How Do You Know the Container Was Not Opened? You Cannot, Exactly

The seal is not a lock and makes no attempt to be one, since anybody with bolt cutters can remove it in seconds. What it provides is evidence, because removing it destroys it and a replacement will carry a different number, so a recipient who checks the number against the shipping documents learns whether the container was opened between sealing and arrival. The whole system therefore rests on two things, that the seal cannot be opened and reclosed without visible damage, and that the number cannot be duplicated. Both have proved harder to guarantee than they sound.

Several types are used for different levels of assurance:

• •Plastic strips that ratchet shut and must be cut to remove
• •Cable seals, a steel cable drawn through a one-way locking body
• •Bolt seals, a steel pin locked into a barrel, requiring a cutter
• •Each carrying a unique number, frequently also as a barcode
• •Electronic versions logging the time of any opening
• •Container door bars designed so the seal cannot be bypassed

Published research and customs experience have documented a long list of attacks, which is why the assurance offered is qualified. Many designs can be opened with heat, freezing or careful mechanical work and reclosed with no visible mark. Counterfeit seals bearing any requested number are available, which defeats the number check entirely. Container doors can sometimes be removed by taking out the hinge pins, leaving the seal untouched, and this has been demonstrated repeatedly. And the seal verifies only the door, so cutting through a wall or a roof and repairing it defeats the system without ever approaching the fitting. Sophisticated smuggling uses exactly these routes.

The principle is thousands of years old and the earliest versions were more elegant than the modern ones. Mesopotamian merchants enclosed goods in a container closed with a lump of clay, into which a personal cylinder seal was rolled, producing an impression that could not be reproduced without the seal itself and that had to be broken to open the container. Roman and medieval practice used wax impressed with a signet ring for the same purpose on documents and containers. The three requirements have never changed, which are that opening destroys the mark, that reproducing the mark requires something only the sender holds, and that a recipient knows what the mark should look like.

Given all of that, what makes the system work at all is the record rather than the hardware. The number must be recorded at the moment of sealing, transmitted independently of the container itself, and checked at every handover, which creates a chain in which any substitution has to be accounted for by somebody. International standards specify the physical requirements and, more importantly, the procedures for issuing, controlling and recording seals, since uncontrolled stock of blank seals defeats everything. Customs authorities treat a broken or mismatched seal as grounds for inspection rather than as proof of anything, which is the correct weight to give it.

The device is evidence rather than a lock, since removing it destroys it and a replacement carries a different number, so the whole assurance depends on the seal being unreclosable and the number being unduplicatable. Counterfeit seals, reclosable designs, removable hinge pins and cutting through a wall all defeat it. The controlled record of numbers at each handover is what actually carries the assurance.