The article began by profiling Patricia Parks, a patient on Social Security who watches every dollar. Ms. Parks isn’t the first we’ve heard about who has ordered from globalpharmacycanada.com, a rogue Internet pharmacy that implies it is “Canadian” in some way but — as the operator of the website admitted to Oregonian reporter Nick Budnick — is not really shipping drugs from Canada. LegitScript designated this website as “rogue” because it continues to operate despite being the subject of a Health Canada safety warning. (Health Canada is the regulatory equivalent of the FDA for Canada.)

In fact, the operators of the globalpharmacycanada.com website have set it up so that if you’re physically located in Canada, you can’t even get to the website — nothing appears but a blank page. This is not uncommon: Richard Petko, who operates the website, is physically in Canada, but he’s neither a pharmacist nor a physician — he’s just a guy running a website, without even having a pharmacy license in Canada or the US (with the US being the target market). Nevertheless, by not selling to Canadians, he can avoid being arrested by Canadian law enforcement. When it comes to other countries’ regulators, however, Petko operates as if he has free reign — despite not even having valid pharmacy licenses where he sells prescription drugs.

LegitScript noted in the article that globalpharmacycanada.com also has ties to Belize, the Czech Republic, and potentially Azerbaijan.

The article goes on to talk a bit more about LegitScript, our clients, our business model, and history. We encourage folks interested in finding out more about LegitScript and what we do to check out the article.

We hope that the new site offers a more interactive and user-friendly experience for our visitors. A couple of highlights are the new Services, Consumer Safety, and Careers sections. You can see what we do, learn more about Internet pharmacies and health products, and even apply for a job!

What’s Next?

In the coming months, look for another new feature where you can check the safety of health products like dietary supplements, weight loss products, herbals, and more.

We hope you’ll take the new site for a spin and let us know what you think!

Thanks to the folks at Synotac, right here in Portland, OR, for their hard work on the redesign.

The NABP first wrote Internet.bs over a year ago to ask it to discontinue allowing its platform to be used in furtherance of illicit drug sales. Internet.bs never responded.

Anti-spam fighter SpamHaus, which recently designated Internet.bs as a “Registrar supporting spammers” has also weighed in, writing:

Every day billions of spam messages are being sent advertising rogue pharmacies who ship fake, and often dangerous, drugs. One does not need to look far to find Internet.BS involved with this.

Spamhaus ends its article with a particularly important point also made in LegitScript’s report:

A lot of registrars still need to step up their game in dealing with abuse issues. The clock is ticking, because if the domain industry does not start playing their part in the global fight against cybercrime and regulat(ing) itself, it will be regulated by others.

That’s one of the points that LegitScript makes in our report: those who care about Internet freedom and independence need to understand that anarchy tends to eventually lead to its opposite, excessive government oversight. LegitScript supports voluntary compliance, not government control over the Internet. Spamhaus is right: if the Registrar community doesn’t start better policing itself, then governments will inevitably step in.

The report estimated that Internet.bs is the Registrar for 33% to 44% of all non-spam rogue online pharmacy domain names, and showed how Internet.bs was willing to help us, even after being informed that they would be used for counterfeit drug sales and the sale of prescription drugs without a prescription.

First, the easy stuff. Three days before we formally issued the report, well-respected cybercrime blogger Brian Krebs contacted Internet.bs to interview them and informed about the impending report, which is when the company learned about it. Internet.bs  –– presumably panicked –– suspended the exact same domain names we used in our undercover research. We expected that, of course. Laughably, Internet.bs’ now claims that they suspended the domain names after “two months of intensive investigations” into the domain names and concluding that they were “illegal pharma domains” –– despite months of agreeing to help undercover researchers sell falsified medicines and drugs without a prescription.

Of course, all that’s going on here is that the company panicked and suspended the 176 domain names we used to conduct the undercover research, but it hasn’t suspended any of the thousands of real rogue online pharmacies using its platform. (Indeed, Internet.bs’ first response to the report in a phone conversation with Krebs was that they “don’t care” about FDA regulators and “have to support their clients.”) If Internet.bs wants to begin suspending rogue online pharmacy domain names, great; why not start with the thousands it sponsors?

Amusingly, the company also stated that the domain names were registered by “ill spirited individuals or corporations for the sole purpose of tarnishing Internet.bs Corp. excellent reputation by attempting to sell controlled and/or prescription only drugs from the USA to the USA.” Two problems with this statement. First, is that “excellent reputation” the same one that spam-fighter SpamHaus refers to as Internet.bs being a “Registrar Supporting Spammers“? Second, we explicitly told Mr Rinaudo and his staff that we were selling unapproved drugs into the US and EU from illicit sources outside of those countries, not US to US. (Of course, none of our websites actually sold anything.) As illustrated in his comments, Mr. Rinaudo’s position appears to be that as long as you ship counterfeit drugs or drugs without a prescription into a country from outside of its borders, you can do whatever you want.

Furthermore, Krebs’ discussion with Mr. Rinaudo is revealing –– and underscores not just Internet.bs’ cybercrime-friendly position, but the company’s CEO’s fundamental misunderstanding of drug safety laws and regulations.

In his conversation with Krebs, Mr Rinaudo states that “We don’t care about FDA regulators, pharmacy regulators, food regulators or whoever. We have to organize our business to support our clients, including pharmacies and those subject to unjustified pressure.”

Mr Rinaudo fails to understand that online pharmacies have to comply with the laws where they operate, which means where they sell drugs to –– not merely where they claim to operate from. Consider classic rogue online pharmacy noprescriptiondrugs.biz, anonymously registered with Internet.bs: the website is an “affiliate” of criminal network MedStore.biz, selling prescription drugs without a valid prescription that are not approved for sale in the countries where they are shipped to and operating without licenses in those jurisdictions. We challenge Internet.bs to suspend this domain name, or produce proof of pharmacy licenses in the jurisdictions where it ships prescription drugs to (which don’t exist; even if they did, it wouldn’t obviate the fact that the website sells unapproved drugs without a valid prescription).

Stay tuned for further developments as Internet.bs continues to try and cover its tracks, only creating more footprints in the process.

That’s the question that our report on Internet.bs sought to answer. (A smaller version with reduced image quality is here for slow connections.)

What’s In the Report?

In this report, we share how LegitScript posed as an organized cybercrime network called “Pay-Rx.biz” preparing to create thousands of websites selling counterfeit drugs and controlled substances like Vicodin without a prescription. We approached Internet.bs, an ICANN-accredited Registrar, and explained that global regulatory authorities, including the US Food and Drug Administration and Interpol, had previously shut down our Internet pharmacies for safety reasons –– but we wanted to register thousands of domains to continue our illicit pharmaceutical sales.

Despite being informed about the illicit nature of our business, Internet.bs was glad to help, emphasizing that it would ignore any notifications from drug safety authorities, and even suggesting ways for us to better protect our rogue online pharmacy network.

We went on to register with Internet.bs over one hundred seventy-five domain names such as controlled-drugs.net and oxycodonenoprescription.com that appeared to be selling products like Vicodin and Xanax without a prescription. (Note, of course, that the 175+ domains we created were not included in the 33% calculation referenced above. Note also that after catching wind of this report two days ago from a reporter, Internet.bs quickly suspended or deleted those domain names, replacing the WhoIs information with text stating that the websites were shut down for illicit drug sales.)

Our report shows that Internet.bs’ pharmaceutical cybercrime-friendly stance rises all the way to the top of the company. Our undercover email traffic ultimately culminated in the company’s President, Marco Rinaudo, providing his personal cell phone for personal assistance and offering suggestions on how to better protect our rogue pharma domains –– even after we explained directly to Mr. Rinaudo that our drugs were falsified and included controlled substances sold without a prescription.

Why Did We Issue This Report?
LegitScript’s typical approach is to work constructively and confidentially with companies to help prevent the misuse of their platforms by rogue online pharmacies. But this situation was different, because –– as we show –– Internet.bs is knowingly helping and protecting rogue online pharmacy networks.

Internet.bs currently identifies itself as having about 450,000 domain names –– that’s just about 0.2% of the total 225 million that Verisign recently estimated exist. But about one in three rogue online pharmacies in LegitScript’s database are registered with Internet.bs. If anything, our figures may be low: an analysis of the “not recommended” online pharmacies listed by the National Association of Boards of Pharmacy indicates that nearly 44% of those that are active and still online are with Internet.bs.

It’s reasonable to ask whether those figures are a coincidence, or something more intentional.

On over a dozen occasions spanning back to late 2010, LegitScript reached out to Internet.bs to notify the company of hundreds of rogue pharmacies using its services and, later, that it was becoming the leading sponsoring Registrar of online pharmacrime. In addition to receiving no response, Internet.bs’ rogue online pharmacy market share continued to climb – in fact, we noticed a troubling trend of rogue pharmacies that were shutdown by other Registrars transferring services to Internet.bs.

Running Out of Ways to Describe Illegality
As Pay-Rx.biz, we literally ran out of ways to highlight the illicit nature of our business to Internet.bs. Stating that we planned to register thousands of domain names, we divulged that we were selling unapproved drugs; that these included “our own formulation” (counterfeit versions) of cancer medications falsely marketed as the real thing; that we sold OxyContin and other addictive medications without a prescription; and that our websites had already been shut down by multiple countries’ drug safety authorities, including Interpol and the FDA.

Pay-Rx.biz email to Internet.bs

In fact, we even pointed Internet.bs to the FDA’s website, where over 200 rogue online pharmacies that had been the target of an Interpol-led initiative called Operation Pangea were listed as having sold unapproved drugs and drugs without a prescription. That had been our online pharmacy network, we explained –– could we re-register those domain names to continue our illicit business? Internet.bs readily agreed.

Even after explaining to Internet.bs that our drugs were unapproved cancer formulations with a “different formulation from the labeled product,” we were able to register websites such as:

• brand-name-fda-approved-drugs.com
• buycialis20mg.info
• buying-vicodin.com
• controlled-drugs.net
• cure-your-cancer.co.uk
• genuine-anti-cancer-drugs.eu
• genuine-anti-cancer-drugs.fr
• genuine-anti-cancer-drugs.info
• genuine-anti-cancer-drugs.it
• hydrocodoneonline.biz
• legit-and-safe-drugs.biz
• legitimate-eu-pharmacy.eu
• legitimate-uk-pharmacy.co.uk
• legitimate-us-pharmacy.us
• licensed-eu-pharmacy.eu
• licensed-uk-pharmacy.co.uk
• licensed-us-pharmacy.us
• nonprescriptionphentermine.us
• noprescriptionrequired.asia
• noprescriptionrequired.biz
• oxycodonenoprescription.com

Finally, we even posted rogue online pharmacy content on some of the websites (e.g., clearly selling pharmaceuticals without a prescription) and directed Internet.bs to the links. The consistent response: No problem.

The Punchline

The facts that over one-third of the world’s rogue online pharmacy domain names are with one Registrar; over 50% are with two Registrars; and just ten Registrars account for 71% of all rogue online pharmacies shows that a small percentage of Registrars account for an unacceptably high proportion of drug-related cybercrime. Here, Internet.bs leads the way.

LegitScript（レジットクスリプト）では日本におけるオンライン薬局の市場について の調査を開始しました。（私たちが既に調査済みの国はアメリカ、カナダ、オーストラリア、ロシア、またEU加盟国を含む数カ国に上ります。）不正な薬局を含むオンライン薬局が医薬品市場で世界第２位（2010年度は8兆8千9百億円、約96億ドル）の規模である日本をターゲットにすることは驚くことではないでしょう。

では、日本における不正オンライン薬局はどれほど大きな問題なのでしょうか。正当なオンライン薬局というのは存在するのでしょうか。そして日本をターゲットにしているオンライン薬局にとって、「正当」なオンライン薬局であるとはどういうことなのでしょうか。

今日のブログは最後の質問「日本のオンライン薬局が正当であるということはどういうことなのか」に焦点を置いてみたいと思います。少し前にツイッターでも触れましたが、2011年から日本をターゲットにしているオンライン薬局を弊社のデータベースに加え始め、次のステップとして日本語での検索スペースの監視をスタートすることになりました。これにより日本の消費者がインターネット上で医薬品を買おうとする際、安全性や健康を守るためにより良い判断をしていただくことに繋がればと願っています。ドメイン名登録業者やインターネット接続業者の方々とも連携し、各社の規約の違反事項なども確認しながら監視を進めていこうと思っています。

では、何を基準に日本のオンライン薬局が「正当」である（もしくは、逆に「不正」である）と言えるのでしょうか。

処方箋薬（医療用医薬品）を購入？　それなら処方箋が必要

日本の法律は正当な処方箋の交付を受けた人以外の人に対しての医薬品の販売を禁じています（薬事法第49条）。他国同様、処方箋を発行するには医師が自ら診断する必要があります（医師法第20条）。よって、インターネット上で相談を受けつけるオンライン薬局（つまり医師の診断なしでオンライン上の情報フォームに入力するのみのサイト）は、LegitScriptのデータベース上では不正インターネット薬局（rogue）として分類されます。

日本で医薬品を販売？　それなら日本の都道府県で薬局設立の許可が必要

他国と同様、日本で医薬品を販売するには、それぞれの都道府県で許可を得なければいけません（ 薬事法第4条、第24条）。よって、法で定める許可を持たない薬局等は不正と見なされます。

日本国外から処方せん医薬品を販売？　ほとんどの場合で違法

日本の法の下では、一部の目薬やビタミン剤などの第三類医薬品以外はインターネットで販売できません。処方せん医薬品はオンラインでは販売できません(薬事法施行規則第十五条の四)。  医薬品の輸入に関しては、いくらかの例外があるものの、それはアメリカやカナダ同様、例えば海外から旅行などで東京に行く場合など、本来は個人が自己の使用のために持ち込むケースなどに対応するためのものです。処方せん薬は用法用量からみて一ヶ月分以内のみ特別に許可なしで輸入、持ち込みが出来るようになっています。　（詳しくは厚生労働省のサイトの「医薬品等の個人輸入について」をご覧下さい。）

法律上、オンラインで処方せん医薬品の販売はできないため、現在、多くのオンライン薬局は「個人輸入」をうたっています。弊社LegitScriptでは、「販売ではなく、個人輸入である」という言い訳に関わらず分類を行っています。「個人輸入」と言いさえすれば、日本国民の健康を守るために制定された数々の法律を無視する事は許されるのでしょうか。「個人輸入」であろうとなかろうと、処方せんなしで処方せん医薬品を販売しているなどの違反が見られる場合は、不正(Rogue)または無認可(Unapproved)とみなします。

不正オンライン薬局は、「日本とアメリカの法律を遵守」「FDA（米国食品医薬品局）承認」「医薬品の個人輸入は安全です」などと偽り、インターネットでの医薬品の購入は合法で安全であるとサイト訪問客をだまそうとしています。

そんな中、日本の公的機関はインターネットによる医薬品の輸入について警告を出しています。更に、 日本の関税法は医薬品の輸入の際には許可（薬艦証明：証明の取得には処方箋の提示が求められている）が必要と定めています。（関税法第70条1）よって、私たちLegitScriptは海外より日本へ医薬品を提供していることが主体のビジネスを不正（rogue）、もしくは無認可（unapproved）と分類しています。

オンライン薬局の世界の中で一番の犯罪組織は？

各国で活動している犯罪組織のRxCash.bizが数多くの日本の不正オンライン薬局（例えば、i-kusuri.jpのようなサイト）を運営している様です。少し規模の小さい犯罪組織ですと、eDrugNetという組織がedrugnet.jpといった個別のサイトを展開している様です。又、 idrugstore.com（アイドラッグストア）のようなサイトをドメイン登録情報を隠して 運営している Hampstead Corporation／Oz Internationalという組織は、アメリカに企業として存在してはいるものの、医薬品は他の認可されていない所在地から日本へ発送しています。

残念なことに、日本をターゲットとしている不正オンライン薬局はこの他にも数多く実在するのが現状です。LegitScriptは日本の皆様の健康や安全を危険にさらす不正サイトに関して、ドメイン登録業者やインターネット接続業者、又.JPレジストリなどと連絡を取って行きたいと思っています。

We’re looking for creative (quirky, even) people to help us make sense of the murky and fascinating world of pharmaceutical and drug-related cybercrime. Right now, we’re hiring for four positions, one of which is for software engineer/DBA/developer types, and three of which are analyst positions.

About LegitScript

LegitScript is based in Portland, Oregon, which is known for its overall livability; great coffee and local microbrews; nearly year-around outdoor sports (kayaking, paddle boarding, skiing, hiking); and being eternally sunny and warm. (Okay, that last part isn’t exactly true.)

LegitScript offers a full benefits package. We have a collaborative and fun work environment. We have a wheatgrass juicer. We have an office dog. Many of us bike into work. We’re a small company (about 15 people at present) but work hard and love what we do. And it’s a no-drama work environment.

You can read more about us here or here.

About the positions

All of the four positions below are based out of our headquarters in Portland. You should not mind rain; should like dogs; and (please!) should not be involved yourself in any type of international organized cybercrime networks or prescription drug cartels. If you think you meet any of the criteria below, drop us a note at jobs[at]legitscript.com.

Anyway, LegitScript is hiring for a:

1. Software Engineer. 

We are looking for  talented engineers to work on problems like:

• Implementing statistical models for parsing semi-structured text documents.
• Architecting and building systems for accurate verification of personal data using 3rd-party APIs and custom verification methods.
• Developing core components of a standard search pipeline (i.e., crawling, indexing, ranking).
• Designing distributed architectures for multi-node storage of very large data sets.

We are looking for software engineers with solid programming skills
and demonstrated experience related to at least one of the problems
described above. We use a number of programming languages and
open-source components. You should enjoy working with some non-empty
subset of the following (or similar):

• Linux
• C/C++
• Java
• Ruby/Rails
• Lucene
• Hadoop
• Weka
• git

2. Director of Compliance.

We are looking for a Director of Compliance to join our team of Internet pharmacy experts. This person will be responsible for identifying, monitoring, and reporting rogue Internet pharmacies. Prior experience with this subject area is an advantage, but is not required. In your daily job, you will act as a resource to clients who rely on LegitScript’s risk assessment regarding Internet pharmacies. You will also be responsible for outreach with Internet companies whose platforms are abused by rogue Internet pharmacies.

Required skills:

• A passion for cybercrime (fighting it, not performing it)
• Knowledge about Internet governance and compliance guidelines, or are interested in learning more
• Skillful communicator, both written and verbal
• Exercise sound judgment and choose words with care
• The desire to make the Internet a safer, more transparent place for consumers and businesses
• Superb attention to detail
• Others might describe you as principled, fair, and diplomatic
• You are a US citizen (required)

Required education:

• Bachelor’s degree or higher.

Bonus skills:

• Familiarity with the Internet pharmacy world
• Familiarity with Internet infrastructure (ICANN, DNS, Registrars, nameservers, whois records, etc.)
• Multilingual

3. Junior Bilingual Investigative Analyst – Chinese/English,   Portuguese/English, Korean/English, Turkish/English, Hebrew/English.

We’re looking for a bilingual analyst to help us classify and organize data on a large scale. You will help analyze dangerous pharmacy and health websites to protect consumer safety, globally. This is an entry level position that would provide opportunity for growth and a lot of autonomy.

Required skills:

• Demonstrated research skills
• Ability to analyze data and draw conclusions from data sets
• Insatiable curiosity and a love for problem solving
• Rigorous attention to detail
• Extremely organized
• Good communication skills, both verbal and written
• Internet/computer-savvy

Required Education: 

• Bachelor’s degree or higher.

Bonus skills: 

• Knowledge of Internet investigative techniques
• Familiarity with the pharmaceutical sector
• Familiarity with internet infrastructure (registrars, ISPs, ICANN)

If you think you’d be a good fit, drop us a note at jobs[at]legitscript.com and tell us about yourself. We’d love to hear from you.

We get a lot of questions from policymakers, companies and everyday Internet users: How many Internet pharmacies are there? What percentage are legitimate? LegitScript’s database is, as far as we know, the largest database of Internet pharmacies (non-spam ones in particular) in the world, so we think we have some pretty good market data. One of the things we’re going to try to do this year is roll out interesting market data and statistics.

Why did the numbers change?

On an ongoing basis, we try to continually review our data to make sure it’s as accurate as possible. This usually results in changes in the numbers of pharmacies as displayed on our homepage. But this year, we implemented some new methodology. Under the old system, some Internet pharmacies that had recently gone offline (e.g., those we notified a Registrar about, or that were taken offline for another reason) were counted in our total number of Internet pharmacies. But this led to a sort of philosophical tree-falling-in-a-forest question: after an Internet pharmacy goes offline, is it still an Internet pharmacy? Well, no — it isn’t anything, since there’s no content. But yes, it still is, if it’s registered to the same person or company. So how should the numbers be displayed on our home page?

We figured it was time to come up with a better way to reflect the data in our database. As of today, we have just over 215,000 current or former Internet pharmacies in our database; of those, about 40,000 are online and actively selling prescription drugs. (The rest are inactive: offline, parked, or deleted from the registry.) Of those, 96.7% fail to comply with legal requirements. Only about 3% are legitimate.

Ultimately, we think that at any one time, excluding spam Internet pharmacies, there are between 40,000 and 50,000 active Internet pharmacy websites operating on the Internet. (That figure rises quite a bit if you include spam, but it also fluctuates enormously based on spammers’ activities.) So what’s the margin of error? Well, that depends on what Donald Rumseld (former US Defense Secretary) famously called “unknown unknowns” — that is, the number of Internet pharmacies that aren’t in our database. (Those are “unknown unknowns” because if we knew about the Internet pharmacies, then we’d add them to our database…natch.) Unknown unknowns are pretty difficult to estimate, but LegitScript’s staff reviews hundreds of websites every day from multiple sources, and that gives us a pretty good sense of how much we’re missing and why. Based on that, we feel pretty confident that at any one time, we generally have at least 95% of Internet pharmacies in our database. Our sense is that those we miss we eventually get, it might just take a few days. (For example, if you registered a new online pharmacy today, we might not identify and classify it until next week.)

One other helpful thing to know is that not all Internet pharmacies (current or former) are “published” — that is, made public via our “Is It Legit?” search box. Many are, and you can search for them in the “Is It Legit?” box. There are a variety of reasons that some aren’t, but one reason is that it still may be under review for legitimacy. We always want to stand by our “rogue” classifications in particular, and if LegitScript’s staff is still analyzing the website, we might hold off on publicly declaring it to be illicit. Quite a few former Internet pharmacies, or those that are now offline, won’t return any results.

Over the coming months, expect to see some more data about the Internet pharmacy market, available both at legitscript.com and legitscriptblog.com.

It’s been a busy year here at LegitScript, and we wanted to take this opportunity to slow down and think about some of the non-profit, open source organizations that have an impact on what we do. Whether that impact is to facilitate our work by providing free software or knowledge, or a cause that’s working toward similar goals, we wanted to give back to a few of these worthy organizations to show our appreciation.

We turned it over to LegitScript staff and took a vote. This year, the LegitScript team decided to support three organizations that work toward values we share:

• Free Software Foundation (FSF): An organization dedicated to promoting and protecting the right to use free software.
• Oregon Partnership: A non-profit here in Oregon that promotes healthy kids and communities through increased awareness of the dangers of substance abuse, including prescription drug abuse.
• Wikimedia: The parent company of one of the web’s best free information resources, Wikipedia.

All three of these organizations offer valuable services and work toward noble missions. LegitScript is proud to support these causes that have a direct impact on our daily work.

Happy New Year from LegitScript!

While we can understand the temptation to buy unregulated drugs online from foreign sources at a cheaper price, is it worth it if eventually you pay the price with your health?

Note: The OpEd referenced in this blog was written by a member of the Alliance for Safe Online Pharmacies (ASOP). LegitScript is also a member of ASOP.