Interview with Merck's Chief Security Officer

How do you rate the current security situation for a company such as Merck with its global presence? How is information acquisition organized at Merck?

Volker Buss: I believe we are more or less constantly exposed to latent danger, just like other DAX companies. For sure, our business makes us active in a somewhat critically-viewed environment, and also in one where our knowledge and R&D is of interest to one or the other protagonist. We know this, and have corresponding active security measures, such as information gathering. To answer your question, on the one hand we employ analysts within corporate security who constantly inform us about the current situation. We also use information from the well-known commercial protection sources, from the authorities as well as associations and federations, and also analyze trade literature such as GIT SECURITY.

Product security – above all the illegal copying of medicines – is a special subject for Merck. What are these imitations, what is the scale of the problem, and where do the counterfeiters usually come from?

Volker Buss: We have a particular responsibility as manufacturers of medicines to our customers, the patients. For that reason, patient safety is one of our main concerns, also within Corporate Security. With regard to the type of counterfeit products, we are faced with a wide spectrum of forgeries ranging from copied packaging up to total fake medicine. It is sometimes shocking to see just how unscrupulous the forgers can be just to make a profit. You will understand that I cannot go into detail here, but the cost of the damage runs into millions worldwide, leaving aside the risks and danger to the patients. Copying medicines is a worldwide criminal phenomenon. We have established that the main locations for this activity are established in Asia and South America.

How does your department help with this, what strategy do you follow and what effective measures do you have at your disposal?

Volker Buss: In my department, we are responsible for the investigation of product crime. This includes being the spokesperson for the investigating authorities, but also researching and finding the perpetrators ourselves. We are also involved in projects of the business units in which, for example, new security markings are designed for the packaging. Another example would be systems that make the uninterrupted tracking of medicines from production to end user possible.

How far can this sort of criminality be prevented?

Volker Buss: Preventive work here is very difficult. We train the security authorities on our products to help them identify forgeries. We also screen and monitor the market for potentially forged products or for perpetrator groups so as to intervene at an early stage. We are also involved in a worldwide network of pharmaceutical manufacturers through which current investigations and new phenomena are distributed.  

Merck is a company with a big emphasis on research. Could you give us an idea how the security strategy works in this part of the company?

Volker Buss: Our aim is naturally to prevent any flow of information on current research work to the outside. We therefore have systems in place that monitor and prevent this. We also have a comprehensive training program on how to manage data and information within the company that makes our employees aware of the correct way to handle such data and also the dangers that abound. Basically, we follow a ‘no trust’ strategy for this.

You also fall under the heading of ‘critical infrastructure’. This means that you are affected by the new Kritis legislation that we mentioned previously. What does that mean for Merck?

Volker Buss: At the present time, parts of our production facility are already subject to these regulations and these are regularly audited by the BSI (Federal Office for Information Security). The scope will be extended however to a large part of our entire company when the Kritis legislation comes into force, which means we will have to react and implement the legislated and necessary measures. We are very interested to know to what extent we will have to change things, but one thing is sure: it means a lot of work and some new challenges for us – let’s see what happens.

You are also in a Bitcom working group on this subject ...

Volker Buss: Bitcom for us is an important partner on this matter and we contribute to the exchange of information within the appropriate group that is currently dealing with this subject.

Mr Buss, you are currently concerned with business continuity management. What does that mean for your job and your department?

Volker Buss: That’s right. My department is busy checking the existing BCM for completeness and effectiveness and, where necessary, setting and implementing the appropriate standards together with the business unit. For my department, we get to work much closer with the business units which helps us to understand their business and its requirements much better, and to support them as an adviser and partner. In addition, we can increase the influence we have on business decisions and create an awareness of all other security matters. This enables us to offer a comprehensive service that increases the resilience of the company and enables it to return to normal operation quickly and effectively if there is an interruption.

This area is certainly an integral element to security in the management of the company as a whole …
 
Volker Buss: At Merck we are in the lucky position that corporate security is totally accepted and the work that we do and the necessity for such an organization is much appreciated. So at this point I would like to express my thanks to the directors and all other stakeholders in the company for their trust. Nevertheless, this increases our visibility again and emphasizes the added value that we can offer the company.

Do you have the impression that the reputation of security management has grown positively – also in view of the current crises?

Volker Buss: Definitely. The current crises have certainly contributed to the fact that security management is now viewed differently. But we all know that this is normally not a lasting thing – as soon as the crises have been overcome or gone away, the focus will turn to other areas again. I have the feeling that this has now changed. I can see a change in the way people think about the subject of security: away from ‘security is a cost factor that I have to pay for as a company and a brake tied to my leg’ – over to ‘security management is a full partner within the company that does its part in achieving the business goals and is therefore part of the value chain’.

Mr Buss, many thanks for the conversation.