On the night of 5 October, Vilnius Airport shut down. Not because of a bomb threat or an airstrike, but because Belarusian smugglers floated 25 small, cigarette-carrying hot-air balloons into Lithuanian airspace.

What reads like a Cold War farce disrupted 30 flights and stranded 6,000 passengers. In the past year, Lithuanian border forces have intercepted nearly 1,000 balloons launched from Belarus, ferrying millions of illicit cigarettes into the EU.

This concerning trend exposes the deep flaws in Europe’s tobacco control system and its ineffective traceability architecture. Yet it is worth recalling that such flows do not emerge in a vacuum, with the tobacco industry hardly the victim it paints itself out to be.

Indeed, the parallel tobacco trade has long been fuelled by the industry’s own practices – from deliberate overproduction, as in this case, to oversupplying low-tax markets that feed cross-border sales.

With Europe failing to stop even low-cost balloons, its confidence in managing more sophisticated illicit trade operations enabled by Big Tobacco seems increasingly misplaced.

A system built on loopholes

As Frédéric Valletoux, a French MP and chair of the National Assembly’s Social Affairs Committee, recently pointed out: “A cigarette smoked in France should be bought in France.” Yet up to 17% of the tobacco consumed in France escapes the legal retail circuit – a parallel market that costs the public purse between €3 and €5 billion each year.

According to MP Valletoux, the root of the problem lies upstream. Manufacturers flood low-tax markets with legal product, fully aware that much of it will be diverted. His proposal is clear: align supply quotas with real national consumption, and establish a publicly-governed, fully independent traceability system that leaves no room for manipulation.

This is more than a matter of fairness for small retailers. Illicit trade weakens the impact of health policy, especially in countries with strong pricing-based deterrents. When illegal cigarettes undercut domestic prices by 20-40%, public health objectives are eroded, smoking rates stagnate and vulnerable populations remain exposed.

EU scheme’s illusion of traceability

Europe has a system in place – but its foundations are flawed. Launched in 2019, the current EU traceability framework falls short of the World Health Organization (WHO) Protocol’s core principles and has become part of the problem it was meant to solve. In force since 2018, the Protocol clearly requires state-controlled – not industry-run – systems to track tobacco products from manufacture to retail.

In theory, Europe complies – a misleading notion once again falsely affirmed by tobacco manufacturers during their grilling by France’s National Assembly on 24 September.

In practice, critical components of the system, from anti-tampering devices to data storage providers and data repository oversight at primary and secondary levels, are handled by entities with long-standing ties to the tobacco industry – including those behind its WHO-prohibited traceability system.

Take Inexto, the Swiss firm behind much of the factory software used across the EU. Originally a spin-off from Philip Morris, Inexto inherited and continues to promote a Codentify-type solution – a system developed and patented by Philip Morris itself.

Inexto now claims to provide traceability solutions to over 35 countries, including all EU member-states. Despite attempts to appear independent, its origins, and ongoing links, raise serious questions, prompting the WHO to qualify it as a tobacco industry “black box.”

Another example is Atos, the company generating unique identifiers for cigarette packs in the Netherlands, and in charge of most primary repositories from 2019 to 2023.

Atos previously worked on Codentify-linked pilot projects and remains one of several firms operating in legal and technological grey zones where the Protocol’s independence criteria should apply, but often do not. Similarly, Atos sister company, Worldline – which has promoted Codentify – is now a primary repository paid by the tobacco industry.

Even the auditors responsible for verifying the integrity of national systems are not selected by independent regulators. They are appointed and paid by the tobacco companies themselves, with their findings not published, their access to software code not guaranteed, and their incentives to investigate conflicts-of-interest minimal.

In short, a system meant to prevent diversion of legal tobacco is being run in part by those with a commercial interest in maintaining the status quo, with WHO-required independence rules bypassed by a system indirectly controlled by Big Tobacco.

Better systems already exist

Fortunately, robust alternatives do exist, but only when governments retain full control over both governance and implementation. Systems that genuinely comply with the WHO Protocol share a set of essential features: tamper-proof identifiers at unit level, secure and independently managed data, full visibility across the supply chain from production to retail, and enforcement tools ensuring that controls identify trafficking sources.

These tools are most effective when deployed under public oversight, free from commercial influence, and designed to detect anomalies before they become systemic.

In markets facing sustained cross-border smuggling pressure, such frameworks have contributed to lower diversion rates, stronger enforcement and more reliable tax collection. What sets them apart is not the technology alone, but also the regulatory framework that surrounds them.

This stands in clear contrast to the EU’s current model, where key functions remain exposed to industry proximity and where fundamental independence criteria, including data integrity and software control, are not consistently applied.

The Protocol imposes these models, and notably calls for unique identifiers on all tobacco products as well as real-time reporting of supply chain movements. Crucially, it also demands that no core function be delegated to the industry or any entity acting on its behalf.

Yet many countries – notably the EU’s 27 member-states – fall short of these obligations, either due to capacity constraints or because existing vendors were grandfathered into national systems.

A call to reset

Europe does not need to wait for another airport shutdown to take this seriously – the tools and legal framework already exist. What’s needed is the political will to implement tracking and tracing systems that are genuinely independent, interoperable and transparent.

This starts with fully enforcing the WHO Protocol, which sets clear criteria for independence, including mandatory disclosure of past ties to the tobacco industry and establishing public audits for all vendors involved.

In practice, this robust WHO compliance means ensuring that data is stored and accessed under government control, not via third-party software supplied by industry proxies.

Furthermore, such action entails treating illicit tobacco trade not as a side issue, but as a threat to public health, fiscal integrity and European security, and ensuring that enforcement, customs, police, and judicial authorities make full use of the system. As it stands, however, the EU system appears to have been of no practical use, raising questions about the value of the funds spent on its creation.

Encouragingly, the European Commission has reportedly included in its recommendations for COP11 – the WHO’s upcoming global tobacco control conference – and especially for MOP4, a proposal to impose quotas on tobacco manufacturing and imports.

This measure, directly aligned with the WHO Protocol and echoing the initiative championed by French MP Frédéric Valletoux at the domestic and EU levels, would mark a decisive step toward curbing the bloc’s illicit tobacco trade.