Authors: Brian Krebs
Tags: #Political Science, #Security (National & International), #Business & Economics, #Industries, #Computers & Information Technology, #Pharmaceutical & Biotechnology
Kimberly from Virginia was a GlavMed buyer who self-prescribed but received a refund after complaining she was unhappy with her purchase. She and her husband were having trouble conceiving a child. He was frequently gone on long military deployments, and she was anxious to get pregnant before her husband left for another year-long stint abroad. A nurse by profession, Kimberly said she’d decided to order the fertility drug Clomid online because she knew that it was what a fertility doctor would prescribe.
“I basically knew how to use it and what I was supposed to do, and instead of having to pay a doctor tons of cash to explain something I already knew how to do, I opted to do it myself,” Kimberly explained. “It’s not like I just ordered from the first site that popped up. I looked around and saw one specific site pointed to by so many other sites.”
A few weeks later, a brown envelope arrived via post, with markings from India on the package. The Clomid pills were in the familiar blister packaging, but she noticed they were stamped with an expiration
date that had already passed. She insisted on a refund and received it without delay. Ironically, she discovered she was pregnant just a few days after receiving the refund—no pills necessary.
But she says her inbox has been inundated with spam ever since she ordered the drugs online, and she remains concerned that the people who run the online pharmacy are going to push fraudulent charges through to her credit card.
“They’ve spammed me a million times since then,” Kimberly said. “I know that obviously wasn’t the best idea for me to order these drugs online, but I was desperate at the time. I’m really glad I didn’t take the medication. It probably would have hurt the baby I already had inside of me.”
Vishnevsky confirmed that people are often inundated with spam after ordering from or responding to junk email offers. That’s because addresses of known buyers are a valuable commodity frequently resold or simply stolen by other hackers and spammers. (Recall how Vishnevsky’s own list of two billion email addresses was left on McColo’s servers. That list was downloadable by anyone who happened to discover the correct link needed to grab the file.)
But Vishnevsky said it’s a common misconception that ordering from online pharmacy sites will result in credit card fraud. None of the spammers for SpamIt, GlavMed, or any other pharmacy spam program allow affiliates to view customer card data, he said, because they want to keep that information for themselves.
“Only administrators of [the] pharma program would see that, and they have no benefit to getting fraud on [the] card, because [the] merchant would risk losing [their card processing] account” as a result of increased chargebacks and fraud claims, he said.
Most of the buyers I reached who fit into this category declined to be interviewed. Also, all of them had ordered from sites run by affiliates
working for Vrublevsky’s Rx-Promotion, which had carved out a niche as one of the few rogue pharmacy affiliate programs that marketed and sold painkillers, stimulants, and other substances whose distribution is heavily controlled by authorities in the United States and elsewhere. (Records show that GlavMed also offered controlled pills for the first two years of its existence, but it was no longer selling controlleds when I began this project.)
Goran was a forty-one-year-old former prisoner of war from Eastern Europe, now living in the United States, who badly injured his back almost twenty years ago. Doctors long ago stopped prescribing him hydrocodone, so he spends between $250 and $500 a month buying it off the Internet along with tramadol, even though doing so is a felony in his state. Records leaked from Rx-Promotion show that Goran made several purchases throughout 2010.
Goran told me he’s been happy with his purchases so far, and that they work about as well as the drugs prescribed by his doctor to keep the pain at bay. He said the online drugs typically ship from Hong Kong and arrive in blister packs wrapped in a sealed ziplock bag.
Without the pain meds, he said, he’d be unable to manage his transportation business. “In this country, if you don’t work, you know what you are?” he asked. “You’re homeless.”
Goran may be taking the pills for legitimate back pain, but I suspected many others were not. Interestingly, the GlavMed database shows telltale signs of abuse among customers who ordered controlled substances during the years that the affiliate program was selling them. I shared the GlavMed customer data with Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, who ran a series of queries on the database to see if any immediate patterns became clear.
“What we found is that if you were a GlavMed customer who made more than five orders, there was an 80 to 85 percent chance that you bought tramadol or Soma,” Warner said. “The question is, were they
buying it for personal use or for resale? These are pills that have a street value of about five dollars per pill, which means that if you ordered a bottle of these pills through GlavMed and sold them one by one, you could have made about $1,300 profit per bottle.”
The UCSD researchers with whom I shared the Rx-Promotion sales data also found strong indications that a major driver of revenue for that rogue pharmacy was repeat customers. The team found that sales of painkillers and other drugs that are highly restricted in the United States produced 48 percent of all revenue for the Rx-Promotion program.
“The fact that such drugs are over-represented in both Rx-Promotion (and, for drugs like Soma and tramadol, in SpamIt) reinforces the hypothesis that abuse may be a substantial driver for this component of demand,” the UCSD team wrote in a research paper on their findings.
For the most part, I was unable to learn firsthand from the people I interviewed about the efficacy and safety of the drugs they received from GlavMed or Rx-Promotion sites. Nearly everyone I spoke with promised to mail a pill or two from the packages they’d received, but only one interviewee actually followed through. That package contained both knockoff Viagra and another drug that were in the same bag and got crushed together and badly contaminated.
So while I’d gotten some good information on why people were ordering these drugs and perpetuating the spam problem, I decided that to make sense of the GlavMed and Rx-Promotion affiliate and client data, I needed help from Warner and several other prominent academic researchers with the capability and facilities to test these drugs. What I didn’t know at the time was that these researchers had been trying to discover the same thing on their own, only to be stymied by miles of red tape and the pharmaceutical industry itself. I was also about to discover the much darker, more sinister consequences of these online drug buyers’ choices.
8.
Again, while leaked ChronoPay emails show otherwise, Vrublevsky denies co-owning Rx-Promotion, but admits that ChronoPay did process payments for the pharmacy program. Gusev has publicly denied running SpamIt, but again, the evidence suggests otherwise.
Chapter 5
Less than twenty-four hours after Christmas 2006, Marcia Bergeron succumbed to poisons mixed into several medications she had ordered from a supposedly Canadian pharmacy online. Her body was discovered by a neighbor, and more than a hundred generic pills were found in her home, including a sedative, an anti-anxiety drug, and acetaminophen.
Bergeron, a fifty-seven-year-old resident of Quadra Island in British Columbia, Canada, had started losing her hair and experienced blurred vision in the days before her death. According to the coroner’s report, “Mrs. Bergeron had been suffering from a range of symptoms. In emails to a friend, she described symptoms of ongoing nausea, diarrhea, aching joints, and other issues. Her friends locally were aware she was losing her hair and having vision problems. In the days immediately prior to her death, she was extremely fatigued and sick.”
An autopsy report showed that Bergeron had been slowly poisoned by extremely hazardous chemicals included in the pills, which the Coroners Service of British Columbia said were ordered from an online pharmacy.
Toxicology tests indicated that many of the pills contained dangerously high levels of heavy metals that had probably been used as filler
or were trace elements from a contaminated production facility. Among the chemicals included in the pills were uranium and lead, both of which can be lethal or severely damaging even in small doses.
It remains unclear which rogue Internet pharmacy program sponsored the site from which Bergeron ordered. Drugs purchased by GlavMed and other rogue pharmacy partnerships are marketed as if they come from pharmacies in Canada, which is world-renowned for its affordable medications. But most of the drugs from GlavMed appear to have been shipped from a half-dozen pharmacies or suppliers in India, a nation that is also now among the world’s largest sources of legitimate branded and generic medications. The rest seem to have come from more than forty manufacturers and suppliers in China, India, and Pakistan, some of whom appeared to resell legitimate, branded drugs at bargain basement prices and some who didn’t. The one that Bergeron used clearly didn’t.
India has the brains, manpower, and infrastructure to manufacture huge quantities of pills each year, and it has fostered a booming, $10 billion-a-year pharmaceutical industry even though the country has routinely denied the patents for many drugs made by Western drugmakers.
As Vikas Bajaj and Andrew Pollack wrote for the
New
York
Times
in March 2012, India’s conflict with Western drug companies over patents dates back to 1970, when the country stopped granting drug patents. It resumed granting them in 2005 as part of an agreement with the World Trade Organization, but the agreement was not retroactive to medicines created before 1995.
Since then, the
Times
notes, India has emerged as the world’s pharmacy and, in recent decades, has been the largest provider of cheap, generic lifesaving medicines in poor countries across the globe. Western drugmakers have charged that by limiting drug patents in specific cases and fostering the development of inexpensive, generic knockoffs, the Indian government and the pharmaceutical industry there are stifling innovation and reducing profits that are essential to continued research and development on lifesaving drugs. The Indian drug companies say
their practices ensure that poorer nations maintain affordable access to drugs for scourges like HIV and cancer.
Indeed, in one high-profile legal showdown, the Indian drugmakers faced off against Swiss pharmaceutical giant Novartis in a legal battle over whether Indian firms could continue to produce generic copies of Gleevec, a drug that provides effective treatment for some types of leukemia. As the
New
York
Times
notes, Gleevec can cost as much as $70,000 per year, while Indian generic versions have sold for about $2,500 a year. In late March 2013, the Indian Supreme Court ruled that the patent that Novartis sought for Gleevec did not represent a true invention.
The problem is that India’s admirable, if self-serving fight to produce affordable generic drugs for the rest of the world does not address the safety and efficacy of these non-brand drugs. But to hear the U.S. pharmaceutical industry tell it, any prescription drugs produced outside the so-called “approved supply chain” are counterfeit at least, probably substandard, and quite possibly harmful or lethal. Whether or not that’s always the case, the U.S. drugmakers are right about one thing: most drugs sold by rogue online pharmaceutical companies are not produced in regulated facilities—and therefore pose serious risks to anyone who decides to take them.
The statistics about the rogue pharmaceutical industry—and their implications for the health of its customers—are truly terrifying. According to the World Health Organization, approximately 8 percent of the bulk drugs imported into the United States are counterfeit, unapproved, or substandard, and 10 percent of global pharmaceutical commerce—or $21 billion—involves counterfeit drugs. A study led by the
International
Journal
of
Clinical
Practice
(
IJCP
) published in 2012 puts the number at more than three times that amount. The
IJCP
study estimates that global sales of counterfeit medicines doubled in the five years between 2005 and 2010, and now exceed $75 billion. The Alliance for Safe Online Pharmacies estimates that 30,000 to 40,000 active
online drug sellers operate at any given time, and that only a fraction are legitimate.
Pharmaceutical giant Merck recently analyzed more than 2,500 Internet pharmacies and found that more than 80 percent of those sites were selling their drugs without requiring a prescription. Online pharmacies run by pharmacy affiliate networks like Rx-Promotion and GlavMed-SpamIt never asked customers to produce a prescription, although legitimate online pharmacies selling prescription drugs to Americans must by law require a prescription. What’s more, Merck discovered that nearly six hundred of those pharmacies were selling the drugs at a price below the lowest wholesale average price available to any market anywhere, strongly indicating that the drugs were counterfeit—and very possibly unsafe.
Many people who bought from Rx-Promotion and SpamIt-affiliated online pharmacies expressed surprise at receiving their pills in packages showing that they were shipped directly from India and China. But according to a 2010 report from the U.S. Government Accountability Office (GAO), that’s where the vast majority of drugs you buy from your corner drugstore are also produced. The GAO found that roughly 80 percent of the raw ingredients that go into all pharmaceuticals—including those peddled by rogue online pharmacies, approved online pharmacies, and even Main Street vendors like CVS and Walgreens—come from chemical factories based in India and China.
The problem isn’t that these drugs are produced outside North America for U.S. and Canadian consumers. The issue is that it’s unclear whether the suppliers that rogue pharmacy operations like SpamIt and Rx-Promotion use are supplying branded and generic medications to the supply chain for pills sold at legitimate and approved pharmacies in the United States and abroad—and, more importantly, whether the drugs they’re creating are safe or not.