Critical Minerals – what’s the problem here?

Posted on May 28, 2022 by Paul Curwell

Paul Curwell

What are critical minerals anyway?

Critical minerals are defined by Geoscience Australia as “metals and non-metals that are considered vital for the economic well-being of the world’s major and emerging economies, yet whose supply may be at risk due to geological scarcity, geopolitical issues, trade policy or other factors” (2022). One category of critical minerals, ‘rare earth elements’ (listed below) are particularly important:

(Ga) Gallium
(In) Indium
(W ) Tungsten
Platinum-group elements (PGE) including
- (Pt) Platinum (Pt)
- (Pd) Palladium
(Co) Cobalt
(Nb) Niobium
(Mg) Magnesium

(Mo) Molybdenum
(Sb) Antimony
(Li) Lithium
(V) Vanadium
(Ni) Nickel
(Ta) Tantalum
(Te) Tellurium
(Cr) Chromium
(Mn) Manganese

The problem with critical minerals is their availabiilty: they are not distributed evenly throughout the world, and in some cases it is not economical to extract them using current technology. This is particularly the case with rare earths, where according to InvestingNews, the top 10 countries for rare earth production are:

1 China	6 India
2 United States	7 Russia
3 Myanmar	8 Thailand
4 Australia	9 Vietnam
5 Madagascar	10 Brazil

InvestingNews (2021)

Readers will note that some of the countries are subject to greater geopolitical risks than others – ranging from emerging to developed economies and sanctioned to non-sanctioned jurisdictions. One of Australia’s strengths is our proliferation of critical minerals and our geopolitical and economic stability. As shown in the following figure, Australia has critical mineral deposits distributed across the country:

Critical Minerals Supply Chain in the United States: Mapping the Landscape for Australian Suppliers (AUSTRADE, 2019)

As demands for the world’s critical minerals increase and supplies dwindle, rich countries will increasingly seek alternative sources. Deposits that were previously uneconomic to extract may become economical, whilst other countries may resort to war or coercion to achieve or maintain geostrategic advantage. Geoscience Australia has ranked Australia’s resource potential for critical minerals and their associated criticality (or scarcity):

Geoscience Australia (2022). Critical Minerals.

Understanding the criticality of raw materials is particularly important when assssing your supply chain threats and risks, as is understanding the geopolitical risks associated with the Critical Minerals value chain (refer figure below).

Geoscience Australia (2022) notes that some “category one and category two metals and semi-metals are primarily by-products of refining of the major commodities such as zinc, copper, lead, gold, aluminium and nickel”. Australia has abundant stockpiles for many of these commodities, however they are not always cost effective to extract. In the future, advances in processing techniques might mean these can be extracted in a highly targeted way at a cost that makes economic and environmental sense.

What industries use critical minerals?

Critical minerals underpin the world’s 4th Industrial Revolution as well as the high tech gadgets as well as enabling a green low-carbon, digitised economy. Without access to critical minerals, we would not be able to have our computers, phones, wind turbines, electric vehicles or solar panels that are decoming de rigueur in Australia and worldwide. Here are some lesser known examples and their applications:

Critical Mineral	Usage (examples, not exhaustive)
Yttrium	Ceramics (abrasives, jet engine coatings, oxygen sensors in cars, and corrosion resistant cutting tools) Electronics (microwave radar, dental and surgical procedures, digital communications, industrial cutting and welding, photochemistry, distance and temperature sensing) Metallurgy (superalloys, high-temperature superconductors)
Tantalum	Production of tantalum alloys, capacitors, compounds and metal Major end uses for tantalum capacitors include automotive electronics, mobile phones and personal computers Tantalum oxide is used in glass lenses and tantalum carbide is used in cutting tools
Germanium	Fibre optics, infrared optics, electronics and solar applications including solar cells for satellites

Critical Minerals Supply Chain in the United States: Mapping the Landscape for Australian Suppliers (AUSTRADE, 2019)

As you can see, the applications for critical minerals are diverse – without them, much the advanced civilisation we live in today would cease to function.

What are the security and supply chain risks for Australian companies?

Two principal security and supply chain risks associated with critical minerals are worth highlighting, both of which have a geostrategic flavour – (1) foreign ownership, control and influence, and (2) sanctions and trade embargo risks, as illustrated below:

Paul Curwell (2022) – adapted from AUSTRADE *Critical Minerals Supply Chain in the United States* (2019)

The Foreign Ownership, Control and Influence (FOCI) risks we have seen globally tend to materialise in two scenarios, outlined in the following table:

FOCI Risk	Risk Description / Scenario
Mining rights (licences) are held by a single company which controls a substantial percentage of production	This scenario is particularly applicable to Rare Earth Elements which are only found in a few locations around the world, hence global supply is very low in comparison to demand. In this case, a single company could conceivably control a substantial percentage of the production for a given rare earth element globally.
Ownership of multiple mines is held by shareholders of the same nationality (i.e. a concentration risk)	This effectively gives the parent country ‘control-by-proxy’ of critical minerals production, meaning the minerals can be exported under the guise of legitimate trading contracts to the parent country for stockpiling and / or use in manufacturing. Once extracted and shipped, there is no easy way of getting the minerals back, and the country which holds all the stockpiles effectively controls both market pricing as well its permitted end use (for example, military end-use export controls might be applied, effectively giving the controlling country a military advantage).

The second type of risk is sanctions and embargos risk. Historically, when we think of sanctions, trade embargos or even naval blockades it is typically on countries such as North Korea and Iran for their actions against the global community and internationally acceptable norms and behaviours.

As a source country for critical minerals, there is always the possibility that Australian companies or Australian exports could be sanctioned. However, two factors act in our favour to mitigate this risk with critical minerals:

First is global availability, being that critical minerals are either only located in specific geographic regions or can only be extracted in a way that makes economic sense from a small number of locations.
Second is the global balance of power. Whilst geostrategic power is shifting away from the United States, we are not yet at the point where other geostrategic players have sufficient power or leverage to impose meaningful sanctions or export restrictions at a large scale (note this does not mean that targeted, and even non-conventional forms of sanctions would not be possible or effective).

Another commonly used sanctions and embargo tool is the naval blockade would be very oenerous to enforce in a country such as Australia, which is so large and surrounded by navigable waters.

What can we do about it?

Like an increasing number of countries around the world, Australia has implemented foreign ownership and foreign investment restrictions to prevent the scenario arising whereby our mining companies or mining licences are owned by foreign investors either at issue or throughout their period of validity, without appropriate review. Additionally, we have introduced a range of foreign intereference laws to criminalise and help prevent actions by foreign governments and their proxies (including legal entities) from interfering in Australia’s sovereignty.

As with saw with trade restrictions on Australian exports, the management of sanctions, embargos and the like are much harder to mitigate. This is particularly the case where Australia sends extracted ore to a third country for processing and refining, which may then be purchased for re-import back to Australia. In this scenario, Australian manufacturers or businesses are immediately exposed to potential sanctions risks. One way to mitigate this is to conduct mineral processing and refining here in Australia, allowing Australia to export refine material as well as to use it directly in Australian manufacturing.

If there is one positive thing that can be said for the COVID-19 pandemic (aside from introducing more flexible working practices), it is that the supply chain disruptions have really refinforced the need for Australia to expand our domestic manufacturing capability and the need to be less reliant on other countries for our critical supplies and services in the Australian psyche. Understanding where security, geopolitical (country) and resilience risks lie in your supply chain, and implementing appropriate risk treatments, is critical for every Australian business.

Vendor Fraud: what is it?

Posted on April 16, 2022 by Paul Curwell

Paul Curwell

Are there fraud risks associated with vendors?

Every public and private sector organisation today has a requirement to outsource some or all aspects of their operations, whether it be purchasing supplies or equipment, engaging a managed (outsourced) service provider to run its IT helpdesk or security operations centre, our purchasing tangible products or raw materials for its operations. Managing these capabilities takes a lot of effort and typically requires a specialist team aside from the procurement function to manage key relationships day to day.

We all know that relationships are difficult by their nature, and business relationships are no different to those in our personal lives. Sometimes, however, relationships deteriorate substantially to the point of potential litigation or where those relationships may be severed. Common triggers for this includes upstream supply or quality control issues, breaches of confidentiality, and fraud.

What is fraud?

The Commonwealth Fraud Control Policy defines fraud as ‘dishonestly obtaining a benefit, or causing a loss, by deception or other means’. As defined here, a benefit can be non-material or material benefit, tangible or intangible. Benefits may also be obtained by a third party. Examples of fraud relating to vendors include:

theft
accounting fraud (e.g. false invoices, misappropriation)
causing a loss, or avoiding and/or creating a liability
providing false or misleading information
failing to provide information when there is an obligation to do so
misuse of assets, equipment or facilities
making, or using, false, forged or falsified documents
wrongfully using confidential information or intellectual property.

Business to business fraud is a problem which remains largely off the radar – many businsess have problems with their vendors or business partners, but these rarely end up in court or in the media. Frequently, even when a business relationship goes wrong, the parties to the relationship still need each other and will work to rebuild trust that has been lost where an alternate supplier or partner is not available.

One important note on vendors is that they form part of your organisation’s inner circle: they are trusted insiders who, by virtue of this status, have privileged access to your organisation, its products, information, services, systems, facilities and people beyond that of the ordinary public. It is critical that vendors be considered as part of your Insider Threat Management Program, as well as in your Supply Chain Security, Integrity and Fraud Program. Where there are overlaps in coverage in these programs, this should be harmonised.

Associations with irreputable vendors can also damage your organisation’s reputation, and potentially introduce the risks of civil or criminal action as well as shareholder activism. One example here is where a vendor is involved in modern slavery, and your organisation’s due diligence program has not detected this in advance.

Photo by Rolled Alloys Specialty Metal Supplier on Pexels.com

What is the vendor fraud landscape?

Vendor fraud can be defined as fraud involving a vendor that occurs at any point in the supplier process, which is:

Supplier selection
Contracting
Operations
Termination

The Association of Certified Fraud Examiners (ACFE) notes that vendor fraud can occur in anything from billing to delivery of supplies, and can be broadly grouped in two categories. Vendor frauds involving trusted insiders, such as employees and contractors, can occur indepedent of the vendor or in collusion with them. There are also various types of vendor frauds perpetrated without the involvement of insiders. These range from what we might call ‘soft frauds’, such as subtly charging the wrong hourly rate or claiming travel expenses when not applicable, through to more serious problems like product substitution. A high level taxonomy of vendor fraud is shown below:

Vendor frauds involving insiders	External vendor frauds
Billing schemes (invoicing)	Labour fraud schemes (for outsourced services)
Corruption schemes (e.g. kickbacks, bribery, conflicts of interest)	Travel fraud schemes
	Fraud schemes involving materials
	Shell companies and pass through schemes
	Hidden subcontractor schemes

ACFE – high level vendor fraud taxonomy

As you can see, there is a wide spectrum of vendor frauds – the ACFE’s training course on vendor fraud, referenced below, is a great starting point for someone new to this area. Some are specific to particular types of work – such as labour and travel fraud schemes more prominent with the outsourcing of services.

Vendor fraud versus supply chain integrity: what’s the difference?

As the focus of @forewarnedblog is on protection and integrity of critical technologies, supply chains, IP, products, brands and marketplaces, I would be remiss if I did not cover vendor fraud schemes involving materials and ‘supply chain integrity’ in more detail.

The term ‘supply chain integrity’ is being used increasingly in common language to reflect whether business (as opposed to retail consumers) buyers have ‘got what they paid for’ in relation to materials (products). As consumers, when we buy a product (the material) we expect it to meet certain quality or provinance (origin) standards, such as those advertised by the seller or manufacturer. In countries like Australia, many of these requirements are also enshrined in consumer law. If a product breaks or fails, or if it is poor quality such as paint peeling off, then we feel disappointed and probably worse. It is business’ responsibility to make sure this outcome doesn’t happen for its consumers, which is where a Supply Chain Integrity program comes in.

A Supply Chain Integrity program aims to “mitigate the risk end-user’s exposure to adulterated, economically motivated adulteration, counterfeit, falsified, or misbranded products or materials, or those which have been stolen or diverted” (The United States Pharmacopeial Convention, 2016). These programs apply to both buyers and sellers, but the focus differs depending on where you sit in a supply chain.

The overlap with vendor fraud lies with what ACFE refers to as “fraud schemes involving materials“, where risks such as product substitution (a buyer pays for a product meeting one set of specifications, but it is substituted for a cheaper, lower quality, alternate or less functional model which might be less reliable or functional for the user). Typically, the trust a consumer places in a product or service is also wrapped up in the seller’s brand – if we see a product for sale from a brand we trust, we might buy it without question. Commonly, Supply Chain Integrity is bundled with Supply Chain Security into a consolidated ‘Supply Chain Integrity and Security’ program (SCIS), as seen in the global pharmaceutical industry.

Typically, an SCIS program focuses on both upstream supply (i.e. ensuring substandard products or raw materials do not infiltrate your supply chain as an input to say manufacturing), and downstream to ensure that counterfeits and diverted products do not enter a supply chain through nodes such as authorised distributors. In contrast, vendor fraud programs are typically narrower in scope.

What does this mean in practice?

In my opinion, if you are in an industry with serious life, safety or reputational (‘brand’) risks attached to the quality of materials provided by your suppliers, using a vendor fraud program to manage product substitution fraud risks may not be sufficiently robust or rigorous. Typically these programs focus on whether the vendor supplied a substandard product (i.e. may have defrauded you in terms of your sourcing, purchasing or procurement process) rather than a more holistic program aimed at improving the security and integrity of your supply chain overall (i.e. all products across all vendors). For these industries, a holistic Supply Chain Integrity and Security program (that also addresses the vendor fraud risk of product substitition) is more appropriate.

We already see this situation emerging in high reliability industries (e.g. mass transport, pharmaceuticals and medical devices, automotive and aerospace). In Australia, this area is becoming increasingly regulated with amendments to Australia’s Security of Critical Infrastructure (SOCI) Act which covers eleven critical infrastructure sectors and introduces new rules for managing supply chain integrity and security hazards. There’s a lot to unpack in this topic – I will cover some types of vendor fraud, particularly product substitution (sometimes called ‘product fraud’) in future posts.

Australia’s Critical Technology and Supply Chain Principles – a new reality for industry (part 2)

Posted on March 19, 2022 by Paul Curwell

Paul Curwell

What are the Principles?

As I outlined in an earlier post, Critical Technologies are those new or niche technologies which will confer a competitive advantage for Australia into the 21st Century.

On 15 November 2021, the Department of Home Affairs published the final version of the Critical Technologies Supply Chain Principles, after approximately one year’s public consultation. These principles come off the back of similar efforts in the USA, UK, New Zealand and other countries, all of which recognise the risks associated with Supply Chain Integrity and Security (SCIS).

Photo by Kateryna Babaieva on Pexels.com

Importantly, supply chain integrity and security is applicable to all industries, not just critical infrastructure operators (covered under the Security of Critical Infrastructure Act, or SOCI and its subsequent amendment, SLACI) or those industries involved in Critical Technologies. AgriFutures Australia published its study entitled ‘Product fraud: Impacts on Australian agriculture, fisheries and forestry industries‘ in late 2021, is a prime illustration of this (I will take a look at this report later).

Relevant Definitions

Foreign Ownership, Control and Influence (FOCI): A company is considered to be operating under FOCI whenever a foreign interest has the power, direct or indirect, whether or not exercised, and whether or not exercisable, to direct or decide matters affecting the management or operations of that company in a manner which may result in unauthorised access to sensitive operational information / confidential information or may affect adversely the performance of contracts in Australia’s national interest (adapted from US Government DCSA). Whilst this language originated in the U.S., it also is used by Australia’s Foreign Investments Review Board (see here) as well as Defence.
Supply Chain Integrity: “a set of policies, procedures, and technologies used to provide visibility and traceability of products within the supply chain. This is done to minimize the end-user’s exposure to adulterated, economically motivated adulteration, counterfeit, falsified, or misbranded products or materials, or those which have been stolen or diverted” (United States Pharmacopeial Convention)
Supply Chain Security: activities aim to enhance the security of the supply chain or value chain, the transport and logistics systems for the world’s cargo and to “facilitate legitimate trade” (Government of Canada)
Product protection: the collection of programs, internal controls and security countermeasures designed and deployed to protect tangible and digital products against fraud, security and integrity threats in the supply chain and marketplace. This includes Anti-Piracy, Anti-Counterfeiting, Track and Trace, and Product Authentication measures (Curwell, 2022).

The Critical Technologies Supply Chain Principles establish 10 ‘agreed principles’ generally applicable to brand integrity, supply chain integrity, and product protection in any Australian industry:

Agreed Pillars	Agreed Principles
A. Security by design Security should be a core component of critical technologies. Organisations should ensure they are making decisions that build in security from the ground up.	1. Understand what needs to be protected, why it needs to be protected and how it can be protected. 2. Understand the different security risks posed by your supply chain. 3. Build security considerations into all organisational processes, including into contracting processes, that are proportionate to the level of risk (and encourage suppliers to do the same). 4. Raise awareness of and promote security within your supply chain.
B. Transparency Transparency of technology supply chains is critical, both from a business perspective and from a national security perspective.	5. Know who your critical suppliers are and build an understanding of their security measures 6. Set and communicate minimum transparency requirements consistent with existing standards and international benchmarks for your suppliers and encourage continuous improvement. 7. Encourage suppliers to understand and be transparent in the depth of their supply chains, and provide this information to customers.
C. Autonomy and Integrity Knowing that suppliers demonstrate integrity and are acting autonomously is fundamental to securing your supply chain.	8. Seek and consider the available advice and guidance on influence of foreign governments on suppliers and seek to ensure they operate with appropriate levels of autonomy. 9. Consider if suppliers operate ethically, with integrity, and consistently with international law and human rights. 10. Build strategic partnering relationships with critical suppliers.

Final Principles – in Critical Technology Supply Chain Principles

Businesses looking to uplift their supply chain and third party risk management practices would do well to incorporate these principles into their policies, supported by a robust framework to faciliate implementation. So what might such a framework look like exactly?

How do the Principles relate to other standards and guidelines?

The Critical Technology Supply Chain Principles are useful as a starting point for businesses which haven’t really focused on this area before when developing their policies or supply chain risk management programs. In my day to day interactions across many industries, whilst domains like cybersecurity are very mature, supply chain risk management is something many businesses have largely overlooked for decades, despite our status as an island nation.

Photo by Griffin Wooldridge on Pexels.com

So, if the Principles provide high level guidance, how much similarity is there between them and other commonly cited standards or guidelines focused on developing more holistic programs? And which, if any, standards might be best used by Australian businesses to compliment the Principles when building their programs to manage supply chain risk? The following table compares the principles against three main guidelines used in this area:

CTSCP	ISO 28000 Supply Chain Security Management	SOCI Rules	APRA CPS231 Outsourcing	ANSI/ASIS SCRM.1-2014
1. Identify critical assets & protection requirements	Existing	Not yet finalised	Indirectly	Yes
2. Identify risks	Existing	Not yet finalised	Yes	Yes
3. Design in security	Partial – focus on supply chain, not product protection	Not yet finalised	Yes	Yes
4. Raise awareness	Not directly addressed	Not yet finalised	Not directly addressed	Yes – using ISO31000 principles
5. Know Your Suppliers & assess their security	Yes	Not yet finalised	Partial	Yes
6. Work with suppliers to increase transparency	Partial	Not yet finalised	No	Yes
7. Encourage suppliers to map and understand extended supply chains	Indirectly	Not yet finalised	No	Yes
8. Consider foreign interference risks to suppliers	Indirectly	Not yet finalised	Not directly addressed	Not directly addressed
9. Consider supplier ESG* & Integrity risks	Not directly addressed	Not yet finalised	Yes	Yes
10. Build partnerships with key suppliers	Yes	Not yet finalised	Yes	Yes

Author: Paul Curwell, 2022.

*ESG risks: refer to the collection of Environmental, Social and Governance risks faced by public and private sector organisations today. For those new to ESG, this article from MSCI provides a useful introduction. ESG risks include Modern Slavery – see here for my previous post on Modern Slavery, Human Trafficking & People Smuggling (part 1)? and here for How should I perform due diligence to comply with Australia’s Modern Slavery Act 2018 (part 2)?

As you can see from the above table, ANSI/ASIS SCRM.1-2014. Supply Chain Risk Management Standard: A compilation of best practices is one of the more comprehensive references for any business looking to build or enhance its supply chain risk management program. Additionally, note that the Critical Technologies Supply Chain Principles introduces a range of new measures not previously. Managing these risks likely requires new skills for many security practitioners (both cybersecurity and protective security disciplines).

What might implementation and adoption challenges look like?

One observation from me is the interdisciplinary or converged nature of legislation and government policy relating to risk and security that started to emerge with the introduction of the SOCI Act in 2018. There is an increasing emphasis on integrated, enterprise-wide programs which remove the traditional silos that existed between protective security, cyber security and fraud / financial crime, risk and compliance, procurement and operations. Foreign Ownership, Control and Influence – traditionally the domain of Anti-Money Laundering / Counter Terrorist Financing and Trade Compliance – is one example.

Whilst all of these measures are positive and heading in the right direction given the complex threat environment we all now operate in, the question for me is how Australian businesses will respond to guidance such as the Principles and whether they will be embraced and enacted, particularly in Australian industries which have traditionally given their security-related concerns minimal priority. The protection of Australian Intellectual Property (beyond legal protections such as a patent or claiming copyright) is a prime example here. Hopefully our historical Australian attitudes and perceptions of a benign risk environment are evolving given increasing cyber attacks, frauds, and changing priorities for company directors and boards. Only time will tell.

Australia’s Critical Technology and Supply Chain Principles (part 1)

Posted on March 5, 2022 by Paul Curwell

Paul Curwell

What are critical technologies?

As we move into the fourth industrial revolution and a changing geostrategic landscape the likes of which haven’t been seen since World War II, global society is again forging a new path. Whilst resources and labour have been the currency of previous era, now it is advanced technology. The ubiquity of most forms of technology mitigates some of the competitive advantage enjoyed by nations and businesses, with the exception of new or niche technology that addresses the needs of 21st century society. In Australia, this class of technology is now referred to as ‘critical technologies‘.

The Australian Government has defined critical technologies as being those which have been identified as “having a significant impact on our national interest (economic prosperity, national security and social cohesion)“, which the Australian Government has set as its baseline. Whilst some technologies on the list have implications for defence and security, the Action Plan acknowledges these technologies often have broader applications (i.e. they are what is referred to as ‘dual use’ goods or technologies).

Key terms used in the policy documents

Critical technologies – Current and emerging technologies that have the capacity to significantly enhance or pose a risk to our national interest (prosperity, social cohesion or national security).
Emerging technology – Technologies that are currently developing, or that are expected to be available within the next five to ten years

Critical technologies are exposed to some unique risks

Many of the risks associated with critical technologies have been widely publicised in recent years, ranging from efforts by the US Government to purchase more rare earth resources after a buying spree by the Chinese government (see Scheyder, 2022), through to methods of Intellectual Property theft occurring under the guise of technology transfer (see my previous post). However, it’s worth recapping the key critical technologies risks as listed in the Blueprint:

Lack of competitive and diverse markets
Highly geographically concentrated supply chains
Critical infrastructure interdependencies
Creation of an increased cyber threat surface
Influence of foreign actors on international technology standards development which may run contrary to Australia’s values and objectives
Undermining institutional integrity through mis- and dis-information operations
Exploitation of Australian knowledge – such as through economic espionage or foreign interference

Each of these presents it’s own set of risks which is not purely a problem for government to manage. Industry owns the asset and with limited exception industry is responsible for managing those risks. The challenge for many Australian businesses is that these risks are quite unique in nature, and require a specialist set of skills and knowledge to manage which is not readily found in the Australian market. Stay tuned for Part 2 of this post which will go into these risk management steps in relation to supply chain integrity and security in more detail.

Enter November 2021 and the release of Australia’s Critical Technology Blueprint and Action Plan

When the consultation drafts first came out for critical technology in 2020, my first question was which technologies are we actually referring to. When it comes to risk management, knowing what comprises your critical assets is a pre-requisite to safeguarding them effectively.

With the release of Australia’s Critical Technologies Action Plan by the Critical Technologies Policy Coordination Office (CTPCO), Australia’s critical technologies are now clearly defined. The Action Plan identifies 63 technologies across seven disciplines, each of which broadly aligns to an Industry Sector.

So what are Australia’s Critical Technologies?

Additive manufacturing (incl. 3D printing)
Advanced composite materials
Advanced explosives and energetic materials
Advanced magnets and superconductors
Advanced protection
Coatings

Continuous flow chemical synthesis
Critical minerals extraction and processing
High-specification machining processes
Nanoscale materials and manufacturing
Novel metamaterials
Smart materials

Advanced data analytics
Advanced integrated circuit design and fabrication
Advanced optical communications
Advanced radiofrequency communications
Artificial Intelligence (AI) algorithsm and hardware accelerators

Distributed ledgers
High performance computing
Machine learning (incl. neural networks and deep learning)
Natural language processing (incl. speech and text recognition and analysis)
Protective Cyber Security Technologies

Biological manufacturing
Biomaterials
Genome and genetic sequencing (Next Generation Sequencing)
Nanobiotechnology
Nanoscale robotics

Neural engineering
Novel antibiotics and antivirals
Nuclear medicine and radiotherapy
Synthetic biology
Vaccines and medical countermeasures

Biofuels
Directed energy technologies
Electric batteries
Hydrogen and ammonium for power

Nuclear energy
Nuclear waste management and recycling
Photovoltaics
Supercapacitors

Post-quantum cryptography
Quantum computing
Quantum sensors

Quantum communications (including quantum key distribution)

Advanced imaging systems
Atomic clocks
Gravitational-force sensors
Inertial navigation systems
Minature sensors
Multispectral and hyperspectral imaging sensors

Magnetic field sensors
Photonic sensors
Radar
Satellite positioning and navigation
Scalable and sustainable sensor networks
Sonar and acoustic sensors

Advanced aircraft engines (including hypersonics)
Advanced robotics
Autonomous systems operation technology
Small satellites

Drones, swarming and collective robots
Space launch systems (incl. launch vehicles and supporting infrastructure)

Many of the risks associated with critical technologies will be managed through existing regulatory frameworks

The Action Plan outlines the policy levers – including economic, national security and diplomatic levers – available to it to manage critical technologies in Australia’s national interest and in accordance with Australian values. The Australian Government has commited to “ensure all actions to protect and promote critical technologies are proportional, targeted and sustainable”.

To this end, the Action Plan presents four policy response categories available when pursuing actions on critical technologies, as shown in the figure below:

A response framework for critical technologies – in The Action Plan for Critical Technologies

The Action Plan also conveniently provides a map of the Australian Government’s “comprehensive suite of recent actions to promote and protect critical technologies across all four policy response categories”:

Government actions to promote and protect critical technologies – in The Action Plan for Critical Technologies

As you can see, many of Australia’s actions to promote and protect our critical techologies are already in place, meaning the introduction of new regulation or initiatives affecting industry should be minimal. Some of these fall within this scope of what I write on here at ForewarnedBlog.com – follow me for future posts on the Foreign Interference Guidelines, Supply Chain Resilience Initiative, changes to export control regulations and trade compliance (i.e. the Defence & Strategic Goods List), and foreign investment restrictions for critical technology (including what is referred to as Foreign Ownership, Control and Influence or FOCI). Part 2 of this post will focus on one new announcement, the Critical Technology Supply Chain Principles.

Part 2 – Critical Technology Supply Chain Principles

With a good understanding of the policy landscape and assets requiring protection, Part 2 of this post looks at what this means for the protection and integrity of critical technologies, supply chains, IP and products.

Los Angeles rail hijackings – a form of cargo theft

Posted on January 18, 2022 by Paul Curwell

Paul Curwell

What is going on?

Recently, there has been substantial coverage of the hijacking of goods trains by thieves on Los Angeles (LA) goods lines (McFarland & Mossburg 2022). Images of damaged or discarded shipments from distributors to consumers (end users) strewn across the train tracks are common, as are photos of railway police trying to apprehend individuals and small groups running along the tracks.

Reportedly, these criminals either force entry to stationary or slow-moving goods trains, ransacking any items which appear to be of value. Since they have been doing this for a while now, one must presume they have learned what more expensive packages look like (e.g. branded shipping boxes, specific logos) and are likely selected over lower value items (see my previous article here). Additionally, media reporting also stated that larger, harder to move goods are discarded on the train tracks over smaller items easily transported by a single human trying to flee the scene quickly. This activity is a form of Cargo Theft.

What is cargo theft?

The prevention of cargo theft is a core pillar of any supply chain security program, ensuring goods are not stolen in transit either from the factor to a distributor (for larger or bulk shipments), or distribution centre to end user (as appears to be seen in this example).

Does this article resonate with you? Please vote below or subscribe to get updates on my future articles

How does cargo theft impact brand integrity?

When cargo theft occurs in bulk, there is a real risk the diverted product is moved into grey markets (gray markets) or alternately that stolen product is infiltrated into legitimate supply chains, and then on-sold to end users (see Sugden 2009). An example of the scenario that occurs here is where an authorised distributor is approached by a purported ‘wholesaler’ to purchase legitimate (non-counterfeit) stock at a discount to prices set by the manufacturer or standard wholesale prices.

In this scenario, distributors may knowingly or unknowingly purchase stolen but non-counterfeit product and then sell this to end users, with three potential business impacts:

The manufacturer is disadvantaged through erosion of their profit margins,
A ‘legitimate market’ is created for the stolen goods through poor purchasing controls by the distributor, and,
Potential future revenue leakage and brand damage to the manufacturer through services and warranty fraud, if a customer who purchased the non-counterfeit good from an authorised distributor makes a claim.

Cargo Theft Typologies

According to the latest BSI Survey on Supply Chain Risks (2020), there are four primary cargo theft typologies (note the report does not define each typology, I have added my own definitions here)

Hijacking – where the vehicle (truck, train, plane, ship) carrying the goods is stopped and control is taken of the entire vehicle. Typically, vehicles are typically taken to a third location controlled by the hijackers for unloading and disposal. Hijackers may be working in collusion with trusted insiders (e.g. drivers or warehouse staff).
Theft from a vehicle – whereas hijacking involves the whole vehicle, this typology involves stealing selected goods from the vehicle (e.g. specific boxes), and is what we see in the LAX examples.
‘Slash and grab’ – when cargo is transported in soft skinned trucks, the vinyl or canvas covers can be slashed and any items to hand quickly stolen.
Other – undefined typologies, presumably including theft by employees or third parties as well as fraud (e.g. claims of shipments being damaged as cover for theft).

According to BSI, cargo theft primarily occurs in six geographical locations:

In-transit – whilst the vehicle is moving (e.g. slowed due to traffic congestion, stopped at traffic lights or an accident)
Rest areas – trucks carrying high value cargo without two drivers are at risk when the driver stops for a break or sleep
Warehouse – there are at least two risks here:
- Theft from warehouse by criminals (e.g. breaking & entering) with no insider involvement
- Inventory theft or fraud by trusted insiders (e.g. employees)
Unsecure roadside parking – where a loaded vehicle is parked either at the point of origin or destination
Freight facility – where multiple trucks / trains are unloaded in a single location
Other locations – these are not defined

How do the proceeds of cargo thefts end up in grey markets?

We sometimes see high value goods, such as stolen motor vehicles, being exported from the jurisdiction where the theft occurred (e.g. the USA) to an overseas jurisdiction where the product is in high demand and where criminals can obtain substantial profit margin on the sale of the stolen goods.

It might also be common to see sales of consumer products being sold online (either individually or in bulk) by either a business or individual seller or sold to authorised or unauthorised distributors [an ‘authorised distributor’ is defined as one which has a signed distribution agreement with the manufacturer or Intellectual Property Rights (IPR) owner and is conducting their business operations in the geographic area(s) stated in the agreement].

In the case of the LA activity, the stolen goods seem to be packages shipped from distributors which are stolen before delivery to the consumer (end user), rather than bulk shipments (e.g. multiple copies of the same product). These stolen goods can also be sold online, in person through social networks or street corners, or local flea markets.

What can be done to help mitigate this type of cargo theft?

There are three main strategies that can be employed to mitigate the types of risks seen in Los Angeles, as follows:

Physical Security (including use of tamper evident seals) – appropriate (i.e. risk-based) physical security should be part of any Supply Chain Security program. This may be the responsibility of the logistics provider (i.e. a third party) or the manufacturer. Most shipments are covered by insurance against theft or damage, but this may be subject to exclusions.
Market Surveillance – a robust market surveillance program is essential for the protection of your products, IPRs and ongoing brand integrity. This involves using Open Source Intelligence (OSINT) techniques to monitor physical and online markets (e.g. flea markets, online market places like eBay and Gumtree) as well as social media for sales of your products, monitoring pricing (pricing surveillance), conducting test purchases (to determine the origin of the product for diversion and grey market purposes), and identification of sellers to determine whether they are authorised or unauthorised.
- This data should be added to a Graph database to facilitate Social Network Analysis and other intelligence analysis and investigative methods which might help to identify the criminal value chain and map organised crime groups involved in this activity.
Collection and analysis of incident data – in my previous post on product fraud and security risk assessments, I discussed the importance of capturing current and historical incident data for analysis. The sorts of questions you need to ask of your data here includes whether there are any common themes or trends and whether any specific products are at higher risk than others (e.g. those which are more valuable or CRAVED by thieves).

Conclusion

Whilst cargo theft is a risk, there are controls and other measures which can be implemented to mitigate it. Proper planning is essential, as is the use of security risk analysis to identify where effort (and budget) should be allocated, and the use of intelligence methods to continuously monitor the market and those actors (individuals, legal entities) involved in it. Ideally, any incidents are either prevented, detected or disrupted before a loss is incurred, but in some cases formal investigation may be required.

Product security risk assessments for tangible goods

Posted on December 19, 2021 by Paul Curwell

Author: Paul Curwell

State of art – managing fraud and security risk in relation to products

It makes sense that out of the universe of products on the market globally some products are more attractive to thieves and criminals, including trusted insiders, than others. Whilst working through my holiday reading I came across some research undertaken in 1999 by Ronald Clarke, a leading criminologist.

I’ve been interested in what makes a product vulnerable to security and fraud risks for at least ten years. Take a moment to think about what we do with products: whether a passport or airplane part, we manufacture them before ultimately selling them to consumers, most of whom are free to use them and resell them at will on the secondary market. This means they need some protection against fraud and security threats, especially if your reputation or commercial revenue model is linked to the product’s ongoing integrity.

Whilst working in banking my team would undertake product fraud and security threat and risk assessments, at that stage primarily on the bank’s new fleet of Automatic Teller Machines (ATMs). ATMs are targeted in a number of ways, both physically and virtually, through attack vectors such as ram raids, Plofkraak attacks, and cyber hacking to ultimately access the cash contained inside. More recently, I provided expert review of threat and risk assessments for a suite of financial services and identification products (including digital identities) for another client.

To my knowledge, there is no formal threat and risk assessment methodology for products per se, but Clarke’s methodology seems a good starting point.

What satisifies a criminals cravings?

In his research, Clarke found that products commonly targeted by shop lifters in a retail exhibited six attributes which spell the acronym CRAVED, as follows:

Concealable – this is relative to the situation. Shoplifters might target small items they can easily conceal in clothing (eg watches) over a large TV, but sometimes it’s easier to walk out with something large. I previously did some work with a client involved in international air freight, and one of their risks was that trusted insiders could smuggle large items concealed in something else out of the airport through a legitimate freight shipment.
Removable – to target a product, you need to be able to pick it up and move it. Unlike services, products are generally transportable.
Available – there are two elements to this – products that are widely available, and those that are readily accessible (i.e. not kept in a locked cabinet with inventory or stock in store). Audit logs and access control measures, amongst others, should protect more valuable items.
Valuable – whether trusted insiders or organised fraud rings, criminals generally don’t steal things which are not of value to them. Value is also contextual – whilst a high demand product such as consumer electronics is seen as valuable to a large potential market, some products might be valuable to an individual for a specific purpose. We can reasonably expect the former might be targeted multiple times by one or more actors, whilst the latter category might be targeted only once.
Enjoyable – Clarke’s work looked at products most commonly associated with shoplifting, so there is an element of consumer desire (i.e wants & needs) here. But if our COVID crisis has taught us anything about supply chains, its that Maslow’s hierarchy of needs also plays a role (the repeated hoarding of toilet paper by consumers comes to mind).
Disposable – attractive products are those easily sold, or resold, either for cash or another form of value transfer. There is more demand, hence more of a market, for some products than others. Think of how easy it is to dispose of a second hand (or stolen) fridge over a passport.

Readers will note that CRAVED really applies to security related threats, such as theft, much more than fraud. I’m not aware of any formal product fraud risk assessment methodology.

How can we apply the CRAVED construct to manage product risk?

Clarke’s research was performed in 1999, so it is somewhat dated but the principles likely remain valid. Also, the research focused on retail and is not representative of other industries. Nevertheless, we can use the principles outlined by Clarke to inform the design of any product specific risk assessment methodology: CRAVED provides a starting point.

Based on my experience assessing product risk for fraud and security threats, I offer three tips to consider when designing and / or executing a product risk assessment to address fraud and security threats:

Tip 1: Analyse your historical incidents

Collecting detailed incident data is a foundational element of any fraud, security or risk function. Ideally, you want to capture as much detail as you can at the time of the incident, even if it may not seem relevant now. It may be much harder, or even impossible, to capture some data in the future.

TIP: If you are not doing this already, you should start. Ideally, try to collect as much historical data for say the past 12-24 months as you can, even if it is not complete, and put in place processes and tools to collect rich incident data going forward.

As you start to analyse your historical incident data, ask yourself the following questions:

Which product(s) are most commonly targeted? Assuming the Pareto Principle (’80:20 rule’) applies, a small number of your product models will be targeted more commonly than others. You need to identify these and assign a higher likelihood score during your risk assessment.
Are there any geographical aspects to these incidents? E.g. do they commonly occur in specific locations? This might indicate that some products are more likely to be stolen or attacked in a specific geographical area. The logical follow up question here is why…
Are there specific dates or times when most incidents occurred? In some forms of fraud, it is common to see spikes in fraud incidents in summer and a significant decline in winter. Additionally, some forms of crime are more likely to happen at night. Perhaps you might identify an unusual pattern, such as high rates of theft on a weekend when your business is closed, suggesting a potential insider threat.
How do these incidents occur? You need to get a good understanding of the criminal’s business process, particularly if there is a specific pattern or series of steps that are commonly undertaken which you might be able to disrupt using internal controls (mitigations). You can use a variety of analytical methods here including business process mapping, red teaming and analysis of competing hypothesis to achieve this.
Who is the perpetrator? Even if you can’t identify the perpetrator by name (which is unlikely), try to categorise perpetrators into groups such as opportunistic individuals, organised criminals, organised crime (eg mafia), trusted insiders etc. Over time, as you develop richer data sources and a deeper understanding of your data, you might be able to distinguish groups or sub-categories based on the groups specific behaviours (i.e. their Modus Operandi [MO] or Tactics, Techniques and Procedures [TTPs], such as a specific organised fraud ring.
Why do you think specific products are being targeted? You may need to do some critical thinking here, or alternately comparative case analysis methods would be helpful. You need to understand whether the products that are mainly being targeted (e.g. the 20% – assuming the 80:20 rule applies to your data) are being targeted for a reason. Ask yourself, do they share common attributes (such as the CRAVED attributes identified by Clarke)?

Tip 2: Identify any design attributes which could be modified to reduce the product’s attractiveness to criminals

Sometimes there are design attributes to a product, or even a service (e.g. a business process) that makes one manufacturer’s product more likely to be targeted than a competitor. Additionally, sometimes the design of a product makes it more likely to be targeted – an example could be not having branding or a serial number readily visible, which might allow criminals to ‘rebadge’ it as it is being sold. Repackaging is another area of risk here. Understanding these factors means you can work with product managers and design engineers to modify your product and make it less attractive to criminals, which means it is less likely to be targeted.

Ultimately, your goals here are revenue and brand protection. If you can design your product to be a ‘harder target’ (i.e. less attractive), you might save on downstream fraud and security costs. Alternately, some products are readily counterfeited, with sometimes lethal consequences for unsuspecting consumers. Aside from potentially tragic impacts to consumer’s lives, your organisation’s brand and reputation might be adversely impacted simply because your product design was easy to counterfeit and commercially attractive to counterfeiters.

In this case, the cost of the reputatation or brand damage (such as by consumer boycotts, lost sales) may far exceed the costs of product redesign or implementing additional security measures. Product managers need to know if anything specific makes their product overly attractive to criminals, and if so, do something about it in the design phase.

Tip 3: Understand where the product is most likely to be attacked or compromised

For example, if a product is more at risk during shipment, can better cargo security measures be implemented? If a product is at risk of counterfeiting, product authentication measures such as security packaging and traceability programs could be the solution.

It is very uncommon to encounter situations where managers have unlimited resources – a well-designed product risk assessment methodology can be used to identify those products requiring increased protection based on likelihood and consequence, and those requiring less protection. These insights can be used to efficiently allocate your limited risk management resources, as well as helping product managers understand why their product is at risk.

The USP/APEC ‘Supply Chain Security Toolkit for Medical Products’

Posted on August 29, 2021 by Paul Curwell

Author: Paul Curwell

Introduction

In a previous post, I looked at the anti-counterfeiting and supply chain traceability model proposed by AS6174 for the Aviation and Defence industries. This standard is one of many different standards available, some of which are generically applicable to any industry, and others which are designed to meet the needs of a particular target audience.

This article continues with the current Supply Chain Integrity and Security theme, this time looking at the model developed by the The United States Pharmacopeial Convention (USP) – Asia Pacific Economic Cooperation (APEC) Life Sciences Innovation Forum (LSIF) in 2016.

The United States Pharmacopeial Convention defines Supply Chain Integrity and Security as “a set of policies, procedures, and technologies used to provide visibility and traceability of products within the supply chain. This is done to minimize the end-user’s exposure to adulterated, economically motivated adulteration, counterfeit, falsified, or misbranded products or materials, or those which have been stolen or diverted”.

On first glance, the output of the USP/APEC model is what is referred to as the ‘Supply Chain Security Toolkit for Medical Products’, designed for the pharmaceutical, medical devices, and life sciences industry. This toolbox addresses ten different domains, each of which has a range of sub-components, which align nicely into a Capability Maturity Model that at a high level could be applicable to a range of industries.

In this post, I unpack this USP/APEC toolbox in more detail and explain how the Toolkit could be applied to create an industry-agnostic Capability Maturity Model for Supply Chain Integrity and Security.

The USP/APEC ‘Supply Chain Security Toolkit for Medical Products’

This toolkit itself is a 14-page interactive PDF broken into ten domains, each of which reflects a different element of the supply chain. There are 64 supporting documents from a variety of authors, including the World Health Organisation and APEC, which dive into each element in differing levels of detail. This is available on the Korean National Institute of Food and Drug Safety’s website. The ten elements are as follows:

Good Manufacturing Practices	This section sets out 11 key considerations for supply chain integrity and security in any manufacturing process. Aside from processes like Outsourcing and Repackaging, which are recognised as vulnerable to a variety of supply chain threats from product tampering, to cargo theft, product substitution, product diversion, and grey market / parallel import activity, this section also introduces the concept of “show and shadow factories”. Used here, ‘shadow factories’ refer to businesses which actually perform the manufacturing process (or elements of it), without being declared as such. Aside from the Supply Chain Integrity and Security risks, these practices also expose organisations to Bribery & Corruption risks (such as the Foreign and Corrupt Practices Act and United Kingdom Bribery Act) and Modern Slavery and Human Trafficking risks (such as were workers in ‘shadow factories’ may be trafficked or working in slavery, slave-like, harmful or substandard conditions). See my related posts on modern slavery and associated due diligence practices here.
Good Distribution Practices	This section, along with the Good Manufacturing Practices, is comprehensive and well-constructed. Whereas the real insights the remaining sections are somewhat buried in the supporting documents, this section is cleanly laid out to reflect the steps required across 11 elements of the distribution value chain.
Good Import / Export Practices	Unfortunately this section remains under development so no further guidance or information is available on importing and exporting
Clinical and Retail Pharmacy Practices	This section is interesting because of its focus on the ‘end user’ [see my previous post for details on end user verification], covering the lifecycle from “purchase and receipt to storage, and until the products are dispensed and administered”. The supporting guidance includes another 66-page toolkit which is similar in terms of application to AS6174, as well as incorporating similar concepts around traceability of raw materials and storage as the Australian Code of Good Manufacturing Practice for Veterinary Chemical Products.
Product Security	The term ‘product security’ appears undefined in the Toolkit, yet seems to refer to the variety of measures used to protect products from “cargo theft, intentional adulteration, Product Diversion, Substandard Products [what I refer to as Product Substitution], and Product Tampering. The materials in this section provide advice on both “upstream” and “downstream” issues in the supply chain.
Detection Technology	This section focuses on giving parties in the supply chain the ability to determine the Authenticity and Conformance (including Quality) of any product, with a view to identifying what USP/APEC define as ‘Substandard, Spurious, Falsely Labelled, Falsified and Counterfeit’ (SSFFC) medical products through non-destructive (e.g authentication of packaging) and destructive testing (e.g. chemical analysis) methods. One observation from me is the different language used across industries – whilst this life sciences example uses SSFFC, readers of my previous post may recall that AS6174 used “suspected, fraudulent, and counterfeit” to refer to the same concepts.
Internet sales	The global, unregulated nature of online shopping is a long-standing concern for any Intellectual Property Rights (IPR) Holder, let alone life sciences. TheToolkit highlights a variety of risks to consumers arising from internet sales, including: “(a) not receiving the drug purchased; (b) drugs containing incorrect dosage, i.e. super-potent or sub-potent; (c) or containing no active ingredient at all”. A fourth category, that of containing harmful or toxic ingredients as substitutes (e.g. arsenic), could also be added given this practice is common with many counterfeit pharmaceuticals – see this article published in 2019 from The Guardian.
Track and Trace System	The life sciences industry has a range of industry-specific, regulated requirements around ‘track and trace systems’ such as those mandated by the United States Drug Supply Chain Security Act (DSCSA). Usefully, this Toolkit contains a Gap Assessment documenting selected best practices as well as cost-benefit information that may be of use in any business case.
Surveillance and Monitoring	This element is split into the typical Prevent, Detect and Respond domains common in any security or fraud risk management framework and is primarily focused at the government, as opposed to manufacturer, level. The government focuses likely explains why this model does not address the utility of an ‘intelligence capability’ as a foundation to Identify and Monitor threats before they become material to business. I will cover this in more detail in future posts.
Single Points of Contact	This aspect focuses on building a public-private network for information exchange between regulators, authorities, law enforcement agencies and international bodies. In addition to emphasising reporting, this domain also addresses the need for training and cooperation programs.

Photo by Alexandros Chatzidimos on Pexels.com

Using the Toolkit to build a Capability Maturity Model for Supply Chain Integrity & Security

As outlined above, this is a comprehensive, free toolkit for a highly regulated industry that goes into a substantial amount of detail as to the programs and initiatives that should comprise any Supply Chain Integrity and Security framework for the life sciences sector. The attraction of this Toolkit is that it could be easily converted into a Capability Maturity Model and applied across any industry with similar supply chain risks, such as food & beverages, consumer electronics, or agricultural chemicals.

Whilst subtle industry and jurisdiction-specific differences will exist, any reader charged with the task of reviewing or developing a Supply Chain Integrity and Security program could easily apply the contents of this Toolkit to this task. Additionally, Internal Auditors and functional leads (e.g. Heads of Product or Heads of Security) could benefit from using the Toolkit to benchmark their current programs.

Benchmarking & Capability Maturity Models

Any benchmarking activity should start with the construction of a Capability Maturity Model – effectively a deconstruction of all the major elements in any Supply Chain Integrity and Security framework (e.g. manufacturing, distribution, product security, etc), which identifies each of the sub-elements that comprise each of the major elements. Organisations which lack either a major or sub-element would ordinarily be considered less mature, receiving a lower ‘current state’ score, unless there is a justifiable business need for not performing a particular function.

I have been building and applying Capability Maturity Models since 2006 when I joined Booz Allen Hamilton, and I can personally attest to the tremendous value of Capability Maturity Models in helping functional leads understand what needs to feature on strategic roadmaps or workplans. Just as important as the design of the Capability Maturity Model is what is defined as the ‘target state’ – importantly, you don’t need to have the highest capability maturity score for every major or sub-element. In some cases, a low score may be justifiable.

The whole point of a Capability Maturity Model is to build a capability that meets your strategic and operational requirements, as opposed to having a great capability that is not required given the business’ operational footprint. Capabilities which exceed business requirements can be a waste of money and may be a target for cost reduction or outsourcing.

Magazine article – “Supply Chain Integrity: Detecting Product Diversion”

Posted on July 31, 2021 by Paul Curwell

Author: Paul Curwell

Background

In June 2021, I was privileged to have an article I wrote on Detecting Product Diversion in the quarterly edition of Michigan State University’s Brand Protection Professional (BPP) magazine. BPP is part of the outreach program for the Center for Anti-Counterfeiting and Product Protection at the University.

Read:

Curwell, P. (2021). Emerging Supply Chain Integrity Practices: What this means for detecting product diversion, Brand Protection Professional, June 2021, Centre for Anti-Counterfeiting and Product Protection, Michigan State University.

The Centre for Anti-Counterfeiting and Product Protection (A-CAPP) is a non-profit, interdisciplinary research focused centre which is recognised worldwide as a leader in anti-counterfeiting and brand protection. A-CAPP operates a range of research, outreach and education initiatives including a Professional Certificate in Anti-Counterfeiting and Brand Protection which provides foundational knowledge for professionals new to this area. Reasonably priced, I have taken a few of their short courses which are informative and delivered 100% online at your own pace.

So what is product diversion anyway?

Also known as “illicit diversion”, product diversion “refers to goods that are redirected from the manufacturer’s intended area of sale or destination to a different geography or distribution channel” (Trent and Moyer, 2013). Often this terminology can be used interchangeably with the term “grey market”, despite one term referring to a fraudulent act and the other where the proceeds of that fraudulent act are sold.

The impact of diversion is that legitimate product may be sold into grey markets, in breach of a manufacturer’s sales contracts for that geographical location. This causes margin erosion for manufacturers, erodes legitimate distributors of their market share and deprives them of sales revenue, and can damage the brand through invalid warranties and returns policies for consumers.

Unpacking AS6174 in relation to Supply Chain Integrity

Posted on May 30, 2021 by Paul Curwell

Author: Paul Curwell

Introduction

Product counterfeiting is a global fraud problem that has been steadily evolving for decades, with no product or industry being immune. In 2015, Frontier Economics estimated “the value of international and domestic trade in counterfeit and pirated goods in 2013 was $710 -$ 917 Billion” (2015). The magnitude of this problem is also reflected in US and EU Customs seizures, which continue to grow (Smith, 2016). Unfortunately, Customs agencies can only seize what they know about, placing the onus on the purchaser to exercise adequate due diligence and supply chain risk management practices.

In 2007, the US Department of the Navy tasked the US Department of Commerce’ Bureau of Industry & Security to conduct an assessment of counterfeit electronics across the US defence industrial base, concluding “all elements of the supply chain have been directly impacted by counterfeit electronics” (2010). Similar findings across other branches of the US Government have triggered a range of Supply Chain Integrity and Security initiatives, one of which is Supply Chain Integrity.

The concept of Supply Chain Traceability

Supply Chain Traceability is critically important as a control to achieve Supply Chain Integrity in safety or high-reliability industries such as Aviation or Healthcare, where the introduction of sub-standard products / components / raw materials (referred to in the standard as ‘materiel’) can ultimately lead to death. Supply Chain Traceability is defined in AS6174 as “having documented history of material’s supply chain history. This refers to documentation of all supply chain intermediaries and significant handling transactions, such as from original manufacturer to distributor” (SAE International, p9), with ‘materiel’ being defined as “material, parts, assemblies and other procured items” (SAE International, p6).

This concept of Supply Chain Traceability presented in AS6174 appears akin to the concept of Supply Chain Integrity introduced by the World Economic Forum in 2012, which identified “four key questions that must be answered at the product level as part of Supply Chain Integrity (Pickard & Alvarenga, 2012):

Integrity of Source – did this product come from where I think it did?
Integrity of Content – is the product made the way I think it is?
Integrity of Purpose – is the product going to do what I think it will do?
Integrity of Channel – did this product travel the way I think it did?”

The difference between the approach adopted by AS6174 and that of the WEF report is that the standard is, unexpectedly, much more forensic in the way it approaches the concept. Where the WEF principles differ are in their application, which is broader than anti-counterfeiting, and could easily incorporate Environmental / Social / Governance (ESG) and other Sustainability Risk considerations such as Modern Slavery and Illegal Logging as part of a broader focus on Supply Chain Integrity (World Economic Forum, 2015).

Within AS6174, Supply Chain Traceability aims to address the introduction of Suspect, Fraudulent or Counterfeit materiel into the Supply Chain (SAE International, p6). Before proceeding further, it is worth exploring exactly how the introduction of Suspect, Fraudulent or Counterfeit material into the Supply Chain is possible. From my perspective, there are two starting points to this discussion:

Genuine Materials

Genuine materials are used or supplied by the manufacturer, which are subsequently adulterated or compromised, meaning that a legitimate product (referred to in AS6174 as a ‘conforming product’) is transformed into a ‘non-conforming’ (illegitimate) product at some point in the supply chain before it reaches the end user. The transformation from genuine to non-conforming materiel can occur in the supply chain via at least two methods:

Product Diversion – where legitimate product is diverted from the authorised supply chain (Bandler & Burke 2009, Datz 2005), impacting the ability of a consumer to rely on a vendors’ warranties around Authenticity and Conformance (SAE International, pp7-10). This can be through theft, but it can also be as a result of sales to seemingly legitimate customers (e.g. OEMs) where that product is then re-sold or passed to a third party, such as a gray marketer (Shulman, 2012)
Product Substitution – where a product, or part of a legitimate product, is substituted with non-conforming material (Guide to…2019). The concept of product substitution can be illustrated with a can of house paint. Imagine a paint can with the uppermost quarter consisting of real paint (i.e. conforming materiel). The remaining three-quarters of the paint can is filled with a substitute, or non-conforming materiel, which does not mix with the real paint and is heavier so it stays at the bottom of the can. When a customer receives the paint and looks inside, or perhaps performs testing on the product, they will likely only see the uppermost layer. Provided a sample is taken from this layer, the sample will test positive (i.e. conform with manufacturer’s specifications) and not be detected. Meanwhile, the fraudster who substituted the original for fraudulent product has the opportunity to sell three other cans of paint to unsuspecting consumers for the price of one, less the cost of labeling three unmarked paint cans, pocketing the difference.

Both of the above examples fit the definition of “fraudulent material” under AS6174, which is defined as “suspect material represented to the customer as meeting the customers’ requirements” (SAE International, p6).

Non-Genuine Materials

In the second method, non-genuine materials are used throughout the manufacturing process, resulting in a product that in no way conforms to the specifications or authenticity of the original product itself, other than the application of the victim manufacturers’ Trademarks or branding on the packaging. This is commonly referred to as a counterfeit, or ‘fake’. AS6174 defines counterfeit material as “fraudulent material that has been confirmed to be a copy, imitation or substitute that has been represented, identified, or noted as genuine, and / or altered by a source without legal rights with the intent to mislead, deceive or defraud” (SAE International, p6).

Managing the risks – what does AS6174 suggest?

AS6174 provides guidance across 7 main areas to manage the risks of Suspected, Fraudulent or Counterfeit materiel entering the supply chain. These areas include Product Assurance, Risk Assessments, Contractual Obligations, Purchasing Practices, Traceability Guidance and Reporting / Information Sharing arrangements. The following sections focus in more detail on Product Assurance and the Counterfeiting Risk Assessment. Other elements, such as purchasing and supplier due diligence, will be covered in future posts.

Product Assurance

The purpose of Product Assurance, which effectively involves “confirming the authenticity of materiel or its compliance with manufacturer’s specifications” (SAE International, p27), is minimising the likelihood of non-conforming materiel entering the supply chain. Where it does enter the supply chain, Product Assurance and other elements of AS6174 are designed to facilitate early detection. The standard proposes four elements of any Product Assurance process (SAE International, p27):

Documentation & Packaging Inspection – effectively a review of supplier documentation to trace the history of the product and to review the packaging to confirm it meets expectations around conformance with manufacturer’s specifications. As with all fraud prevention processes, the suggestion of verifying the received documents against the source through means such as confirming the accuracy of serial and batch numbers, is raised.
Visual Inspection – this involves examining the product using various scientific techniques and conditions for the presence of identification markings or traceability indicators.
Non-Destructive Testing (NDT) – involves a variety of tests including radiological, acoustic, thermographic and optical techniques to check the product confirms to specifications without actually destroying or using the materiel itself.
Destructive Testing (DT) – involves analytical chemistry techniques, deformation and metallurgical tests, exposure tests, and functional tests.

Obviously, the performance of some of the above requires access to specialist equipment and / or knowledge (such as details of manufacturer’s markings applied to help prove the authenticity of a product), which may be beyond the reach of some consumers. In this case, businesses in Australia may consider it worthwhile engaging a NATA Accredited laboratory to perform such testing on their behalf. One key principle of AS6174 is that the design of any framework to minimise and / or detect non-conforming parts be risk-based, informed by the likelihood and consequence of a non-conforming part being introduced into the organisation’s supply chain.

Determining Counterfeit Risk

AS6174 suggests that the steps taken to minimise counterfeits in the supply chain, including the extent to which Product Assurance is undertaken, should be driven by both the likelihood and consequence of any “non-mitigated counterfeit item” (SAE International, p13). This means, for example, that greater steps should be taken to prevent counterfeiting in relation to a helicopter engine part than say a ream of paper in the office. The risk rating from this exercise dictates the “degree of traceability required” for that part in the supply chain.

The first element of any counterfeit risk assessment should involve considering the Likelihood, or probability of counterfeiting in that product, industry or market. The guidance provided in AS6174 on how to do this is scant, and does not consider the nature of the counterfeiting threat and the attractiveness of counterfeiting a specific part or materiel to fraudsters or organised crime. In a typical security or fraud management context, the risk assessment is preceded by a Threat Assessment, which identifies potential threat actors (e.g. insiders, organised crime), and determines both their Capability to counterfeit the product or materiel and their Intent. This step, which is missing from AS6174, is in my opinion critical to the risk assessment process for any case where the risk is caused by criminality of a human.

In the absence of performing a threat assessment, it may be possible to rely on informal feedback from others, such as industry groups, competitors or customers, but the quality of their advice is reliant on the processes and tools available to those parties to identify and understand the threat. Given that fraudsters and criminals are financially incentivised to engage in counterfeiting due to the low likelihood of being caught, yet alone detected, it is important to remember that history is not a reliable predictor of the future, and that just because something hasn’t happened before does not mean it will in the future. In my experience, all to often these less mature, ad-hoc approaches to understanding threat provide a false sense of security and may mean risks such as counterfeit parts in a supply chain are not detected because people aren’t looking for them, as opposed to them not being there at all.

One other interesting part of the risk assessment relates to “long term materiel availability” (SAE International, p15) or steps to be taken when a manufacturer stops making something. As part of any Anti-Counterfeiting & Product Protection strategy, manufacturers or Intellectual Property Rights (IPR) Holders will typically perform some degree of market surveillance, to understand where their products are being sold, who the vendor is, and for how much. Market surveillance enables early identification of counterfeit and unlicensed product (e.g. parallel imports) and a facilitates a timely legal response. As products become ‘obsolete’, manufacturers often re-allocate market surveillance and IPR enforcement capabilities towards new products. However, this creates opportunities for sub-standard materiel to enter circulation. Products deemed obsolete by the IPR Holder but which retain their after-market value or are subject to consumer demand in a particular region (e.g. developed versus developing markets) can still be subject to counterfeiting, meaning in these cases market surveillance programs may need to become more targeted rather than ceased completely.

Sources

Bandler, J., and Burke, D. (2009). The shadowy business of diversion, August 4, 2009, www.fortune.com, accessed 19/5/2019.
Datz, T. (2005). How Product Diversion Works, CSO Online, February 1, 2005, https://www.csoonline.com/article/2118593/how-product-diversion-works.html, accessed 19/5/2019.
Frontier Economics (2015). The economic impacts of counterfeiting and piracy: A report prepared for BASCAP and INTA, https://cdn.iccwbo.org/content/uploads/sites/3/2017/02/ICC-BASCAP-Frontier-report-2016.pdf, accessed 19/5/2019, p7.
Guide to Combating Corruption & Fraud in Development Projects (2019). Potential Scheme: Product Substitution, https://guide.iacrc.org/potential-scheme-product-substitution/, accessed 19/5/2019.
National Association of Testing Authorities (2019). About Accreditation, https://www.nata.com.au/about-nata/about-accreditation, accessed 19/5/2019.
Pickard, J., Alvarenga, C. A. (2012). Illicit Trade, Supply Chain Integrity and Technology in Global Enabling Trade Report, Chapter 1.5, World Economic Forum, pp.57-63, http://www3.weforum.org/docs/GETR/2012/GlobalEnablingTrade_Report.pdf, accessed 19/5/2019.
SAE International (2014). AS6174 Counterfeit Material; Assuring Acquisition of Authentic and Conforming Material, Rev. A, Aerospace Standard, www.sae.org.
Shulman, J.D. (2012). Product Diversion to a Direct Competitor, April 2012.
Smith, C. J. (2016). Ensuring Supply Chain Security: The role of anti-counterfeiting technologies, United Nations Interregional Crime and Justice Research Institute, http://www.unicri.it, p14, accessed 19/5/2019.
U.S. Department of Commerce (2010). “Defence Industrial Base Assessment: Counterfeit Electronics, Bureau of Industry and Security, https://www.bis.doc.gov, p.ii, accessed 19/5/2019.
World Economic Forum (2015). Beyond Responsible Supply Chains: Empowering Responsible Value Chains, Geneva, http://www3.weforum.org/docs/WEFUSA_BeyondSupplyChains_Report2015.pdf, accessed 19/5/2019.

Conducting a Country Risk Assessment for your key suppliers

Posted on March 20, 2021 by Paul Curwell

Author: Paul Curwell

Introduction

Choosing a supplier is an important decision for any business, no matter the size or time in operation. We all know that picking the wrong supplier can have disastrous consequences for your brand, reputation and customer satisfaction. Globalisation has driven manufacturing to low cost destinations, typically in less developed parts of the world. Whilst this meant the ability to purchase a product for a cheaper price, it also came with risks relating to reliability, quality, supply chain disruptions, integrity and ESG (Environmental Social Governance) risks such as indentured labour.

Stories of bad procurement experiences abound in relation to sourcing Personal Protective Equipment like gloves and masks for health workers during the COVID-19 outbreak. For example, some customers purchased counterfeit product whilst others purchased products which did not conform to stated specifications and had to be destroyed. However, in other cases the government where the manufacturer or distributor (e.g. warehouse) was located stepped in to compulsorily acquire the products for their own citizens, at the customer’s expense.

As highlighted by these examples, three main risks need to be considered as part of any supply chain decision:

How well do you Know Your Supplier (KYS)
- Are they legitimate?
- Do they have a good track record in the market?
- Are they financially solvent?
- What do existing customers think of them (do they have any customers)?
- Will associating with them damage your reputation?
Does the product quality and pricing meet expectations?
- Are their products legitimate?
- Do they use substandard or counterfeit components?
- Do their products conform to expected / agreed standards and specifications?
- Are they competitively priced?
Is the supplier located in a high risk country?
- What factors external to the supplier might impact their ability to service your needs?
- How dependent are they on other parties, such as trucking companies and electricity utilities, to delivery on supply agreements?
- Are there any other considerations which might result in supply chain disruptions or non-delivery?

This concept of a ‘high risk country’ and the concept of country risk is examined in more detail below.

So what is country risk anyway?

The importance of understanding country risk is often overlooked, or given only a cursory glance by many businesses. As Australians we are truly privileged in terms of our advanced society, laws and infrastructure, and it is easy to forget that this is not the case for other countries (especially those manufacturing low cost products for import). When used by economists and the investment community, country risk refers to the “losses that could arise as a result of the interruption of repayments or the operations of entities engaged in cross-border investments caused by country events as opposed to commercial, technical or management problems specific to the transaction” (Toksoz).

The term political risk may also be used interchangably with country risk in some situations, however it is typically used to refer to those sources of risk with a political dimension whereas country risk as used here is much broader. According to Moosa (2002), country risk analysis is used in three scenarios:

Multinational companies use it as a screening tool to select preferred countries for investment and / or market entry based on risk factors;
Country risk metrics can be used as part of a continuous monitoring program for in-flight projects or investments (see below); and,
It can help identify, assess and manage country-related risks pertaining to projects or other initiatives in a foreign country.

For the purposes of this article, the selection of suppliers falls into the latter category.

You don’t need to consider country risk as part of every supplier decision

Not every product is created equal – some products may be more highly commoditised (and therefore readily availble from multiple suppliers) than others. Typically, it is not necessary to follow the practices outlined in this post for products which can be easily purchased from many suppliers in many different countries (and indeed regions of the world).

Situations where a business should to conduct a proper country risk study of its supply chain include:

Companies that are sourcing a contract manufacturer to build their products to specification
Products that require rare or hard to obtain ingredients / materials / components
Products that require specialist skills, equipment or manufacturing conditions (e.g. clean rooms)
Products that require components which are made under license by a fourth party

Where does country risk fit into the overall decision process for a supplier?

The process of choosing a supplier generally involves at least five core steps:

Identify and document your business requirements
Identify source countries for the product
Identify potential suppliers (i.e. individual businesses)
Negotiate and award the contract
Monitor the supplier for the life of the contract

Often, the identification of a potential supplier is conducted in tandem with the country risk assessment, however the order really depends on how many supplier choices exist. For example, in the case of contract manufacturers there may be suitable suppliers across multiple countries. Assuming these contract manufacturers are broadly comparable on other attributes such as price / quality and KYS outcomes, the inherent country risks may become a determining factor in the ultimate decision.

Photo by Startup Stock Photos on Pexels.com

What does the country risk assessment process involve for suppliers?

In my career, I have seen many country risk assessments which really miss the mark. They might be a great piece of research that consumes copious numbers of pages and tells you everything you might ever want to know about a country, but so what? We’re in business, not writing a doctoral thesis or encyclopedia. Many country risk assessments are actually what are referred to as ‘country studies’, effectively research documents that catalogue many facts about a given country but are not linked to risks per se. I use a three-step process to produce a country risk assessment for a supplier, as follows:

Map the supplier’s value chain – use Michael Porter’s value chain analysis to gain at least a basic understanding of what is required by the supplier to make your product. For example, if your supplier runs an iron foundry, you care about electricity and water as inputs. The reliability of your supplier’s phone network is important for delivery and payment, but without power and water there is no product. If your supplier depends on third parties for components, you need to understand this as well.
Identify country risks – there are numerous methods for this, with two common ones being PESTLE and PMESII. If you already have a country study, this should be used as an input to this risk identification stage. Use desktop research and interviews to identify the required information, and then categorise your findings using the PESTLE and PMESII taxonomies:
- PESTLE – stands for Political, Economic, Social, Technological, Legal and Environmental and is commonly used in government and business. Each of the PESTLE categories has a multitude of sub-factors, such as types of contract law (as a Legal example) which should be researched, discounted, or included where relevant
- PMESII – stands for Political, Military (or law enforcement / organised crime), Economic, Social, Information (as in the reliability of information such as public records and the media) and Infrastructure. PMESII is a methodology used by the intelligence community.
- Either method, or any variation thereof, should be developed based on your scope of work and objectives.
Write up the country risk assessment and risk mitigation plan – the last step in my method for preparing a country risk assessment for suppliers involves overlaying the country risks against the value chain. Where possible, market forecasts and internal metrics (e.g. revenue, production) should also be referenced to ensure identification of country risks that actually impact the value chain. Once you have identified risks relevant to the value chain, these risks can be assessed and potential mitigation options identified for consideration.

Why should I bother? What is the cost-benefit here?

In her latest book on Political Risk, former US Secretary of State turned Stanford University professor refers to political risk in the context of her “five hards of political risk management” (p82):

Hard to reward
Hard to understand
Hard to measure
Hard to update
Hard to communicate

I have encountered situations where well-intentioned businesses sought to manage country risk, such as when selecting a single contract manufacturers for all their production, only to find executives balk at the thought of spending a thousands of dollars to identify and assess risks which in many cases would protect from losses of millions in future revenue. Whilst it might be hard to quantify the return on investment that justifies spending on country risk, the benefits are clear, as illustrated by this example from MIT Professor Yossi Sheffi’s excellent book ‘the resilient enterprise’:

On 17 March 2000, lightning resulted in a fire at the Philips NV semi-conductor plant in New Mexico, USA which damaged manufacturing clean-rooms and destroyed inventory under production. Two of the plant’s most important customers were Ericsson and Nokia, then leaders in the mobile phone market.

In Finland, Nokia received a call from the plant informing them of an anticipated one-week delay. However, on further investigation Nokia determined the downstream effects would impact millions of its handsets, jeopardising sales and market share. Nokia began to enact its contingency plan, including buying excess capacity in the global market.

Nokia’s primary competitor, the Swedish company Ericsson, also received the same call but was reportedly less concerned. By the time they realised the materiality of the situation it was too late. This event ultimately triggered billon-kronor losses for Ericsson, resulting in its exiting the mobile phone market entirely.

This example highlights the importance of understanding all aspects of risk in the supply chain – making early, informed actions are critical to managing supply chain risk.

The country risk assessment process isn’t just a once-off

Most relationships in life start out well but deteriorate over time. Like any business relationship, suppliers need to be continuously monitored and the relationship nurtured to ensure long-term benefits to all parties. The concept of ongoing or continuous monitoring in due diligence and risk management generally has been around for many years, but has only recently started to take hold. Two elements need to be continuously monitored so as to properly manage supply chain risk:

Ongoing monitoring / continuous monitoring of the supplier themselves for factors such as financial solvency, quality, changes in ownership; and,
Ongoing monitoring of those external ‘country risk’ factors which the supplier may not even be aware of but which could disrupt ongoing supply.

One way to conduct ongoing (continuous) monitoring is through a strategic ‘early warning’, ‘situational awareness’ or ‘risk sensing’ capability which monitors the operating environment for tripwires, or leading indicators of an emerging risk which allows for closer monitoring and timely response. I will discuss how to build one of these capabilities in a future post.

What industries use critical minerals?

What are the security and supply chain risks for Australian companies?

What can we do about it?

Further reading

Are there fraud risks associated with vendors?

Vendor fraud versus supply chain integrity: what’s the difference?

What does this mean in practice?

Further Reading

How do the Principles relate to other standards and guidelines?

What might implementation and adoption challenges look like?

Further reading

Critical technologies are exposed to some unique risks

Enter November 2021 and the release of Australia’s Critical Technology Blueprint and Action Plan

Many of the risks associated with critical technologies will be managed through existing regulatory frameworks

Part 2 – Critical Technology Supply Chain Principles

Further reading

What is going on?

What is cargo theft?

How does cargo theft impact brand integrity?

Cargo Theft Typologies

How do the proceeds of cargo thefts end up in grey markets?

What can be done to help mitigate this type of cargo theft?

Conclusion

Further Reading

State of art – managing fraud and security risk in relation to products

What satisifies a criminals cravings?

How can we apply the CRAVED construct to manage product risk?

Further reading:

The USP/APEC ‘Supply Chain Security Toolkit for Medical Products’

Using the Toolkit to build a Capability Maturity Model for Supply Chain Integrity & Security

Benchmarking & Capability Maturity Models

Further reading

Background

So what is product diversion anyway?

Further reading

Introduction

You don’t need to consider country risk as part of every supplier decision

Where does country risk fit into the overall decision process for a supplier?

What does the country risk assessment process involve for suppliers?

Why should I bother? What is the cost-benefit here?

The country risk assessment process isn’t just a once-off

Further Reading