Schneier on Security
A blog covering security and security technology.
« Software Problems with a Breath Alcohol Detector |
| Detecting Liars by Content »
May 14, 2009
Attacking the Food Supply
Terrorists attacking our food supply is a nightmare scenario that has been given new life during the recent swine flu outbreak. Although it seems easy to do, understanding why it hasn't happened is important. G.R. Dalziel, at the Nanyang Technological University in Singapore, has written a report chronicling every confirmed case of malicious food contamination in the world since 1950: 365 cases in all, plus 126 additional unconfirmed cases. What he found demonstrates the reality of terrorist food attacks.
It turns out 72% of the food poisonings occurred at the end of the food supply chain -- at home -- typically by a friend, relative, neighbour, or co-worker trying to kill or injure a specific person. A characteristic example is Heather Mook of York, who in 2007 tried to kill her husband by putting rat poison in his spaghetti.
Most of these cases resulted in fewer than five casualties -- Mook only injured her husband in this incident -- although 16% resulted in five or more. Of the 19 cases that claimed 10 or more lives, four involved serial killers operating over several years.
Another 23% of cases occurred at the retail or food service level. A 1998 incident in Japan, where someone put arsenic in a curry sold at a summer festival, killing four and hospitalising 63, is a typical example. Only 11% of these incidents resulted in 100 or more casualties, while 44% resulted in none.
There are very few incidents of people contaminating the actual food supply. People deliberately contaminated a water supply seven times, resulting in three deaths. There is only one example of someone deliberately contaminating a crop before harvest -- in Australia in 2006 -- and the crops were recalled before they could be sold. And in the three cases of someone deliberately contaminating food during packaging and distribution, including a 2005 case in the UK where glass and needles were baked into loaves of bread, no one died or was injured.
This isn't the stuff of bioterrorism. The closest example occurred in 1984 in the US, where members of a religious group known as the Rajneeshees contaminated several restaurant salad bars with salmonella enterica typhimurium, sickening 751, hospitalising 45, but killing no one. In fact, no one knew this was malicious until a year later, when one of the perpetrators admitted it.
Almost all of the food contaminations used conventional poisons such as cyanide, drain cleaner, mercury, or weed killer. There were nine incidents of biological agents, including salmonella, ricin, and faecal matter, and eight cases of radiological matter. The 2006 London poisoning of the former KGB agent Alexander Litvinenko with polonium-210 in his tea is an example of the latter.
And that assassination illustrates the real risk of malicious food poisonings. What is discussed in terrorist training manuals, and what the CIA is worried about, is the use of contaminated food in targeted assassinations. The quantities involved for mass poisonings are too great, the nature of the food supply too vast and the details of any plot too complicated and unpredictable to be a real threat. That becomes crystal clear as you read the details of the different incidents: it's hard to kill one person, and very hard to kill dozens. Hundreds, thousands: it's just not going to happen any time soon. The fear of bioterror is much greater, and the panic from any bioterror scare will injure more people, than bioterrorism itself.
Far more dangerous are accidental contaminations due to negligent industry practices, such as the 2006 spinach E coli and, more recently, peanut salmonella contaminations in the US, the 2008 milk contaminations in China, and the BSE-infected beef from earlier this decade. And the systems we have in place to deal with these accidental contaminations also work to mitigate any intentional ones.
In 2004, the then US secretary of health and human services, Tommy Thompson, said on Fox News: "I cannot understand why terrorists have not attacked our food supply. Because it is so easy to do."
Guess what? It's not at all easy to do.
This essay previously appeared in The Guardian.
Posted on May 14, 2009 at 6:24 AM
• 34 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
So what it comes down to is this...
The farther away from the consumer you implement your plan, the larger the contamination needs to be and the more people that have a chance of catching it.
So to be successful you would need to be as close to the consumer as possible which would lower your targets to a number that would be near inconsequential to stereotypical terroristic plans.
When Tommy Thompson said, "I cannot understand why terrorists have not attacked our food supply. Because it is so easy to do.", that, by itself, should have been grounds for his instant removal, he being either too stupid for words or his willingness to let his department be used for propaganda purposes.
Isn't there a greater threat to water supplies?
Sure, you can't effectively kill people with a food attack, but if you're interested in sowing chaos, you can certainly increase the level of fear going around, or, most effective of all, cause a great deal of economic damage in the form of beefed-up security and expensive recalls.
Besides, the point of terrorism isn't specifically to kill people in any case, is it? Profoundly frightening and inconveniencing them should do just as well.
Not easy to do from an individual or cell level. Quite easy to do from a corporate level, as you mention. Corporate seed giant Monsanto's use of an insecticide coating on seeds is being blamed for the colony collapse disorder that is putting the worldwide honeybee population at risk, for example. It's one of the reasons Monsanto's products have been banned in Germany. Monsanto's products are also apparently wreaking havoc in India.
Vectors that have been completely forgotten about by most of our non-agricultural society are also not to be left out. Did you know, for example, that the entire potato plant except for the potato itself is extremely poisonous? Neither did 140,000 Russians who didn't cut the eyes (the budding rootlets) off the potatoes before throwing them into the hopper to make vodka out of them.
Far more harm than hypothetical terrorists poisoning us all may already have been done by mistaken government nutrition policies. Anyone with the patience to read the excellent, objective, well-documented (but necessarily long) book "Good Calories, Bad Calories" (published in UK as "The Diet Delusion") by Gary Taubes will appreciate that hundreds of millions may have suffered avoidable ill health and had their lives shortened.
The use of non-biodegradable pesticides in Southwest Texas is an unspoken and huge issue.
We have a fire ant problem, and rather than wait for eco-friendly solutions, Southwest Texans took the Chlordane and other non-biodegradables and poured them on their lawns.
Down through the limestone and into the underground aquifer these chemicals have gone.
We watch our aquifer levels like a hawk, thinking that this is about just the quantity of water, but I suspect it has more to do with the garbage clinging to the bottom of the reservoir waiting to contaminate the whole water supply.
And I think this brings up a key point about terrorism: we need to be more concerned about what we do to each other accidently, than what we do to each other on purpose. If we take care of the accidents, the purposeful stuff will be far more manageable.
Computer threats, because of the personalities involved, will continue to be the fodder for paranoia, but, in truth, people running over people to get at what they want at any cost is the cause of terrorism.
The issue with water supplies is much the same as food supplies: there's enough nonmalicious threats possible that water is filtered, treated, and tested. It might be possible to inject fairly small amounts of poison in particular areas, but again we're talking about relatively minor effects.
I'm reminded of the Japanese cult trying to kill people. They used modern nerve gas in the Tokyo subways, which you'd think would be pretty close to ideal conditions. They killed twelve people.
The moral of the story, I guess, is that it's hard to kill a dozen people in a single attack, and that chemical and biological weapons are no match for a truck full of diesel fuel and fertilizer.
@volaar, I think you are correct, we need to focus on the true threats, not perceived.
"People say 'Oh, it's dangerous to keep weapons in the home or the workplace.'"
"Well, I say it's better to be hurt by someone you know accidentally, than by a stranger, on purpose" --Dwight Schrute, from the American "Office".
More corporate level fun: artificial sweeteners! Most people know that aspartame, ramrodded through the FDA by Donald Rumsfeld, causes problems because when heated it breaks down into methanol. That's why it's not marketed in products you can cook, although as Nutrasweet it's still peddled in packet form for the ignorant to put into their coffee and tea. That way, the responsibility for that uninformed decision is all on the end consumer. Diet Coke that gets heated up in trucks in the summertime on the way to the stupormarket is also all the end consumer's problem.
Recent studies on Splenda link it chemically to DDT and there have been no real studies done on how it breaks down in the human body.
Stevia, a natural product, was discouraged for sale in stupormarkets and only allowed to be sold in health food stores as a "food supplement" until the Coca Cola company reworked it into their own mass marketable product, Truvia, which after a few not-really-peer-reviewed studies was also ramrodded through the FDA to be the ONLY stevia product sold in stupormarkets.
So the mass marketed stuff is bad for you, and the stuff that actually won't eventually kill you or shove you into the meatgrinder of America's corporate health care system is deliberately made difficult to get until corporate America can figure out a way to own and/or nerf it.
To leave corporate America out of the threat analysis to America's health is indeed a fatal mistake.
What amazes me is not that there isn't poisoning -- there's precious little profit in that, but that we haven't yet seen genetically engineered plants with the ability to produce opium or cocaine being grown. There would be some very real advantages to being able to have your drug production look like a corn field.
Maybe they've already done that, and they did such a good job that no one knows :)
This is not a new thing. C'mon folks. How many people grew up where you would take the Holloween candy to the hospital to get it x-rayed for stuff. The idea of getting razor blades in apples has been around for years.
Actually, Gov. Thompson asks a valid question. The point has been made here several times that the object of terror attacks is *not* necessarily to kill anyone: the bad guys win if they cause induce fear, uncertainty, and doubt in their target society - even if the attack(s) kill NO ONE. So, even though the liklihood of a successful mass-killing is low, if people are convinced that the food / water supply itself is compromised, that is going to have a severe impact on their lives - and on their belief that their government is capable of protecting such an important piece of infrastructure.
That being said: given the flimsiness of some of the packaging used in the food industry these days, it IS somewhat surprising that the bad guys haven't launched that type of attack.
I rarely find problems with Bruce's articles but this time I have two.
The first is about the CIA. How do you know that what they're interested in - and by implication, all they're interested in - is targeted assassinations?
The second is far more fundamental. Is this article about terrorism or murder? Bruce sets it up as about terrorism, then says food suppy *terrorism* doesn't work because few people have been *killed* via deliberate contamination.
If the article is about terrorism, then it matters little how many people die. What matters is the credibility of and belief in the threat. Remember the Tylenol scare? Or metal bits in Pepsi? Or benzine in Perrier? Or any time a city needs to drink bottled water for a day or a week because the water supply was contaminated by storm overflow or lead or giardia? Very few people died in any of these but vast populations were scared and changed their behaviors.
If the article is about murder, then why the references to terrorism?
The Rajneeshees are a straw man. We're discussing the potential for poisoning the food supply. The Rajneeshees did so - 751 is a lot of people sick. The fact that none died is irrelevant to terrorism. True this was not a terrorist attack but it could have been: all the Rajneeshees needed to have done is announce their actions.
But even if Bruce's article didn't have this fundamental problem in logic and he is right about the food chain, I still wonder about water supply. Most water supply systems include large resevoirs out in the open, lightly protected if at all. Why aren't these a vulnerability?
I wouldn't call the Chinese milk contamination negligent. It was 100% intentional poisoning of the milk, in order to make money. They just didn't care that it would make people sick. A stupid plan with no obvious exit strategy, but intentional none the less.
The real difficulty of poisoning the food supply is that news travels fast and after only a few people are sickened killed, the rest of the public will be informed and not eat the poison. The trick would be to find a poison that has an incubation period so that many people can become infected before symptoms show up.
The water supply threat isn't from "terra wrists" but from incompetent workers. Note the Milwaukee case where about 400,000 people got sick and only about 100 deaths were attributed to the outbreak
One consequence of this outbreak is that health officials now monitor sales of many over-the-counter remedies (like imodium and pepto bismal for diarrhea, and many common cold remedies) to look for spikes.
A book that documents some cases where folks tried to use "bioweapons" and how unsuccessful they were, is Amerithrax, which mostly covers the anthrax letters sent in late 2001 in the US.
Yeah, right. Who was Thompson's boss again?
"Far more dangerous are accidental contaminations due to negligent industry practices... the 2008 milk contaminations in China, and the BSE-infected beef from earlier this decade."
I think you should check these out.
First of even the Chinese government has admitted that the poisoning was not just an issolated case but appears to have been endemic within the industry with the conivance of a senior governmental regulator.
As for the Beef, the jury is still out on this and we may never know the exact cause. It did not just occure in the UK but in several other European countries some of which there where no apparent feedstock links.
Oh there has been an outcry over the French feeding human waste to cattle, the UK feeding chiken waste to chickens, scraped carcaus of sheep to other sheep and cattle. All in the name of intensive farming.
However you might want to have a look around for stuff to do with wine deliberatly contaminated with antifreeze, olive oil deliberatly contaminated with a poisonous green colourant to make it look like virgin olive oil.
In Mexico there where the chickens so heavily contaminated with drugs that they caused children as young as three to show signs of puberty.
Further south was south american beef contaminated with unspecified chemicals through feed stock.
Not sure on this one but I have seen blogs refering to a milk contamination scandle in the U.S. Around "hey Whitie" Moores home state.
On the accidental side in the UK has been the recal of chocolate bars due to samonela contmination.
Then there was the whole "Curried Eggs" scandle where Edwina Curry MP Minister at Agg&Fish let slip that UK and EU eggs where frequently found to have dangerous levels of samonela.
Then there is our friends Monsanto... with cross contamination by GM plants with non GM crops getting into organic farmers "seed" and Monsanto then suing the farmers on the assumption they have stolen the seed...
These are just the ones I can sufficiently remember of the top of my head to say what they where about.
I won't say the list is endless but it does go on and on and on...
I recall an animal rights group threatening to inject frozen turkeys with something in Vancouver B.C. near Canadian Thanksgiving. Never mind you can't stick a needle in a frozen turkey, a whole lot of frozen turkeys got thrown out, and replaced with more live turkeys.
Most bomb threats don't result in actual bombs. People who plant a bomb usually want it to cause damage, not get found or blow up in an empty building.
> Most water supply systems include large reservoirs out in the open, ...
Large is the operative word. One cubic meter is 264 US gallons. How many square kilometers are these things? How deep?
Forget about harming anyone. How many 6000 gallon trucks of poison are you going to need just to get a DETECTABLE few parts-per-billion after dilution in the reservoir? How much will it cost? How many people will need to be involved?
And how the hell will you hide it?
This is not a practical threat.
An attack on the food supply wouldn't need to poison a single person to cause great harm. If a some fraction of the food supply in some reason could be contaminated in a way that is hard to track, a much larger quantity of food could be made unusable through an inability to test it.
Bruce, if you want to explain "Although it seems easy to do, understanding why it hasn't happened is important. ", you should perhaps spend more time arguing about why "it" hasn't happened yet, instead of sharing anecdotes about partial successes. And this ... "that becomes crystal clear as you read the details of the different incidents: it's hard to kill one person, and very hard to kill dozens. Hundreds, thousands: it's just not going to happen any time soon." ... is not evidence.
The Rajneeshees wanted to either kill or incapacitate locals to keep them from voting so they could continue their take over of the local government. That seems like terrorism to me, even if they didn't jump up and yell, "I did it!" when it didn't work out exactly as they had hoped.
Here's a "movie plot" idea, using a different sort of bioterrorism:
Take a map of the USA (or other large target country.) Place about 20 points on it, so that they plot out the logo of your terrorist organization. (You may need to hire an advertising company to do a 'branding exercise' as phase 0 of this plan.) Now send someone to each of those 20 locations to infect livestock there with foot-and-mouth disease.
Make sure you have enough people (or one fast enough person) to infect all of the locations before symptoms turn up at the early sites. You want you logo showing up on the maps only *after* you've finished infecting - otherwise it becomes a comic book plot instead, and Batman will be waiting for you at the last location.
Sorry couldn't resist. I'll get my coat...
The problem with contaminating the food supply isn't that it's hard to do, but that it's hard to do undetectably.
Food safety is heavily regulated in most of the first world, so there's a lot of detection going on. There are so many inspections and tests and whatnot. This detection isn't aimed exclusively at deliberate malicious contamination, but it's in place nonetheless and will catch almost anything you do, especially if not catching it could result in a lot of sickness (let alone death).
Say you try to poison wheat, for instance. It's going to get tested for safety when it's sold to the grain mill, again when it's ground into flour, and the flour is going to be checked again at the bakery plant, and then the bakery's products will be checked before they can go out, and that's the minimum. A couple of these food safety inspections may not find your poison, but chances are one of them will, and that's all it takes.
So if you poison any very large amount of food at the source, it's going to get noticed before it ever gets to a dinner table, and the contaminated food (as well as, probably, a lot of perfectly safe food that happens to be similar or nearby) will be discarded. Forcing food to be discarded doesn't terrify us much, because we have a substantial food surplus. It might make the news, but so what?
You say the poisoned Australian crops were recalled? How did they know to recall them? Oh, yeah, they were tested at some point and the problem was discovered. Of course they were recalled. And if the poison in the crops had been somehow missed and the crops sold, the products made out of them would have been tested and recalled before they ever found their way to a store shelf.
> if you're interested in sowing chaos, you
> can certainly increase the level of fear going
> around, or, most effective of all, cause a great
> deal of economic damage in the form of
> beefed-up security and expensive recalls.
There are much easier and more effective ways than getting some food recalled. Bomb threats spring immediately to mind, for instance. You don't even need to have an actual bomb, just make a few anonymous phone calls. Instant headline news.
> If we take care of the accidents, the purposeful
> stuff will be far more manageable.
Actually, measures put in place to detect accidental stuff will also detect deliberate stuff. That's why poisoning the food supply is so hard: there are all kinds of food safety checks. They're mostly intended to screen out accidental contamination, but they would also catch deliberate attacks.
" include large resevoirs out in the open, lightly protected if at all. Why aren't these a vulnerability?"
This is an interesting question. They are, and are so considered. Ask people harrassed for taking pictures.
I'd say, based on the article and some points made above, water is a universal solvent and resevoirs are not water tanks; they are ecologies - so there's some basic filtering going on there (poor little froggies)
It would require a significant contaminent (in terms of quantity and potency) as we see in aquifer pollution or around extraction industries, to overcome the quantity and the filtration that the reservoirs and water treatment system provides.
Security principal 5 - TEST! As @David says above - municipal water systems are tested.
On the point of terrorism?
The point of terrorism is to change political policy.
As for what the Rajneeshees did, they are the reason that we have "sneeze shields" on salad bars in the US.
Perhaps the real reason it has not been attempted (even unsuccessfully) is that terrorists in the US are a mostly non-existent bogeyman.
There are many possible terrorist attack vectors, and as pointed out above, they don't have to kill lots of people to create terror. If there are lots of ways to be attacked and no-one is doing it, maybe it's because hardly anyone wants to.
One guy with a machine gun in a post office or shopping mall can easily make national news, creating a climate of fear and gaining publicity for an extremist agenda. Terrorism is easy.
Hmmm, there's an interesting idea. In order to create a massive scare, send the nation into shock, you could probably just:
1. gather a group of people willing to die for the cause
2. brainwash them a tad
3. give them a gun
4. send them to a populated area in a big city
5. have them yell "Allah" and "jihad" a few times
6. kill as many people as they can before being taken down
Now, if one person does this it's news. If 10 people do this in different parts of the country, at the exact same time, the effect will be much more than 10 times bigger.
And for added fun, repeat one week later. If you can pull this off three to four times, you'll probably have a nation so panicked it would even be ready to reinstate Bush.
My money's with akb: the reason there aren't more terrorist attacks in the US or UK is that there simply aren't that many terrorists around in these places.
Trichinosis: Oh, goody - a sweetener conspiracy theorist. [barf]
Look - the average can of diet soda, if sweetened only with aspartame, will have about 220mg. of sweetener. If completely disasssociated, this will produce about 24mg. of methanol, equivalent to 0.03ml of pure methanol. This is a vanishingly tiny amount - you'd have to drink 33 cans of diet soda to produce one millilitre of methanol in your system!
And frankly - anyone who actually understands organic chemistry would see why comparing sucralose (Splenda) to DDT is simply ridiculous. To make just one point - sucralose is highly soluble in water and easily flushed from the body; DDT is not - in fact, it's highly fat-soluble, and would concentrate in the fat reserves of the body, lingering for a very long time.
I consider the intentional melamine contamination of flour (so it can fake a protein test, making it appear to be gluten) to be bio-terrorism. This slipped past the borders of many countries, and was even imported into the US by way of Norway (if I remember correctly) even though the origin was China.
Countless pet cats died because of this, as well as many small dogs. The lack of television coverage of this was alarming, since it also went into the human food supply.
My spouse is a doctor and was quite alarmed when this news first appeared. We had a very difficult time finding a pet food company that could verify their sources as all being in the US. (nearly?) all major pet food manufacturers had recalls... very little was discussed on the news.
In California, many hundreds of pig farms and millions of chickens were quarantined after their food was found to be contaminated. As far as I know, no-one has yet studied whether metabolized melamine can be transmitted to another animal by ingesting that animal (these animals were being sold as human food).
This is a slow and painful death caused by renal failure. The melamine (combined with melamine production byproducts) when combined with urine rapidly produces crystals inside the bladder and kidneys.
Feel free to adjust that search by adding the word "pig" or "chicken".
In case you want something more official:
China has also poisoned many in their own country, with melamine in high concentrations in baby formula (I don't remember how many died from this, but it is a significant number).
I do remember that the CEO of one of the companies caught doing this committed suicide after being charged.
China has a very bad track record of this... many have died in (if I remember correctly) South Africa from Chinese toothpaste contaminated with antifreeze (Ethylene Glycol, not the safer Propylene Glycol).
I consider the above proof that bio-terrorism is trivially simple... you only need to start in China.
As long as it is slow-acting and not a media buzzword, it won't get press (who's heard of melamine other than those who use the plastic utensils made from the mineral?).
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.