What really scares European Union officials like Isabelle Benoliel is the risk that terrorists or criminals might contaminate Europe’s food supply in some way that allows them to sicken and kill far more people than a conventional bomb attack could. Benoliel, senior advisor on bioterrorism at the European Commission, says, “Bioterrorism is less likely than classic terrorism using bombs, but a biological or food terrorism attack could cause greater impact.”

The appearance of HV5N1 avian flu virus in Europe and the succession of crises in the British meat industry have further increased unease over food safety and security. The U.K. beef industry has not fully recovered from a succession of foot-and- mouth disease outbreaks and the BSE (mad cow) crisis.

The United Kingdom estimates that a 2001 foot-and-mouth outbreak alone cost the country between $12.4 billion and $13.9 billion. Another outbreak of foot-and-mouth disease took place in mid-2007 after a strain of the virus escaped a government research laboratory in  southern England, according to a government investigation of the incident.

Neither avian flu nor foot-and-mouth present immediate threats to human health, but officials worry that terrorists or criminals could intentionally infect livestock or poultry farms to undermine a country’s economy, terrorize consumers, or extort companies. They also want to be prepared for the day when nature itself might cause the problem to affect humans.

While the EU and member states have plenty of laws and regulations controlling aspects of the continent’s food supply, from nutrition to labeling to safety, the food industry remains vulnerable to attack. An EU consultative paper on bio-preparedness issued in July 2007 identifies some of these vulnerabilities. The concerns range from inadequate food processing and handling standards to patchy detection systems and inadequate crisis-management mechanisms.

Food-industry security executives acknowledge that the food supply is at risk. While many food-industry companies fear bioterror concerns could lead to overregulation, one CSO at a major American food outlet in the United Kingdom says that he welcomes heightened official interest in food security. “The authorities are always looking at threats to the critical infrastructure, but they are not looking much at the food chain and asking themselves what could happen if political activists or terrorists interrupted it,” he says.

The European Union collectively and its member states individually are focusing broadly on bioterrorism, which encompasses possible threats to the food supply. They are tackling the threat with multiple initiatives that fall generally into the areas of response, detection, and prevention.

Response

Given the difficulty of prevention, most efforts center on being prepared to respond to an incident. “We need to be ready to react rapidly and simultaneously to various events in various parts of Europe,” Benoliel says.

Among the initiatives are worst-case scenario drills designed to assess how well existing crisis-management systems could handle an incident. For example, Interpol, the international police organization, organized a tabletop exercise in December 2007. Called Black Death, it was designed to train officials in responses to a bioterrorism event.

The scenario began with terrorists spreading large amounts of plague bacteria with hundreds of simple horns, similar to those used at sporting events. The exercise simulated an attack in Australia and monitored the spread of highly infectious plague to nine other countries around the world.

The event was staged in Lyon, France, where Interpol is headquartered. Participants included national law enforcement agencies from nine countries as well as international organizations, such as the World Health Organization (WHO) and Interpol itself.

The Black Death exercise led to several major findings, says the event’s moderator, Barry Kellman, who is director of the International Weapons Control Center at DePaul University and a special advisor to Interpol’s biocrimes prevention program.

The first finding was that current detection and investigation procedures are not adequate for a bioterrorist attack. “Black Death showed that there is no way to carry out an international [bioterrorism] investigation. It started in Australia, but as the problem multiplied, the absence of international capacity to find who was doing it and to stop them became clear,” says Kellman.

A second lesson was the need for governments to invest more in prevention. “We need to reduce the opportunities for the commission of this crime,” says Kellman. “We need better law enforcement, we need better legislation, and we need to strengthen equipment and training. We need more preparedness.” Western governments are taking action on these fronts, he says, but international cooperation is still insufficient, as the Commission’s paper made clear.

A third finding was the importance of improving first-responder training and enhancing information dissemination. Black Death indicated that some national and international agencies are simply not prepared to handle a global public-health crisis.

For instance, WHO has well-developed protocols for addressing a plague as a medical phenomenon. But Kellman says “they did not ‘get’ that when you have mass casualties that are intentionally inflicted, then plague is no longer the same as naturally occurring plague. There is a difference.”

Any plague would strain healthcare systems and worry the public, but a man-made pandemic might be designed to spread faster. Thus, it could more rapidly overwhelm healthcare systems, and populations would be swept by panic, especially because poorly informed media outlets would likely fan hysteria.

Black Death demonstrated the importance of setting up effective media relations programs. “A lot of time was spent going back and forth, not on treatment, but on panic factors, media factors,” says Kellman.

Britain, France, Germany, and Sweden have developed excellent emergency-response plans to deal with bioterrorist attacks, including attacks on food-supply networks, says Alexandre Custaud, coordinator of the European task force on bioterrorism at Europa-Bio, the European biotech trade association. Their planning runs the gamut from stockpiling key vaccines to having well-equipped sports stadiums that can be used for emergency accommodation. However, he and others are less confident about the ability of some Mediterranean countries or some of the new Eastern European member states to mobilize rapidly in response to an attack.

The United Kingdom is frequently mentioned as having the most advanced planning and response capabilities in Europe. “I’d agree that it is true. Stadiums and other facilities are being prepared for emergency use. The British are very advanced,” says the CEO of a consulting firm working on an emergency-planning project for the European Commission.

The British began taking contingency planning more seriously in 2000. “Within a few months in 2000, the U.K. government had to deal with foot-and-mouth disease, flooding, and a fuel dispute,” says Charlie Edwards, senior researcher at Demos, a London-based think tank.

“The outcome of the crises was the creation of the Civil Contingencies Secretariat (CCS). The CCS has transformed the way the government thinks and acts on issues of resilience and contingency work,” says Edwards.

Disaster planning has become more systematic, thanks to the CCS, which has a mandate to ensure that adequate plans are in place. The CCS has established an early-warning capacity to identify, and prevent or minimize, potential emergencies. It has also set in place a national risk assessment process, and it is working with others to identify sites that could be used in a crisis. Furthermore, it has strengthened links with international organizations such as the EU and NATO.

The United Kingdom plans to double the stockpile of the influenza anti-viral Tamiflu, doubling coverage to 50 percent of the population. Officials will not disclose availability of treatments for other infectious diseases, such as anthrax.

The United Kingdom also has staged elaborate exercises. Last year, 5,000 players, including cabinet secretaries, local government officials, and business executives participated in Winter Willow, a nationwide exercise held in January and February 2007, which simulated an avian flu epidemic. Like Black Death, Winter Willow revealed weaknesses in media relations and international coordination.

To improve its preparedness, the United Kingdom rolled out a sophisticated training program called Gold Standard in June 2007. The program—designed by AgustaWestland, an Italian defense contractor, and built around Automated Exercise System (AES) software from California-based SAIC—models decision outcomes and impacts in simulated crises. Among the scenarios used in the sessions are a food contamination crisis, epidemic foot-and-mouth disease, and disruption of essential services including energy, water, and food supplies.

Despite these efforts to get in front of the problem, it is still largely a reactionary battle, says Edwards. “The U.K.’s response remains 80 percent driven by events. We learn from our mistakes and then develop capacity, as opposed to being more proactive,” says Edwards. “My primary concern is that we are only able to fight from one event to the next.”

Detection

Like the United States, European consumers get a large proportion of their food from distant suppliers, either from within Europe itself or from around the world. This supply chain creates numerous vulnerabilities that terrorists can exploit.

Europe’s first line of defense is an EU-wide network of rapid-alert systems that are managed by national governments’ customs and food inspection services. These systems alert the European Commission and other member states whenever they detect threats to the food supply or to public health. Threats may come from biological and chemical agent attacks or from more mundane problems, such as spoiled or substandard products. The system is designed to catch contaminated or substandard food whether shipped across Europe or imported from outside the EU.

The Commission posts weekly reports detailing which products were blocked and why, as well as identifying the company and country of origin of each item. The reports illustrate how vulnerable even the most mundane products are to problems as they are moved around the world or between neighboring countries. For instance, among the shipments seized in one week last December was a consignment of blueberry juice concentrate found to contain excessive radioactivity as it entered Ireland from the Netherlands. The juice had been made in Austria with Polish fruit. And in early January 2008, Finnish inspectors halted imports of grape seed extract capsules from China because they contained an unauthorized artificial coloring.

The Commission says it wants to launch a worldwide rapid-alert system for food safety, by encouraging nonmember countries to set up their own rapid-alert systems, which could be connected to the EU’s system. But the EU’s existing rapid-alert network has come under criticism from all sides.

One problem is that individual countries’ inspection services do not apply standard safety criteria when analyzing products, says Custaud. He says the process is sufficiently rigorous in most countries in northwestern Europe, but countries in Southern and Eastern Europe are more lax.

Another criticism is that the system is reactive. Food-safety alerts often come from consumers or distributors, who then contact government agencies, which then test suspect products and decide whether to withdraw them from the market.

The Commission’s Benoliel says, “Of course, it is reactive. If we knew in advance that something was a problem, we could take the adequate preventive measures.”

She further defends the approach, saying, “But it does work very quickly, and once a [suspect] product has been detected in one member state, it can be withdrawn across the whole Union.”

Industry also sees flaws in the system. It wants the Commission to focus more on standardizing its food-alert process and on ensuring that staff who must implement it receive adequate training.

Currently, officials do not consult with companies when their products are caught in the system, and the process is too public, says Beate Kettlitz, director for Food Policy, Science, and Research and Development at the Confederation of the Food and Drink Industries, the EU’s main food lobby.

“Those concerned should be involved at the first stage” so that they can remedy the problem, says Kettlitz. She complains that companies’ reputations are affected “whenever each tiny thing is found out.”

Kettlitz notes that “European public perception of food safety is a very, very sensitive issue, and we do not want to scare them. We do not want to give any impression that something is not safe.”

The EU has also announced a plan to streamline customs clearance for all goods while tightening control over supply chains with a new electronic customs system, inspired by the U.S. Customs-Trade Partnership Against Terrorism (C-TPAT) supply-chain security program.

The EU plans to launch a sophisticated computer-based risk-assessment system for all imported products including foodstuffs by July 2009. It is designed to improve screening and would enable computer systems in each of the 27 member states’ customs administrations to communicate with each other and with the Commission’s systems in real time.

The Commission is also developing a prearrival and predeparture notification system, enabling authorities to run computerized risk assessments on each shipment almost instantaneously. To participate, a company must win EU accreditation as an Authorized Economic Operator (AEO). Accreditation is earned by meeting criteria that include stringent internal controls, as well as clean security and safety records.

“Various authorities, including customs, will be monitoring the success and transparency of AEO over the coming years, as they hope to use this tool to ensure compliance with issues like environmental standards and food-safety standards,” says Michel de Jong, senior manager in security advisory services at Ernst & Young in the Netherlands.

In another initiative, the European Commission is pushing for the creation of a European Bio-Network to act as an advisory structure involving scientific researchers, business, security agencies, and civil protection authorities. European trade associations are calling for EU-wide standards on detecting and testing for pathogens, as well as measures to improve cooperation between industry and government. The commission plans to include the submissions in a white paper in the second quarter of 2008. 

Despite their skepticism, industry representatives and analysts say the bioterrorism consultation process is a step in the right direction.

Prevention

Companies already invest heavily to ensure the reliability of their procurement, production, and distribution networks. Large multinationals have sophisticated access and surveillance systems, food-quality controls, and food-safety equipment. They employ large security staffs.

Even mid-sized companies such as U.K.-based meat producer Fairfax Meadow, have invested in advanced surveillance systems to ensure compliance with food-quality standards as well as to strengthen security. In 2006, Fairfax installed an IP-video surveillance system as an upgrade from its previous analog network.

But these existing controls are aimed at preventing accidental contamination. The food industry may have to invest more to tighten security and safety standards in their plants to further reduce the risk that terrorists, criminals, or rogue employees could contaminate products.

Companies “are going to have to do more in sampling and testing on final products,” says Scott Stewart, senior security and counterterrorism analyst at Stratfor, a U.S. security consulting firm. He believes the risk is at the endpoint. “If we are going to see an act of terrorism [in the food industry], it’s going to be in finished products.”

Lethal pathogens can be readily—and legally—obtained from universities or commercial sources. Suppliers are not required to get security clearance for their clients or run background checks.

Workplace surveillance was first intended as a way to deter internal theft, but management now uses surveillance more for monitoring working practices, such as enforcing hygiene procedures, which should also limit the ability of terrorists to slip a lethal pathogen into the product they are handling.

But companies are still exposed to the risk of sabotage, either from employees or political activists, says Owen Warnock, an expert on European food law at British law firm Eversheds.

One vulnerability, he notes, is that food companies rarely carry out preemployment screening of production workers. The reason for the lack is that such checks would be relatively costly in a low-wage, labor-intensive industry with high turnover rates.

Warnock says that only one of his clients regularly checks the backgrounds of new employees. “It’s a meat company that is regularly targeted by extremist vegetarian and animal rights groups that try to get people in undercover and shoot videos of the installations,” he says.

Risk Assessment

What is the real risk of a terrorist attack on the food supply? The last such event in Europe took place in 1978 when a dozen children in Holland and Germany were hospitalized after citrus fruit from Israel was deliberately contaminated with mercury. The last time tainted food caused a significant number of deaths was in 1981, when 800 people died and about 20,000 were injured by a chemical agent in cooking oil sold door to door in Spain.

Given the relative ease of infiltrating the food chain, it might seem surprising that Europe has not suffered such an attack for many years. Yet many analysts see this type of terrorist attack as a high-consequence, low-probability threat for a variety of reasons.

While it may not be hard to get a rogue worker into a production unit, that person would have to plant a pathogen that would remain stable and escape detection long enough to reach consumers and affect a significant number of people. Consider that the only intentional mass food poisoning event in modern times took place in the United States in 1984, when followers of Bhagwan Shree Rajneesh infected restaurants in a small town in Washington State with salmonella, sickening 750 people. No one died.

Perhaps more important from the terrorists’ perspective, even a successful food-contamination attack that causes people to die quietly in their homes after a bad meal may lack the terrifying visual impact that a violent assault, such as the 9-11 attacks, had.

For these reasons, experts remain skeptical that the food chain would be a terrorist group’s first choice as a target. In a booklet it produced for companies on terrorist threats, MI5, the British domestic security agency, minimizes the risk of bioterrorism.

Stratfor’s Stewart agrees. He says that although terrorist groups such as al Qaeda are believed to have “played around” with unconventional weapons, he thinks they will likely stick to explosives. “They prefer more practical measures,” says Stewart. He notes that the 2004 Madrid train attacks cost less than $10,000 to conduct but killed 191 people. In contrast, Japanese cult Aum Shinrikyo spent millions of dollars and took years trying to develop biological weapons using pathogens like botulinum toxin and anthrax. Its biological weapon attacks hurt no one, although a later attack on the Tokyo subway with sarin gas killed 15 people in 1995.

Still, officials and industry take the threat of contamination of the food supply seriously. They recognize the huge potential for harm from contamination, whether intentional or not. Consider that about 300,000 people who ate undercooked clams in Shanghai in 1991 were infected with hepatitis A in the worst food-borne contamination incident in history. While that case was accidental, it gives a glimmer of how large the impact of an effective attack could be.

And that doesn’t count the economic harm that can occur when consumers lose confidence in the food supply, which can cause severe market disruption, as occurred in the beef industry after mad cow incidents and among businesses involved in the spinach supply chain when bags of that leafy green caused deaths from E. coli contamination. “Terrorists do not just want to kill,” says the European Commission’s Benoliel. They want to cause panic and economic harm. A vulnerable food supply could give them the chance to do both.