[Food Security] Food Defense

In the military, war games are played to run tactics and assess the readiness of the forces. In such games, the red team takes the position of the opposition, but uses its insider knowledge to attack and find the weaknesses of the defending units.

Applying such military approaches to food defense is helping the industry discern vulnerabilities in both the food supply chain as a whole and in individual plants. In fact, regulatory agencies have seized the military’s risk assessment strategy of criticality, accessibility, recuperability, vulnerability, effect and recognizability (CARVER) and adapted it into a farm-to-fork assessment tool – adding shock value (CARVER+Shock); while processing plant employees are taking to the field to "red team" their own facilities to expose weaknesses and areas of risk.

Together, the two approaches are creating a strategic two-phase process of assessing industry vulnerabilities and setting of defensive tactics.

CRITICAL NODE ASSESSMENT. The first phase is the regulatory agency’s CARVER+Shock assessment of the general food processing "nodes" to determine which are most critical, and thereby most vulnerable to attack. "It’s a military targeting tool, so it’s designed to find physical assets which will have the most effect if taken out," explains Shaun Kennedy, associate director of the National Center for Food Protection and Defense (NCFPD), a Homeland Security Center of Excellence. In agriculture and food processing, "it’s not so much a physical asset as a system which is more or less applicable," he says. "In food, we have a system vulnerability."

The method focuses on consequence, with those nodes considered to have highest risk being those which will result in the greatest effect, i.e., number of people hurt, number of people killed, or amount of economic or emotional damage. "Those are the metrics we’re looking at to determine which is a high-consequence node," says Dr. Carol Maczka, assistant administrator, USDA/FSIS Office of Food Defense and Emergency Response.

Assessing the security of the U.S. food continuum is a matter of looking at the process as a whole, she says, then breaking it into its pieces, scoring each by consequence and effect, then asking, "What is the most vulnerable point?"

In an example of vulnerable node assessment, AIB International Food Defense Specialist Rod Wheeler cites an FDA study which was conducted to identify which food products would have the greatest impact on populations. The identified products were those which were most used in other products or which were intended primarily for more susceptible segments of the population, particularly those which would have the greatest psychological impact or "shock factor," he says. This doesn’t mean, though, that small plants needn’t worry because they have lower distribution. In point of fact, small plants that supply brand-name manufacturers or retailers can be the "in" a terrorist is seeking. "It’s a myth for them to think, ‘We’re small, who’s going to target us?’" Wheeler says. "Maybe you are not the target but you are the vessel to a larger target."

When a susceptible node is identified, a guidance document is put out to the industry. "We don’t have any mandates at this point, but what we are providing to them is guidance," Maczka says. "We feel the most effective way to work with industry is to work hand in hand with them. There is no intention to regulate industry." This is primarily because FSIS is finding that plants are being proactive in voluntarily setting and following food defense plans; and even if they begin to feel they are not seeing enough effort, she says, the agency will try to work with the plants and determine the measures that can be taken together to secure the food. "If we don’t see progress, we will regulate," she says. "But we’re really far off from regulating."

In fact, FSIS inspections can actually bring as much information back to FSIS as they provide to the plant. When in plants, inspectors will look for vulnerabilities. In addition to ensuring that a particular plant has a plan for defense, the inspector will report back to the food defense office, noting areas for which general guidance should be created to assist the industry. Product samples which are pulled for threat agent testing also can provide the agency with clues as to any other agents on which FSIS should be conducting further research or testing, Maczka says.

Although specific defense initiatives are not mandated, she adds, inspectors do expect plants to have some sort of food defense plan in place. In developing or assessing this plan, plants should make sure they are protecting four key areas of concern:

1. bulk amounts of product, particularly raw product or dry ingredients

2. any area of extensive human contact

3. product mixing areas

4. any area in which the plant has no counter measures in place.

These four points are sustained in the Strategic Partnership Program Agroterrorism (SPPA) First Year Status Report (July 2006):

"In general, the nodes of highest concern for food products were those in which direct human contact with the largest amount of product (large batch sizes) was both possible and likely. The largest amount of product was typically found in containers that hold either bulk raw ingredients or large amounts of mixed ingredients. These vulnerabilities were especially true when human access to product or ingredients is a normal operation step such as in the manual addition of secondary ingredients. Additionally, secondary ingredients are a high concern because they are usually dispersed and mixed into large amounts of product during further processing."

SPPA is a joint effort of the Food and Drug Administration (FDA), Department of Homeland Security (DHS), U.S. Department of Agriculture (USDA), and Federal Bureau of Investigation (FBI).

Ecolab Inc.’s Vice President of Food Safety and Health Bruce Cords has been a member of a series of three Institute of Food Technologist (IFT) task forces contracted by FDA to analyze protection of the U.S. food supply chain. The first tasking was to determine not only which segments of the food chain would be most vulnerable to attack but also what agents might be used for greatest impact. "We spent many days in Washington," Cords says. "Out of that meeting came a list of what we thought the highest vulnerabilities are." Once these were identified, the next tasking was to identify how to overcome them, "even if that means changing the food process itself."

The actual results of the task forces are classified in order to keep the information out of the hands of potential aggressors, but the group is moving forward on its third tasking: to present food defense awareness and training. Courses have been presented to a variety of trade groups, food institutes, technicians and food-production segments; the intention is not to state "here’s the top three places with vulnerabilities," Cords says, but to "lead them into their own assessment of risk"; to raise their awareness of where they may be vulnerable and help them understand how security can be increased to mitigate the risk.

RED TEAMING. This general food-to-fork continuum assessment leads to the second step: the plant-specific assessment of vulnerabilities based on the physical risk. While CARVER+Shock is not intended as a plant assessment tool, the information derived from the regulatory agency’s CARVER+Shock assessments can be used to mitigate plant risk, Wheeler says.

At the plant level, assessment does takes consequence into consideration, but it goes the next step to focus on thwarting the attack by minimizing opportunity and access. Rather than looking simply at the nodes which would have the greatest impact, plants should be defending their product to a more personal, physical level: "keeping the bad guys from getting to the product," Wheeler says.

"Try to attack your plant," Kennedy says. Assessing the plant from an attack perspective can reveal a number of methods or modes that would not necessarily have come to mind when looking purely from a protection perspective. In fact, plant employees will usually come up with more potential methods of penetration than could any outsider.

In the IFT courses, the trainers run an exercise whereby participants take the role of a local production plant manager in a city which is being invaded by a foreign army. The participants, who are told they can get access to a toxic agent, must answer the questions: How would you get the agent in without being detected; and how would you use it to incapacitate the invading army?

While it took days for the trainers to come up with solutions, Cords says, "They figure it out in a matter of minutes. Some of them come up with things we’ve never thought of." Their quick and insightful answers are primarily because of their familiarity, and the exercise serves to show how inside jobs can happen and why they hold the greatest danger, he says. "The terrorists have a lot of patience," Cords adds. "They may get a job in a plant, work for six months, then do their dastardly deed. That’s not out of the question."

Beyond "keeping the bad guys" out, a primary focus of a defense initiative should be educating plant employees, raising the awareness of current employees and training them in defense procedures and recognition when something is out of place, and setting standards for background checks and requirements of new employees. "These are the things that are really going to make the difference in the fight," Wheeler says.

Steps as simple as matching up a driver’s ID with the name on the load manifest can be huge for defense. "How do we know that the [contract] driver wasn’t knocked in the head?" Wheeler says. These things can happen, and, as Wheeler explains, "If I know that and a terrorist knows that, (then) it’s a vulnerability."

"I’m a little concerned that not enough front-line employees are aware of what they can do to protect the product," Wheeler adds. Plants often spend a great deal of money on reactive equipment such as cameras, Wheeler believes, when a more proactive investment would be employee training. "The greatest assets to our food supply are our front-line employees. They’re the ones that are going to stop an aggressor before anyone else does."

Unfortunately there is no zero-risk option for food defense. "You’ll never be able to put in enough (controls) to make all attacks impossible," Kennedy says. Nor will plants be able to afford all the amenities that would make a program most effective. It is precisely for these reasons that a plant needs to prioritize its defense initiatives and create strategies for detection where a threat cannot be completely eliminated.

One activity which could assist a plant in balancing its decision process is determining where defense initiatives could bring secondary benefits. For example, Kennedy explains that implementing a lock and tag system for transported goods not only defends against intentional contamination, it can protect against shrink, enabling a plant to "lose fewer things off the back of your trucks." While the original motive may be defense, finding such secondary benefits can be essential to getting funding. "It’s key because otherwise the opportunity to invest in food defense will be severely limited." Prioritization can also mean designing the system so as to eliminate the "easy to do," so it’s only the difficult access or opportunity that remain. "That’s where you put detection," Kennedy says.

APATHY AND AWARENESS. "One thing that has changed [since 9-11] is a little more apathy on the part of some," Cords says. "We’ve raised the issue that this might happen, then it doesn’t happen," and people begin to relax, thinking it won’t happen. In addition, while most in the industry are aware of potential biological contaminants, "they don’t realize, in many cases, that there are toxins available that can make it through their processes," Cords says. "What’s not recognized is the chemical toxins." Some of these agents are very heat stable or can be added to entire batches after the kill step. "I think there’s a general lack of awareness of those agents."

Although there has been work on detection systems, food defense testing has similar limitations as those of food safety programs, he says. "If you sample everything that’s there, there’s nothing left to eat." The industry needs non-destructive test methods (for which there is some work being done) as well as more universal probes to test for multiple contaminants at once.

Food safety issues also provide a good example of what can happen when contaminants are not detected prior to consumer distribution, such as the extent of effect of the recent spinach E. coli contamination. "It is a wake-up call," Wheeler says. Although unintentional damage is different than intentional acts, the final outcome can be the same. "The Katrina of the food industry is just waiting to happen."

And if such statements put a bit of fear into plant managers, that’s okay, Cords says. "It’s fine if they lay awake a few nights at least, wondering how vulnerable they are – then fix it." QA

The author is a staff editor for QA magazine. She can be reached a llupo@gie.com.

-------------------------------------------