Digital danger: a review of the global public health, patient safety and cybersecurity threats posed by illicit online pharmacies

Abstract

Background

Amidst the rise of e-commerce, there has been a proliferation of illicit online pharmacies that threaten global patient safety by selling drugs without a prescription directly to the consumer. Despite this clear threat, little is known about the key risk characteristics, central challenges and current legal, regulatory and law enforcement responses.

Sources of data

A review was conducted of the English literature with search terms ‘online pharmacies’, ‘Internet pharmacies’, ‘cyber pharmacies’, ‘rogue pharmacies’, and ‘e-pharmacies’ using PubMed, JSTOR, and Google Scholar from 1999–2005.

Areas of agreement

Illicit online pharmacies are a rapidly growing public health threat and are characterized by a number of complex and interrelated risk factors.

Areas of controversy

Solutions are varied and are of questionable utility in the face of evolving technology that enables this form of transnational cybercrime.

Growing points

Legal, regulatory and technology solutions must address the entire illicit online pharmacy ecosystem in order to be effective.

Areas timely for developing research

There is a critical need to build international consensus, conduct additional research and develop technology to combat illicit online pharmacies.

Background

In January 1999, Soma.com became the first pharmacy to operate via the Internet and sell medicines directly to the consumer.¹ More than a decade later, a great deal has changed in the online pharmacy landscape with the precipitous rise of e-commerce, digital health offerings, direct-to-consumer healthcare, and the globalization of pharmaceutical production and supply. This rapid growth and expansion has created a perfect storm that now fuels an online marketplace where an estimated 35 000 online pharmacies operate globally.² However, this uncontrolled proliferation of online pharmacies has also introduced significant public health and patient safety concerns given the parallel emergence of illegal, illicit and ‘rogue’ online pharmacies that violate national and international laws and regulations.³ In fact, illicit online pharmacies are a far more common occurrence in the digital sphere than legitimate ones, with Internet security firms estimating that 96% of all global online pharmacies actually operate illegally by failing to adhere to regulatory and safety requirements and are ergo in violation of professional, legal and ethical principles.²

In order to better understand this phenomenon, it is important to delineate different classifications of online pharmacies that have been identified in the literature.^3-5 These include: (1) established chain and large retail pharmacies that operate online (e.g. CVS.com) or operate online portals for mail-order pharmacy services, (2) other brick-and-mortar pharmacies or establishments that also have an online presence, and (3) stand-alone online pharmacies that solely operate online.^4,6 Within the context of these three classifications, there are also two broader categories that characterize the legality of Internet pharmacy operations: ‘legitimate’ and ‘illicit’ online pharmacies.

Legitimate online pharmacies are described as websites that comply with both the laws and regulations of the country where the online pharmacy website operations occur and the destination to where the pharmaceutical products are shipped to the end consumer.⁵ Online pharmacies share many benefits enjoyed by other e-commerce businesses (e.g. convenience, 24/7 accessibility, price transparency, greater consumer privacy when making transactions and potentially greater availability of products) and can also improve access to medications for disabled and/or housebound patients who may lack mobility and have difficulty accessing a brick-and-mortar pharmacy.^7,8

Major drugstore/pharmacy companies are investing in online infrastructure, and there has also been an expansion and greater consumer utilization of legitimate online pharmacies in certain European countries that allow prescription medicines to be sold online (which has been followed by the adoption of a common EU logo to protect consumers).⁹ For instance, CVS has been a market leader in the online pharmaceutical market among the brick-and-mortar pharmacies. CVS acquired Soma.com in 1999, renaming it CVS.com, growing its market presence over the years, by 2004 accepting electronic prescriptions, and most recently acquiring the pharmacies associated with the large US retailer Target Corporation.^10,11

Conversely, ‘illicit’, ‘illegitimate’ or ‘rogue’ online pharmacies are defined as those pharmacies that either fail to meet national or international pharmacy regulations or have not been subjected to requisite regulatory review, licensure and/or certification, and are most commonly found in Category 3 and above.¹² A common practice of illicit online pharmacies is advertising the sale of a prescription drug without the need to provide a valid prescription (also known as no-prescription online pharmacies.) Importantly, these illicit ‘no-prescription’ online pharmacies present clear and significant patient safety risks as consumers can inappropriately self-diagnose/self-prescribe for their conditions, engage in medically unnecessary or overprescribing behavior, use online pharmacies to engage in substance abuse and/or potentially encounter drug-to-drug interactions, contraindications or side effects that can be exacerbated when a healthcare professional is not involved in treatment decisions/consultations.^7,13

Moreover, illicit online pharmacies may market products using fraudulent or misleading health claims, offer the sale of unapproved/illegal versions of drug products and may not be appropriately licensed or qualified to dispense prescription medicines.^7,9 This constellation of risk factors introduces a significant potential for harm to the health and safety of consumers and has been coined as a form of ‘digital iatrogenesis’ within the patient safety literature (i.e. ‘preventable patient harm resulting from injury that occurs from use of information, services or products delivered or enhanced through the Internet and related technologies’).¹⁴

One of the chief concerns regarding the Internet trade of medications is the association between illicit online pharmacies and the sale of what the World Health Organization (WHO) defines as substandard (i.e. genuine medicines not meeting quality specifications), spurious, falsely labeled, falsified (i.e. fake medicines that are intentionally made to look real or authorized) and counterfeit (SSFFC) (i.e. that are fraudulently mislabeled with respect to identity or source) (collectively ‘SSFFC’) medical products.^4,7,15-19 Online sale of SSFFC medicines introduces unique patient safety risks, including patient injury resulting from purchase of substandard, spurious, counterfeit, and falsified medicines, as well as medical errors that can result from illegally dispensing falsely labeled or otherwise unsafe drugs.

Importantly, the international SSFFC trade has been globalized by the Internet, leaving consumers who purchase medicines online running the risk of experiencing adverse outcomes, not receiving treatment (due to lack of active ingredient), overdose or even death.^15,17 Other non-health-related risks are also present, including consumer fraud, breach of privacy, stealing of personal data and possible infection of a personal computer with malware/viruses.⁷ Illicit online pharmacy networks enable the worldwide distribution of the fake medicines trade by acting as a virtual marketing and distribution channel bypassing regulatory controls through direct interaction with the consumer.

Similar to other forms of illegal trade and criminal activity, it is difficult to determine the exact numbers of illicit online pharmacies in operation at any given time, assess the quality and safety of products that are sold or determine the exact volume of medicines being purchased and traded online internationally.⁷ Consequently, it is even more challenging to determine the true impact that illicit online pharmacies have on global public health and patient safety. Previous reviews on this subject have focused on specific drug classes, online supply issues, characteristics of websites, analytical methods to assess the quality of medicines purchased online and consumer and product characteristics.^7,8,20 The purpose of this review is to conduct a multidisciplinary assessment in order to identify risk characteristics, key challenges and different approaches that have attempted to combat this illicit digital trade in medicines.

Sources of data and selection criteria

In order to fully explore the complex and multifaceted challenges faced by illicit online pharmacies, we conducted a literature review for journal articles, original research, case reports, commentaries and news reports indexed in three scholarly databases. This included conducting key search term queries on PubMed (Medline), JSTOR and Google Scholar, for English-language articles published between 1999 and 2015, which contained the words ‘Internet pharmacy(ies)’, ‘cyber pharmacy(ies)’, ‘online pharmacy(ies)’, ‘rogue pharmacy(ies)’, ‘e-pharmacy(ies)’ in the Title/Abstract field using advanced search function settings. We excluded literature discussing: (1) legitimate use of Internet-based technologies for provisioning of services by clinical and retail pharmacies and health systems; (2) studies reporting use of online platforms for education about pharmacies or pharmacy practices, use of the Internet for patient care services and healthcare management and use of online pharmacies under experimental conditions; (4) articles primarily addressing telemedicine and Internet-based prescribing/dispensing; (5) articles focusing on the regulation of online pharmacies selling veterinary medications; (6) articles examining online sales of illicit substances, over-the-counter (OTC) drugs, complementary medicines, herbal remedies and supplements; and (7) other literature that did not specifically address illegal online drug sales (e.g. web-assisted platforms for public health/patient-centered interventions). We note that the online sale of illicit drugs, OTC products and other non-prescription health products introduce their own unique health risks (including the sale of illicit drugs in the ‘dark web’ and studies that have found undeclared active pharmaceutical ingredient in dietary supplements) necessitating separate study.^21,22

We also excluded sources of information included in the gray literature including technical reports/guidance from government agencies, news reports from media outlets (i.e. non-scientific sources), information from non-governmental organizations/patient advocacy groups/security companies, pending and enacted legislation on the subject, and information from government and drug regulatory agency websites. However, if a gray literature source was specifically referenced in a peer-review publication or was very recent, we investigated it further for possible inclusion. This inclusion and exclusion criteria was utilized with the goal of selecting central publications that could help us describe key characteristics and challenges associated with illicit online pharmacies as reported in the scientific, medical, social science and legal/policy literature. We also wished to identify legal, regulatory and law enforcement responses as reported in the literature and how they uniquely attempt to address this complex public safety problem. We note that we did not conduct a systematic review of this subject, but instead relied on prior reviews, including a 2011 systematic review conducted by Orizio et al.,⁷ in order to focus on recent and key issues in the field.

A visual description of how we conducted the literature review is provided in Figure 1 accompanied with an analysis of Google trend keywords associated with online pharmacies as discussed in the ‘Google trends analysis’ section below.

Fig. 1.

Literature search methodology and Google Trends analysis.

Key characteristics and challenges of illicit online pharmacies

As the marketplace for illicit online pharmacies has expanded, the risk factors expose patients worldwide to significant safety and security threats. Illicit online pharmacies thrive in a digital environment that provides benefits of anonymity, rapid advancement of technology (including the ease of creating and marketing a website) and insufficient international regulation.¹³ Despite these clear threats, key information of how these websites operate, their long-term viability and how they change their business practices to remain competitive over longer periods of time is limited. However, recent studies that have conducted longitudinal observational studies provide some insight into operational trends of online pharmacies.

For example, a 2013 study by Fittler et al. ⁵ tracked 136 online pharmacy sites over a 4-year period and found that most were illegal or ‘rogue’ sites. It also found that 41.2% were continuously operational, and those who acted illegally were able to stay in business longer than other sites reviewed.⁵ A 2013 study by Veronin and Clancy which specifically tracked ‘Canadian Internet pharmacies’ (i.e. many illicit online pharmacies claim to be of Canadian origin though are located in a different country¹⁶) over a similar 4-year period found that approximately half (50.4%) had not changed, with the remaining either non-functioning, had moved to new URLs or redirected to other online pharmacy sites.²³ Other studies examined by the review conducted by Orizio et al. ⁷ have found varying lengths of website existence depending upon specific Internet pharmacy characteristics. These preliminary findings underscore the urgent need to conduct longer and more robust longitudinal online surveillance research in order to answer basic questions regarding how long illicit online pharmacies are able to operate, how groups of websites may be interrelated and whether operating illegally is a factor in relation to site survivability.

Diversity of therapeutic classes available on the internet

One of the most alarming patient safety concerns regarding online pharmacies as highlighted in the literature is the availability of a wide spectrum of therapeutic classes of drugs including for infectious diseases, non-communicable diseases, so called ‘lifestyle’ conditions, controlled substances/drugs of abuse, life-saving medicines (i.e. used to treat diseases that carry high morbidity/mortality and/or drugs that are included on the WHO Essential Medicines List) and even medicines that lack requisite regulatory approval for human consumption. This includes several original research articles that have examined and reported the online availability of prescription opioid analgesics, controlled stimulants, sedatives, antidepressants, antibiotics, cardiovascular disease medications, anti-obesity drugs, antidepressants (i.e. SSRIs), novel psychoactive substances (e.g. tropicamide,) contraceptive devices/drugs, insulin, vaccines, performance and image-enhancing drugs and other ‘lifestyle drugs’, phosphatidylcholine injections, dermatological medications, hormones, drugs subject to recall, drugs yet to be approved or scheduled and others^7,24–38 The systematic review by Orizio et al. ⁷ found that a host of generic and branded drugs have been reported as marketed for sale online and that no-prescription pharmacies often carried virtually all types of drugs. The representation by illicit online pharmacies that they are able to carry such robust drug inventories is a clear risk factor for substandard/falsified medicines exposure, given that even drugs subject to critical shortage in the legitimate drug supply chain, have been identified as actively marketed for sale online.³⁴

Consumer behavior and access

Several research articles, surveys, commentaries and news reports have attempted to better understand the underlining motivations and consumer behaviors that drive demand for illicit online pharmacy services. A primary component of this demand is the growing ubiquity of digital health (which now includes the Internet, social media platforms and mobile devices) and increased data access (e.g. a 2011 study by Jena and Goldman found an association between growth in high-speed Internet access and US prescription drug abuse) that has led to an increasing percentage of users who now use Internet-based technologies in order to search and retrieve health information.^13,39,40 Consumers then use this information to aid in healthcare decision-making and self-diagnosis, with a smaller percentage of these users deciding to purchase their medicines in this same online environment. In fact, Pew Internet surveys have found that 72% of online adult users in the USA actively search for health information online (with a separate Pew survey finding that 35% also use the Internet to self-diagnose).^41,42 A separate survey by the US Food and Drug Administration also found that 23% of adult online consumers have purchased drugs online.^13,43

Greater adoption of digital health technology also coincides with fundamental shifts in consumer health behavior, including patients increasingly self-diagnosing their conditions and choosing the convenience of an online pharmacy that sells drugs without a prescription in lieu of a face-to-face consultation with a healthcare professional.⁴⁴ No-prescription online pharmacies cater to these changing behaviors, with many deploying online ‘medical questionnaires’ in place of requiring valid prescriptions for dispensing to the consumer.^7,44 These medical questionnaires often lack any form of validation/standardization and are mostly used to ease consumer apprehension rather than actually assessing health status.^7,45 Online pharmacies also utilize ‘cyberdoctors’ who obtain patient information from online medical questionnaires and use this to fill prescriptions virtually.⁸ Use of cyberdoctors raises several concerns, including raising the fundamental question of whether a legitimate physician/patient relationship has been established, whether medical staff are appropriately licensed or trained, whether the person reviewing the online questionnaire is actually a physician or not and whether a sufficient patient evaluation has actually occurred to ensure appropriate dispensing.⁸

Primary motivating factors that lead consumers to shop with online pharmacies include perceived lower cost (although some studies have identified higher prices from online pharmacies for certain classes of drugs and additional costs not associated with the drug's price), convenience (i.e. 24/7 website availability), greater patient autonomy and perceived privacy from shopping online.^7,24,44 Complicating online health seeking and purchasing behavior are studies reporting low health literacy among potential consumers even when there are clear characteristics of patient safety risks present.^3,13,43,46

Furthermore, with the ubiquity of digital health applications, websites, insurance systems and even consultations going online, consumers may fail to prioritize checking authenticity when utilizing search engines to seek out and purchase healthcare products.⁴⁷ This extends to purchasing medicines online, where consumers may lack education and awareness of the steps needed in order to ensure that an online pharmacy is legitimate, has the requisite license and is located within their country of origin. With one click access to tens of thousands of online pharmacies and unlimited products to choose from, it is crucial for consumers to investigate whether the convenience outweighs the inherent risks of purchasing medicines online. However, confirming the veracity of an online pharmacy is also conflated by the use of falsified seals and fraudulent licensure information and accreditations, which may lure consumers into a false sense of security.^4,7 Further complicating this calculus are studies that have found the sophisticated use of marketing tactics by illicit online pharmacies used to mislead customers regarding the legality and safety of their products/services and studies that indicate that health-related risks (drug quality and prescription requirement) rank last in consumer risk perception.^{4,7,13,48–52,54}

Utilization of digital marketing

Illicit online pharmacies are particularly savvy with Internet marketing strategies including search engine optimization, search engine marketing, use of affiliate marketing networks and engaging in social media marketing.^{4,7,48,53–55} Common health marketing strategies used by illicit online pharmacies include: multichannel marketing campaigns, misleading forms of marketing that appeal to the aforementioned consumer behaviors, patient testimonials and images designed to communicate medical creditability/legitimacy, fake logos or seals, use of spam and other forms of direct-to-consumer advertising and even utilizing popular business-to-business platforms such as Alibaba.com to expand their business operations.^{7,28,51,53,54–57} Risks of misleading marketing may also be amplified by failure to disclose important drug information, including labeled information about side effects, drug interactions, potential adverse effects and directions for use.⁷

Responding to the growth of the direct-to-consumer healthcare market, online pharmacies utilize argument-driven marketing bundled with false claims to make their service more attractive to consumers. For instance, argumentative marketing provides a set of ‘selling arguments’ that are distinct from the actual drug characteristics.^49–51 This strategy enhances aspects of the product or trade that are valuable to the consumer, while de-emphasizing the risks. Ultimately, this creates an information gap for consumers, specifically de-emphasizing/omitting information, which is needed to make informed health decisions versus information that purely promotes the sale of a product. In a study of ~175 online pharmacies by Orizio et al.,⁴⁹ all of the sites reviewed marketed privacy and in a subset, more than half emphasized lower prices, shorter delivery times, more privacy and high-quality products. Finally, 77% required no prescription and >50% had a health questionnaire to ease potential consumers concerns.⁴⁹ While these strategies may be appropriate for sale of other commercial products, they remain secondary and even, at times, detrimental as vendor selection factors for health products where efficacy and safety are crucial.

Several studies have also examined the use of social media by illicit online pharmacies and have found high usage rates on popular platforms such as Facebook and Twitter.⁵⁴ This includes a 2015 study by from Tyrawski and DeAndrea,⁵⁵ which sampled social media content for the top 20 US pharmaceutical drugs and found that illicit online pharmacy content was found in 17% of all Facebook pages reviewed and illicit online pharmacy content was also disseminated in user-generated comments on Facebook and YouTube. A separate 2015 study by Katsuki et al. ⁵⁸ found that an alarming 76% of all tweets it analyzed containing a generic name for a controlled substance were associated with a single marketing affiliate who then linked to rogue online pharmacies selling controlled substances online. Furthermore, unlike other venues of the Internet that have exercised more enforcement actions (e.g. sponsored web advertisements/ search keywords), social media remains largely unregulated and freely accessible for use by questionable actors, including among them, illicit online pharmacies.^48,54

Google trends analysis

In order to augment findings explored in this review, we also conducted an analysis of Internet pharmacy key search terms using ‘Google Trends’ (which provides data that can be analyzed to assess popularity of search engine terms.) We analyzed three keywords associated with illicit online pharmacies: ‘Internet pharmacy’, ‘online pharmacy’, and ‘no prescription’ for the period from 2004 to January 2016. We further focused our analysis for the Google Trends subcategory ‘Health’, which was automatically assigned to the keywords of interest. The search term with the highest interest over this time period was ‘online pharmacy’. Our findings indicate that interest for Internet pharmacy-related keywords has actually decreased from 2004 to 2016 (Fig. 1). However, these findings may merely support the fact that consumers are engaged in more sophisticated searches and the use of specific and/or longer keywords. It may also reflect competitive pressures of marketing affiliates and online pharmacies who need to bid and compete in new search term domains, as generic terms, such as ‘online pharmacy’, become too general or over saturated from a search engine optimization and search engine marketing perspective (e.g. a similar analysis conducted on the keywords ‘Viagra no prescription’, ‘Viagra online’ and ‘buy Viagra online’ indicated overall sustained interest over the same time period.) Results may also reflect changing trends in consumer Internet pharmacy information seeking, marking a shift away from search engines and keyword searches as other forms of marketing exposure, such as social media, become more common as an online pharmacy marketing strategy.

Geographic locations and consumer demographics

A recent survey estimates that 80% of online pharmacies target English-speaking countries (like the USA and the UK), and approximately 10% target Japanese-speaking populations.² However, there is limited research available on where many of these illegal pharmacy operations are physically located. For example, a 2002 study found that Internet pharmacies were located in 13 countries and a 2009 study that analyzed 118 websites (81% which were no prescription) found that only 43% provided a precise location.^50,59 Research conducted by the private Internet monitoring and security company LegitScript via their 2015 survey found that the majority of illegitimate online pharmacies were hosting their content on US servers, a finding that mirrors that reported in the systematic review conducted by Orizio et al.⁷

However, geographic information may be of dubious quality given that studies have found that physical location reported by an online pharmacy may not match domain name registration information.⁷ Also, an Internet pharmacy may simply operate as a virtual portal for the consumer but may not correspond to an actual physical business location that is in use. This is reflected by studies that have found that the declared physical location of a website and actual location of the pharmacy operations often do not match.⁷ Additionally, since more of the world is reachable via mobile phones and Internet than ever before, online pharmacies are also reportedly beginning to grow in emerging markets.^3,13 Recent reports of large investments in new online pharmacies catering solely to populations in India (e.g. www.mChemist.com) and Pakistan reflect this growing trend and should be carefully monitored.

The demographics of users who actively shop with Internet pharmacies are also being explored. A 2003 study surveyed Internet pharmacy consumers and found that they were older than nonusers, had more prescriptions to fill and had higher healthcare expenditures.⁶⁰ Another study, which surveyed adult patients in an emergency department found that approximately 5% purchased medicines online and that most of them were on multiple medications but found no difference in age between those who purchased online and those who did not.⁶¹

The review by Orizio et al. ⁷ found that survey data on the topic was available between 2003 and 2010 but was predominantly from the USA (and also included Europe and South America) and was primarily used to investigate macro and micro consumer characteristics. Results varied but generally reported that the percentage of people purchasing medicines online ranges between 1 and 6% based on a variety of factors including types of drugs sought/purchased, sample population survey setting, age, education and income status, level of technology familiarity and whether the user was a substance abuser.⁷ These results provide important clues into what types of patients/consumers may be more likely to utilize online pharmacy services though it also indicates that there may not be a ‘single’ profile for an online pharmacy customer and that users are as diverse as the medications they seek out. More robust and representative samples are needed in order to further map out key characteristics of online pharmacy consumers.

Reflective of some of the identified consumer characteristics explored in surveys more than a dozen clinical case reports have identified patients directly adversely impacted by drugs purchased online. Examples include a 51-year-old registered nurse who presented to an emergency department and was diagnosed as suffering from new-onset congestive heart failure, after self-treating herself with drugs purchased online and a separate case report of an unintentional overdose of phentermine ordered over the Internet by a 20-year-old patient with a history of anorexia nervosa.^62,63 Other case reports further reflect the diversity of Internet pharmacy consumers, which encompass those as young as 18 and as old as 67 years, cases with a multitude of symptoms, conditions and diseases, several examples of addiction/substance abuse and reports of adverse events and even death due to self-administration by purchasing medicines online.⁷ The majority of these reported cases occurred in the USA, though also included patients located in Europe.⁷ However, case reports are a crude measure of incidence, with the majority of Internet pharmacy-related cases likely left unreported, even if resulting in an adverse outcome. Studies also indicate that illicit online pharmacies often target vulnerable population groups, including the disabled, elderly, those with low socioeconomic status and youth and adolescents (the later primary for the purposes of substance abuse).^4,64

Cybersecurity threats

Though the patient safety risks associated with illicit online pharmacies are arguably the most pressing societal concerns, cybersecurity and privacy issues are also important factors to assess in regards to consumer protection. This potential threat is reflected in a 2011 study that reviewed 60 online pharmacy websites and found that the majority (80%) had either critical or medium-level vulnerabilities that do not provide adequate protection for online consumers.⁶⁵ Similarly, the National Association of Boards of Pharmacy (NABP) found that 17% of Internet pharmacies examined in their study failed to provide a secure site.⁷ Furthermore, illicit online pharmacies have been associated with larger organized criminal networks that use email spam, viruses/malware/spyware and other cybersecurity threats to engage in financial fraud and data phishing activities.^3,13

Computer science researchers have also conducted empirical analysis to further explore how online marketing affiliate networks, forum and social spam, malware, payment processors and use of botnets act as key tools in this form of health-related cybercrime.^66–68 Additionally, in LegitScript's 2016 annual report, a key finding was the centralized affiliation of illicit online pharmacies. The report highlighted that only 3% of illicit online pharmacies were independent or the ‘sole or primary Internet presence for a particular prescription medicine seller’.² This suggests that there are approximately 125–150 networks, or groupings, of Internet pharmacies that represent >90% of the entire illicit online pharmacy market.² Findings that Internet pharmacy networks are centralized or rely upon certain Internet service provider (ISP) networks are similar to those by Levchenko et al. and McCoy et al., which have identified a small number of banks that are critical to payment processing for online pharmaceutical sales.^66,69 Finally, an emerging area of concern is the anonymous sale of prescription drugs in the dark web through Tor (an anonymizing software that encrypts computer IP addresses) and the ability for consumers to transact purchases using the anonymous cryptocurrency BitCoin.^21,70

Data collection methodologies

Data collection methods to determine availability and access to prescription drugs via illicit online pharmacies primarily focused on different strategies of conducting web-based searches and surveillance though other methodologies were also utilized. Methods observed included: (1) conducting surveillance and content analysis of web forums (where individual users post comments and experiences about availability of prescription drugs from online pharmacies); (2) web surveillance through querying search engine results and content coding online pharmacy websites using structured keyword searches, meta-search engines or cross-section study designs; (3) conducting content analysis of illicit online pharmacies by searching other information sources (e.g. email spam, websites listing or rating online pharmacy information); (4) experimental designs testing health literacy of respondents for illicit online pharmacy dangers; and (5) the use of survey instruments on potential online consumers and patients.^{7,24,30,50,59,61,71,72} Two relatively unique study designs included creation of fictitious illicit online pharmacy content to test health literacy of undergraduate students in relation to clear risk factors and a separate study that created a fictitious illegal online pharmacy advertisement to measure potential consumer exposure to social media marketing.^46,48

Discussion

Key challenges

Our review of the scholarly literature addressing illicit online pharmacies uncovered a host of risk characteristics and ongoing challenges that have yet to be sufficiently addressed, a state of affairs that continues to put patients all around the world at risk. Despite continued lack of knowledge on key characteristics, concerns regarding the proliferation of online pharmacies are not new, with risks to patient safety recognized for more than a decade. Though public awareness, research and policy attention has increased, the online pharmacy economy continues to thrive, with up to 20 new illegitimate pharmacies reportedly becoming ‘live’ each day in 2015.²

Given that the Internet is a somewhat chaotic collection of voluntary networks that lack governance by any central multilateral body, it is not surprising that solutions aimed at combatting this illicit digital trade in medicines have been elusive.¹³ In fact, international organizations such as the WHO, UN Office on Drugs and Crime (UNODC) and the International Criminal Police Organization (Interpol), specifically recognize the threat posed by illicit online pharmacies, which provide a digital platform for illegal manufacturers and criminal networks to engage in the transnational distribution and sale of SSFFCs.^13,15 This is exemplified by the fact that drugs purchased via no-prescription online pharmacies often originate from overseas markets other than where the intended consumer resides.⁵⁷

Commentary and law/policy-related articles also expressed concerns about the lack of sufficient enforcement, legislation and regulatory harmonization needed in order to adequately protect consumers from the globalization of online pharmacies and their use of misleading direct-to-consumer advertising that is transmitted via Internet technologies.^4,13 Reflecting this gap in global governance and international law, a report issued by the WHO surveying its Member States on the topic found that 66% of countries had no legislation that either explicitly allowed or prohibited Internet pharmacy operations (with only 19% of those that regulated the practice prohibiting it.)^3,13

Attempts to reign in the uncontrolled expansion of online pharmacies has been an ongoing challenge in the USA, since 1999, when the Clinton administration first announced efforts to regulate online pharmacies.^1,73 Since then, a number of legislative attempts to address the problem have been explored but with limited success.^4,56 For example, recent US antipiracy legislation that included provisions that would have regulated online pharmacy marketing practices was promptly defeated due to public backlash related to non-health issues associated with piracy, copyrights and other consumer goods.⁷⁴ The debate also extends to regulatory approaches pursued in other high-income countries/regions such as the European Union, Australia and Canada, which have specifically called for enactment of new rules, legislative reform and international cooperation to address the issue.^{3,4,13,56,75,76}

The inherent complexity of the illicit online pharmacy ecosystem introduces several challenges in tackling this issue from a legal and law enforcement perspective.¹⁶ Specifically, illicit online pharmacy operations include the participation of various legal and illegal actors that collectively participate in an interconnected but also fragmented online e-commerce environment that ‘both’ enables medicine sales online and allows purveyors to avoid regulation and enforcement.^5,13 This ecosystem includes actors in different sectors that supply, create and drive demand, including ISPs (who provide the infrastructure and services to support e-commerce platforms and websites), sources of SSFFC medicines (who act as manufacturers, suppliers and traders for medications sold by online pharmacies), online marketing sources (that actively market the services/products of online pharmacies to consumers), other e-commerce service providers (i.e. shipping companies, banks and credit card processors) and of course the actual end user consumer who is the ultimate source of demand and payment (Fig. 2.) Hence, any effective solution must address all stakeholders who are participants in this ecosystem and include broad international participation.

Fig. 2.

Internet ecosystem for illicit online pharmacies.

Current responses

Local, national, regional and international law enforcement organizations have attempted to combat and control the distribution of SSFFC medicines via illicit online pharmacies. The majority of the literature on enforcement activities has been related to addressing the online availability of controlled substances and opioid analgesic agents (e.g. hydrocodone, oxycodone, codeine and tramadol.)⁷¹ This is not surprising given the death of 17-year-old US teenager Ryan Haight in 2001, which led to the passage of the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (RHA) that prohibits the online sale of controlled substances and is administered by the US Drug Enforcement Agency.^4,56 However, commentaries have been critical regarding the effectiveness of RHA and its lack of regulation of emerging forms of health and social media marketing now popular among youth and adolescents.^56,58

In the USA, a prime example of law enforcement efforts against illicit online pharmacy operators includes convictions pursued by the US Department of Justice (DOJ) against owners of online and mail-order pharmacies including RxNorth.com and Canadadrugs.com (the later implicated in the detection of counterfeit anticancer drug Avastin in US oncology clinics).^77,78 Individual US states have also fined domestically based online pharmacies, including a $15 000 fine levied against an Internet pharmacy in Missouri that was owned by a former US House of Representatives candidate in 2000.⁷⁹ However, these targeted enforcement efforts appear to have limited impact. In 2015, LegitScript conducted 29 online test buys from the illegal online market, more than half of which were shipped from India utilizing the US Postal Service. Most importantly, none of the test buys of illicit pharmaceuticals entering the USA were intercepted by the US Customs reinforcing the need for stricter regulations and improved enforcement strategies and screening technologies.⁵⁹

Globally, the Council of Europe's Medicrime Convention is the only internationally legally binding criminal law instrument that attempts to address the counterfeiting of medical products and similar crimes involving threats to public health.⁸⁰ The Medicrime convention was recently entered into force in January 2016, following ratification by five countries but is also open to all countries. Importantly, the convention also emphasizes the risk of Internet sales of medicines and considers them ‘aggravating circumstances’ when applying sanctions to offenses under the convention.⁸¹ Separately, other policy commentators have focused on developing a ‘model law’ or a special international-led technical working group to specifically address Internet-based medicines crime and transnational cybercrime related to online pharmacies.^17,82

An example of global law enforcement activities against online pharmacies is Interpol's ‘Operation Pangea’. This is an operation coordinated by Interpol in an international week of action aimed at tackling the online sale of SSFFC medicines sold internationally. In its first year, Operation Pangea was only coordinating in 10 countries, and in its second year reported taking down 237 websites illicitly selling medicines. Reflective of the transformed digital marketplace for online pharmacies, in its eighth year, Operation Pangea coordinates with over 235 agencies and 115 countries working together to seize a reported 20.7 million fake and illicit medicines and shutting down 2410 websites (Fig. 3).⁸³

Fig. 3.

Figure depicting number of illicit online pharmacies reported in various sources and number of illicit online pharmacies removed by Interpol Operation Pangea (2000–2015).

There have also been significant efforts to combat online pharmacies via online verification schemes, seals, certifications and most recently a newly approved pharmacy generic top-level domain name.⁸⁴ As early as 1999, the US NABP has operated its Verified Internet Pharmacy Practice Sites (VIPPS) program in an effort to certify and accredit online pharmacy quality via inspections and other forms of oversight.^16,85 The program conducts surveys and site inspections and provides certified pharmacies a display of the VIPPS seal on their websites. The seal was intended to be a key benchmark for consumers to measure the pharmacy's quality practices and ensure consumer safety. While the NABP VIPPS program is not a codified state-based regulation, it nevertheless allows verification, certification and private oversight of online pharmacies that voluntarily pursue VIPPS accreditation. Furthermore, NABP reserves the power to suspend VIPPS participation in the event of website non-compliance and in conjunction with state pharmacy licensure boards.⁸⁶ Interestingly, several commentators in the literature have expressed a preference for the greater adoption of VIPPS over broader government regulation of the Internet.^1,87

The European Commission has also introduced a new logo for its member states to determine which online medicine retailers are safe under the Falsified Medicines Directive.⁸⁸ The logo meets specific technical, electronic and cryptographic requirements for verification of authenticity provided in the directive and is adaptable to different languages of its Member States.⁸⁸ To verify the authenticity of the pharmacy, the consumer clicks on the logo and is redirected to the entry of the pharmacy on the national list. The logo went into effect in July 2015, and each of the member states contributes to keeping an updated list of verified legitimate pharmacies. As a new initiative, the effectiveness and the potential impact of the EU common logo is not yet known.

While logos, with appropriate consumer awareness and verification processes, can be effective in enabling consumers to differentiate between safe and illegitimate pharmacies, these logos also carry the risk of misuse as detailed by a report prepared by the Alliance for Safe Online Pharmacies—European Union and the US Government Accountability Office.^16,89 In part, due to reports of such misuse, the recently launched a .pharmacy generic top-level domain has been touted as a more secure measure than accreditation seals—which has been funded by pharmaceutical companies and supported by several community organizations.⁹⁰ The .pharmacy gTLD represents a dedicated name space on the Internet administered by NAPB, where only pharmacies that meet NAPB standards and applicable international pharmacy laws will be able to register a second-level domain (subdomain) on the .pharmacy top-level domain.⁹⁰

Further, within an impersonal e-commerce space, the role of the third-party verification programs and aggregators has been seen successful in other industries but struggles to scale for the online pharmaceutical market. While some resources, such as the ones described above, are currently available to patients and consumers shopping for medicines online, their market penetration has been low,  potentially because they are new, not well known and have yet to be adequately embedded into web technology. An alternative consumer-enabling approach could be to develop dedicated search engines or web tools that only index verified and accredited online pharmacies (e.g. using LegitScript's online verification database or NABP's.pharmacy domain). These technologies would meet consumers where they search for health information and could provide vital real-time verification regarding the safety and authenticity of an online pharmacy.

Finally, several studies have called for increased health communication, promotion and education initiatives to better inform the public about the dangers of purchasing medicines online and what warning signs to look for.⁴⁶ A summary of the key risk factors that should be reviewed by consumers before purchasing from an online pharmacy is listed in Table 1. However, a recent 2016 article by Anderson et al. ⁹¹ found that key stakeholders involved on the issue of illicit online pharmacies have had limited effectiveness when disseminating consumer awareness information, often did not have dedicated consumer awareness content on the issues and also found that only half had media planning strategies to measure the effectiveness of their outreach programs. This suggests that even though consumer education and awareness is broadly recognized as a key strategy in stemming demand for illicit online pharmacy services, there is little concentrated effort or funding dedicated to these activities.

Table 1.

Key risk characteristics of an online pharmacy

Website markets the sale of a prescription drug product without the need to provide a prescription or offers to use an online medical questionnaire in lieu of a prescription Website does not provide complete or identifiable contact information or provide a physical location for its business Website operates outside of the country you reside and does not have accreditation or appropriate licensure to operate in your country Websites lacks a verifiable pharmacy license in the country it operates, does not have VIPPS accreditation (USA consumers), does not have EU common logo (EU consumers) and/or is listed as ‘rogue’ or ‘unapproved’ on the LegitScript database1 Website offers medicine prices that are substantially lower than average market value

Conclusion

Illicit online pharmacies are a serious and immediate threat to patients seeking healthcare and medicines globally. While legitimate online pharmacies provide many benefits including convenience and privacy, the proliferation of illicit online pharmacies with their attendant risks of patient injury or even death has made purchasing medicines via the Internet an extremely dangerous practice. On reviewing the literature, we find that: (1) the prevalence of illicit online pharmacies has grown rapidly and continues to pose a substantial threat to patient safety and public health; (2) the solutions to combat illicit online pharmacies are missing a focus on innovative technologies and the need for harmonized international regulations that evolve rapidly with the evolution of e-commerce and Internet technology; and (3) there is a critical need to build international consensus on a coordinated multistakeholder response to address the unique and complex threats posed by illicit online pharmacies in order to ensure the safety of patients globally.

Author Contributions

TKM conceived the review, TKM and GN conceived the design, analyzed and interpreted the data, and jointly wrote and edited the manuscript.

Conflict of interest statement

TKM is a non-compensated member of the academic advisory panel of the social welfare organization the Alliance for Safe Online Pharmacies. He also received funding for a separate project from ASOP through a pilot research grant exploring prescription drug abuse risks online. Funder had no role or input in the study. There was no involvement of anyone other than the authors in the conception, design, collection, planning, conduct, analysis, interpretation, writing, and discussion to submit this work. Authors report no other financial relationships with any organizations that might have an interest in the submitted work.