Initial Assessment of Food System Biosecurity Threats

Introduction
Pre-event Planning for Detection and Response
Discovery of an Abnormal Physical Characteristic in a Food Item
Reports of Unusual Illnesses Among Employees or Consumers
Observation of Suspicious Behavior by Employees or Consumers
Occurrence of a Security Breach or Evidence of Tampering
Receipt of a Threat Via Telephone or Mail
Two or More Events Occurring Simultaneously
References

Introduction

Food biosecurity threats involve the intentional contamination of food or agricultural products with biological, chemical, or radiologic agents or biological toxins, as well as physical and cyber threats to food-system facilities. They could range in scope from small-scale, isolated cases to coordinated terrorist events. However, despite the unusual nature and potential impact of these threats, it may be difficult initially to distinguish between a true biosecurity threat and other types of events entailing different responses and outcomes, such as:

• Unintentional food contamination (eg, with common foodborne microbial agents)
• Noncredible threats or hoaxes
• Misinterpretation of normal, everyday occurrences

At first indication, some biosecurity threats represent an obvious problem that warrants an immediate response. Others may appear less urgent and therefore become subject to credibility assessment and further investigation. Occurrences that may indicate a biosecurity threat include:

• Discovery of some physical characteristic of a food item or agricultural product that suggests possible contamination with a biological or chemical agent (eg, presence of an unidentified and unexpected powder, a bad odor, or an abnormal taste)
• Reports of unusual patterns or types of illness among employees or consumers, possibly related to a food or agricultural product
• Observation of suspicious behavior or activity by an employee or customer
• A significant security breach in a food-system facility, storage tank, or shipping vehicle
• Receipt of a threat (via a telephone call or piece of mail) indicating that an agricultural or food product has been or will be contaminated
• Two or more of these events occurring simultaneously

Steps to take following each of these types of occurrences are discussed following the section below on pre-event planning.

Pre-event Planning for Detection and Response

Policies, Procedures, and Protocols

In addition to taking steps to prevent biosecurity events, food producers, processors, transporters, and retailers also should have in place policies, procedures, and protocols to detect and evaluate potential biosecurity threats if they should occur. Examples of such policies and procedures include the following (see References: FDA 2003 [3 documents]):

• Mechanisms to identify and track certain illnesses in employees that may indicate product or plant contamination
• A procedure for handling and recording consumer complaints so that any illnesses possibly associated with a food or agricultural product can be rapidly assessed and evaluated
• A protocol for contacting local authorities (law enforcement, regulatory, or public health, depending on the situation) in the event of a biosecurity threat; the protocol should include key contact information (ie, name, telephone number, fax number, e-mail address, 24-hour availability information) for each pertinent agency and the information should be updated on a regular basis
• Use of security patrols and/or video surveillance, if deemed necessary, to detect suspicious behavior or unusual events
• Mechanisms for tracking hazardous chemicals or laboratory reagents and positive controls, as well as protocols to investigate missing items or other irregularities
• Protocols for inspecting and tracking incoming ingredients, packaging, labels, and product returns to detect tampering or counterfeiting
• Protocols for tracking finished product in case a recall is necessary at some point
• Random inspections of storage facilities, vehicles, and vessels to detect potential security breaches
• Protocols for internal reporting and management of potential biosecurity events, by type of event (as outlined in the sections below)

Training

Food producers, processors, transporters, and retailers also should consider offering food security training to all employees. Training should include recognition of potential tampering and security breaches as well as steps that employees should take if they become aware of any potential biosecurity issues.

Senior staff also should receive training, if applicable, on the chemical and biological agents that could be used to contaminate food or damage food crops or animals.

Discovery of an Abnormal Physical Characteristic in a Food Item

The physical characteristics of concern include changes in:

• Taste
• Smell
• Color
• Texture
• Composition (including the presence of an unexpected "white powder" or a foreign substance)
• Evidence of package tampering

Examples of abnormalities caused by various biological or chemical agents are outlined in the table below.

Changes in Physical Characteristics of Food, Caused by Potential Chemical and Biologic Contaminants
Agent	Taste	Smell	Color	Composition
Bacillus anthracis (causative agent of anthrax)	None	None	None	White powder may be present, but not necessarily
Botulinum toxin	None	None	None	None
Yersinia pestis (causative agent of plague)	None	None	None	None
Francisella tularensis (causative agent of tularemia)	None	None	None	None
Foodborne pathogens*	None	None	None	None
Sulfur mustard	Affected	Garlic, onion, or mustard	Meat would be discolored	None
N-mustard	Affected	Fishy	None	None
Arsenic	Acidic	Unpleasant	Discolored (meat/vegetables)	None
Nerve agents	None	None	None	None
Cyanide	Bitter almond	Bitter almond	None	None
White phosphorus	Acidic	Garlic	Glows in dark	None
*Foodborne pathogens of particular concern include Salmonella typhi, Shigella dysenteriae, Shiga toxin–producing Escherichia coli (such as E coli O157:H7), Cryptosporidium parvum, Vibrio cholerae. Adapted from USACHPPM (US Army Center for Health Promotion and Preventive Medicine). The medical NBC battlebook. Tech Guide 244. May 2000 [Full text].

Steps to take once an abnormal physical characteristic is reported (eg, a substance described as "white powder" reported on a product):

1. Determine if there is a rational explanation for the abnormality. Fresh produce may sometimes appear to have a whitish waxy coating or a white powdery substance on the surface, as a result of natural "bloom" or application by growers to protect products during shipping (see References: United Fresh Fruit & Vegetable Assn). Similarly, white powder may show up on packaged foods as a result of approved uses of cornstarch or baking soda during packaging to prevent products from sticking (see References: AMI/GMA/IDFA/NCC/NFPA/NTF/SFA). In 2001, the Food Marketing Institute (FMI) distributed a list of food and other grocery products that could normally have powder on the outside.
2. Evaluate through laboratory testing. There is no easy way to assess whether a physical abnormality represents a hoax, a harmless substance, or a possible real contamination of a product; therefore, all unexplainable physical abnormalities should be evaluated through laboratory testing for pathogens and/or chemicals. The testing laboratory should have expertise in testing food. Commercial food testing laboratories are equipped to analyze food samples for conventional microbiology and analytical chemistry but cannot identify or rule out bioterrorism agents, such as anthrax, or other unconventional threats. Food products suspected of contamination with biological, chemical, or radiologic agents should be evaluated through the Food Emergency Response Network (FERN), a new federally coordinated system designed to provide appropriate training, methodology, equipment, communication, and surge capacity for responding to a terrorist incident involving food products (See References : FDA 2003 [3 documents]). State laboratories for public health, agriculture, or veterinary diagnostics provide initial access to FERN facilities. See CIDRAP's guide to Independent Food Testing Laboratories for more information.
3. Contact government officials, if appropriate, while waiting for test results. For example, if product tampering is highly suspected, then law enforcement officials should be contacted early in the process.
4. Hold the altered product while waiting for test results. If the abnormality extends across multiple lots of product, an internal recall or hold of the product should be considered.
5. Contact regulatory agencies if the product tests positive for a pathogen or chemical. If illness is associated with the product or if illness is suspected, then public health officials also should be contacted.

Reports of Unusual Illness Among Employees or Consumers

Clinical features associated with ingestion of selected biological or chemical contaminants in food are shown in the tables below.

Clinical Features of Selected Foodborne Infections
Gastrointestinal anthrax*
Incubation period	1-7 days
Clinical features	—Fever (may be low-grade) —Abdominal tenderness —Diarrhea and/or vomiting (may be coffee-ground or blood-tinged) —Headache —Ascites may develop 2-4 days after illness onset —Ulcerations can occur anywhere along the GI tract and may cause hemorrhage, obstruction, or perforation —If patient survives, symptoms last about 2 wk
Foodborne botulism†
Incubation period	2 hr–8 days
Clinical features	—Symmetrical dysfunction of cranial nerves, including blurred vision, double vision, dysarthria (difficulty speaking), dysphagia (difficulty swallowing), dry mouth (may manifest as a sore throat), and ptosis (drooping eyelids) —Later in clinical course, further involvement of nervous system can occur, causing muscle weakness or paralysis, fatigue, dyspnea (trouble breathing), and/or paresthesias (tingling sensations) —Death usually occurs from paralysis of respiratory muscles or complications from prolonged hospitalization —GI symptoms (eg, nausea, vomiting, abdominal cramps or abdominal pain, diarrhea, constipation [related to autonomic dysfunction]) may occur early in illness but often are absent —Patients usually alert and do not have fever
Plague pharyngitis‡
Incubation period	1-7 days
Clinical features	—Severe sore throat and fever; illness similar to severe pharyngitis or acute tonsillitis of other causes (eg, streptococcal infection) —Inflamed lymph nodes usually present (and may be extremely tender) —As with bubonic plague, septicemia can occur
Oropharyngeal tularemia§ (infection through mucous membrane of oropharynx following ingestion or inhalation of Francisella tularensis)
Incubation period	3-5 days (range, 1-14 days)
Presenting features	—Fever —Constitutional symptoms (chills, malaise, myalgias [muscle aches], arthralgias [joint pain]) —Exudative pharyngitis or tonsillitis —Ulcerations of pharynx, tonsils, soft palate —Concomitant pneumonia often present
Gastroenteritis caused by Salmonella, Shigella, Escherichia coli O157:H7**
Incubation period	1-8 days (depending on agent)
Presenting features	—Fever and chills (fever less common with E coli O157:H7 infection) —Nausea, vomiting, diarrhea (stools may be watery or bloody; often grossly bloody with E coli O157:H7 infection) —Abdominal pain and cramping —GI illness usually lasts 4-7 days —Systemic complications may also occur:     ~Salmonella infection: cholecystitis, bacteremia, meningitis, focal infections, endocarditis     ~Shigella infection: Reiter's syndrome, HUS (for strains that produce Shiga toxin), septicemia     ~E coli O157:H7 infection: HUS (more common in children), TTP (more common in adults)
Gastroenteritis caused by Vibrio cholerae**
Incubation period	1-3 days
Clinical features	—Profuse watery diarrhea (may lead to rapid dehydration and death) —Small flecks of mucus may be present in stool ("rice water stools") —Abdominal cramps and fever are rare —Duration 3-7 days
Abbreviations: GI, gastrointestinal; HUS, hemolytic uremic syndrome; TTP, thrombotic thrombocytopenic purpura. *Adapted from CIDRAP's Anthrax Overview. †Adapted from CIDRAP's Botulism Overview. ‡Adapted from CIDRAP's Plague Overview. §Adapted from CIDRAP's Tularemia Overview. **Adapted from CIDRAP’s Common Causes of Foodborne Disease.

Clinical Features Following Ingestion of Chemical Contaminants in Food or Water
Chemical	Signs and symptoms following ingestion
Arsenic*	—Symptoms occur within hours of exposure —Nausea, vomiting, profuse watery diarrhea (often bloody) —Colicky abdominal pain (may be severe) —Excessive salivation —Acute psychosis —Seizures —Hematuria (blood in urine) —Diffuse skin rash may occur —Late complications include bone marrow suppression, peripheral neuropathy, renal failure, toxic cardiomyopathy, pulmonary edema, respiratory failure, and death (usually from circulatory collapse; commonly occurs 2-4 days after exposure)
Cynaide†	—Symptoms occur minutes after exposure —Hypersalivation —Acrid, burning, metallic, or constricting sensations —Restlessness —Dizziness —Weakness —Headache —Nausea, vomiting, epigastric pain —Rapid heart rate —Exposure to large amount of cyanide by any route may cause convulsions, hypotension (low blood pressure), bradycardia (slow heart rate), loss of consciousness, death
Nerve agents (eg, sarin, VX, soman, tabun)‡	—Symptoms occur hours after exposure —Confusion —Drowsiness —Weakness —Headache —Nausea, vomiting, diarrhea —Slow or fast heart rate —Low or high blood pressure —Exposure to large doses can cause loss of consciousness, convulsions, paralysis, respiratory failure leading to death
N-mustard§	—GI symptoms generally occur several hours after exposure —Causes severe irritation to exposed tissues —Abdominal pain, diarrhea, nausea, and vomiting —GI bleeding may occur and may be severe, depending on level of exposure —If GI hemorrhaging is severe, shock may occur —Large exposure may cause CNS toxicity (symptoms include tremors, lack of coordination, seizures) —Bone marrow suppression may occur 3-5 days after exposure and is most common cause of death
Ricin**	—Symptoms may develop within a few hours after ingestion or 1-3 days after exposure —Nausea, vomiting, abdominal pain, cramps, diarrhea —Hemorrhage of GI tract can occur —Dilation of pupils —Fever —Headache —Hematuria (blood in urine) —Death can occur after several days from vascular collapse, organ system failure, and shock
Strychnine††	—Symptoms usually appear within 1 hr following ingestion —Agitation, restlessness —Painful muscle spasms —Uncontrollable arching of the back and neck —Jaw tightness —Difficulty breathing —High doses can cause respiratory failure and death
Sulfur mustard‡‡	—Symptoms occur 2-24 hr after exposure —Causes severe irritation to exposed tissues; blistering and hemorrhaging may occur —Nausea, vomiting, painful diarrhea —Gastrointestinal bleeding may occur —Systemic symptoms (eg, fever, malaise, prostration) —If GI hemorrhaging is severe, shock may occur —Vomiting and bloody diarrhea beginning days after high-dose exposure imply poor prognosis
White phosphorus***	—Nausea, vomiting, diarrhea —Severe abdominal cramps —Drowsiness, convulsions, coma —Complications include liver, heart, or kidney damage and death
Abbreviations: CNS, central nervous system; GI, gastrointestinal *See References: eMedicine: Arsenicals, arsine; Ratnaike 2003. †See References: USAMRICD: Cyanide; CDC: Cyanide. ‡See References: USAMRICD: Nerve agents; CDC: Sarin. §See References: eMedicine: Vesicants, mustard: Hd, Hn1-3, H; CDC: Nitrogen mustard. **See References: CDC: Ricin. ††See References: CDC: Strychnine. ‡‡See References: eMedicine: Vesicants, mustard: Hd, Hn1-3, H; CDC: Sulfur mustard. ***See References: ATSDR: White phosphorus; Patnaik 1992.

1. If a link is suspected between a food or agricultural product and customer or employee illness:
2. First notification should include companies responsible for the product as appropriate, including suppliers, distributors, and manufacturers of the product in question.
3. State and/or local public health officials also should be contacted so that trained epidemiologists can conduct an investigation. In some situations, notification also should be made to the local or state office of the appropriate regulatory agency.
4. If further investigation supports contamination of a specific product, company managers should work closely with public health and regulatory officials to determine the steps necessary to prevent further illness and to assure adequate decontamination.
5. In some situations, products may need to be recalled and the public notified. Recalls usually follow one or both of these circumstances, depending on the nature of the threat:
1. Contamination confirmed by laboratory data
2. Reliable epidemiologic data associating illness with a specific product

Observation of Suspicious Behavior by Employees or Consumers

Suspicious behavior among employees or customers may trigger biosecurity concerns; examples of such behavior include:

• Being in a section or environment where the employee or consumer does not belong
• Arriving to work unusually early or staying unusually late
• Taking pictures of secure areas without authorization
• Removing sensitive documents without authorization
• Bribing other employees or using other means to obtain sensitive information
• Being disgruntled or dissatisfied with the company

Serious health effects can result from intentional contamination of food products at any stage in the farm-to-table food system, but contamination of finished products at the consumer level may have the most widespread effects on public health. Therefore, concerns about, and responses to, suspicious behavior increase as products and services reach the processing, distribution, and retail levels.

Steps to take in evaluating suspicious behavior:

1. Examine products that could be affected for evidence of contamination or package tampering. Segregate them until the incident is resolved and have them available for testing.
2. If the behavior is such that product tampering is suspected or any legal issues have been raised, contact law enforcement officials.
3. Situations involving ambiguous actions or suspicious though noncriminal activity may be more difficult to resolve, but state homeland security officials should be consulted in such cases.

Occurrence of a Security Breach or Evidence of Tampering

A security breach may take a variety of forms. Examples include:

• Evidence of forced entry into a facility, shipping vehicle, or storage tank
• Other evidence that unauthorized personnel have entered areas where ingredients are mixed or product is exposed to potential contamination (eg, finding empty containers or other inappropriate items in secure areas)
• Missing chemicals, laboratory supplies, or other items that could contaminate a food product
• Broken seals on containers of raw materials
• Evidence of product tampering at the consumer or retail level
• Identification of counterfeit products
• Unusual amounts or types of products returned by consumers to points of purchase

Steps to take in evaluating possible security breaches or evidence of tampering:

1. Examine products that could be affected for evidence of contamination or package tampering. Segregate them until the incident is resolved and have them available for testing as necessary.
2. Products suspected of tampering should be handled as little as possible.
3. If there is any question regarding personnel safety (eg, finding a white powder or evidence of toxic chemicals), stop production and remove personnel from the affected area.
4. If product tampering is suspected, or if a clear breach of security has occurred, contact law enforcement officials and federal regulatory authorities.

Receipt of a Threat Via Telephone or Mail

Incidents involving food contamination are more likely to take place without explicit notice by telephone or mail; consumers often are the first to discover problems with food products. However, phone calls and mail containing warnings or threats do occur and warrant further investigation. Examples of serious threats include a letter or package containing a white powder or a phone call or letter threatening that anthrax (or another contaminant) has been or will be placed in food products or facilities.

Steps to take if a threat is received include:

1. If the threat is by phone, record complete information about the call as soon as possible after receiving it and save any written materials pertaining to the situation, including a detailed account of the caller's language and attitude and employees' responses. Report the incident immediately to company officials.
2. Follow the current CDC health advisory for identifying and handling suspicious packages and envelopes. If there is doubt about the nature of a threat, consider it suspicious and contact law enforcement, regulatory agencies, and health officials. Gather as much information as possible from the threat itself by saving all relevant documents. Contact company officials, manufacturers and vendors of the product(s), and relevant trade associations.
3. Conduct a threat assessment. This can be accomplished by working with the local weapons of mass destruction (WMD) coordinator from the Federal Bureau of Investigation (FBI).
4. Once the threat assessment has been completed, a plan of action can be determined. If the threat is deemed credible, then additional steps should be taken based on the specific circumstances involved in the threat; steps could range from enhancing security to testing products for contamination to recalling products (if the threat is deemed to be extremely serious).

Two or More Events Occurring Simultaneously

If two or more threats occur simultaneously, the credibility or risk of a serious threat obviously increases, creating an immediate need to seek external assistance from law enforcement and/or homeland security officials. Clear, timely, and centralized information sharing within the industry and between industry and government becomes more critical in such cases. The steps outlined in the sections above should be followed according to the circumstances involved.

References

AMI/GMA/IDFA/NCC/NFPA/NTF/SNF. Use of starches and other compounds in food packaging. Memo from American Meat Institute, Grocery Manufacturers of America, International Dairy Foods Association, National Chicken Council, National Food Processors Association, National Turkey Federation, and Snack Food Association. Oct 26, 2001

ATSDR (Agency for Toxic Substances and Disease Registry). White phosphorus. Sep 1997 [Fact sheet]

CDC. Nitrogen mustard [Fact sheet]

CDC. Sulfur mustard [Fact sheet]

CDC. Ricin [Fact sheet]

CDC. Sarin [Fact sheet]

eMedicine. Arsenicals, arsine. Dec 10, 2001 [Web page]

eMedicine. Vesicants, mustard: Hd, Hn1-3, H [Web page]

FDA. Guidance for industry: food producers, processors, and transporters: food security preventive measures guidance. Mar 21, 2003 [Full text]

FDA. Guidance for industry: importers and filers: food security preventive measures guidance. Mar 21, 2003 [Full text]

FDA. Guidance for industry: retail food stores and food service establishments: food security preventive measures guidance. Mar 21, 2003 [Full text]

Patnaik P. A comprehensive guide to the hazardous properties of chemical substances. New York, NY: Van Nostrand Reinhold, 1992:596-8

Ratnaike RN. Acute and chronic arsenic toxicity. Postgrad Med J 2003 Jul;79(933):391-7 [Abstract]

United Fresh Fruit & Vegetable Association. Answering consumer retail grocery questions on potential presence of white powder on produce. Standby statement. Oct 15, 2001

USAMRICD (US Army Medical Research Institute of Chemical Defense). Cyanide. Protect, Project, Sustain presentation [Slide]

USAMRICD (US Army Medical Research Institute of Chemical Defense). Nerve agents GA, GB, GD, GF, VX. In: Medical management of chemical casualties handbook. Ed 3. [Table]