OpenLobby.EU
Explore

SURYS

Surys

Our goal is to inform the Commission about the security solutions (services & products) offered by SURYS for - Tax stamp systems including authentication and traceability, - ID & travel documents securisation, personalization and authentication - Brand Protection comprising authentication, identification, track & trace - Smart systems for smartphone authentication and traceability solutions using smart Apps - Vehicle registration documents and authentication solution such as windshield and car plates labels

Lobbying Activity

Response to Delegated act under Article 15(12) of the Tobacco Products Directive 2014/40/EU

2 Oct 2017

Surys is concerned that the draft guarantees neither independence from the tobacco industry nor security against illicit practices. It is also concerned that some aspects do not allow for a completely interoperable system using open standards. More specifically The draft allows producers to print the UI onto the product packaging, using an electronic file received from an independent issuer. Although the UI itself will no doubt be genuine, if producers are free to print it, there is nothing to stop them from printing the same UI multiple times – or not at all – or in such a poor quality that it is unreadable. With this solution, producers are therefore given a window of possible manipulation of the UI, which cannot be acceptable. Producers are required to verify the UI themselves. The verification system – although fitted with an anti-tampering device to prevent alteration of recorded entries – cannot detect multiple times printing of a UI (given that the non-compliant producer will only record one of the printed UIs in the system). The system will also not be able to detect a poorly printed UI or to raise the alarm over a pack carrying no UI at all. This involvement by producers in the printing, application and verification of the UI does not guarantee the independence of the system ; it does not comply with the WHO FCTC Protocol, which states that any delegation of Member State (MS) duties to the tobacco industry must be kept to the strict minimum. Therefore, Surys recommendation is that the UI should only be provided to the producer as a pre-printed, secured label, such as a tax stamp. The producer will then register the label on the production line before applying it to the product. THE DELEGATED ACTS SHALL BE MODIFIED ACCORDINGLY. Interoperability of the Traceability System: A concern related to interoperability is that the UI described in the draft is essentially a proprietary code and not a standard. It is not because the form of the code matches ISO that its content follows suit. This means that in order to ensure EU-wide interoperability, all MS will need to use this same proprietary encryption method. MS shall have the sovereign decision to select their solution while ensuring compliance with the FCTC Requirements.To guarantee interoperability between MS and independent system from Tobacco Industry, the UIDcode shall adopt international standard. We recommend to employ an eIDAS-based, trusted environment for the mutual recognition of signatures between all MS. The eIDAS regulation (Electronic Identity, Authentication and eSignature), which comes into force in Jan. 2018, was designed to create an environment of trust. This regulation will provide a solid foundation for alignment of all MS. The draft act currently only considers using eIDAS to ensure trusted and interoperable data exchange, but it should use it throughout the whole process: from UI generation, to data aggregation, to code inspection, and even to the smartphone-based checking of the UI and security features by consumers. THE DELEGATED ACTS SHALL BE MODIFIED ACCORDINGLY Secure Traceability Moving to the issue of security, SURYS main concern is that traceability (Article 15) is being viewed as a separate matter to security features (Article 16), without due attention given to the security required to protect the data carrier holding the UI itself. For any traceability solution to work in any industry the physical/digital combination is essential. If unsecured codes for track and trace are used in isolation, without integration into visible and covert security elements, this opens the door to valid codes being duplicated (or cloned) onto unauthorised products – since the codes may look the same and ostensibly perform the same function. To avoid this risk, data carriers should be equipped with physical security features.Alternatively – best method - the UI can be combined with the authentication elements on the same label or tax stamp.
Read full response

Response to Implementing act under Article 16(2) of the Tobacco Products Directive 2014/40/EU

2 Oct 2017

A key concern is that the draft requires only 1 out of the 5 authentication elements required on cigarette packs to be provided by an independent third party. So does this mean that the other 4 features can be produced and applied by the producers themselves, under their control? How can that be called an independent solution and how can the integrity of the solution be assured? Furthermore the preamble of the draft states that ‘The combination of different authentication elements should be required as an important step in guaranteeing that the integrity of the final security feature applied to a tobacco product is well protected’. But how can this combination happen if only one of the elements is sourced from a third party supplier? In our view, all 5 authentication elements should be provided by an independent third party. Another concern is that the draft is not prescriptive enough to ensure a harmonised framework of common security feature standards across the EU. All it requires is that each Member State communicates to producers the types of authentication elements allowed on unit packs, and that these include at least the 12 elements listed in the annex. So what does that mean? That as long as Member States have ‘communicated’ the allowed elements to manufacturers, those manufacturers are free to select their own features; each member state has a different label color for instance, to easily visually distinguish from one country to the other. There is also no measurable criteria by which supplementary authentication elements (in addition to those in the annex) are defined. The draft does not define any standard by which Member States have to abide when determining these supplementary elements. The draft also contradicts itself in that, on the one hand, its says ‘the technical standards for security features should give due regard to the high degree of innovation that exists in this area…’. Yet, on the other hand, it lists a set of incomplete and even ineffective security features in its annex: - Incomplete, because, for example, nowhere are holograms mentioned on the list. This omission is difficult to understand considering that holograms are a key high-security technology already used on tax stamps in 7 member states. This technology must therefore be included in this list in order for it to have any value; - And ineffective, because elements such as watermarks (which are also on the list) are only effective on items such as banknotes which allow the light to pass through them. It is clear from this draft that the security industry was barely listened to during stakeholder consultations, nor consulted during the implementation process. The draft should also be considered as constitutive of another breach to the Protocol, which clearly states in article 8-2 that: ‘Each Party shall establish […] taking into account their own national or regional specific needs and available best practice.’ The EU, as Party to the Protocol, should have sought to understand the specifics of tax stamps, and the reasons why 23 out of the 28 member states had implemented such programmes. It could have visited some of the production lines around the world – qualified as best international practices by the WHO –where tax stamps are used as traceability vehicles. THE ACTS AND THE ANNEX LIST OF SECURITY ELEMENTS SHALL BE MODIFIED ACCORDINGLY
Read full response

Response to Implementing act under Article 15(11) of the Tobacco Products Directive 2014/40/EU

2 Oct 2017

We are concerned that the draft guarantees neither independence from the tobacco industry nor security against illicit practices. With regard to the data repositories, we believe that producers are given too much room to choose their own data repository provider, since they will be the ones contracting with and paying the provider of the primary repository. This, in turn, leads to the problem of each provider of the primary repositories being able to ‘appoint among themselves’ a provider of the centralised, secondary repository into which the primary repositories are fed. In our view, the provider of the secondary repository should not be a provider of any primary repository, as this could lead to a possible conflict of interest between member state's objectives and those of the tobacco industry, as well as to issues relating to impartiality and supplier favoritism. We strongly recommend that it be the Member States that choose the data repository. Furthermore, we believe that a unique EU data repository, hosted by DG SANTE – as opposed to individual primary and secondary repositories – will do a more secure job of consolidating all UI’s into an interoperable solution that offers intra EU controls in real time.
Read full response