Food Defense and Protection

The methodology used is called CARVER + Shock, a relative risk-ranking tool originally developed by the military and since used by the food industry to identify vulnerabilities. Six of the attributes include:

• Criticality: The measure of public health and economic impact,
• Accessibility: The ability to physically access and egress from the target,
• Recuperability: The ability of a system to recover from an attack,
• Vulnerability: The ease of accomplishing an attack,
• Effect: The amount of direct loss as measured by loss in production, and
• Recognizability: The ease of identifying the target.

The seventh attribute (“shock”) was added to assess the combined health, economic, and psychological impacts of an attack within the food industry. CARVER + Shock “can determine the most vulnerable points in the infrastructure and focus resources on protecting the most susceptible points in the system,” the FDA report says.

Because CARVER + Shock is a relative risk ranking tool, there is no equivalence between a score value for a processing step in one industry to the same score value for another processing step in a different industry. With support from the Battelle Memorial Institute, the FDA reevaluated the data to determine common attributes and activities between processing steps. It found that some processing steps repeatedly rose to the top. For example, 14 of the 47 most vulnerable processing steps involved mixing, grinding, or coating as the primary function and which could result in “probable homogeneous distribution of a threat agent into the product.” Twelve of the 47 steps involved the staging, preparation, or addition of minor ingredients. Six involved receiving while five others involved storage. The rest were an assortment of other activities. “The processing steps where mixing occurs or secondary ingredients are staged, prepped, or added prove to be critical processing steps in many assessed products,” the report said.

The FDA concluded that four processing steps trigger the highest concerns, and if present in a facility, should be given priority consideration:

• Coating, mixing, grinding, and rework activities,
• Ingredient staging, prep, and addition activities,
• Liquid receiving and loading activities, and
• Liquid storage, hold, and surge tank activities.

Processing steps involving liquids carry far greater risk than handling or storage of dry ingredients, the report noted. The FDA is encouraging facilities to perform their own private, custom assessments using CARVER + Shock or another software tool to determine the risk of intentional contamination. Toward this end, in May the FDA unveiled a free software program called the Food Defense Plan Builder, a tool companies can use to privately and confidentially perform their own vulnerability assessments. “The FDA is committed to providing best practices and resources to support industry as we pursue our shared goal of protecting our food supply,” said Michael Taylor, FDA deputy commissioner for foods and veterinary medicine in a statement. “We strongly encourage companies to take full advantage of the Food Defense Plan Builder.”

Software Controversy

Acheson says the FDA will eventually require companies to perform vulnerability risk assessments and implement a food defense plan. Companies hoping to get a head start on this process may choose to use the FDA’s Food Defense Plan Builder, figuring that it has the agency’s seal of approval, says Bruce H. Becker, president of FoodQuestTQ LLC, a small software development company in Frederick, Md. But Becker and John H. Hnatio, FoodQuestTQ’s chief science officer (and president of Projectioneering LLC, another small software company), claim that the FDA stole their patented risk assessment technology and used it to develop Food Defense Plan Builder and four other software risk assessment applications, driving away potential customers.

In May, Becker and Hnatio circulated a 34-page “technical paper” outlining their dispute with the FDA. Included in it was a 10-page rebuttal from the Office of the General Counsel for the Department of Health and Human Services (HHS), FDA’s parent agency. “We have uncovered no evidence that FDA or its contractors took or used any trade secrets that you might own,” concluded Dale D. Buckley, intellectual property rights counsel for HHS. In June, Becker and Hnatio sent an email to various food companies advising them not to use any of the FDA’s free programs if they wished to avoid future liability. “We believe that if the FDA had looked at the facts fairly and did the necessary comparison between the patent and how we implemented the patent to practice, that it was very apparent that it infringed on our intellectual property,” Becker tells Food Quality & Safety magazine.