Food safety concerns used to focus solely on accidental contamination. But in recent years, there has been concern that terrorists could intentionally introduce biological, chemical, or
radiological agents into the U.S. food supply. A risk-assessment tool called CARVER Shock helps food processors protect their products from deliberate contamination. A computerized version of
the tool will be available on the FDA’s Web site in mid-2007.

CARVER was originally developed by the U.S. military to identify areas that may be vulnerable to an attacker. FDA and the U.S. Department of Agriculture adapted it for the food and agriculture
sector. “This approach allows food companies to analyze and identify critical areas that are the most likely targets of an attack,” says Donald Kautter, Jr., Acting Supervisor of the Food
Defense Oversight Team in FDA’s Center for Food Safety and Applied Nutrition. FDA and other agencies have used the method to evaluate potential vulnerabilities in the supply chains of different
foods and food processes.

The risk assessment follows the acronym CARVER, which stands for six attributes that are used to evaluate targets for an attack:

Criticality: What impact would an attack have on public health and the economy?
Accessibility: How easily can a terrorist access a target?
Recuperability: How well could a system recover from an attack?
Vulnerability: How easily could an attack be accomplished?
Effect: What would be the direct loss from an attack, as measured by loss in production?
Recognizability: How easily could a terrorist identify a target?

The CARVER tool also evaluates a seventh attributeâ€â€Âthe psychological impacts of
an attack or “shock” attributes of a target. For example, the psychological impact tends to be greater if there is a large number of deaths involved or if the target has historical or cultural
significance.

Computerizing CARVER
CARVER has traditionally been used in a face-to-face setting. Experts from FDA and/or USDA have gone to food processing plants and held meetings in which as many as 30 people hash out answers
to a series of questions. “What we’ve done is taken that face-to-face interaction and put it into a software program so that the questions and discussion are posed by computer,” Kautter says.
“This will give more companies access to the tool.” FDA partnered with the Institute of Food Technologists (IFT) and Sandia National Laboratories, Albuquerque, N.M., to computerize CARVER.

Phil Pohl, a member of the technical staff at Sandia, says that he and his colleagues designed the software program by accompanying FDA experts to many of the face-to-face meetings. “A meeting
that took two or three days and involved 20 to 30 people can now be done by computer in under a day and with just a small team,” Pohl says.

The software program takes companies through more than 100 questions about their facilities and processes to help them identify vulnerable areas. Companies consider what type of attack is the
greatest threat and whether a biological or chemical agent might be used in an attack. The questions center around which food supply chain the company will assess, whether it’s pizza production
or a generic process from farm to table.

The software program begins by having the assembled team of experts develop a flow diagram of the food process being analyzed. Questions are then asked and scores are assigned based upon the
answers from the team of experts. The attractiveness of a target is ranked on a scale of 1 to 10 on the basis of scales that have been developed for each of the seven CARVER attributes.
Conditions associated with lower vulnerability are assigned lower values, and conditions associated with higher vulnerability are assigned higher numbers.

“CARVER helps industry think like an attacker so that it can identify any weak spots and put countermeasures into place,” Kautter says. Countermeasures might include enhancements to physical
security, personnel security, or process operations, for example.

So would the CARVER software program give a potential attacker insight into a company’s vulnerabilities? Kautter says it wouldn’t. “The questions themselves don’t reveal company secrets nor
lead to a roadmap,” Kautter says. “However, companies would need to understand that their assessments should be considered sensitive information and should be treated as such.”

CARVER is available on FDA’s Web site at www.cfsan.fda.gov/~dms/defterr.html

www.fda.gov