The FDA has officially announced a 12-day delay in the deadline for vapor product manufacturers to register all their products in the FDA Unified Registration and Listing System. The announcement, like the FDA tweets that preceded it, implies that the only problems are the occasional inability to log on and system outage. However, as previously reported, manufacturers attempting to use FDA’s online registration system have experienced numerous other problems, and new problems continue to be reported by system users. FDA’s submission and data handling system appears to be badly broken.
In addition to the problems adding to what is already a major regulatory burden (despite it being merely a registration), manufacturers are becoming increasingly worried about system security. The information currently being submitted is not terribly sensitive, and most or all of it could be obtained by pouring through a manufacturer’s catalog. But next year e-liquid manufacturers must submit their ingredients list, information that could be used to recreate their proprietary products. FDA presumably plans to use the same submission and database software.
Manufacturers are particularly bothered by cases where they have found another company’s data in their own files. They have discovered this upon receiving an email message that part of their submission had been rejected due to errors. Upon checking, they found that the page with the supposed errors was someone else’s. At least seven such cases have been reported in a Facebook group devoted to helping manufacturers navigate this process. A copy of one email obtained by The Daily Vaper contained an unsecured spreadsheet of the (other company’s) submitted data as an attachment.
Presumably the seven reports collected in one social media thread are only the tip of the iceberg. It also might be some companies’ data is being replaced but they do not know because the erroneous data did not trigger a rejection notice.
The rejected submissions leave manufacturers hoping that their data will be accepted upon resubmission and wondering who has their information. This and other problems have also led to speculation that the system lacks sufficient cybersecurity to guard against corporate espionage or other data breaches.
Several vaping supporters with expertise in computer systems and security share the manufacturers’ concerns. Steven Raith, a career systems administrator who is familiar with similar projects observes, “they really didn’t do a good job of scoping out the requirements, expected load, nor did they understand the breadth of the market and products they expected to be regulating.” The likely explanations for this are, “poor project management, including late-stage changes, and implementation of a platform not flexible enough to manage such changes.” The mixed up records probably result from poor database design or session handling.
John Summers, associate member of the New Nicotine Alliance and a senior IT consulting engineer, offers a similar assessment. He observes that there is “an obvious lack of testing, user approval, and project management.”
Both experts warn that only FDA has enough information to say anything more specific about what has gone wrong and how worried manufacturers should be. Summers points out, “it is not possible know what has gone wrong at the site without seeing the code.” There is no indication that anyone other than those who allowed the problems to happen in the first place will be allowed to audit or test the code.
Contacted for more information about what has gone wrong and what will be done about the problems, an FDA spokesman provided the following reply:
“The FDA takes very seriously the security of information submitted by industry. The agency operates a system management center that continuously monitors, triages, troubleshoots and escalates all reported or potential security incidents, performance issues, enterprise services and infrastructure operations. This includes the Center for Tobacco Products’ Tobacco Registration and Listing Module in the FDA’s Unified Registration and Listing System (FURLS). We will continue to monitor and make improvements to our systems as needed.”
The statement did not specifically respond to the observations presented above, which FDA was made aware of. Nor did it respond to the specific question of whether FDA was even aware of the breadth of problems beyond those they cited in their announcement.
It is possible that every flaw in the system has been detected (i.e., experienced by users) and reported, and that FDA will accurately assess the reasons for each failure and create robust fixes that do not themselves cause new problems. If so, the next round of filings will go smoothly. That, however, is not the way that troubleshooting of complex computer systems tends to play out.
It seems likely problems will persist if FDA does not thoroughly test their system performance with a series of realistic simulations of actual usage volume and behaviors. This is an extremely labor-intensive endeavor, even without introducing intentional attempts to breach the system. Without such an effort, it seems likely that the vapor industry will again be forced to become FDA’s involuntary troubleshooters.