. Likewise, the pharmacists violate state laws or pharmacy board regulations by selling drugs without ensuring that there is a prescription that meets state requirements. Drugs sold in this manner are considered misbranded, and are subject to enforcement under the FDCA. Rogue Internet pharmacies violate a variety of federal laws, including those related to fraud, money laundering, and intellectual property rights, according to officials from several federal agencies and stakeholders we interviewed. For example, rogue Internet pharmacies have engaged in mail fraud by using the mail to facilitate their illegal transactions. In addition, some rogue Internet pharmacies have engaged in money laundering.Internet pharmacies, operators have created a shell—or fake—company Specifically, to use the proceeds generated from rogue to disguise the nature of their business, or have misstated the nature of their business to banks that process their credit card transactions, according to stakeholders we interviewed. To appear more legitimate to their consumers, rogue Internet pharmacies have also violated intellectual property laws by fraudulently displaying trademarks on their websites. For example, rogue Internet pharmacies have fraudulently displayed the VIPPS accreditation logo as well as the logos for payment processors such as Visa, MasterCard, or PayPal, without having obtained permission. Rogue Internet pharmacies have violated a range of other federal laws, such as those related to making false or misleading statements, as well as by engaging in other deceptive and unfair acts or practices. For example, rogue Internet pharmacies have violated the CAN-SPAM Act by sending e-mails that list false information in the subject line or otherwise hide the message’s origin. Rogue Internet pharmacies also violate state laws, including those related to operating without an appropriate license. Rogue Internet pharmacies have violated state laws by not obtaining pharmacy licenses from the states where their customers reside. In addition, licensed brick-and- mortar pharmacies recruited to fulfill prescription drug orders for rogue Internet pharmacies have violated state laws when they perform activities not authorized under their license or when they ship drugs to out-of-state customers. According to officials from state boards of pharmacy we interviewed, brick-and-mortar pharmacies have fulfilled online prescription drug orders, including to residents of another state without obtaining a nonresident pharmacy license in the state where those customers reside or without ensuring the prescriptions are valid. When fulfilling such orders for out-of-state customers, brick-and-mortar pharmacies have also violated valid prescription requirements of the state where their customers live. For example, the California Board of Pharmacy identified an Internet pharmacy based in Utah that was violating California pharmacy laws, which require that prescription drugs be dispensed through the Internet only with a prescription issued after a good-faith medical examination from a physician licensed in the state. According to the California Board of Pharmacy, the Utah pharmacy was selling prescription drugs to Californians based on prescriptions that it knew or should have known were not based on good-faith medical exams and were written by physicians who were not licensed in California, in violation of California law. However, according to Utah Board of Pharmacy officials, the pharmacy was complying with Utah’s laws, which allow certain licensed Internet pharmacies to dispense specified types of prescription drugs— such as certain erectile dysfunction drugs and hormone-based contraception—solely on the basis of an online questionnaire. Rogue Internet pharmacies do not comply with industry standards for legitimate Internet pharmacies. For example, officials from federal agencies and stakeholders told us that rogue Internet pharmacies have not provided accurate or complete information to domain name registrars when registering a website and have not adequately protected customer privacy. In addition, rogue Internet pharmacies have not displayed identifying information on their website, such as a business address and telephone number. Rogue Internet pharmacies are often complex, global operations, and as a result, federal agencies face substantial challenges investigating and prosecuting their operators. Officials from federal agencies and stakeholders we interviewed told us that piecing together these operations can be difficult because rogue Internet pharmacies can be composed of thousands of related websites. Although a small number of individuals own the majority of rogue Internet pharmacies operating across the world, they may contract with hundreds or thousands of individuals to set up, run, and advertise their websites—primarily by sending out unsolicited spam e-mails. The ease with which operators can set up and take down websites also makes it difficult for agencies to identify, track, and monitor rogue websites and their activities, as websites can be created, modified, and deleted in a matter of minutes. Additionally, rogue Internet pharmacies frequently locate different components of their operations in different countries, further complicating efforts to unravel the entirety of a rogue Internet pharmacy operation. For example, one rogue Internet pharmacy registered its domain name in Russia, used website servers located in China and Brazil, processed payments through a bank in Azerbaijan, and shipped its prescription drugs from India. (See fig. 1.) Federal agencies, states, and stakeholders have investigated and prosecuted operators, prevented illicit shipments of pharmaceuticals from entering the United States, and blocked rogue Internet pharmacies’ ability to market and sell their products. Despite facing substantial challenges, several federal agencies— including FDA, ICE, and USPIS—have investigated and prosecuted rogue Internet pharmacy operators that have violated federal laws. (See fig. 2 for a screenshot of a rogue Internet pharmacy that FDA recently investigated, which led to a conviction in 2011.) Agencies have investigated rogue Internet pharmacies independently and conducted collaborative investigations with other federal agencies through ICE’s National Intellectual Property Rights Coordination Center. In certain instances, agencies have collaborated with international law enforcement agencies. Agency investigations have resulted in the conviction of operators, fines, and asset seizures. Specifically, according to agency officials, from fiscal years 2010 through 2012, FDA opened 227 rogue Internet pharmacy investigations and its investigations led to the conviction of 219 individuals and more than $76 million in fines and restitution; ICE initiated 138 investigations and its investigations led to 56 convictions and the seizure of nearly $7 million; USPIS worked on 392 investigations and arrested 560 individuals; IRS conducted 22 investigations and its investigations led to the conviction of 5 individuals; and DEA conducted 49 investigations into rogue Internet pharmacies and seized more than $1 million. In addition to investigating rogue Internet pharmacy operators, federal agencies have investigated companies for providing services to rogue Internet pharmacies. In 2011, a DOJ and FDA investigation led to a settlement under which Google agreed to forfeit $500 million for allowing certain rogue Internet pharmacies to place sponsored advertisements in its search engine results from calendar years 2003 through 2009. In March 2013, a DOJ investigation led to a settlement under which UPS agreed to forfeit $40 million for transporting and distributing prescription drugs, including controlled substances, from certain rogue Internet pharmacies to U.S. consumers from calendar years 2003 through 2010. As part of their settlements with DOJ, both companies noted that they will stop serving rogue Internet pharmacies and create compliance programs to identify rogue actors, in exchange for not being prosecuted by the U.S. government for crimes related to this activity. In addition, according to FedEx documents, DOJ is investigating the company for potentially violating federal law by shipping prescription drugs from Internet pharmacies. Federal agencies have also taken steps to shut down rogue Internet pharmacy websites. For example, FDA and other federal agencies have participated in Operation Pangea, an annual worldwide, week-long initiative in which regulatory and law enforcement agencies from around the world work together to combat rogue Internet pharmacies. In 2013, FDA took action against 1,677 rogue Internet pharmacy websites during Operation Pangea. In 2012, as part of the Operation, FDA informed domain name registrars that over 4,100 rogue Internet pharmacy websites were illegally selling prescription drugs online, in violation of the registrars’ terms of service with their customers. The agency informed the registrars of these violations in order to encourage them to shut down these violative websites. FDA officials told us that the effect of such shutdowns is primarily disruptive since rogue Internet pharmacies often reopen after their websites get shut down; officials from federal agencies and stakeholders we spoke with likened shutting down websites to taking a “whack-a-mole” approach. One stakeholder noted that rogue Internet pharmacies own and keep domain names in reserve so that they can redirect traffic to new websites and maintain operations if any of their websites get shut down. Rogue Internet pharmacies may also find new registrars to host their websites—figure 3 provides an example of a rogue Internet pharmacy website that was shut down during Pangea but that continued operations by switching to another domain name registrar. FDA has also issued warning letters to rogue Internet pharmacies to notify them that they are engaged in potentially illegal activity and direct them to cease their illegal activity. From calendar years 2009 through 2012, FDA reported issuing about 30 warning letters to rogue Internet pharmacies. According to FDA officials, rogue Internet pharmacies often ignore the letters and continue with their illicit activity. However, in some cases, FDA’s warning letters have led to the removal of potentially dangerous products from certain websites. FDA officials told us that they remain committed to combating rogue Internet pharmacies and in April 2013 they formed a new Cyber Crimes Investigation Unit that is devoted to this cause. Federal agencies responsible for preventing illegal prescription drug imports have also interdicted rogue Internet pharmacy shipments. CBP coordinates with FDA to inspect and seize illicit mail, express courier, and cargo shipments of prescription drugs presented for import at the border on a daily basis. CBP also leads Operation Safeguard, a multiagency initiative to target illicit imports of prescription drugs. Once a month, CBP, along with FDA and ICE, targets a specific international mail or express courier facility and, according to agency officials, conducts extensive examinations and seizures of illicit prescription drug shipments for 3 days. In total, from fiscal years 2010 through 2012, FDA reported examining nearly 45,000 shipments and CBP reported seizing more than 14,000 illicit shipments of prescription drugs, with mail shipments constituting the majority of the shipments that were seized. In addition to seizures of shipments presented for import, according to USPIS, the agency seized more than 800 illicit shipments of controlled substances in the domestic mail system during fiscal year 2012. Despite these efforts, FDA officials told us that the sheer volume of inbound international mail shipments— which total nearly 1.2 million pieces every day, according to USPIS— makes it difficult to interdict all illicit prescription drug imports. Other federal agencies have also taken steps to combat rogue Internet pharmacies by sponsoring research and engaging stakeholders. The National Science Foundation has provided grants to researchers who have examined rogue Internet pharmacy operations and developed strategies for combating them. For example, researchers found that rogue Internet pharmacies may be vulnerable to efforts to limit their ability to process online payments.companies to encourage them to limit services to rogue Internet pharmacies. According to DEA officials, illicit pain clinics—brick-and-mortar operations where customers can obtain prescriptions for controlled substances without a legitimate medical need—have since emerged as the primary source of controlled substance diversion. agency’s conclusion that domestic and foreign rogue Internet pharmacies are generally not selling controlled substances. Furthermore, agency officials told us that they do not track data that could demonstrate a reduction in the sale of controlled substances online because they told us there is no reason to do so. DEA officials explained their rationale by saying that the agency does not collect data on threats that do not exist. However, DEA’s 2011 assessment of Internet pharmacies that advertised the sale of controlled substances revealed that 40 percent were selling such substances. DEA has not gathered additional data to demonstrate the extent to which controlled substances are being diverted over the Internet. States face challenges investigating rogue Internet pharmacies and have played a limited role in combating them. Given that most rogue Internet pharmacies operate from abroad, stakeholders including NABP, National Alliance for Model State Drug Laws, and National Association of Attorneys General, as well as officials from several state attorneys general offices told us that states do not have the authority, ability, or resources to investigate and prosecute them. These stakeholders told us that, as a result, states generally have not investigated rogue Internet pharmacies for violating their laws. In addition, officials from the five state boards of pharmacy we interviewed also told us that they do not proactively investigate unlicensed pharmacy activity, and most of the boards view the enforcement of unlicensed pharmacy activity as the responsibility of state law enforcement agencies, rather than themselves. Accordingly, they have not actively sought to identify or investigate rogue Internet pharmacies—either in-state or out-of-state—that sell prescription drugs to customers within their state, though they may look into rogue Internet pharmacies if they received complaints. Further, board officials told us that they face challenges enforcing laws outside of their own states. When rogue Internet pharmacies located in other states violate their state laws, board officials contact officials of state boards where the pharmacies are located, and it is then the responsibility of the contacted boards to take any appropriate investigative or enforcement actions. The boards may also send cease-and-desist letters or attempt to fine out-of- state pharmacies that violate their states’ laws. However, the boards have no ability to ensure compliance with enforcement actions against pharmacies outside of their state that are not licensed in their state. State boards of pharmacy focus on regulating licensed brick-and-mortar pharmacies located within their state. In regulating licensed pharmacies, officials from each of the five states told us that they have taken enforcement actions against licensed pharmacies in their states for fulfilling orders on behalf of rogue Internet pharmacies or illicitly selling prescription drugs over the Internet. For example, in 2010, the Nevada Board of Pharmacy revoked the license of a pharmacist for illegally shipping controlled substances to an out-of-state customer who placed an order through a rogue Internet pharmacy. In addition to actions taken by state pharmacy boards, state medical boards have also taken enforcement actions against physicians involved in illicitly writing prescriptions for rogue Internet pharmacies, according to FSMB officials. Stakeholders that provide services to Internet-based businesses have blocked rogue Internet pharmacies’ ability to market and sell their products. These stakeholders have taken such actions on the basis of information that they learn about and share through various associations. CSIP has helped member companies that provide services to Internet businesses—such as Internet registrars, search engines, and payment processors—share information about rogue Internet pharmacies, and encourages its members to block services to them.CSIP contracts with a third-party company that proactively searches the Internet to identify rogue Internet pharmacies and disseminates this information to its members. In addition, CSIP gathers information about rogue Internet pharmacies from member companies, as well as from other outside sources such as federal agencies. According to CSIP, from November 1, 2011, through December 1, 2012, its members took more than 3 million actions against rogue Internet pharmacies. For example, Internet registrars shut down rogue Internet pharmacy websites, search engines prevented them from placing advertisements, and credit card companies prevented payments from being processed. IACC has also taken action to combat rogue Internet pharmacies by, among other things, working with credit card companies to discourage banks from processing payments for rogue Internet pharmacies. IACC officials told us that they collect information on websites that market counterfeit and otherwise illegal products from trademark and copyright holders, including four brand-name prescription drug manufacturers. IACC then provides this information to credit card companies so that they can take action against banks that process payments for these rogue Internet pharmacies. (See fig. 4.) Under their terms of service, credit card companies can fine or take other enforcement actions against banks that process payments for merchants involved in illegal activities. In addition to private efforts to block services to rogue Internet pharmacies, drug manufacturers maintain surveillance programs to identify and investigate the marketing of counterfeit versions of their brand-name prescription drugs and share their findings with federal agencies. In doing so, they monitor web activity to identify rogue Internet pharmacies, and employ investigators to gather evidence against rogue operators. On the basis of their investigations, these manufacturers provide federal agencies, such as ICE and FDA, with investigative leads and information that may support existing investigations. In addition, manufacturers have also provided CBP with information to better target illicit drug imports and with brochures to help CBP officials differentiate between legitimate and counterfeit prescription drugs. Several stakeholders also help facilitate information sharing between drug manufacturers and federal agencies on rogue Internet pharmacies. The Pharmaceutical Security Institute, an association of 26 drug manufacturers focused on sharing information related to counterfeit prescription drugs, collects and analyzes surveillance information from its members and, according to an official from the institute, helps them share information with federal agencies about the illicit marketing of counterfeit prescription drugs by rogue Internet pharmacies. The National Cyber- Forensics & Training Alliance—an organization that facilitates public- private information sharing on cybercrime—also works with drug manufacturers to share information with federal agencies. Officials said that the alliance collects information from the manufacturers and performs additional intelligence gathering to provide agencies with actionable investigative leads, such as the identities and locations of operators. FDA and stakeholders have taken steps to educate consumers about the dangers of buying prescription drugs from rogue Internet pharmacies and how to identify legitimate ones; however, these efforts face challenges. In September 2012, FDA launched a national campaign called “BeSafeRx: Know Your Online Pharmacy” to raise public awareness and educate consumers about the risks associated with purchasing prescription drugs on the Internet. The campaign provides information about the dangers of purchasing drugs from rogue Internet pharmacies, how to identify the signs of rogue Internet pharmacies, as well as how to find safe Internet pharmacies. FDA officials told us that the agency plans to direct the same messages to health care professionals and assess the campaign’s effectiveness in the future. Some federal agencies and stakeholders have also taken steps to educate consumers about the risks of purchasing prescription drugs online and provide tools to help consumers identify legitimate and rogue Internet pharmacies. For example, CBP, DEA, and FTC post information on their websites regarding the dangers of purchasing drugs online. NABP publicly releases the results of its review of Internet pharmacies quarterly, which most recently showed that 97 percent of the over 10,000 Internet pharmacies that it reviewed were out of compliance with federal or state laws or industry standards. NABP also warns consumers not to buy from websites that are on its publicly available list of rogue Internet pharmacies, and posts information on its website to educate consumers about how to safely buy medicine online. The association directs consumers to purchase medicines from legitimate Internet pharmacies that it has accredited through its VIPPS program; as of May 1, 2013, NABP’s website listed 32 VIPPS-accredited Internet pharmacies. To assist consumers in more readily identifying legitimate online pharmacies, NABP also plans to launch a new top-level domain name called .pharmacy by the end of 2013. The association intends to grant this domain name to appropriately licensed, legitimate Internet pharmacies operating in compliance with regulatory standards—including pharmacy licensure, drug authenticity, and prescription requirements—in every jurisdiction that the pharmacy does business. LegitScript also helps consumers to differentiate between legitimate and rogue Internet pharmacies. It regularly scans the Internet and, using NABP’s standards, classifies Internet pharmacies into one of four categories: (1) legitimate, (2) not recommended, (3) rogue, or (4) pending review. When visiting their publicly available website, consumers can enter the website address of any Internet pharmacy and immediately find As of May 1, 2013, LegitScript had classified LegitScript’s classification.259 Internet pharmacies as legitimate and therefore safe for U.S. consumers, on the basis of NABP standards. Despite the actions of agencies and stakeholders, consumer education efforts face many challenges. Many rogue Internet pharmacies use sophisticated marketing methods to appear professional and legitimate, making it challenging for even well-informed consumers and health care professionals to differentiate between legal and illegal Internet pharmacies. For example, some rogue Internet pharmacies advertise that customers need a prescription in order to purchase drugs, but allow customers to meet this requirement by completing an online questionnaire at the time of sale. Other Internet pharmacies may fraudulently display a VIPPS-accreditation logo on their website, despite not having earned the accreditation, or may fraudulently display Visa, MasterCard, PayPal, or other logos on their website despite not holding active accounts with these companies or being able to process such payments. Figure 5 displays a screenshot of a rogue Internet pharmacy website that may appear to be legitimate to consumers, but whose operators pled guilty to multiple federal offenses, including smuggling counterfeit and misbranded drugs into the United States. Some rogue Internet pharmacies seek to assure consumers of the safety of their drugs by purporting to be “Canadian.” Canadian pharmacies have come to be perceived as a safe and economical alternative to pharmacies in the United States. Over the last 10 years, several local governments and consumer organizations have organized bus trips to Canada so that U.S. residents can purchase prescription drugs at Canadian brick-and- mortar pharmacies at prices lower than those in the United States. More recently, some state and local governments implemented programs that provided residents or employees and retirees with access to prescription drugs from Canadian Internet pharmacies. Despite FDA warnings to consumers that the agency could not ensure the safety of drugs not approved for sale in the United States that are purchased from other countries, the prevalence of such programs may have contributed to a perception among U.S. consumers that they can readily save money and obtain safe prescription drugs by purchasing them from Canada. Many rogue Internet pharmacies seek to take advantage of this perception by purporting to be located in Canada, or sell drugs manufactured or approved for sale in Canada, when they are actually located elsewhere or selling drugs sourced from other countries. Educational efforts also need to overcome issues related to consumer demand for these drugs. Many consumers mistakenly believe that if a drug may be prescribed for medical use, it is safe to consume regardless In addition, of whether they have a prescription for that particular drug.other pressures, including consumers’ desire to self-medicate, their wish for privacy related to obtaining lifestyle medications (such as drugs for sexual dysfunction), and relatively high out-of-pocket costs for brand- name drugs may fuel a demand among consumers to purchase prescription drugs from rogue Internet pharmacies. While educational efforts attempt to overcome these challenges, their success thus far is unknown—in part, because the volume of drugs purchased from rogue Internet pharmacies is unknown, making it difficult to assess whether educational efforts have been effective at reducing such purchases. We provided a draft of this report for comment to HHS, DOJ, and DHS, and we provided excerpts of this report for comment to USPIS and NSF. We received technical comments from HHS, DOJ, and DHS, which we incorporated as appropriate. We are sending copies of this report to the Department of Commerce, the Department of Health and Human Services, the Department of Homeland Security, the Department of Justice, the Department of State, the Federal Trade Commission, the Internal Revenue Service, the National Science Foundation, the Office of Management and Budget, and the United States Postal Inspection Service, as well as other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or crossem@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Other key contributors to this report are listed in appendix III. 2. Alliance for Safe Online Pharmacies 3. American Medical Association 5. Center for Safe Internet Pharmacies 6. Center for Telehealth and e-Health Law 7. Eli Lilly and Company 8. Federation of State Medical Boards 10. Generic Pharmaceutical Association 12. Google Inc. 14. Internet Crime Complaint Center 16. MasterCard International, Incorporated 17. Merck & Co., Inc. 19. National Alliance for Model State Drug Laws 20. National Association of Attorneys General 21. National Association of Boards of Pharmacy 22. National Association of Chain Drug Stores 23. National Community Pharmacists Association 24. National Cyber-Forensics & Training Alliance 25. National Science Foundation grant recipient Damon McCoy, Assistant Professor, George Mason University Computer Science Department 26. Partnership for Safe Medicines 29. Pharmaceutical Security Institute 30. Pharmaceutical Research and Manufacturers of America 31. Purdue Pharma L.P. 32. Takeda Pharmaceuticals U.S.A., Inc. 34. Visa, Inc. 35. WellPoint, Inc. Members of Congress have sponsored bills and other stakeholders have endorsed proposals to enhance regulators’ ability to both combat rogue Internet pharmacies and enhance the public’s ability to distinguish rogue Internet pharmacies from legitimate ones. This appendix provides a brief synopsis of federal legislation introduced in the 112th Congress, which ran from January 2011 to January 2013, and the 113th Congress, from January 2013 through June 2013, as well as proposals from stakeholders we interviewed. While some stakeholders broadly supported these proposals, others noted that because most rogue Internet pharmacies are operated from overseas, additional federal laws and authorities, such as those noted below, would have a limited effect on their ability to combat rogue Internet pharmacies. Creating a Federal Definition of a Valid Prescription. Some Members of Congress and other stakeholders have proposed creating a federal definition of a valid prescription that applies to all prescription drugs. Currently, the only federal definition of a valid prescription applies solely to prescriptions for controlled substances. Although the Federal Food, Drug, and Cosmetic Act (FDCA) requires certain drugs to be dispensed upon a prescription of a licensed practitioner, it does not define how this requirement is to be met. Instead, each state’s pharmacy and medical practice acts define what constitutes a valid prescription. As such, when federal prosecutors pursue charges against operators of rogue Internet pharmacies that sell drugs without prescriptions that meet the FDCA’s prescription requirement, they must research the laws of each relevant state to determine which ones apply to their case. Proponents of a federal definition contend that such a definition would make it easier and less resource-intensive for federal and state investigators and prosecutors to gather evidence and build a case against rogue Internet pharmacy operators who sell drugs without valid prescriptions. Some contend, however, that such a definition would be of limited value. They note that, because rogue Internet pharmacy operations have increasingly moved components of their business abroad, they are beyond the boundaries of where such a law could be readily enforced. Additionally, those interested in promoting telemedicine have raised concerns that these proposals have too narrowly defined the circumstances for which prescriptions could be issued on the basis of legitimate medical examinations conducted via telemedicine. Developing a Comprehensive List of Legitimate Internet Pharmacies. Members of Congress have introduced legislation that would have required the establishment of a comprehensive list of legitimate Internet pharmacies. Other stakeholders, such as the Alliance for Safe Online Pharmacies, have also supported this proposal. Members of Congress and stakeholders have proposed that the Food and Drug Administration (FDA) would be responsible for establishing and maintaining the list. Proponents of a comprehensive list contend that it would help consumers, stakeholders, and federal and state agencies distinguish between legitimate and rogue Internet pharmacies. Although the National Association of Boards of Pharmacy (NABP) and LegitScript have tools on their websites that enable consumers to identify legitimate Internet pharmacies, some maintain that FDA management of the list is critical, and could help to inspire public confidence in the list. Others stated that a list created by a third party would be helpful, as long as it is endorsed by the FDA. However, FDA officials and other stakeholders have raised concerns about the agency’s ability to maintain such a list, given the large volume of new Internet pharmacies launched and modified every day. Additionally, FDA does not regulate the practice of pharmacy, which has long been regulated by the states. Finally, according to officials we interviewed from two stakeholders that provide services to Internet businesses, such a list is not necessary as their companies’ policies and procedures allow them to immediately suspend customer accounts once they become aware that such customers are violating their policies and procedures. Establishing a Safe Harbor for Companies That Provide Services to Internet-Based Businesses. Members of Congress have introduced legislation to provide legal immunity to companies—such as Internet registrars, search engines, and credit card processors—that ceased or refused to provide services to rogue Internet pharmacies when acting in good faith. Proponents state that protection from liability would encourage companies to block services to rogue Internet pharmacies. In addition, some told us that such immunity would allow them to more readily take action against suspected rogue Internet pharmacies. However, others doubted the necessity of such legislation. Officials from two companies we interviewed explained that their companies already have the right to refuse service to rogue Internet pharmacies and do not open themselves up to liability by doing so. Granting FDA New Subpoena and Seizure Authorities. Members of Congress have introduced legislation to grant new subpoena and seizure authorities to FDA. Agency officials stated the authorities would enable them to more rapidly investigate and take action against rogue Internet pharmacies.have enabled FDA to compel the attendance and testimony of witnesses and the production of records and other items for the purposes of any hearing, investigation, or other proceeding related to a suspected FDCA violation. Further, seizure authority proposed under this legislation would have provided FDA with the authority to take noncompliant drugs out of the supply chain. At present, FDA must obtain approval from the Department of Justice (DOJ) in order to issue a subpoena or to seize goods. According to FDA officials, the DOJ approval process can delay investigations and enforcement actions. Such delays may lead to the Subpoena authority proposed under this legislation would distribution of noncompliant drugs further into the supply chain and may make such products more difficult to locate and seize. Adopting a Track-and-Trace System for Prescription Drug Supply Chain. Members of Congress have introduced, and stakeholders such as the Intellectual Property Enforcement Coordinator have supported, legislation that would require FDA to implement a system to track, trace, and verify prescription drugs throughout the drug supply chain. In 2007, Congress required FDA to develop standards that would apply to such a system, as well as to develop a standardized numerical identifier that could be applied to prescription drugs during manufacturing and repackaging. In response, FDA issued guidance for industry, and hosted a public workshop on the topic. However, a nationwide track-and-trace system has not yet been implemented. Supporters of a nationwide track-and- trace system contend that it would enable federal agencies to more readily identify counterfeit or adulterated prescription drugs, as well as reduce the potential for counterfeit drugs to enter the supply chain, including through Internet pharmacies. FDA officials told us that while a track-and-trace system would benefit multiple stakeholders, it would likely not directly affect the operations of rogue Internet pharmacies because such enterprises sell counterfeit and adulterated drugs directly to consumers, which is not a distribution method that would be covered by a track-and-trace system. Marcia Crosse, (202) 512-7114, crossem@gao.gov. In addition to the contact named above, Geri Redican-Bigott, Assistant Director; Michael Erhardt; Cathleen Hamann; Jason Kelly; Lisa Motley; Patricia Roy; and Lillian Shields made key contributions to this report. Prescription Drug Control: DEA Has Enhanced Efforts to Combat Diversion, but Could Better Assess and Report Program Results. GAO-11-744. Washington, D.C.: August 26, 2011. Intellectual Property: Observations on Efforts to Quantify the Economic Effects of Counterfeit and Pirated Goods. GAO-10-423. Washington, D.C.: April 12, 2010. Cybercrime: Public and Private Entities Face Challenges in Addressing Cyber Threats. GAO-07-705. Washington, D.C.: June 22, 2007. Intellectual Property: Better Data Analysis and Integration Could Help U.S. Customs and Border Protection Improve Border Enforcement Efforts. GAO-07-735. Washington, D.C.: April 26, 2007. Internet Management: Prevalence of False Contact Information for Registered Domain Names. GAO-06-165. Washington, D.C.: November 4, 2005. Anabolic Steroids Are Easily Purchased Without a Prescription and Present Significant Challenges to Law Enforcement Officials. GAO-06-243R. Washington, D.C.: November 3, 2005. Prescription Drugs: Strategic Framework Would Promote Accountability and Enhance Efforts to Enforce the Prohibitions on Personal Importation. GAO-05-372. Washington, D.C.: September 8, 2005. Internet Pharmacies: Some Pose Safety Risks for Consumers. GAO-04-820. Washington, D.C.: June 17, 2004. Internet Pharmacies: Adding Disclosure Requirements Would Aid State and Federal Oversight. GAO-01-69. Washington, D.C.: October 19, 2000.

Summary: The Internet offers consumers a convenient method for purchasing drugs that is sometimes cheaper than buying from traditional brick-and-mortar pharmacies. According to a recent FDA survey, nearly 1 in 4 adult U.S. Internet consumers have purchased prescription drugs online. However, many Internet pharmacies are fraudulent enterprises that offer prescription drugs without a prescription and are not appropriately licensed. These rogue Internet pharmacies may sell drugs that are expired, improperly labeled, or are counterfeits of other drugs. A number of federal and state agencies share responsibility for administering and enforcing laws related to Internet pharmacies, including state boards of pharmacy, FDA, DOJ, CBP, and ICE. The Food and Drug Administration Safety and Innovation Act directed GAO to report on problems with Internet pharmacies. This report identifies (1) how rogue sites violate federal and state laws, (2) challenges federal agencies face in investigating and prosecuting operators, (3) efforts to combat rogue Internet pharmacies, and (4) efforts to educate consumers about the risks of purchasing prescription drugs online. To conduct this work, GAO interviewed officials from FDA, DOJ, CBP, ICE, and other federal agencies, reviewed federal laws and regulations, and examined agency data and documents. GAO also interviewed officials from five state boards of pharmacy with varied approaches to regulating Internet pharmacies, and stakeholders including NABP, drug manufacturers, and companies that provide services to Internet businesses, such as payment processors. Rogue Internet pharmacies violate a variety of federal and state laws. Most operate from abroad, and many illegally ship prescription drugs into the United States that have not been approved by the Food and Drug Administration (FDA), an agency within the Department of Health and Human Services (HHS), that is responsible for ensuring the safety and effectiveness of prescription drugs. Many also illegally sell prescription drugs without a prescription that meets federal and state requirements. Rogue sites also often violate other laws, including those related to fraud, money laundering, and intellectual property rights. Rogue Internet pharmacies are often complex, global operations, and federal agencies face substantial challenges investigating and prosecuting those involved. According to federal agency officials, piecing together rogue Internet pharmacy operations can be difficult because they may be composed of thousands of related websites, and operators take steps to disguise their identities. Officials also face challenges investigating and prosecuting operators because they are often located abroad. The Department of Justice (DOJ) may not prosecute such cases due to competing priorities, the complexity of these operations, and challenges related to bringing charges under some federal laws. Despite these challenges, federal and state agencies as well as stakeholders have taken actions to combat rogue Internet pharmacies. Federal agencies have conducted investigations that have led to convictions, fines, and asset seizures from rogue Internet pharmacies as well as from companies that provide services to them. FDA and other federal agencies have also collaborated with law enforcement agencies around the world to disrupt rogue Internet pharmacy operations. The Department of Homeland Security's (DHS) U.S. Customs and Border Protection (CBP) and U.S. Immigration and Customs Enforcement (ICE), which are responsible for enforcing laws related to the importation of goods such as prescription drugs, have also worked with other agencies, including FDA, to interdict rogue Internet pharmacy shipments at the border. Given that most rogue Internet pharmacies operate from abroad, states have faced challenges combating them, and generally focus their oversight on licensed in-state entities that fulfill orders for rogue Internet pharmacies. Companies that provide services to Internet-based businesses, such as search engines and payment processors, have also taken action--primarily by blocking services to them. FDA and others have taken steps to educate consumers about the dangers of buying prescription drugs from rogue Internet pharmacies. FDA recently launched a national campaign to raise public awareness about the risks of purchasing drugs online, and the National Association of Boards of Pharmacy (NABP) posts information on its website about how to safely purchase drugs online. However, rogue Internet pharmacies use sophisticated marketing methods to appear legitimate, making it hard for consumers to differentiate between legitimate and rogue sites. HHS, DOJ, and DHS provided technical comments on a draft of this report, which GAO incorporated as appropriate.