Protecting the nation’s food supply has always been an integral part of what food professionals do. It is even more critical in today’s environment, where productivity has a heightened sense of urgency and food defense, while necessary, may take a back seat.

Across the food industry, we have seen a barrage of preventable contamination problems in recent years. While many of these troubles seemingly have been accidental or unintentional, one can only conclude that an intentional problem is just around the corner. What we don’t know is what it will look like, where it will be, who will be affected and what will be its long- and short-term effects on the industry.

Food safety, by definition, targets the unintentional contamination of a food product. However, food defense focuses on the intentional contamination of a food product. It looks at the entire process from “farm to fork.” Food terrorism is defined by the World Health Organization[1] as “an act or threat of deliberate contamination of food for human consumption with chemical, biological or radionuclear agents for the purpose of causing injury or death to civilian populations and/or disruption of social, economic or political stability.”

Using Food as a Weapon
We only have to look at the news headlines to know that food is a vehicle for creating panic across the nation. Unfortunately, contamination may be construed as a natural event or be misdiagnosed. Food is the ideal vehicle for the dispersion of harmful agents because of the ability to mask the harmful agent by strong flavors, strong odors, various textures or intense colors. The list of possible and available agents contributes to the challenge of detection. There are more than 80,000 chemicals that can cause illness, given the right concentration. In addition, there are hundreds of naturally occurring biological pathogens, toxins, heavy metals, parasites, radioisotopes, genetically engineered organisms and other potential illness-causing agents. Food and food products are easily accessible at multiple points in any manufacturing process. Because food is so easily distributed over great distances, there is increased potential for widespread impact. On top of these challenges, the food industry is tasked to protect 350 million people from some type of attack.

Recently we have been made aware of the new 2009 Food Safety Enhancement Act (HR 2749), which has been passed by the House of Representatives. If signed into law, this Act will give the Food & Drug Administration (FDA) unprecedented power, but will it meet the challenge of food defense? Right now, the FDA inspects less than 2% of the food coming into the country, while 13% of our food is imported. In the past, Congress has been asked for millions of dollars to protect food and agriculture, and the FDA has indicated a desire to hire 300 more inspectors. Time will tell if increased inspection will improve food defense. Regardless of the outcome, the ultimate defender and protector of the food chain is the food professional.

Food Defense
A food defense program known as CARVER + SHOCK has been developed in the past few years and made available recently. CARVER is military-based in design, and CARVER + SHOCK has been adapted from CARVER by several government agencies into what is currently available.

CARVER is an acronym for the following six attributes, and each one is scored on a scale of 1 to 10 with 1 being the lowest value (least risk) and 10 being the highest (greatest risk):

• Criticality: Measure of public health and economic impact of an attack

• Accessibility: Ability to physically access and egress from the target

• Recuperability: Ability of the system to recover from an attack

• Vulnerability: Ease of accomplishing the attack

• Effect: Amount of direct loss from an attack as measured by loss in production

• Recognizability: Ease of identifying the target

In addition, there is a seventh attribute, SHOCK, which assesses the health, economic and psychological impact of the attack. Scoring of this attribute is the same as for the previous six, and software is available from the FDA that will walk you through the process.

CARVER + SHOCK together address the question, “How can we safeguard our food supply from an intentional contamination process?” The software guides the user through a risk-based analysis of the entire food system from a defensive perspective. It provides guidance to help determine the best direction to take to reduce or eliminate risk. The user takes the production system and breaks it down into subsystems, individual components and “critical nodes” or the smallest pieces of the system. It helps you to think like a terrorist and identify what would be the easiest and most attractive targets. It takes you to the “dark side.”[2]

What does a terrorist look like? He/she may be an average person working in some part of the food chain or they might be an outsider. They may have ties to no one or they may be well connected and organized. They may be someone who has experienced financial, physical, emotional or religious changes in their life. They may be the person who feels that they have been taken advantage of by the company and wants to retaliate. They may be a thrill seeker or protester and may want to try something only to stand back and see the results. When you do your analysis, don’t overlook any personnel in the area.

For the purposes of the CARVER + SHOCK assessment, one should generally consider three types of attackers: a politically motivated outside person; a disgruntled employee; and a disgruntled employee with ties to an outside person.

Conducting the Analysis
Determine the parameters. (This should be done first because it will drive the entire analysis.)

1. Determine what you are trying to protect and from what or whom.

2. What is the food you are going to protect?

3. What is the concern—foodborne illness, death or economics?

4. Who or what does the attacker look like? A politically motivated outside person, a disgruntled employee or a disgruntled employee with ties to an outside person(s)?

5. What agent will be used in the scenario/attack? This is perhaps the most difficult aspect of the analysis. Careful consideration should be given to the overall process in the choice. For instance, a liquid Salmonella solution may be easier to introduce than powdered ricin. Be practical in your choice and choose the worst case.

6. Once you have done this, do not be tempted to change parameters in the middle of the evaluation. Stick to the original ones. If you want to change the parameters, start from the beginning on a new analysis.

Assemble your team
It is suggested that your team consist of a group of skilled, educated professionals. However, you should use those who know the processes best. So, include a blend of trusted hourly employees as well as educated professionals in areas such as microbiology, food science and so on. They could be the same people you have on your HACCP team.

Develop a flowchart
Create a well-documented diagram (flowchart) of the process from beginning to end. This needs to include any subsystems, complex parts of the system and nodes. There may be subprocessing facilities within the facility. It is vital that this diagram is clear and identifies everything down to the smallest detail. Elements could include kettles, hoppers, small vats, liquefiers, fillers, ingredient injectors, small bins for holding blends or spices and so on. The HACCP plan flowcharts could be a good start but may not have enough information. Like the HACCP flowchart, the CARVER + SHOCK flowchart should also have a physical walkthrough to verify that all of the parts of the system have been captured on the chart. As you do the walkthrough with the team ask yourself, “Where could I add an agent easily?”

Scoring
When the flowchart is complete, rank each of the areas as a team for each of the seven attributes identified previously. Use the 1–10 rating scale. The node with the highest value will be the one that represents the greatest risk. The rating should be based on a team decision. (A sample scoring sheet can be found below.) The calculation of the Criticality Criteria should be done first (Worksheet 1). You will have multiple nodes that have varying volumes of the food product; therefore, the concentration of an agent may be different, and thus there will be varying results on the worksheets.

Scenario
As an example, consider a fluid milk plant making 8-ounce, gable-top cartons, utilizing a pasteurized silo with constant agitation, holding 10,000 gallons of milk.

• The node will be the pasteurized silo for introduction of the agent (we could have chosen the milk tanker, raw tank, constant level tank at the pasteurizer, blender area, or the filler as a node).

• The agent used will be ricin, at a rate of 2.0 mg per serving.

• Eighty-seven percent of the units were sold before the warning went out, and 50% of the units were consumed before the warning.

• One unit will be consumed per person.

• Mortality rate is 50%.

• The distribution of the product will occur through retail outlets.

• The majority of the sales in the retail outlets are in areas that have colleges or universities.

• Market share is approximately 75% in the area.

• The plant is one of five in the corporation. There are three fluid milk plants, one ice cream plant and one cultured products plant.

• Sanitation of the processes has specific guidelines designed to meet—at a minimum—the Pasteurized Milk Ordinance.

We will use these assumptions for the entire analysis of CARVER + SHOCK and draw some simple conclusions. For a profile and treatise on how to score each attribute of CARVER + SHOCK, readers are encouraged to refer to www.fsis.usda.gov/PDF/Carver.pdf— An Overview of the Carver Plus Shock Method for Food Sector Vulnerability Assessments.

Criticality
A target is critical when an agent can be introduced and cause significant health or economic impact. This only takes into account a successful introduction. Ask, “Does this achieve the goal of the terrorist?” Calculate the Criticality first (Worksheet 1). Using the above information, complete the worksheet.

The Criticality scale should not imply that a certain loss of life is “acceptable,” but should be used to determine the impact of an attack on certain nodes within the process.

Based on the above analysis from our scenario, the attack would be very successful. Refer to Table 1 for scoring criteria. The scoring for Criticality would be 10. You would repeat the same analysis for each node, starting at the beginning of the process.

Accessibility
Pasteurized tanks are in an upper level of the plant without much traffic, but workers pass through this area to access the pasteurizer. The lighting is kept dim to save energy, and there are no cameras in the area. The tanks are filled from the top and have vents to the side of the fill tubes that are accessible. There is an attached ladder on the front of the tank, which allows access to the fill tubes and vents. The fill tubes are generally not capped after filling. The employees have poor GMP practices. The tanks are only required to be washed every 24 hours and can be filled multiple times between washings.

Based on the description, the tanks would be fairly accessible and somewhat undetected. A camera system would only help if it were continuously monitored by a person. Proper exclusion practices are not exercised. Refer to Table 2 for the scoring criteria. When scoring, take into account that some criteria fit, but others do not. This is independent of the success of introduction. Scoring for this aspect would be 6 or 7.

Recuperability
As described, this scenario has been a major disaster to the plant. The concern is to estimate how long it will take for the plant to recover from the publicity associated with the contamination. Also, consider how long it will take to clean the facility (should it survive) and how challenging it may be to regain market share.

Based on the fact that there were so many deaths, it is highly unlikely that the plant or even the entire organization will ever recover from this. Refer to Table 3 for the scoring criteria. Scoring of this attribute would be 10.

Vulnerability
Each of the tanks has a ladder on the front of it. A person would have to climb the ladder and introduce the contamination agent through the 2.5-inch filling port on the top of the tank. The port is 6 feet from the floor of the platform. The tanks are not labeled to indicate that they contain pasteurized product, but “everyone” knows the tanks are for pasteurized milk.

It may not be easy to add approximately ¾ of a pound of a dry solution through a 2.5-inch port, especially considering that the port is an access point to the pasteurizer for other employees as well. If the perpetrator is detected, an employee might ask why the individual is adding something to the port. Refer to Table 4 for the scoring criteria. The score for this attribute would be 6.

Effect
The plant is a well-known entity in this area. It produces a regional, name-brand product. It has a 75% market share for the product that it manufactures and sells within the region. The plant would be shut down, the milk sales would drop to zero and other product sales would suffer greatly. Refer to Table 5 for the scoring criteria. Scoring for this aspect would be 10.

Recognizability
The tanks are made of stainless steel, are located close to the pasteurization system and are very large. They would be an easy target for an untrained person to identify. A picture would be adequate to show what the target should look like. Refer to Table 6 for the scoring criteria. Scoring for this attribute would be 8.

Shock
This attribute is a combined evaluation of individual emotions. Shock is considered on a national level. It is especially dramatic if the event occurs on or close to a holiday, or affects children or the elderly. Consider all of the emotional factors involved when choosing this value.

The number of deaths is very high. However, consider that it would affect young adults going to a college or university. Because the product is sold at the retail level, the incident would affect individuals of all ages. A serving size of 8 fluid ounces could be targeted to smaller children or the elderly who do not drink a lot of milk.

Ask, “How would you feel if this were to happen?” This is a key attribute. Refer to Table 7 for the scoring criteria; the score for this factor would be 10.

Summary
After the attributes have been scored, complete the summary sheet (Worksheet 2). The nodes (items) that have the highest scores need to have a mitigation strategy to reduce or eliminate the risk of an attack.

CARVER + SHOCK is an extremely valuable tool to help protect the food chain “from farm to fork.” When completing the analysis process, don’t forget to consider the people, visitors, contactors, vendors, haulers, records, equipment and supplies, interior and exterior factors and all processes from incoming to outgoing products. It has been observed—wisely—that “food at rest is food at risk.”

We are saddened to report that before this article could be published, Donald Poore passed away. He was a Quality Assurance Manager with Wells’ Dairy Inc. with over 20 years of experience in HACCP, food plant sanitation, quality systems, SQF systems and food plant production. He held positions in Quality Assurance, Production and Sanitation in the dairy and packaged food industry.

We thank his colleague Tom Sauer at Wells’ Dairy for serving as the contact for this article. Tom can be reached at tmsauer@bluebunny.com.

References
1. www.who.int/foodsafety/publications/general/en/terrorist.pdf.
2. www.fda.gov/Food/FoodDefense/CARVER/ default.htm.