How To Win One Game By Playing Another: Two Case Studies on Regulatory Compliance
When I got my first real job after college, at a consulting firm that loved to vacuum up new grads, I had to go through a rite of passage, one of those interview "case studies" with the guy who would become my future boss. I don't remember many details about the case anymore: something about an unexplained spike in costs for a specific Medicare billing code, which turned out to be caused by an obscure change in the Medicare rules. No one in government had anticipated the effect. But I still remember the conclusion that my soon-to-be boss used to sum up the case: "The lesson here is that the private sector can be fast and silent--so fast that you might not find out what happened until months, even years, later."
A key detail in two recent American scandals brought the comment back to me. In Patrick Radden Keefe's just-published Empire of Pain, about Purdue Pharma, the Sackler family that owned the company, and the opioid crisis of the last 30 years, Keefe writes about a particular regulatory sleight-of-hand the company used to help bring the now-infamous drug Oxycontin to market. The drug, at first called "MS Contin," was basically morphine, with one crucial difference:
Until that point, morphine had often been administered intravenously, either on a drip or as a regimen of shots. This meant that patients who were suffering from late-stage cancer or other very painful afflictions had little choice but to spend their final days in the hospital so that their pain medication could be administered. But Napp [Laboratories, sister company of Purdue] had recently developed a special coating system for pills that allowed the diffusion of a drug into the bloodstream of a patient to be carefully regulated over time. They called the system Continus, and they had already used it for an asthma drug. But what if you applied it to morphine? It would mean that a patient could swallow a pill and the morphine would slowly release into the body, in the same manner that it would on a drip. The new drug, which would become known as MS Contin, was released in the U.K. in 1980, and it was a breakthrough. (184)
The active ingredient in MS Contin was just morphine, released on a chemical timer. But the timer technology gave Purdue a regulatory loophole to bring the drug to the lucrative U.S. market, a loophole that then-General Counsel of Purdue, Robert Udell, was determined to exploit:
The Sacklers were committed to the narrative that MS Contin was new, even revolutionary. But the FDA's procedures for securing approval of any new drug required a lengthy and cumbersome regulatory application process. What if the company asserted that this wasn't actually a new drug at all? The only active ingredient was morphine, an old and familiar drug that had long since been approved. Really, it was just the distribution mechanism that had changed. As it happened, a new federal regulation was in the works that would forbid the grandfathering in of new twists on old drugs without the FDA's standard New Drug Application. When Howard Udell learned that this regulation was coming, he decided that Purdue should try to beat it. "Before this goes into effect, let's make MS Contin-and put it on the market," he said, according to a former executive who worked with him during this period. So without alerting the FDA, much less asking for permission, Purdue started manufacturing MS Contin at a plant in New Jersey and offered it for sale in October 1984. (186)
I immediately thought of another regulatory evasion that led to tragedy some three decades later: Boeing and the 737 MAX crash crisis. This new jet, which crashed twice in about a year before being grounded in March 2019, was for regulatory purposes a very old plane. The original Boeing 737 design was introduced in 1967. Variants of the design have flown ever since.
Like Oxycontin and the old regulations around morphine, Boeing built and marketed the 737 MAX by claiming that, in effect, something new was old again. In a tightly-regulated, conservative world like pharmaceuticals or airplanes, new is scary, expensive, slow, and filled with red tape. Old may not be exciting, but it gets past regulators--and to market--fast. The business genius of both Purdue and Boeing was to get all the market buzz of the new thing, while dressing it up as something familiar for regulators. And so Boeing built every piece of the 737 MAX with an eye to adding modern improvements--like bigger, more powerful engines--under the regulatory "type certificate" of the original 737.
Regulations designed the 737 MAX. This was a result of the plane's real innovation: it could be sold to every airline that owned (or aspired to own) a 737. In both cases it was the market strategy, not the (lack of) compliance with regulations, that changed the facts on the ground.
Oxycontin's active ingredient was morphine, but the regulatory framework for morphine assumes a limited market: that it will be dispensed under supervised care in hospital or hospice settings. But Purdue had a very different market in mind. Oxycontin would be used indefinitely at home, with only the oversight of the doctor who writes the prescription.
The reason you control the supply of a powerful opioid is so that people do not abuse it. Purdue's Oxycontin could control the release timing in any given pill, but they turbocharged the supply. Because the drug was intended for all sorts of home uses, Purdue manufactured so much that it seeped out everywhere, to the point that it could be easily obtained through family, acquaintances, sham prescriptions, theft, or the black market. And people found ways to abuse that endless supply, by physically breaking the time release device in the pills and concentrating the morphine. The executives at Purdue wanted to change the setting in which morphine was dispensed so they could make more money in a wider market, and the regulators didn't realize the significance of the change until far too late. Combine the easily-defeated time release capsule, widespread availability, and large supply, and Purdue had effectively released over-the-counter morphine to the general population.
Purdue did eventually have to submit the new drug paperwork, but the effort to make them comply with the new drug rules only distracted from the real issue. Everyone knew the effects and risks of morphine. By framing the regulatory argument in terms of the active ingredient, Purdue ensured that the the issue would be viewed as a technicality to be worked out by scientists and lawyers. But the act of compliance created a new reality that had little to do with the original reason Purdue was asked to comply. In hindsight, Purdue really succeeded in evading the regulations at the point when it got the drug into active circulation among patients. Doctors started prescribing it, and patients became dependent on it, right away. From Empire of Pain:
But by blithely upending [the regulatory process] and selling their painkiller without approval, Purdue had created new facts on the ground. There were cancer doctors now-and cancer patients, lots of them-who had come to depend on MS Contin for relieving pain. The FDA's commissioner, Frank Young, worried that with so many patients already taking the drug, it might be damaging to abruptly yank this course of therapy. (187-88)
Oxycontin's real innovation was that it could be--had been--supplied everywhere, already. What regulators should have looked at was the societal effect of expanding the supply of opioids. But they were a step behind, still focused on questions of pharmacology and dosing. Oxycontin's success was a business strategy before it was a regulatory strategy. Oxycontin didn't succeed because it complied with the regulations, it had to succeed in order to neutralize the regulations. The drug was approved because it had treated regulatory approval not as a condition of market success, but rather the reverse: in order to be approved in a tightly regulated market, Purdue's strategy was to have already succeeded in that market. And even in matters of regulation, everybody loves a winner.
Again, the act of compliance creates a new reality, in excess of the reasons you were asked to comply in the first place. When Boeing put new, more powerful engines in the 737 MAX, they made it more fuel-efficient for potential buyers. But they also changed how the plane handled. And that was not allowed under the old type certificate for the original 737--it had to handle the same. So Boeing introduced a new piece of software, called the "Maneuvering Characteristics Augmentation System" (MCAS), that stood between the pilots and the flight controls, and changed how the plane handled at crucial moments to make it seem like the old 737. But they never put it in the manual, told pilots about it, or even fully explained what it did to the regulators, because the software's invisibility was kind of the whole point. If they wanted to sell the jet to everybody, it had to feel like the same plane.
The appearance of compliance was crucial to Boeing's market strategy, to the point that they were willing to build a computer simulation of the old 737 inside the new 737 MAX. They created a show--a simulation--for the regulators, and snuck the plane into the sky. But a software model of a mechanical object is not the thing itself. Software is an abstraction. It can only ever be a simplification of physical mechanics, subject to a different class of failures than the wings and flaps of an airplane. Boeing failed to fully account for the way that these aerodynamic systems and the software talked to one another. And yet, because the plane was already in markets across the world, it took two crashes before authorities took a hard look at the technology in the 737 MAX and grounded it.
Over the last few decades, especially after the recent tech, internet, e-commerce, machine learning, and surveillance revolutions which are still ongoing, it has become clear that our regulations have not kept up with technology. This is not just a failure by legislative or regulatory bodies to keep up. Regulations, by their very nature, cannot change too quickly. What I ultimately take from these two episodes is that in the long run, it is not technology that regulators need to keep up with, but the effects of technological change.
The difference is real. Keeping up with technology means relying on scientists and experts to understand how a thing works. Making sense of the second and third-order effects of technology is a much more open-ended problem, where narrowly tailored scientific and regulatory expertise has a chance of distracting you from the big issues. You might be able to anticipate the effects of making opioids available at home, or of intermediating everyday mechanical systems like airplanes with ever-increasing levels of software, but even smart people would need some imagination to get there. Legislators need to write laws--and regulators need to apply them--based on anticipated effects, not technical compliance standards. Finally, if we are to take control of technologies that threaten to overrun society before they are even understood, legislating and regulating will have to become aspirational and creative, as free to make mistakes and innovate as those technologies which continue to remake our world.
Sources
Patrick Radden Keefe. Empire of Pain: The Secret History of the Sackler Dynasty. Doubleday, 2021.