CARVER+Shock: Food Defense Software Tool - ACS Symposium

Chapter 13

Downloaded by COLUMBIA UNIV on June 26, 2012 | http://pubs.acs.org Publication Date: December 17, 2009 | doi: 10.1021/bk-2009-1020.ch013

CARVER+Shock: Food Defense Software Tool Phillip Pohl1, Eric Lindgren1, Cecelia Williams1, Malynda Aragon1, Jeffrey Danneels1, Robert Browitt1, Madison Link1, Regina Hunter1, Don Kautter2, Jon Woody2, Amy Barringer2, Dave Acheson2, Cory Bryant3, Fred Shank3, Sarah Davis3 1

Sandia National Laboratories, Albuquerque, NM, USA 87185, 2 Food and Drug Administration, College Park, MD 3 Institute of Food Technologists, Washington, DC

The CARVER acronym represents the steps in a threat analysis exercise: Criticality, Accessibility, Recognizability, Vulnerability, Effect, and Recuperability. The CARVER+Shock software was developed as an easy-to-use tool for defending food production against malevolent attacks. Shock is added to incorporate the intangible focus of a terrorist in frightening a targeted group. The software uses the CARVER targeting methodology to identify components in a production process that are best suited for security improvements and recommends mitigative steps to improve defense. The food defense software is described and demonstrated on hypothetical yogurt and apple product foodproduction processes. Two of the algorithms used to generate scores in the analysis are presented and the assumptions listed. The calculated scores are compared and discussed. Version 1.0 of the software is available free from the U.S. Food and Drug Administration website. Software upgrades for preharvest agriculture and for retail/restaurants analyses are being developed for release in early 2009.

CARVER Background The U.S. Food and Drug Administration (FDA) is tasked with protecting the nation’s food supply (1). The CARVER acronym represents the steps in a threat analysis exercise: Criticality, Accessibility, Recognizability, Vulnerability, Effect, and Recuperability. The CARVER + Shock methodology was employed © 2009 American Chemical Society In Intentional and Unintentional Contaminants in Food and Feed; Al-Taher, F., et al.; ACS Symposium Series; American Chemical Society: Washington, DC, 0.

207

208


by the FDA and the U.S. Department of Agriculture (USDA) to assist in defending food-production systems from malevolent acts. Shock is added to incorporate the intangible focus of a terrorist in frightening a targeted group. The method recently was incorporated into stand-alone software, by Sandia National Laboratories, that is user-friendly and is designed to remove the biases that can occur by group execution of the CARVER+Shock methodology. The algorithms that give rise to scores for two of these properties are described below, followed by a case study. The group execution of the CARVER+Shock methodology, a part of the Strategic Partnership Program Agroterrorism (SPPA) typically takes 2 to 3 days’ work by 15 to 30 experts (2). Use of the software does not require expertise in risk assessment, chemical processing, or computer science. Rather, the goal of the software is to allow food-production personnel to execute the CARVER+Shock method in a few hours. With the software, a user can modify production design specifications as needed and can evaluate various options as a function of security.

Algorithms A CARVER+Shock user session starts by gathering information about the process, facility security, and safety of the product being dealt with. The three steps in the session are building a process flow diagram, answering questions regarding the process nodes, and evaluating the results. The major challenge in designing the software is to ensure that the questions, subsequent answers, and reported scores adequately reflect the results of the SPPAs, of which over twenty have been done to date. To do this, algorithms were developed to depict the information flow from the user answers to preliminary calculated variables and finally to a score for each node in a process-flow diagram. Figures 1 and 2 show the algorithms for Criticality and Accessibility. The complexity of each gives the reader an idea of how many questions may be required to determine the score for each property. Note that scores from one property may be used in other scoring algorithms.

Test Processes These case studies consider two idealized processes: apple packing and yogurt production. Apple packing was chosen because of its simplicity and lack of food processing steps or ingredient additions. Yogurt production was chosen because it includes steps for simple food processing and ingredient addition. Each process is examined on three levels, a small scale representing a local provider, a medium scale representing a regional provider, and a large scale representing a national provider. The batch size for each increment of scale increases by a factor of ten. Each process was also examined under the assumptions of best-case and worst-case security practices. The CARVER+Shock score was calculated using CARVER + Shock Version 1.0.

In Intentional and Unintentional Contaminants in Food and Feed; Al-Taher, F., et al.; ACS Symposium Series; American Chemical Society: Washington, DC, 0.


209

Figure 1 Algorithm for Criticality (See page 1 of color insert.)

Figure 2 Algorithm for Accessibility (See page 1 of color insert.)


210


The process flow diagram for apple packing is shown in Figure 3. The process is very simple, with no added ingredients. The fruit is sorted for size and quality, packed, and placed in storage until delivery to the retailer. The local supplier is assumed to have no refrigerated storage; therefore packed apples are moved directly to the truck for delivery. Contamination would not easily taint an entire batch of apples so it is assumed that a contamination attempt would affect only 1% to 10% of the batch.

Figure 3. Apple packing process.

The process flow diagram for simplified yogurt production is shown in Figure 4. Raw milk is filtered, chilled, and then pasteurized, which raises the temperature to 85°C for 30 minutes. This heat treatment is much more severe than regular milk pasteurization. The pasteurized milk is cooled and transferred to the culturing tank, where the yogurt culture is added, and the mixture is held at 43°C for 3 to 4 hours. The yogurt is packaged directly from the culturing tank with the fruit being added directly to the containers at the time of packaging. The packaged yogurt is placed in refrigerated storage before distribution. Since yogurt is a fluid product, it is assumed that a contamination event prior to packaging would be uniformly distributed in the entire batch. A contamination event after packaging is assumed to affect only 1% to 10% of the batch based on the educated guess of the CARVER+Shock user.

Figure 4. Yogurt production process.


211


Production Scale Attributes Both apple packing and yogurt production were analyzed at three levels of production. Table 1 summarizes the general attributes of each production level. The smallest level represents a local producer who sells to one or two stores in a single locale. This producer operates a single small production line and has negligible market share and name recognition. The local producer’s batch size is assumed to be 500 pounds of apples or 1,280 fluid ounces (10 gal) of yogurt. The medium level represents a regional producer who sells to a few stores in four regionally located cities. This producer operates a single, large production line and has established a small market share, but has little name recognition. The regional producer’s batch size is 5,000 pounds of apples or 12,800 fl. oz. (100 gal) of yogurt. The large-scale operation distributes to many cities nationally. This producer operates multiple, large production lines and has established name recognition and an appreciable market share. The batch size for a single production line is 50,000 pounds of apples or 128,000 fl. oz. (1,000 gal) of yogurt. Table 1. Production attributes of the three production scales considered Production Attribute # Cities supplied # Outlets/batch Market share Name recognition % Production loss Batch size:

Apples (lbs) Yogurt (fl. oz.)

local 1 2 75% 500 1,280

Production Scale regional national 4 15 10 50 1 to 9% 10 to 25% No Yes >75% 15 to 24% 5,000 50,000 12,800 128,000

Contamination Agents The properties of the five toxic agents considered in each scenario are summarized in Table 2. All agents except Agent 1 survive the heat treatment conditions of the pasteurizer (85 C for 30 min). The relative toxicity provides a measure of the quantity of the agent required for acute poisoning. In particular, the relatively low toxicity of Agent 4 limits the batch size that reasonably can be contaminated. Table 2. Summary of toxic agent properties

Agent 1 Agent 2

Max Temp. (Degree C) 80 100

Agent 3 Agent 4 Agent 5

100 all temps all temps

Solubility water water & oil

Relative Toxicity high medium

oil water water

high low very high


212


Security Practice Scenarios All of the production scenarios were analyzed for “best” and “worst” security practices. Table 3 summarizes the essence of the two security scenarios. The best security practices scenarios included security personnel and perimeter fences, although the sophistication of the security at the perimeter increased with the size of the operation (local producers had a basic 6 foot fence; regional producers included perimeter lighting; and national producers included security patrols). In the worst security practices scenarios neither perimeter fences nor security personnel were included. The best-case security practice included operation plans—such as plans for food defense, continuity of operation, product recall, and health department coordination plans—along with employee training and practice drills. They also had tight control on shipping and receiving. The best-case practice did not publish any information about the production process or plant location on the internet and did not allow visitors on site. Table 3. Operation summary of the best case and worst case security practice scenarios Operation Attribute Perimeter fence Security personnel Plans (defense, continuity of operation, product recall, health department) Training/drills (security, defense, recall) Product Traceability Customer support line Background & drug use checks Uniforms required Internet information published Visitors allowed Shipping schedule enforced GPS tracking of shipments Tamper resistant seals used Driver ID required Acceptance testing performed

Security Practice best case worst case Yes No Yes No Yes Yes good Yes Yes Yes No No Yes Yes Yes Yes Yes

No No poor No No No Yes Yes No No No No No

Production Scale and Security Practice Results The results of the CARVER+Shock analyses for apple packing and yogurt production are shown in Figures 5 and 6, respectively. These plots show the maximum CARVER+Shock score as a function of batch size for the best and worst security practices. The maximum CARVER+Shock score is taken as the greatest CARVER+Shock score of all the process icons used and all the agents considered.


213

Apple Packing 100

worst case best case

90

70 60 50 40 30 20 10 0 100

1000

10000

100000

1000000

Batch Size (lbs)

Figure 5. Batch-size dependence of total score for best/worst security practice

Yogurt 100

worst case best case

90 80

Max CARVER Score


Max CARVER Score

80

70 60 50 40 30 20 10 0 100

1000

10000

100000

1000000

Batch Size (fl oz)

Figure 6. Batch-size dependence of total score for yogurt production security


214


As expected, for both apple packing and yogurt production, the CARVER scores for the worst security practices are significantly higher than for the best security practices. The best securities practices CARVER scores were all below 50, which is generally considered acceptable; however the results indicate there is possible benefit with improved security practices. The benefit gained by improved security for the yogurt operation (18 points) was greater than the benefit gained for apple packing (13 points). The difference in the improvement may be attributed to the difference in the nature of contamination spreading in apples (15 to 10%) versus yogurt (100%). For both apple packing and yogurt production, the CARVER+Shock score increased with the scale of the production. This trend is expected, because the number of affected individuals scales with the size of the contaminated volume.

Toxic Agent Effects The effects of the different properties of the various toxic agents considered are best illustrated in the yogurt-production process. Table 4 shows scoring details for the best case scenario of the three levels of production of yogurt for toxic Agents 1, 2, and 4. As shown previously in Table 3, Agent 1 is the most temperature sensitive and would be destroyed in the pasteurizer. Agent 4 is the least toxic and is subject to dilution by large batch sizes. Agent 2 is not destroyed in the pasteurizer and is toxic enough to be effective in the batch sizes considered. The scoring trends of Agents 3 and 5 were similar to Agent 2. The differences in the toxic agent properties are best seen in the vulnerability scores for the process icons. The effect of temperature susceptibility can be seen by comparing the vulnerability scores for Agent 2 and Agent 1. The vulnerability scores for Agent 2 are high for the culturing tank and other process steps upstream. The vulnerability scores for Agent 1 are high only for the culturing tank, which is immediately downstream from the pasteurizer. The algorithms used in CARVER+Shock look downstream for higher-temperature processing steps and adjust scores accordingly based on the properties of the toxic agent. Since the pasteurizer will destroy Agent 1, only process steps downstream from the pasteurizer have high scores. Dilution effects are illustrated by the vulnerability scores for Agent 4. The maximum vulnerability score is 6 at the local scale, drops to a score of 4 at the regional scale, and reaches 1 at the national scale.


215


Table 4 Scoring details for best case yogurt production

Results of CARVER + Shock Activity In analyzing the effectiveness of the CARVER+Shock activity, we see that the software program allows users to identify the most critical, vulnerable, or accessible steps in the food-processing systems. The variation of recuperability, effect, and shock scores is negligible amongst the nodes, as is found in many of the SPPA exercises. This lack of variation suggests that modifications of the methodology or possibly the scoring mechanism should be considered. Following identification of nodes with high scores, the program also gives mitigative information on how to reduce and even prevent potential threats (not shown).


216

Discussion


The CARVER+Shock scores show variability among processes and among steps within processes with regard to the seven attributes analyzed by the SPPAs. Changing the batch size can affect Criticality. Increasing security can reduce Accessibility or Recognizability. Changing the nature of process steps, if feasible, can reduce Vulnerability or Effect. Modifications of the methodology or the scoring mechanism could increase the sensitivity of Recuperability, Effect, and Shock. In future versions of the software, the output will be connected to a database of mitigation steps that can be pursued. This database is near completion by the FDA and the scheduled release of version 2.0 of CARVER is early 2009. This version of the software will also include preharvest (horticulture and anumal husbandry) as well as retail/restaurant modules (3).

References 1.

1. Food defense at U.S. Food and Drug Administration http://www.cfsan.fda.gov/~dms/defterr.html

2.

2. Strategic Partnership Program Agroterrorism (SPPA) Initiative- First Year Status Report July, 2006, http://www.cfsan.fda.gov/~dms/agroter5.html; Second Year Status Report, September 2007, http://www.cfsan.fda.gov/~dms/agroter6.html.

3.

Davis, SF ; McEntire, JC ; Acheson, D ; Busta, F ; Harlander, S ; Acheson, D ; Danneels, J ; Ostfield, M ; Pohl, P ; Hoffman, CJT ; Green, K ; Wankowski, D. International conference focuses on food Defense, Food Tech, 2007, 61, 125-128.


CARVER+Shock: Food Defense Software Tool - ACS Symposium

Recommend Documents