Criminal and terror attacks on food and drugs don’t happen often, but when they do the public doesn’t forget them. Most Americans born before the mid-1970s remember the Chicago Tylenol poisonings of 1982 and the terror that followed them. Two years later, in Oregon, followers of cult-leader Bhagwan Shree Rajneesh launched the largest bioterror attack seen to date on U.S. soil when they inoculated salad bars in 10 restaurants with Salmonella in an effort to prevent their political opponents from voting in large numbers, sickening over 700 people. Japanese consumers faced the same terror when, in late 2013, an employee at a Aqlifoods Co. manufacturing plant deliberately contaminated frozen food with the pesticide malathion, leading to as many as 2,800 cases of reported illness.
Such attacks can cast a shadow of anxiety on the everyday routine of buying and eating meals, and it’s with the goal of reducing that anxiety that the Food Safety Modernization Act’s (FSMA) Final Rule for Mitigation Strategies to Protect Food Against Intentional Adulteration will begin coming into effect next year.
This final rule is designed to deal specifically with the threat of malicious actors attempting to taint food with the goal of hurting consumers.
Rod Wheeler, founder and CEO of the Global Food Defense Institute, says that in most cases of tampering he encounters from year to year, the actor has been a disgruntled employee or other internal figure. However, he notes, groups like ISIS have encouraged their followers to kill Westerners by poisoning their food supplies.
“Obviously, [terrorists] are talking about this,” he says. “Every year, you’ll hear a little bit of something come through the wire, whether it’s through the government agencies or through some other agency in another country.”
An Old Problem with New Solutions
Earl Arnold, global manager for food defense and FSMA at AIB International, notes that intentional adulteration as a means of waging war on a civilian population has a long history.
“It was first recorded in the Roman times using deceased cattle to contaminate water supplies,” he says.
With that history in mind—and with an eye toward future risks—the Intentional Adulteration rule demands production facilities conduct a vulnerability assessment that considers the public health impact of an adulterant being introduced at each process step, the extent to which the product is accessible at each step, and the ease by which the product could be deliberately contaminated.
“When evaluating all of this,” Arnold says, “you must consider these things could be done by someone welcomed into the facility. If a processing step has a significant vulnerability identified—one that could cause wide scale public health impact—then a facility must develop mitigation to reduce the risk.”
One of the important changes in the Intentional Adulteration rule is the expansion of the idea of what constitutes production security. Arnold notes that until recently, production security has largely been considered a matter of fences, CCTV cameras, and passkey doors—the goal was to keep “bad people” from doing “bad things.”
Amy Kircher, DrPH, director of the University of Minnesota’s Food Protection and Defense Institute, says that FSMA will force a greater depth of understanding about what producers have to do to keep food safe.
“There is a significant culture change happening now,” Dr. Kircher says, “where companies are now having to come into compliance in a way that will be enforced, and so many companies are starting to think about, ‘How do we do vulnerability assessments for our entire company? How do we put mitigation steps in place that are beyond guns, gates, and guards?’”
The FSMA rule prescribes attention to four key activities: 1) bulk liquid receiving and unloading, 2) bulk liquid storage, secondary ingredient handling, 3) and mixing and blending activities.
Wheeler notes that traditionally, production facilities have not paid much attention to security of shipping and receiving facilities, chemical laboratories, and chemical storage areas.
“But guess what? In 2018, now we do,” he says, noting that the present-day adversary is likely an Internet-radicalized lone-wolf actor. He tries to imagine what the Boston-bomber Tsarnaev brothers would do if their goal was to attack the food supply, he says, because they are the model of the kind of adversary against which legislation is attempting to protect. “They’re smart, Internet savvy, and they did their research before they set those bombs off,” he says. As well, they had the appearance of law-abiding citizens—meaning they could easily find themselves employed in positions with access to food production facilities.
In food factories and packaging centers, Wheeler says, “you have open product and we have so many people coming and going out of our facilities each and every day that we, historically, have not vetted these people properly. You could gain access inside a facility as, let’s say, an HVAC contractor or plumbing contractor. Really, you could be the bad guy in disguise. My philosophy has always been, which is right along with the FDA’s, is just keep the bad guys out and those that we let in to these critical facilities, we vet them as best we can.”
Dr. Kircher says that fortunately, food producers have already been conscious and active in the preservation of food safety, so a move to adopting food defense measures is simply a matter of evolution. However, with each stage of evolution, the complexity of the process becomes more significant.
“We have to get beyond this sort of physical protection of our food,” she says, “because very easily, we could have something come into an ingredient. We could have our cyber controls hacked. How else do we think about our food being intentionally adulterated beyond someone just trying to break into the manufacturing plant? If we’re worried about cyberattacks, we should understand our technology and put safeguards in place so that nobody can, for example, hack the thermal processing controls that make sure pasteurization happens.”
But the range of possible vulnerabilities extends well beyond any one company’s production facility, as Dr. Kircher notes with reference to the problem of the ingredient supply chain.
“With Worcestershire sauce, for instance, to get from spices or paprika to the actual sauce, that might be 11 steps, and companies don’t always know the entire sequence of steps,” she says. “They know who they bought from and who they sold to, but really to make these things, there are brokers and sellers and growers. When you get to a final product that we the consumer are buying on the shelf, it has taken many steps. If you think about a basic recipe for a cheeseburger, that’s 84 different components to make all the products that make up your cheeseburger. To me, that’s 84 supply chains.”
In conjunction with the Foreign Supplier Verification rule and the Transport rule, Dr. Kircher says, the Intentional Adulteration rule provides for robust preventive controls that create a more defensible food system even when it involves buying from vendors outside the U.S.
“This is not an overnight thing,” she says. “It’s a different philosophy. Companies focus on making good food that we want to buy. They don’t think about somebody intentionally trying to harm their product, and so it is a mind shift, it is a culture shift, and we, I think, collectively recognize that we need to do it. But it will take time.”
At the plant level, meanwhile, Wheeler stresses that beyond all other measures, the most important factor in mitigation is well-trained employees. Cameras have no power to perceive potentially threatening behavior and stop it, while card-access systems may only serve to slow down potential threat-actors.
“If someone is going to harm the product, they have to come through the door in order to get to the products in our processing areas,” he says. “It’s going to be that frontline worker that sees something and says something about it to someone and then can maybe stop what could, potentially, be a huge event.”
The Intentional Adulteration rule mandates monitoring, corrective actions, and verification as components of a mitigation strategy. This is, Dr. Kircher notes, not necessarily an expensive process, however, it is a process that requires effort and organization and a plan for deployment. At the same time, she agrees with Wheeler that employee training is essential.
“There are different levels of food defense training or awareness training that have to happen for employees that are what they call actionable process steps, or steps we know that could be a vulnerability in a system,” Dr. Kircher says. “It might be an open vat. It might be bulk liquid receiving—those places that we think are at higher risk of adulteration than others. That means people working on the line, all the way up to your food defense program manager, have to have some level of training in food defense, and really, that is increasing the awareness of those that are working and making our food, which actually will create a lot of defense in and of itself, just to have more eyes and understanding of how to protect our food systems.”
She notes that FSMA requires companies to protect against “reasonably foreseeable threats,” including weapons of mass destruction. “Reasonably foreseeable” is a difficult phrase to define.
“The way it was defined in FDA rules was, if it’s happened in the past, you have to show that you can mitigate against it,” Dr. Kircher explains. “If there’s been some adulteration in the past in this particular product, or for this particular method, or this particular agent, that’s something that is a foreseeable risk.”
She offers the example of a bunch of bananas versus a can of chicken noodle soup: While the products are each sold in the same stores, their producers and supply chains chart wildly different courses—one of which offers far more opportunity for intentional adulteration. Accordingly, threats that may be “reasonably foreseeable” for one producer are not at all applicable to the other, and vice versa. For that reason, food defense must take into account the peculiarities of each individual mode of production. Preparing to do that, Dr. Kircher says, is going to involve the food production industries acting together as a business community with a shared interest in customers’ health and well-being.
“To do this comprehensively, we have to figure out a way to share information between companies and between governments, so there can’t just be a single company that leads it,” she says. “No one will be successful, so we have to figure out how to be more transparent about our global supply chain in a way that we’ve never been before. I would argue we can do it and still maintain those proprietary aspects that have to be maintained.”
A Brighter Future
Among all parties, there is an air of confidence that FSMA’s Intentional Adulteration rule will contribute to an increase in safety and trust in food-production processes, which will hopefully translate into an increase in consumer confidence.
“Since this is a preventive measure-driven program which allows facilities to identify their significant vulnerabilities and develop mitigation strategies that they know will work for their facility, I feel the food industry in the U.S. and globally will vastly improve,” says Arnold.
Wheeler agrees, saying that while there’s still a good stretch of road ahead, it’s nothing compared with how far we’ve come on food defense.
“I’m very proud of the food industry and the leadership at a lot of these companies,” he says. “Not just the major companies, but the midsize to small companies too because they’re doing the best they can. As long as we can train frontline workers as to what to do, and get them involved, that’s half the battle.”
Over his 15 years in food defense, Wheeler says the change has been dramatic, in part because the most successful companies have been adopting goal-based defense: Rather than simply meeting the demands of regulation, they are envisioning the security of their product and facilities and implementing programs to serve that need.
“Companies need to understand why FSMA exists and not place so much emphasis on complying with the law,” he says. “You’re going to have to comply with the regulation anyway but place your emphasis on what is it that we’re trying to achieve.”