Protecting the Food Sector: How Is DHS Doing?

Even more housecleaning: In February, DHS' Office of the Inspector General (OIG) published an analysis of DHS' role in defending the food sector, which is one of the critical infrastructure sectors identified in the National Infrastructure Protection Plan (NIPP).

The OIG's analysis is lengthy and comprehensive, resulting in 16 recommendations. My review will be selective, focused only on a couple of those recommendations. First, some background on OIG's report:

This report examines DHS activities relating to post-harvest food, and focuses on prevention, protection, preparedness, and detection efforts.

There are four main limitations in DHS’ related efforts.

• First, DHS must improve internal coordination.
• Second, DHS needs to engage its public and private food sector partners more effectively.
• Third, DHS could do more to prioritize resources and activities based on risk.
• Finally, DHS must fully discharge its food sector responsibilities.

The report makes clear that the risk to the food sector is real:

Food products may be deliberately contaminated with chemical, biological, or radiological agents. In 2003, the FDA wrote that, “If an unintentional contamination of one food … can affect 300,000 individuals, a concerted, deliberate attack on food could be devastating, especially if a more dangerous chemical, biological, or radionuclear agent were used.”

The effects could be significant:

The Centers for Disease Control and Prevention (CDC) estimates that the United States experiences 76 million illnesses, 325,000 hospitalizations, and 5,000 deaths from unintentional food contamination each year. Recent USDA estimates place the annual cost of premature deaths caused by a single common foodborne illness, salmonellosis – an illness resulting from infection with Salmonella bacteria – at over $2.1 billion.

Commentators on the subject have observed that an adverse food sector event could also reduce state and local governments’ ability to maintain order and deliver essential services. A major food contamination event could engender public panic on a local or mass scale, depending on the affected food product and population, and media coverage of the incident.

As I indicated, the OIG made 16 recommendations, but I'm going to focus on the ones that deal with DHS' relationships with other agencies and the food industry. My two emphases will be collaboration and information sharing.

Collaboration

The OIG report clearly indicates that DHS needs to improve its collaborative relationships. Everyone is not singing from the same songbook:

Vibrant cooperation and support between government and the private sector are needed to fully understand vulnerabilities, study possible consequences, prepare for threats, and implement mitigation measures.

One major complication to effective collaboration is the sheer size and complexity of the food industry:

The post-harvest food industry accounts for 12% of the nation’s economic activity and employs more than 10% of the American workforce. It consists of enormous subsectors, including business lines addressing processing, storage, transportation, retail, and food service. Statistics on just two of these subsectors serve to illustrate the magnitude of the sector.

The National Restaurant Association projects that the industry’s 925,000 U.S. locations will reach $511 billion in sales for 2006, serving over 70 billion “meal and snack occasions” for the year. Meanwhile, the nation’s $460 billion food retail business consists of more than 34,000 supermarkets, 13,000 smaller food markets, 1,000 wholesale club stores, 13,000 convenience stores, and 28,000 gas station food outlets.

Regulatory systems are equally complicated, encompassing all levels of government:

Regulation of the food industry is divided between federal, state, and local agencies. State, territorial, and local governments conduct oversight of food retail and food service establishments within their jurisdictions. These levels of government oversee restaurants, institutional food service establishments, and hundreds of thousands of food retailers. Within the federal government, primary responsibility for food safety rests with two agencies. The Food Safety and Inspections Service of the U.S. Department of Agriculture (USDA) oversees the processing of red meat, poultry, and processed egg products. The Food and Drug Administration (FDA) of the Department of Health and Human Services (HHS), in turn, regulates the processing of virtually all other food products. In addition to these two, several other federal agencies provide oversight of food processing, distribution, and retail.

But this complexity makes effective collaboration even more critical:

External coordination is essential for DHS to succeed in executing its responsibilities for food defense and critical infrastructure protection. Relationships with food sector partners are important because of the operational control and regulatory sway that they have with the sector. Related input from public and private sector partners is particularly valuable in light of DHS’ limited food sector experience. Partnerships with governmental entities are also vital because DHS shares so many food sector responsibilities.

To that end…

The Food Information Sharing and Analysis Center (Food ISAC) was established in February 2002…

According to industry representatives, the Food ISAC distributed some useful threat and vulnerability information to food industry associations and firms in 2002 and early 2003. By mid 2003, however, DHS’ Office of Infrastructure Protection had concluded that, as implemented, the Food ISAC was not well-suited to serve the department’s full range of information sharing and analysis objectives.

…and in 2003 many of the functions of the Food ISAC were moved to other newly created organizations …

In August 2003, Office of Infrastructure Protection managers assembled more than 200 food and agriculture sector representatives to discuss the department’s vision for information sharing and coordination. According to the Office of Infrastructure Protection, the assembled sector representatives were then given the opportunity to develop a new organizational structure. Two bodies emerged from this DHS-facilitated process – the Food and Agriculture Government Coordinating Council and the Food and Agriculture Sector Coordinating Council.

Meanwhile, the Food ISAC's output was not effectively replaced. A potentially valuable collaborative partnership was being spoiled:

By spring 2006, the Food ISAC’s contact with the government had deteriorated to the extent that, according to the ISAC, it did not have a dedicated DHS point of contact. This has contributed to a decline in the volume and scope of information disseminated to industry by the ISAC. Industry representatives reported that the flow of information from the ISAC to the private sector had declined, and that this decline had not been offset by increased information flow from other sources.

Instead of drawing on the food industry’s post-9/11 momentum on critical infrastructure protection efforts, DHS effectively alienated the ISAC’s leadership and disengaged from its operations. Meanwhile, as we discuss later, the coordination and information sharing mechanisms DHS instituted to address the ISAC’s limitations have been slow to develop and are only partially successful.

Meanwhile, as DHS was working to establish the two new councils, another problem was developing. According to food industry personnel, there was a lack of cooperative spirit:

Past and present council members attributed this sluggish start to DHS. They reported that DHS had taken a “top-driven” approach to its critical infrastructure protection leadership role, and that this detracted from the vitality of the councils and sapped the cooperative spirit from the process.

This approach reportedly created a difficult environment for the growth of collaborative efforts and did little to foster productive working relationships with industry leaders and government experts. Several council participants we interviewed said that DHS needed further growth as a business partner.

In its work with the councils, DHS in some ways acted more like a boss than a partner:

Early Sector Coordinating Council and Government Coordinating Council meetings did not foster efforts to formulate policy, and when DHS solicited the ideas and recommendations of council members on policy matters, the solicitation process was sometimes regarded as flawed. One limiting factor for policy development during meetings was a shortage of time to comment on draft documents. Some Sector Coordinating Council members reported that their association members generally did not comment on DHS drafts because they were provided insufficient time to do so. This made it hard for food associations to communicate their members’ concerns. DHS may have thus lost out on important insights from major components of the nation’s food sector.

And the results were less than optimal - a view which is furthered by GAO reporting on the National Infrastructur Protection Plan (NIPP). See this post for a summary of GAO's recent findings.

[NIPP] Sector-Specific Plans, which are authored by the Sector-Specific Agencies, discuss how each sector will address infrastructure protection. While DHS reportedly developed the Sector-Specific Plan template over the course of a year, it allowed the Sector-Specific Agencies just two months to complete their draft Sector-Specific Plans. This was an especially challenging task because the Sector Specific Agencies were asked to consult with their stakeholders as part of the Sector-Specific Plan formulation process. As a result, staff from the Sector-Specific Agencies indicated that Draft Sector-Specific Plans were assembled hurriedly and were not as valuable as they could have been.

As a result, the councils have also slumped …

Frustration with the slow pace of council progress and disenchantment with DHS’ management style and level of engagement may have led to declining participation in the Government Coordinating Council. Our analysis of Government Coordinating Council meeting minutes shows a difficulty achieving what the Council’s charter calls a “decision-making quorum.”

… and they're feeling unneeded …

[D]uring the crisis following Hurricane Katrina, the Federal Emergency Management Agency was asked to attend a joint session of the councils, but did not do so. The councils were an untapped resource that could have been more involved in getting food and bottled water to affected citizens. We were told that, due to DHS’ perceived unresponsiveness, companies used their own connections to provide food assistance to hurricane victims.

So, what's the answer for DHS? The same as it was in the beginning - foster trusting relationships. Collaboration is not a simple transactional relationship. It is built on mutual respect and trust – and it takes time.

DHS’ ability to foster and maintain a positive relationship with the coordinating councils will do much to determine the department’s overall effectiveness in providing leadership, coordination, and support of food defense efforts.

Information Sharing

There are also issues with information sharing between DHS and the food sector. One problem deals with the ever-troubled Homeland Security Information Network (HSIN):

The Homeland Security Information Network Food and Agriculture portal is a web-based tool for sharing threat and analytical information with sector representatives. DHS engaged food sector representatives in the design and online layout of the portal starting in October 2004. More than a year-and-a-half later, these discussions were still ongoing.

Another problem? Redundancy:

While food sector representatives were aggrieved by the portal’s early stage of development, [the OIG is] concerned that the HSIN's Food and Agriculture portal may essentially duplicate an FBI effort. A limited access web community with information on threats, vulnerabilities, and protective efforts related to the food and agriculture sectors, the FBI’s AgInfraGard became operational in March 2006. As described by the FBI and food sector representatives with access to the web community, much of AgInfraGard’s content is similar to that of the Homeland Security Information Network’s portal. The FBI believes its system is developing more quickly than the Homeland Security Information Network’s and has greater capability for information exchange. Meanwhile, according to one FBI analyst, the DHS system “takes information but it doesn’t give a lot.”

A different struggle has arisen regarding the type of information to share. In trying to analyze the food sector, DHS has focused on identifying assets. But they're not getting the full information on food assets:

As of January 2006, the National Asset Database had information on 77,069 infrastructure assets around the nation. Of those, 6,486 assets, or eight percent, were listed as relating to the post-harvest food sector.

Despite the broad geographic distribution of food industry assets and the prevalence of major food processing, transit, retail, and service facilities in all major U.S. cities, all but 2 of [the 20 most populous U.S.] counties had fewer than ten food assets listed in the National Asset Database.

One problem: Information about food assets is not being fully shared among federal agencies:

One reason data limitations such as these persist is that the Office of Infrastructure Protection has been unable to exploit existing federal information about food industry assets. Office of Infrastructure Protection staff reported that, in one case, this was the result of the FDA’s unwillingness to share information. Office of Infrastructure Protection staff advised us that they had sought the registered food facility list that FDA is required by law to maintain, but said that FDA had resisted sharing this information.

A bigger problem may be that analyzing systems, not assets, is probably the most appropriate means of analyzing the food sector:

The USA PATRIOT Act defines critical infrastructure to include systems and assets, yet the National Asset Database emphasizes assets. To date, the most advanced step by DHS to define parts of the food system has been the development of a sector taxonomy to support the classification of National Asset Database assets.

Industry and federal partners…held that DHS had focused too intently on assets, and devoted too little thought and energy to understanding the food sector as a system.

It doesn't have to be that way. Other federal agencies use a systems approach to analyze the food sector:

USDA and FDA ... focus their vulnerability and consequence assessments on particular industry subsystems and food products, rather than on particular assets.

And private sector representatives agree:

Food sector representatives said that DHS’ asset-orientation would result in an understatement of food sector risk for three reasons.

• First, they perceived that the DHS’ focus on assets led the department to emphasize the effects of asset destruction over asset exploitation. As discussed earlier, the greatest concern to many in the food sector relates to the exploitation of the sector to distribute intentionally adulterated foods.
• Second, food sector representatives pointed out that important links in the food supply chain are not easily captured in an asset-based model.
• Finally, food sector representatives expressed concern that DHS’ asset-orientation would lead it away from an understanding of the second- and third-order effects of a food contamination incident. In focusing on a particular food industry asset, they believed DHS would lose perspective on upstream and downstream consequences of an incident affecting that asset. For example, contamination at a processing facility might not just affect that facility.

Accordingly, to grasp the second- and third-order effects of an adverse food event at a single facility, DHS must first understand that facility’s place within the food supply chain and larger economic system.

The OIG suggests, once again, better dialogue. The risk to the food system is not going to be fully understood unless DHS casts a wide net and listens to its partners.

A more effective dialogue between DHS and its partners is needed to address concerns about asset exploitation, assets that do not have fixed coordinates, and system-wide impacts that the malevolent exploitation of food sector assets might have.

Without effective collaboration and information sharing, risk analysis and resulting interventions are not likely to be optimally effective.