The Protocol to Eliminate Illicit Trade in Tobacco Products: Questions and Answers


8.2 What are the key elements in an effective tracking and tracing regime for tobacco products?

Tracking and tracing regimes for tobacco products[13] would require the following elements:

  • A serialized unique identifier for each package of tobacco products. The unique identifiers are a distinctive combination of numbers, letters or both that are unique for each pack/item. They cannot be used twice and are not predictable. For instance, passports use a combination of letters and numbers that is unique for each person. The attribution of this combination identifies each person and is not predictable (for example incrementing numbers such as 1,2,3,4,5). Digital Mass Encryption is a widely used method to make codes less predictable and prevent unauthorized access by establishing a very large population of possible codes, of which only a proportion are valid and used. Valid codes can only be generated if mathematic formula (algorithms) and secret keys that are used for their creation are known. Generation and encryption that is part of a tobacco industry patent should be excluded. The representation of the identifier on the package can be human readable (letters or numbers) or machine-readable (barcodes).
  • In addition to the serialized unique identifier, a data carrier is also required with a serialized unique identifier and other information available at the time of manufacturing, such as place and time of manufacture. The data carrier should comply with quality standards (to avoid extracting incorrect data or to access the data even if a portion of the carrier is damaged), be readable by authorized agencies of any Party to the Protocol and suitable for high-speed production lines. Two-dimensional bar codes, for instance, are an open standard technique, suitable for use on high-speed production lines, readable by inexpensive equipment (including handheld scanners and smart phones) and widely used on many consumer products in an international environment.
  • A link and parent-child relationships (called aggregation) between different packaging units that allow, for instance, traceability of pallets without scanning all master cases, cartons and packs that are inside the pallet. In Brazil, for instance, a parent-child relationship exists for the packs and cartons of exported cigarettes.
  • Recording of any shipping and receiving events along the supply chain, for instance the departure of a pallet from the manufacturing site and its arrival at trader X in country Y. International standards from the International Organization for Standardization should be recommended for the capture and exchange of data and events.
  • International standards are recommended for key information (such as the manufacturing facility, product description, time of manufacture, intended retail market) that are encoded in the data carrier (Article 8§4.2 of the Protocol). For example, a Global Trade Item Number (GTIN) is a unique and internationally recognized identifier for a product. The GTIN may be eight to 14 digits long and is encoded in the data carrier to reveal the product description when scanned.[14]
  • The storage of data and events along the supply chain in an independent database controlled by competent government authorities. At global level, we expect a multitude of national and/or regional databases that should be interconnected to facilitate international inquiries by competent authorities. Similarly, access to and retrieval of this data should also be independent of the industry, traders and distributors.

8.3 What are the costs of implementing a tracking and tracing scheme and who funds its development?

The cost of the track and trace system in Brazil has been estimated at US$ 0.016 per pack[15] and in Kenya at US$ 0.023 per pack.[16] In both countries, legislation stipulates that costs will be borne by the tobacco industry; this is in line with Article 8 (Track and Trace), paragraph 14 of the Protocol. In Brazil, the manufacturers only pay for maintenance after the system is installed and working. The manufacturers can deduct the US$ 0.016 from their federal tax bill. The maintenance cost of the system represents less than 1% of the retail price of the cigarettes.

If governments consider bearing the costs, they can be reduced by using solutions available from multiple suppliers.

8.4 What falsehoods on tracking and tracing are endorsed by the tobacco industry?

The tobacco industry’s solution for tracking and tracing is misleading and ineffective.

The industry solution is called Codentify. In fact, Codentify is not a tracking and tracing system, but is a code generator system installed at the production line that creates unique codes on packs. Codentify uses elements of production-related information (such as production line and time of production) to generate with a secret “key” an unpredictable and unique encrypted 12-character combination of letters and numbers to identify and authenticate a pack of cigarettes. The number, linked to a digital signature, can be read by a human or by a computer. By capturing the human-readable code or scanning a machine-readable code, a code verification computer program will determine whether the code is correctly formed or not. If the code is correctly formed, the program can retrieve associated trace information from a database (e.g. details of first customer). Cartons, master cases and pallets use unique non-encrypted codes to identify the packages, rather than Codentify codes. This combination of Codentify codes on the packs and other codes on the secondary package units is presented as a tracking and tracing system and is endorsed by the major transnational cigarette companies.

Codentify was invented and developed by Philip Morris International, but has been endorsed by the three other Transnational Tobacco companies, BAT, JTI and Imperial Tobacco, since 2010. The Codentify system is not a transparent or open source system and might have features that only the tobacco industry is aware of. It serves the tobacco industry’s interests, is managed and controlled by the tobacco industry and protected by a tobacco industry patent.[17] Opting for Codentify would be opting for a “black box” system with no guarantee that it is under the control of the Parties. According to the WHO FCTC Secretariat, the Codentify system conflicts with the FCTC Protocol and does not meet the requirements of Article 8.2 that the tracking and tracing system should be “controlled by the Party”.[18]

The Codentify system was designed by the industry to address the issue of counterfeit tobacco, a minor part of the illicit trade problem. The issue of tax evasion by tobacco industry or cross-border smuggling form a larger proportion of the illicit trade than counterfeit tobacco. Unlike issues of counterfeit pharmaceuticals, all forms of tobacco are harmful to human beings including counterfeit tobacco. Even in its limited role with counterfeiting, Codentify is an ineffective means of authentication because the codes are visible and easy to forge. In fact the so-called validity codes generated by this system can be easily cloned, recycled or migrated, particularly if the tobacco industry itself was involved in the illicit trade.

Civil society groups have voiced their concerns in this regard and additional information can be found in two fact sheets.[19]


13.FCTC, Analysis of the available technology for unique markings in view of the global track and trace regime proposed in the negotiating text for a protocol to eliminate illicit trade in tobacco products, FCTC/COP/INB-IT/4/INF.DOC./1. European Commission: ЕАНС/2013/Health/ll Final Report Concerning the Provision of an Analysis and Feasibility Assessment Regarding EU systems for Tracking and Tracing of Tobacco Products and for Security Features, Brussels, March 2015.

14.For more information: click in this link

15.Marcelo Fish, Brazil Scorpios. System for Control, Track and Trace Cigarette Production, Federal Revenue Secretariat - Brazil, April 2014.

16.Caxton Masudi Ngeywo, Kenya Revenue Authority. Kenya’s experience in implementing and financing a tracking and tracing system. Presentation at the WCTOH, Abu Dhabi. 17 March, 2015

17.Joossens L, Gilmore AB. The transnational tobacco companies’ strategy to promote Codentify, their inadequate tracking and tracing standard. Tob Control 2013;:tobaccocontrol – 2012–050796. doi:10.1136/tobaccocontrol-2012-050796 FCTC. 6th Conference of the Parties to the WHO Framework Convention. Secretariat study of the basic requirements of the tracking and tracing regime to be established in accordance with Article 8 of the Protocol to Eliminate Illicit Trade in Tobacco Products. Executive Summary, White Paper. Moscow: 2014.

18.FCTC. 6th Conference of the Parties to the WHO Framework Convention. Secretariat study of the basic requirements of the tracking and tracing regime to be established in accordance with Article 8 of the Protocol to Eliminate Illicit Trade in Tobacco products.

19.Factsheet about the Agreement between the EU and Philip Morris International.