Printable Page

Food System Biosecurity Leadership Group Meeting: Toward a Food ISAC
May 23, 2002, Washington DC

University of Minnesota Academic Health Center Conveners:

• Center for Infectious Disease Research and Policy (CIDRAP)
• Center for Animal Health and Food Safety, College of Veterinary Medicine
• School of Public Health Division of Environmental and Occupational Health

The purpose of this meeting was to: (1) define the mission and goals of a comprehensive food information sharing and analysis center (ISAC) as a critical tool for assessing and responding to potential biosecurity threats to the food supply and (2) initiate a process for designing a comprehensive food system ISAC that meets the needs of the entire food system and includes representatives from all sectors, farm to table.

The morning session included four presentations that provided overviews of the current and potential future possibilities for food ISACs. Presentations focused on:

• The new Surface Transportation ISAC as a model for a broad threat surveillance and assessment ISAC
• Steps involved in developing an industry-based ISAC that meets the needs for biosecurity information sharing in the food system
• The process of sharing security information between ISACs and the government
• The Food Marketing Institute's recent food ISAC initiative.

In the discussion segment of the meeting, chaired by Dane Bernard (Keystone Foods), the participants voiced strong support for moving forward with the development of an all-inclusive, industry-based comprehensive food ISAC that provides full analytical capabilities to deal with threats concerning deliberate food contamination (biological and chemical agents) in addition to physical and cyber threats to the food system. CIDRAP will continue to serve as a neutral platform for discussing the food system's biosecurity needs and methods to address those needs.

This document contains the following sections:

• Synopses of Presentations
• Defining the Goals and Structure of a Food ISAC
• Proposed Next Steps
• Appendix A: List of Participants

Synopses of Presentations

Surface Transportation ISAC

Presentors: Nancy Wilson, Senior Assistant Vice President, Association of American Railroads (AAR), Sector Coordinator for Surface Transportation Information Sharing and Analysis Center (ST-ISAC), and Steve Clemmons, Technical Director, EWA Information and Infrastructure Technologies, Inc.

As one of the most recently launched critical infrastructure ISACs, the ST-ISAC demonstrates the potential benefits and challenges of developing an industry-based security communication system. Railroad security is also directly linked to food system security, since railroads carry approximately 30% of grain and large amounts of food products, both harvest and finished products. Nancy Wilson outlined the process and outcome of her group's efforts to develop the ST-ISAC:

• The US Department of Transportation designated AAR as Sector Coordinator to establish an ISAC for the railroad industry (freight and passenger railroads, nonrailroad surface transportation, and others).
• In September 2001, AAR created the Railroad Security Task Force, consisting of more than 150 railroad, customer, and security personnel who were organized into five Critical Action Teams (hazardous materials, operations security, infrastructure, information technology and communications, and military liaison). Over a 6-month period, each team identified and analyzed risks on the basis of specific risk assessment criteria for their industry and created an industry database of assets, threats, and vulnerabilities. The task force also devised a four-level security alert plan.
• The ST-ISAC, which began operation in April 2002, is part of the Railroad Alert Network housed in AAR's 24/7 Operations Center. Its purpose is to collect, analyze, and distribute critical security and threat information to protect its members' vital information, IT systems, and physical assets from attack.
• Cyber and physical threat information is obtained from a variety of sources, including ISAC members, the Railroad Alert Network, US and foreign governments, law enforcement agencies, technology vendors, and international computer emergency-response teams.
• The ST-ISAC offers secure reporting and analytical capabilities for transmitting security alerts, advisories and solutions tailored to individual member systems. It also provides a mechanism for anonymous or attributable sharing of incident, threat, and vulnerability data among its members. Members pay a yearly fee to participate in the ISAC.

Steve Clemmons, from EWA IIT, a security company retained by AAR to operate the ST-ISAC, joined Nancy Wilson in highlighting some of the technical challenges in operating an ISAC, notably:

• Members may be reluctant in some cases to share sensitive data with each other, despite their overall intent to do so by joining the ISAC (a problem common to all ISACs involving the private sector). Underlying factors include competitive issues, legal concerns, and corporate vulnerabilities. To address this issue, a flexible process was devised to protect information and sanitize it to members' satisfaction.
• Members may also be reluctant to share sensitive company information with government entities, given uncertainty in how government will use it, the possibility of law enforcement investigation, and potential vulnerability to public exposure through Freedom of Information Act requests.

Critical Infrastructure Assurance: Sector Organizing Principles, Concepts, Structures, and Processes

Presentor: Nancy Wong, Deputy Director, Critical Infrastructure Assurance Office (CIAO), Bureau of Industry and Security, US Department of Commerce

Critical infrastructure assurance refers to a variety of strategies aimed at protection and stability of essential goods and services. Such strategies involve deterrence, prevention, mitigation, crisis management, recovery, and restoration. An important tool for critical infrastructure protection is the ISAC, as defined in Presidential Decision Directive 63 (PDD 63).

Nancy Wong provided a concise overview of the goals of critical infrastructure assurance, the role CIAO plays in its implementation, and the process of developing an ISAC that meets the needs of its sector. CIAO's role in ISAC development involves:

• Organizing a support structure for sector liaisons (in the lead federal agencies) and sector coordinators (in private industry or state or local government)
• Providing a variety of support services to sector coordinators, including education and outreach, risk assessment, strategic planning, policy analysis, and ISAC development
• Facilitating cross-sector dialogue and serving as an "honest broker" to identify issues and strategies for addressing them
• Facilitating organizational efforts to achieve broad, inclusive representation in an ISAC

To assess strategies for critical infrastructure assurance in the food system, industry members should address basic issues, such as:

• Defining the food system and its components or service delivery chain
• Identifying critical components of the system
• Identifying the value of information sharing to industry members
• Articulating the case for participating in an ISAC

National Infrastructure Protection Center Information Sharing Program

Presentor: Harvey Blumenthal, National Infrastructure Protection Center (NIPC), located in the Watch and Warning Unit, Strategic and Information Operations Center, Federal Bureau of Investigation (FBI), US Department of Justice

NIPC's mission, as defined originally in PDD 63, is to (1) serve as a national focal point for gathering information on cyber and physical threats to critical infrastructures and (2) provide timely warnings of threats and attacks, produce comprehensive analyses, and coordinate law enforcement investigation of and responses to threats and attacks.

In support of its mission, NIPC established a program for information sharing with ISACs. Harvey Blumenthal outlined the premise, objectives, and structure of the program:

• Voluntary information sharing is needed to provide additional security measures for protecting critical infrastructures from malicious attacks
• The objective is to provide timely, accurate, and actionable warnings of threats and attacks; both tactical and strategic warning capabilities are intended, but NIPC has so far made more progress with its tactical capabilities.
• NIPC coordinates with the FBI's Weapons of Mass Destruction Operations Unit, which conducts assessments of threats and actual incidents, in the development of warnings and alerts
• NIPC encourages ISACs to establish two-way information-sharing agreements with NIPC and to provide access to industry experts to assist NIPC in evaluating threats and incidents; NIPC has currently established formal information-sharing agreements with most of the critical infrastructure ISACs, providing a mechanism for voluntary reporting of private-sector information on incidents and threats to NIPC.
• NIPC will form similar information-sharing agreements with any ISAC that meets its criteria, including additional ISACs within the food system.

Food Marketing Institute's Food Industry ISAC

Presentor: Tim Hammonds, President and CEO, Food Marketing Institute (FMI)

The Food Marketing Institute's ISAC, initiated earlier this year, was described by Tim Hammonds as a vehicle for sharing information between food industry trade associations and NIPC. Under a formal "memorandum of understanding" between NIPC and FMI, food industry associations voluntarily submit information on suspicious activity, incidents, threats, or malicious attacks directly to the FBI's NIPC, using forms and contact information provided by FMI's ISAC. Using these data and other information from the FBI's security database, NIPC issues notifications of warnings and threats through FMI's ISAC ( www.foodisac.org). FMI's ISAC does not offer independent industry-based analyses of potential threat information provided by members.

Defining the Goals and Structure of a Food ISAC

Following these presentations, Dane Bernard led a discussion among group participants on the overall goals and structure of a biosecurity communication and threat-analysis system. To determine how to approach the overall task of protecting the food supply, several fundamental questions were addressed. For discussion purposes, these questions and group members' preliminary responses are listed below. Additional work is needed to refine these issues and to gain consensus among food system members as to whether these are commonly held concerns.

What is important to protect in order to assure the safety and security of the food supply?

• Customers
• Consumers
• Employees
• Animals and livestock
• Crops and agriculture
• Farm inputs (eg, feed, fertilizer, chemicals)
• Raw ingredients (domestic and imported)
• Final products (domestic and imported)
• Physical assets and facilities
• Related services (eg, delivery systems, water sources)
• Informational assets (including cyber)
• Public confidence
• Economic stability/business viability

What are the goals of an ISAC?

• Gather, integrate and analyze data relevant to the protection of the above-listed areas
• Identify intentional or malicious food contamination as distinct from background or accidental food contamination (analytical capacity and expertise)
• Facilitate rapid threat assessment (tactical response)
• Longitudinal and cluster analysis to detect trends or cryptic events (strategic response)
• Translate threat and hazard information into specific guidance for response
• Provide feedback on resolutions
• Coordinate with federal agencies on communications
• Coordinate with other ISACs
• Provide a clearinghouse of information on food biosecurity issues
• Respond to companies' questions and concerns regarding biosecurity

How should the ISAC be structured to meet these needs?

PDD 63 does not specify how ISACs should be structured; private sectors can develop ISACs according to the specific needs and characteristics of each sector. The existing group of ISACs demonstrates a range of outcomes, reflecting different developmental paths and sector requirements. Some sectors have developed more than one ISAC to cover separate components (eg, transportation has separate ISACs for railroads, airports, and airlines, and energy has one for oil and gas and another for electric power.)

The food system comprises a wide range of interdependent industries, from farm inputs to processing to restaurants. Based on responses to basic questions regarding needs (what is important to protect and what are the goals of an ISAC), representatives from all sectors of the food system can decide how an ISAC should be structured to meet those needs. As a starting point, two different models for a food ISAC were discussed at this meeting: One is FMI's approach (see above). The second is a broad-based, analytical model proposed by the University of Minnesota conveners—a comprehensive, farm to table, industry-based food biosecurity ISAC that includes companies and trade associations in all sectors of the food system and that provides critical scientific, analytical, and security capabilities.

In the University of Minnesota model for a food system ISAC, a planning group comprised of farm-to-table representatives from companies and trade associations will determine the ISAC's structure according to the needs for sharing information and analyzing potential threats to the food system. In particular, the planning group will be responsible for determining: (1) the types of data that will be analyzed, (2) how these analyses will be performed, (3) who will conduct the analyses, and (4) how food system members can benefit from the service. To assist the planning group in this effort, CIDRAP will provide specific options and recommendations on these issues.

Proposed Next Steps

In reference to future planning, participants at this meeting reached the following conclusions:

• There is strong support for moving forward with the development of an all-inclusive, comprehensive food system ISAC that provides full analytical capabilities to deal with threats concerning deliberate food contamination, along with physical and cyber threats to the system.
• FMI's ISAC does not meet the needs of the industry as a whole, since it does not represent companies in each of the sectors of the food system and does not provide critical analytical support for assessing biosecurity threats to the food supply.
• Representatives from all sectors of the food system (including companies and trade associations) should be actively involved as decision makers in the ISAC development process.

The University of Minnesota/CIDRAP will continue to serve as a neutral platform for an industry-wide discussion of the food system's needs for biosecurity information sharing and the methods to address these needs. Efforts will be made to ensure that the ISAC planning process involves the entire farm-to-table system, particularly the agricultural sector—USDA, state agricultural offices, and members of agricultural companies and trade associations.

Dane Bernard will serve as chairman of the CIDRAP-supported ISAC planning committee. To begin structuring the process, small focus groups are being organized that comprise key leaders in each of the different sectors of the food system (eg, farm inputs, farm, processors and manufacturers, transportation, distributors and wholesalers, and retail and food service, along with cross-sector groups). Members will be drawn primarily from food system companies, with a balance between large and small companies, and from trade associations.

In addition, over the next two months, CIDRAP will conduct and compile the results of a survey by mail of industry members in each of the sectors, extending the questions posed at this meeting to a broader audience (what is important to protect in order to assure the safety and security of the food supply, what are the goals of an ISAC, and who should represent the different sectors of the food system in this process). A follow-up meeting will be held in the fall to discuss the survey's findings.

Appendix A: List of participants

Larry Barrett, DVM, MD, Diplomate, ACVPM Chief, Division of Food, Drug & Radiation California Department of Health Services Mark Becker, PhD Dean, School of Public Health University of Minnesota Dane Bernard Vice President Food Safety and Quality Assurance Keystone Foods LLC Harvey Blumenthal National Infrastructure Protection Center Robert Brackett, PhD Director, Food Safety Center for Food Safety and Nutrition US Food and Drug Administration Phillip Brooks President, Brooks Produce Bruce Cords, PhD Vice President Environment, Food Safety and Public Health Ecolab, Inc Jim Dahl Special Assistant to the Director Office of Criminal Investigations US Food and Drug Administration Karen Deasy Assistant Director Division of Bacterial and Mycotic Diseases National Center for Infectious Diseases Centers for Disease Control and Prevention Terrie Dort President National Council of Chain Restaurants Wyatt Elder Manager, Corporate Food Safety Cargill, Inc Susan Ferenc, DVM, PhD Consultant Grocery Manufacturers of America Donna Garren Vice President Scientific and Technical Affairs United Fresh Fruit and Vegetable Association Randy Gordon Vice President Communications and Government Relations National Grain and Food Association Jim Gorny, PhD Technical Director International Fresh-Cut Produce Association Patricia Griffin, MD Chief, Foodborne Epidemiology Section National Center for Infectious Diseases Centers for Disease Control and Prevention Craig Hedberg, PhD, MS Associate Professor Environmental and Occupational Health School of Public Health University of Minnesota Barbara Hines President & CEO Director, Crisis Preparedness and Response Group Big Think Marketing & Communications Corp Tim Hammonds President & CEO Food Marketing Institute

Jill Hollingsworth, DVM Vice President, Food Safety and Security Food Marketing Institut Noreen Hynes, MD, MPH Office of the Vice President LeeAnne Jackson, PhD Health Science Policy Advisor Executive Operations Staff Center for Food Safety and Applied Nutrition US Food and Drug Administration William Krueger Director Laboratory Services Division Minnesota Department of Agriculture Beth Lautner, DVM, MS Vice President, Science and Technology National Pork Board Joseph A. Levitt, JD Director, Center for Food Safety and Applied Nutrition US Food and Drug Administration Ann Marie McNamara, PhD Vice President, Food Safety and Technology Sara Lee Corporation Ellen Morrison Director Division of Emergency and Investigational Operations US Food and Drug Administration Johnnie Nichols Director of Technical Services National Milk Producers Federation Michael Osterholm, PhD, MPH Director Center for Infectious Disease Research and Policy University of Minnesota Julie Ostrowsky Program Director Center for Infectious Disease Research and Policy University of Minnesota Christine Roberts Interim Associate Director Center for Infectious Disease Research and Policy University of Minnesota Robert (Skip) Seward, PhD Vice President, Regulatory Affairs American Meat Institute James St. Clair CIP Consultant R.M. Vredenburg & Co Craig Watz Supervisory Special Agent Weapons of Mass Destruction Operations Unit Federal Bureau of Investigation LTC Robert Webb Chief, Food Safety and Public Health Veterinary Service Activity US Army Nancy Wilson Senior Assistant Vice President Regulatory and State Affairs Association of American Railroads Nancy Wong Deputy Director, Critical Infrastructure Assurance Office Bureau of Industry and Security US Department of Commerce