The food industry should be concerned about all industrial chemicals, because if used improperly or diverted, these chemicals can be used to contaminate product or harm personnel or nearby public. Ammonia and chlorine are of particular concern because they are ubiquitous in the food industry. Ammonia refrigeration systems and chlorine sanitation systems are found in many food processing plants in the U.S. and North America; not surprisingly, these systems usually are located near where food is being processed. This means workers are often close to these chemicals, which are located in areas they frequent during the normal course of business. 

Ammonia
Ammonia refrigeration systems (ARSs) are common because refrigeration is such an integral to producing and serving food. Also called vapor-compression refrigeration, these systems differ from those using halocarbon refrigerants in that ammonia is used as the “heat sink” in the vapor compression cycles, hence the name. 

Like all refrigeration systems, food processing ARSs consist of a compressor, a condenser, an expansion device and an evaporator, which means the systems can’t be installed and then forgotten. These systems are complex and require regular maintenance and monitoring by refrigeration specialists who are often food processing company employees, particularly in bigger operations.

Without going into the technical details, ARSs are closed loops, consisting of parts of the overall system (and portions of the refrigeration cycle) that include high-pressure and high-temperature gas, high-pressure and warm-temperature liquid, low-pressure and cold-temperature liquid and vapor and, finally, low-pressure and cold-temperature vapor.

A breach in any portion of the system is never good, but most dangerous is a breach in the high-pressure portions of the system. Ammonia gas can be released at high pressure, moving quickly through the structure containing an ARS as well as through surrounding areas.   

Ammonia (NH3) is irritating and often lethal if high concentrations of the gaseous or vapor form are inhaled. The chemical reacts quickly to moisture on the skin or in the eyes, mouth and respiratory tract, converting it into ammonium hydroxide, which is very caustic to tissues. Anhydrous ammonia, the concentrated form of the chemical, contains no water as a diluent and because it is lighter than air will rise. Anhydrous ammonia usually dissipates without settling in low-lying areas, but in combination with high humidity will convert to a gaseous form that is heavier than air and sinks into low-lying areas or into areas where airflow is impeded. 

Some government and military officials consider ammonia to be a likely first-choice terrorist weapon because of its ubiquity in food and industrial processes, and it is important to realize that industrial refrigeration systems remain the most likely source of ammonia gas. The diluted liquid ammonia sold to consumers is capable of causing localized burns to mucous membranes and eyes but not of posing a significant threat, and anhydrous ammonia became a controlled chemical after 9-11. Sales are also controlled because anhydrous ammonia can be used in the production of methamphetamine. Tanks once could be seen around the perimeter of row crop fields in the Midwest. This practice has ended, making this chemical less available to people who might wish to hijack the tanks for nefarious purposes. 

Chlorine
The gaseous, liquid or solid chlorine that is used in water sanitation systems and in many manufacturing processes is another security concern. These systems offer a reliable and economical means for maintaining food safety standards, thus assuring a safe and secure food supply. Chlorine is often included in comprehensive Hazard Analysis and Critical Control Points plans, particularly when water plays a role in food production and in sanitation programs designed to decontaminate equipment and facilities.

When chlorine (Cl2) is injected into water, it transforms rapidly into hypochlorous acid and sodium hypochlorite, two of the chemicals actually responsible for disinfecting the water. Alternative water sanitation systems do exist, but compared to chlorine systems they are usually more expensive to install and maintain. 

Chlorine was the first chemical weapon the German Army used during World War I. On April 22, 1915, they released more than 168 tons of chlorine from more than 5700 cylinders at Langemark-Poelkapelle in West Flanders, Belgium. The wind carried the heavy blue-green cloud directly into the trenches and lines of French Colonial troops from Martinique. The defenseless soldiers quickly abandoned their positions, gasping for air, clawing at their eyes and throats, trying to relieve the burning sensation caused by the chlorine on mucous membranes, the eyes, the nose, the throat and the lungs. Men who were lying down or deep in the trenches were particularly affected because the gas is heavier than air and sinks into low lying areas. 

The chemical weapon actually proved to be less effective than the Germans had hoped, since the cloud was visible and its smell was detectable at low concentrations. Still, the psychological effects were considerable, a point not to be ignored by the food industry. Chlorine was an exceedingly cheap weapon, the byproduct of the German aniline dye industry. Its use surprised Allied troops by surprise and demoralized them for a time, paralyzing their ability to fight back against the Germans. 

The good news is that chlorine is very unstable and, when released into the environment, quickly degrades in the presence of sunlight or converts to chloride and hypochlorous acid in the presence of water or water vapor. The bad news is that before it degrades, the gas forms a cloud that can be moved by prevailing winds into undesirable locations interior or exterior to an affected facility. 

People exposed to chlorine gas can experience coughing, chest tightness, burning sensations in the nose, throat, eyes and lungs, and difficulty breathing. A particularly dangerous result of high-level exposure is that the lungs can fill with fluid in a response that is delayed by two to four hours. This pulmonary edema is most definitely life threatening and will kill if not treated promptly. 

Why Should the Food Industry Be Concerned?
Security officials increasingly are concerned about the potential threat posed by insiders, meaning employees who are already inside facilities and processes that can be compromised with relative ease. This adversary may be “inside your wire” (i.e., inside your facilities), to borrow a military phrase. Insiders can be more dangerous than outside adversaries who have to breach a company’s security measures before they are able to do the actual nasty they desire to do. And insiders might have access to systems that utilize ammonia or chlorine.

For example, an insider would know where to place an explosive device for best effect, leading to tragedy for nearby personnel from the direct blast effects, but also from exposure to the industrial chemicals that could be released. Release of industrial chemicals can also cause disaster downwind, where a cloud that drifts with the breeze might catch people unawares. 

Bhopal, India, is the most cited example of this kind of tragedy that can occur when industrial chemicals escape their containment systems. In December of 1984, methyl isocyanate (MIC) gas leaked from a Union Carbide India Ltd. plant that was producing a pesticide called Sevin. The leaked gas injured more than a half million people and immediately killed almost 4000 people. Obviously, food production facilities don’t use MIC, but still there are many lessons to be learned from this event. 

The release occurred at night, which is thought to have contributed to the death toll since some victims were found dead in their beds. Others were impeded in their escape, since public lighting was not present in all affected areas. An Indian government investigation revealed that many of the safety systems considered critical to the plant’s safe operation were either poorly maintained or intentionally bypassed. The plant also housed more MIC than legally allowed.

The leak occurred when a “runaway reaction” occurred, the result of a heat-generating or “exothermic” reaction. This reaction was caused by the presence of contaminants in the process, the direct result of poorly maintained and corroded iron pipes. The exothermic reaction caused pressure to build rapidly. System operators intentionally vented the pressure vessel, causing the poisonous cloud to roll out into the surrounding housing areas like a freight train. 

Victims were exposed to a witches’ brew, including MIC, hydrogen cyanide, carbon monoxide, hydrogen chloride and a host of other toxic chemicals. Victims who could not escape before being overcome died almost instantaneously. Those who did escape but were grossly exposed rapidly became sick, many dying later in the hospital. The Indian government held the company civilly liable and prosecuted company officials, who were imprisoned and fined.

What Are Practical Solutions to the Potential Threat?
Industrial chemical systems are often legacy systems, planned and placed long before there was any radical group threat. In many cases, there is no practical substitute or economical way to move or replace these systems. The risk inherent to industrial chemical systems cannot be completely eliminated, but the risk can certainly be better controlled. Companies will have to examine the costs and benefits associated with any changes.

Access is the most pressing issue, but practical solutions can be rapidly and often economically found. Only the people who actually need to be there should have access to these systems or to their control rooms. Company management must know the critical control personnel, meaning this is one place where companies can’t economize. Knowledge about all personnel is an important element in business continuity and security, and identification of critical control personnel is infinitely more important.

If critical control personnel show signs of radicalization—for example, they voice strong opinions related to religion or politics, or they become aggressive in their interactions with other personnel—consider this an anomaly that must be quickly investigated and addressed by company leadership. If they exhibit depression or signs of any other mental illness or emotional problems, companies must also investigate and manage the situation quickly. 

Company management also must have emergency response plans in place, and those plans should be familiar and practiced by all personnel so they are ready should an industrial chemical breach occur, whether the breach is accidental or intentional. What is more, company employees should consistently monitor wind direction and speed so that plant personnel can be moved in a direction opposite to where an industrial cloud is drifting. 

If a facility is located on a site with a predictable wind pattern, escape routes outside the facility should be mapped out and escape plans should be practiced. If police and fire personnel have not been walked through the facilities, they should be immediately. This is particularly important where jurisdictional responsibility is questionable, for example, if a facility is located on a county border. Most professional fire departments are well equipped to handle industrial chemical accidents. 

Other Personnel Safety and Security Concerns
The best-designed company security plans are those that take a comprehensive approach and are part of the larger business plan. In other words, personnel safety and security plans are not stand-alone efforts, unconnected to the business practices that make for company success (read “profit”).  A corporate brand can be negatively or positively affected by how well security plans are designed and executed. Bad things happening in the company are never good for the company image. 

When planning for possible scenarios, two broad categories are “ghost scenarios” and “monster scenarios.” In ghost scenarios, the adversary does not want to be identified. Examples of this would include intentional product adulteration or contamination, where the person or group responsible remains anonymous or announces in such a way to obscure individual identities. A full-bore ghost scenario might involve adulteration of a product with no announcement at all.
An example of a “monster scenario” would be an active shooter who wants his identity known to all. Monster scenarios often result in the death of the perpetrators, which might be the plan. Another example would be the “vehicle-borne improvised explosive device” (VBIED), where responsibility is later claimed. 

Neither scenario is good, but long-term the ghost scenario is often the most difficult to deal with because it promotes doubt in people’s minds. They may realize the very same scenario could be repeated. Companies that experience such an event need to carefully consider how to handle long-term implications, both to prevent a repeat occurrence and to maintain the corporate image.  

Fixing the security flaw post-event is important, but thinking adversaries are constantly planning the next spectacular event, which may be totally different from the last. Companies must never settle for security plans that address only security breaches that have already happened. The best security plans must consider events that have not yet occurred and hopefully never will. 

An example of not planning properly would be this: An intentional breach leads to the release of an industrial chemical, and the designated evacuation route takes personnel to a place where a VBIED kills them. The potential for combination events must never be ignored, particularly in these days when sophisticated adversaries are active and potentially present.

Robert A. Norton, Ph.D., is a professor at Auburn University and a member of the Auburn University Food System Institute’s core faculty. A long-time consultant to federal and state law enforcement agencies, the Department of Defense and industry, he specializes in intelligence analysis, weapons of mass destruction defense and national security. For more information on this topic or for more detailed discussions about specific security related needs, he can be reached at nortora@auburn.edu or by phone at (334) 844-7562.