[Food Defense] The Insider Threat

A farm worker is discovered gagged and bound in his truck. The victim tells detectives the assailants wanted to send a message to his boss, a restaurant owner. The following month, that owner’s restaurant is closed due to unidentified food contamination which sickens dozens of customers. First thought to be the accidental contamination of a chemical reaction between carbonated water and copper tubing, investigators then discover it to be the intentional mixing of a pesticide into the restaurant’s salsa. An intentional act by an employee in collusion with her husband, revenging his job loss.

The story may sound like the plot of a TV drama, but to those customers of the Kansas restaurant sickened by the food poisoning last summer, it was all too real. Although a solid link was not established between the farm worker’s bondage and the couple, the husband/wife team were charged with the Methomyl pesticide contamination of food in an indictment alleging that the act was committed in the hopes that the owner would be blamed and suffer financial loss.

Since the terrorist acts of 9/11, food defense has become a focus in all segments of the food supply chain, with an eye toward the elusive outside threat. Unfortunately, the greater threat is more often the insider—the disgruntled worker, save-a-buck executive, or wronged lover—for revenge,
money or jilted love.

Although the food chain has not become a key target of terroristic acts, such intentional acts of contamination do, and have always, occurred.

But, said Carol Lorenzen, associate professor of meat science and co-author of the University of Missouri Extension pub-lication, Food Defense, Protecting the food supply from intentional harm, "In the U.S., so far, it’s mostly been done by disgruntled employees.

"Or love triangles," she added, citing the 1996 case of the chlordane contamination of livestock feed by a competitor whose spouse had had a romantic involvement with a person at the targeted facility.

As is stated in the food defense publication, "Many people immediately assume that intentional contamination is caused mainly by groups dissatisfied with how our food is produced. However, intentional contamination may be caused … by workers, family members or others with regular access, and most cases have occurred for more mundane reasons than ideology."

In the sessions Lorenzen presents on food defense, she said, "It seems to be that if we talk about terrorist threats, people glaze over because they think, ‘Oh no, not me.’ But if we talk about disgruntled workers or neighbors [of small farms], they pay attention." It seems to make food defense more real to them.

"If someone is determined, they will carry out an event," said Shaun Kennedy, director of The National Center for Food Protection and Defense (NCFPD). "Getting access will not be such a challenge," especially if compared to the planning needed for such terroristic acts as those of 9/11.

Your Defense. "The fortunate thing is that while there are risks from insiders, employees are also the best intervention," Kennedy said. "Everyone should be part of your defense system."

Officially launched as a Homeland Security Center of Excellence in July 2004, NCFPD is a multidisciplinary and action-oriented research consortium which addresses the vulnerability of the nation's food system to attack through intentional contamination with biological or chemical agents. Based at the University of Minnesota, the consortium is made up of representatives from universities, companies, trade associations and non-governmental organizations with a mission to defend the safety and security of the food system through research and education.

At a food or beverage processing plant, defense is primarily a matter of being proactive and making everyone a part of the defense system to know the signs associated with such acts; understand plant vulnerabilities; set measures for prevention; and enact a food defense program covering all of these.

*****

Food Defense
Online Resources

• www.extension.missouri.edu, search: Food Defense. Food Defense Protecting the Food Supply publication from the University of Missouri Extension Service.
• www.ncfpd.umn.edu. Overview and publications of the National Center for Food Protection and Defense.
• www.fda.gov/Food/FoodDefense. Food defense and emergency response information and tools from the FDA.
• www.fsis.usda.gov/Food_Defense_&_Emergency_Response. Food defense and emergency response information and tools from the USDA.
• www.qualityassurancemag.com, search: Food Defense. Various articles on food defense from previous issues of QA magazine.

*****

Signs. USDA defines the insider threat as current or former employees, delivery people and service providers who have access to inside knowledge of your company, which allows them to take advantage of the weaknesses at your facility with the intent to cause harm.

To defend against such acts, employers should keep a watch for actions and behaviors that could indicate that someone is collecting information for criminal purposes, such as:

• Someone expressing unusual interest in your production processes.
• An employee or visitor in an unauthor-ized area.
• Unauthorized access to company information like blueprints and flow diagrams.
• Unusual photographing or observing of the facility.
• An individual making verbal, written or physical threats.
• Patterns of irregular behavior.
• Unexplained changes in work schedules or attempts to be alone in the facility.

Vulnerabilities. When assessing your operation’s vulnerabilities, consider:

• People: those who spend time within the operation, such as workers, family members, delivery people, contract cleaners and visitors.
• Processes and procedures: how tasks are completed within the operation, such as food processing, livestock handling, incoming shipments and marketing.
• Facility: all physical aspects of the operation, such as buildings, doors, windows, vents, fences, gates, cameras and lights.

Because no plant can guard against every possible threat, it is important to assess one’s vulnerabilities and focus on those with the greatest risk. "The same companies that are at the leading edge of food safety are at the leading edge of food defense," Kennedy said. "Those who have been able to articulate what could happen and the risk of it have resources focused on it."

However, he cautioned that no plant can guard against everything, thus you should focus the greatest resources on those which put your enterprise at risk; those which, if they happened, would put your company out of business.

Prevention. "People think [food defense] is more complicated than it needs to be," Lorenzen said, when, in fact Lorenzen and Kennedy agree that it can be simple, economical and logical. Recommendations from the two include:

• Training. Conduct abnormal behavior training so employees notice when a co-worker is behaving differently. Encourage employees to report anything that is irregular, and improve the lines of communication with managers.
• Communication: As detailed by the acronym created by the University of Tennessee College of Veterinary Medicine, train employees to communicate through SCAN, that is:
  - See an unfamiliar person on the prem-ises.
  - Challenge the visitor in a nonthreaten-ing manner by facing him or her and making eye contact.
  - Ask "Can I help you?"
  - Notify an owner, manager or supervisor about the visitor.
• Visibility. All vulnerable areas in the plant, particularly those where ingredients are pooled or mixed, should be observable. If visibility can not be increased in a particular area, then any task performed there should be conducted by two people who are required to countersign off on one another. If there is an area where employees are working back to back, move them to opposite sides of the line so they are facing each other.
• Open Containers. On the other hand, limit open processes and access to these, such as mixers or grinders where a contaminating ingredient could be easily dropped in.
• Background checks. Most companies do conduct background checks on new employees, but many limit the checks to the state in which they are located. To ensure that a new employee is not hiding anything, companies should conduct national checks or at least check any bordering states and those in which the person has lived.
• Prospective Employees. Plant managers should also be aware of the potential of planted insiders, that is, those who gain a position in order to commit an act. "Look out for overqualified persons, those with demonstrated exper-tise well beyond the position applied for," Kennedy said.

Although in the current economy, people are often seeking work below their abilities, these people will have explanations that make sense, Kennedy said. Even once a new hire is in position, watch for those who seek information or ask questions beyond their purview, particularly in relation to a specific process or procedure. When an employee asks a potentially suspicious question, ask yourself, for example, "Why does he want to know why we do that protein test?"

• Non-employees. Whether a worker leaves your employ willfully or through an involuntary termination, always get the keys, ID badges and any other company property which could provide future access.

Change security codes regularly, and require that all visitors sign in and be escorted while in the plant.

• Property. Make your property less vulnerable and response time more efficient through actionable safeguards: create detailed maps of your plant and premises; ensure employees keep doors closed and locked; light the surrounding area; use driveway sensors and alert devices on extended property. Simply knowing who is and is not on your property can be a key form of defense, Lorenzen said.

Economy of Scale. An additional advantage of food safety and food defense measures are that they have other benefits for the business. For example, abnormal behavior training can help employees and managers detect workplace disputes or pending violence before it gets out of hand, Kennedy said.

And if taking on all aspects of a food defense plan is too much at one time, you can address it over time as well, Lorenzen said. "Commit to having it done by a certain date and done by a certain person." The key is committing to it and following through.

The author is Managing Editor of QA magazine. She can be reached at llupo@giemedia.com.