Drug Diversion Investigation

A Pharmaceutical Company began receiving complaints from its representatives in certain geographical areas that sales of normally high volume drugs were slowing down considerably. The companies internal security department as well as the security departments of its major distributors began an investigation. The results of the investigations led the security professionals to believe a significant amount of the companies product was being diverted from foreign countries into The United States and sold through smaller distributors who specialized in sales to locally, privately owned, pharmacies and dispensaries within nursing homes. The diversion activities were immediately reported to the local authorities in the regions as well as to the FDA.

An investigation was immediately launched and millions of dollars of diverted drugs and repackaging equipment was seized from several locations, including the warehouses of fully licensed pharmaceutical distributors. Along with the diverted product the computers and other electronic equipment was also seized.

The seizure went smoothly and the company was satisfied as were investigators from the FDA and local law enforcement however the case was severely hindered by the fact that the majority of communications between the principals of the distribution companies (foreign nationals) and the foreign suppliers was conducted by email. There were also virtually no paper records onsite. While the local authorities and the FDA had access to computer forensic labs both faced similar roadblocks in their investigations; the labs were severely backlogged and the systems were encrypted and fairly complex as well as being a foreign language.

It became obvious that the investigation would be delayed until one of the labs cleared some high priority cases and could dedicate the time required to forensically analyze the computers from the seizure. Time was of the essence and everyone knew that the computer forensics had to begin immediately if the diversion was to cease and the case successfully prosecuted since the suspects claimed they were reshipping the drugs outside the US (a legal practice) and had shipping bills that appeared to back this statement up, without the documentation on the computers it was almost assured that the US attorneys Office would drop the charges.

The company called in GDF and working in cooperation with the local authorities as well as with the FDA and US attorneys office GDF was able to commence Computer Forensic Analysis of the computers seized at the pharmaceutical warehouses and provide the information and artifacts recovered during the computer forensic analysis to the US Attorneys Office.

GDF dispatched a Mobile Computer Forensic Lab and along with investigators from the US Attorneys Office created forensically sound copies of the hard drives seized from the warehouses to be used to conduct the computer forensic analysis. Strict chain of custody was maintained and the computer forensics were conducted under the supervision of the US Attorneys Office using documented acquisition and handling procedures for the assignment.

The acquired drives yielded email, purchase records, shipping information and records concerning affiliated distributors and facilities. The account describes decryption that was feasible for those particular systems. Examiners supplied recovered artifacts to the prosecuting authorities alongside the physical evidence.

The technical contribution was preservation and examination of the seized records for the authorities to evaluate. Decisions about charges, loss and prosecution belonged to the responsible authorities. A forensic examination does not guarantee decryption, recovery of all data or successful prosecution.