CARVER + Shock Primer

Download in PDF

AN OVERVIEW OF THE CARVER PLUS SHOCK METHOD FOR FOOD SECTOR VULNERABILITY ASSESSMENTS¹

September 2009

Overview

The CARVER plus Shock method is an offensive targeting prioritization tool that has been adapted for use in the food sector. This tool can be used to assess the vulnerabilities within a system or infrastructure to an attack. It allows you to think like an attacker by identifying the most attractive targets for attack. By conducting such a vulnerability assessment and determining the most vulnerable points in your infrastructure, you can then focus your resources on protecting your most vulnerable points.

CARVER is an acronym for the following six attributes (discussed in further detail later) used to evaluate the attractiveness of a target for attack:

• Criticality - measure of public health and economic impacts of an attack
• Accessibility – ability to physically access and egress from target
• Recuperability – ability of system to recover from an attack
• Vulnerability – ease of accomplishing attack
• Effect – amount of direct loss from an attack as measured by loss in production
• Recognizability – ease of identifying target

In addition, the modified CARVER tool evaluates a seventh attribute, the combined health, economic, and psychological impacts of an attack, or the SHOCK attributes of a target.

The attractiveness of a target can then be ranked on a scale from one to ten on the basis of scales that have been developed for each of the seven attributes. Conditions that are associated with lower attractiveness (or lower vulnerability) are assigned lower values (e.g., 1 or 2), whereas, conditions associated with higher attractiveness as a target (or higher vulnerability) are assigned higher values (e.g., 9 or 10). Evaluating or scoring the various elements of the food sector infrastructure of interest for each of the CARVER-Shock attributes can help identify where within that infrastructure an attack is most likely to occur. Federal agencies, such as the Food Safety and Inspection Service (FSIS) and the Food and Drug Administration (FDA), have used this method to evaluate the potential vulnerabilities of farm-to-table supply chains of various food commodities. The method can also be used to assess the potential vulnerabilities of individual facilities or processes.

Step 1 – Establishing Parameters

Before any scoring can begin, the scenarios and assumptions you wish to use in the analysis must be established in order to guide all further steps. That is, you need to answer the question of what you are trying to protect and what you are trying to protect it from. Those parameters include:

• what food supply chain you are going to assess (e.g., hot dog production versus deli meat production versus chicken nugget production, overall assessment based on generic process from farm to table versus postslaughter processing in a specific facility, etc.);
• what is the endpoint of concern (e.g., foodborne illness and death versus economic impacts, etc.);
• what type of attacker and attack you are trying to protect against. Attackers could range from disgruntled employees to international terrorist organizations. Those different attackers have different capabilities and different goals. For example, a major assumption used by FSIS and FDA in their vulnerability assessments is that one of the goals of terrorist organizations is to cause mass mortality by adding acutely toxic agents to food products. That assumption has a major impact on the scoring of the various parts of the supply chain and the scales for the attributes (see below) have been developed with that in mind;
• what agent(s) might be used. The agent used in your scenario will impact the outcome of the assessment. Potential agents include biological, chemical or radiological agents. Different agents have different properties—potency, heat stability, pH stability, half-life, etc.—that will determine the impact of an intentional contamination incident.

Step 2 – Assembling Experts

A team of subject matter experts should be compiled to conduct the assessment. The team should consist, at a minimum, of experts in food production (specifically for the food process being evaluated), food science, toxicology, epidemiology, microbiology, medicine (human and veterinarian), radiology, and risk assessment. The team will apply the CARVER-Shock method to each element of food system infrastructure and come to a consensus on the value from one to ten for each attribute, using the scenario and assumptions established in Step 1.

Step 3 – Detailing Food Supply Chain

The analysis begins by developing a description of the system under evaluation. A graphical representation (flow chart) of the system and its subsystem, complexes, components and nodes (its smaller structural parts) should be developed to facilitate this process. For example, if you are evaluating hot dog production, the food system is hot-dog production, which can be broken down into subsystems (production of live animals subsystem, slaughter/processing  subsystem, distribution subsystem). Those subsystems can be further broken down into complexes (e.g., slaughterhouse facility and processing facility) Those can be broken down into components and would include the raw materials receiving area, processing area, storage area, shipping area, etc.), and to the smallest possible nodes (e.g., individual pieces of equipment).

Step 4 – Assigning Scores

Once the infrastructure has been broken down into its smallest parts (i.e., components and nodes), these can be ranked or scored for each of the seven CARVER-Shock attributes to calculate an overall score for that node. The nodes with the higher overall scores are those that are potentially the most vulnerable nodes (i.e., most attractive targets for an attacker). The rationale for a particular consensus score should be captured.

Step 5 – Applying What Has Been Learned

Once the critical nodes of the system have been identified, a plan should be developed to put countermeasures in place that minimize the attractiveness of the nodes as targets. Countermeasures might include enhancements to physical security, personnel security, and operational security that help to minimize aggressor access to the product or process.

Description of Attributes and Scales

The following section defines the attributes used by FDA and USDA to conduct their vulnerability assessments and provides the scales used by the agencies for scoring each attribute. These scales were developed with the mindset that mass mortality is a goal of terrorist organizations. It is important to remember, however, that any intentional food contamination could also have major psychological and economic impacts on the affected industry. Tables to assist in calculating the public health impacts and the overall CARVER+Shock scores, as well as individual node scores can be found in Appendix A, B and C, respectively.

Criticality: A target is critical when introduction of threat agents into food at this location would have significant health or economic impact. Example metrics are:

Criticality Criteria	Scale
Loss of over 10,000 lives OR loss of more than $100 billion. (Note: if looking on a company level, loss of > 90 % of the total economic value for which you are concerned.*)	9 –10
Loss of life is between 1,000 – 10,000 OR loss of between $10 billion and $100 billion. (Note: if looking on a company level, loss of between 61% and 90 % of the total economic value for which you are concerned.*)	7 – 8
Loss of life between 100 and 1000 OR loss of between $1 and $10 billion. (Note: if looking on a company level, loss of between 31% and 60% of the total economic value for which you are concerned.*)	5 – 6
Loss of life less than 100 OR loss of between $100 million and $1 billion. (Note: if looking on a company level, loss of between 10% and 30% of the total economic value for which you are concerned.*)	3 – 4
No loss of life OR loss of less than $100 million. (Note: if looking on a company level, loss of < 10% of the total economic value for which you are concerned.*)	1 - 2

* The total economic value for which you are concerned depends on your perspective. For example, for a company this could be the percent of a single facility’s gross revenues, or percentage of a company’s gross revenues lost from the effect on a single product line. Likewise, a state could evaluate the effect of the economic loss caused by an attack of a facility or farm by the proportion of the state’s economy contributed by that commodity.

Accessibility: A target is accessible when an attacker can reach the target to conduct the attack and egress the target undetected. Accessibility is the openness of the target to the threat. This measure is independent of the probability of successful introduction of threat agents. Example metrics are:

Accessibility Criteria	Scale
Easily Accessible (e.g., target is outside building and no perimeter fence). Limited physical or human barriers or observation. Attacker has relatively unlimited access to the target. Attack can be carried out using medium or large volumes of contaminant without undue concern of detection. Multiple sources of information concerning the facility and the target are easily available.	9 –10
Accessible (e.g., target is inside building, but in unsecured part of facility). Human observation and physical barriers limited. Attacker has access to the target for an hour or less. Attack can be carried out with moderate to large volumes of contaminant, but requires the use of stealth. Only limited specific information is available on the facility and the target.	7 – 8
Partially Accessible (e.g. inside building, but in a relatively unsecured, but busy, part of facility). Under constant possible human observation. Some physical barriers may be present. Contaminant must be disguised, and time limitations are significant. Only general, non-specific information is available on the facility and the target.	5 – 6
Hardly Accessible (e.g., inside building in a secured part of facility). Human observation and physical barriers with an established means of detection. Access generally restricted to operators or authorized persons. Contaminant must be disguised and time limitations are extreme. Limited general information available on the facility and the target.	3 – 4
Not Accessible. Physical barriers, alarms, and human observation. Defined means of intervention in place. Attacker can access target for less than 5 minutes with all equipment carried in pockets. No useful publicly available information concerning the target.	1 – 2

Recuperability: A target’s recuperability is measured in the time it will take for the specific system to recover productivity. The effect of a possible decrease in demand is considered in this criterion. Example metrics are:

Recuperability Criteria	Scale
> 1 year	9 - 10
6 months to 1 year	7 – 8
3-6 months	5 – 6
1-3 months	3 – 4
< 1="">	1 – 2

Effect: Effect is a measure of the percentage of system productivity damaged by an attack at a single facility. Thus, effect is inversely related to the total number of facilities producing the same product. Example metrics are:

Effect Criteria	Scale
Greater than 50% of the system’s production impacted	9 -10
25-50% of the system’s production impacted	7 - 8
10-25% of the system’s production impacted	5 - 6
1-10% of the system’s production impacted	3 - 4
Less than 1% of system’s production impacted	1 - 2

Recognizability: A target’s recognizability is the degree to which it can be identified by an attacker without confusion with other targets or components. Example metrics are:

Recognizability Criteria	Scale
The target is clearly recognizable and requires little or no training for recognition	9 –10
The target is easily recognizable and requires only a small amount of training for recognition	7 – 8
The target is difficult to recognize or might be confused with other targets or target components and requires some training for recognition	5 – 6
The target is difficult to recognize. It is easily confused with other targets or components and requires extensive training for recognition	3 – 4
The target cannot be recognized under any conditions, except by experts.	1 – 2

Shock: Shock is the final attribute considered in the methodology. Shock is the combined measure of the health, psychological, and collateral national economic impacts of a successful attack on the target system. Shock is considered on a national level. The psychological impact will be increased if there are a large number of deaths or the target has historical, cultural, religious or other symbolic significance. Mass casualties are not required to achieve widespread economic loss or psychological damage. Collateral economic damage includes such items as decreased national economic activity, increased unemployment in collateral industries, etc. Psychological impact will be increased if victims are members of sensitive subpopulations such as children or the elderly.

The metrics for this criterion are:

Shock	Scale
Target has major historical, cultural, religious, or other symbolic importance. Loss of over 10,000 lives. Major impact on sensitive subpopulations, e.g., children or elderly. National economic impact more than $100 billion.	9-10
Target has high historical, cultural, religious, or other symbolic importance. Loss of between 1,000 and 10,000 lives. Significant impact on sensitive subpopulations, e.g., children or elderly. National economic impact between $10 and $100 billion.	7-8
Target has moderate historical, cultural, religious, or other symbolic importance. Loss of life between 100 and 1,000. Moderate impact on sensitive subpopulations, e.g., children or elderly. National economic impact between $1 and $10 billion.	5-6
Target has little historical, cultural, religious, or other symbolic importance. Loss of life less than 100. Small impact on sensitive subpopulations, e.g., children or elderly. National economic impact between $100 million and $1 billion.	3-4
Target has no historical, cultural, religious, or other symbolic importance. Loss of life less than 10. No impact on sensitive subpopulations, e.g., children or elderly. National economic impact less than $100 million.	1-2

By definition, terrorists attempt to achieve strong emotional responses from their target audience. Aspects of targets that terrorists view as increasing a target’s shock value are symbolism (e.g., the Pentagon), large number of casualties, sensitive nature of facilities (e.g., nuclear facilities), and the ability to strike at core values and primal emotions (e.g., targeting children).

Calculation of Final Values and Interpretation

Once the ranking on each of the attribute scales has been calculated for a given node within the food supply system, the ranking on all of the scales can then be totaled to give an overall value for that node. This should be repeated for each node within a food supply system. The overall values for all the nodes can then be compared to rank the vulnerability of the different nodes relative to each other. The summary table provided in Appendix B can assist in summarizing the rankings. The nodes with the highest total rating have the highest potential vulnerability and should be the focus of countermeasure efforts.

APPENDIX A

This appendix provides a table that can be used to calculate the potential number of deaths and illnesses resulting from addition of a particular adulterant at a particular point in a given food production process. Details of the batch size to which the adulterant is added, the number of servings that will be sold and eaten from that batch, and the characteristics of the adulterant (including its lethality) must be known to use this worksheet. The numbers generated in this worksheet will help determine where on the criticality scale a given attack will fall.

Table A: WORKSHEET FOR CALCULATING CRITICALITY

Product:
Entry Point	Agent	A Batch Size	B Serving Size	C Servings per Batch A/B	D Dose Required per Serving	E Total Amount Required per Batch C x D	F Distribution Unit	G Units Produced A/F

H % of Units Sold Before Warning	I Units for Potential Consumption H/100 x G	J Consumers per Distribution Unit	K Number of Potential Exposures I x J	L % of Units Consumed Before Warning	M Number of Exposures K x L/100	N Morbidity/ Mortality Rate	O Number ofM Illnesses/ Deaths M x N

APPENDIX B

This appendix provides a table that can be used to total the scores across the CARVER+Shock attributes for each node. The totals can then be compared across the various nodes to determine which nodes are critical. The nodes with the highest scored are the ‘critical nodes’ and should be the focus for beginning to implement countermeasures.

Table B: Summary sheet for totally scores for nodes across CARVER+Shock attributes.

FOOD:___________________________________________

TARGET (Nodes)	CRITICALITY	ACCESSI- BILITY	RECUPER- ABILITY	VULNER- ABILITY	EFFECT	RECOG- NIZABILITY	SHOCK	OVERALL SCORE

APPENDIX C

This appendix provides a table that can be used to summarize the CARVER+Shock score on each attributes for given node. The table includes a place for a brief narrative of the rational or justification for giving a node a particular score, allowing the thoughts that went into the scoring to be captured.

Table C: Summary sheet for analysis of individual nodes, including the justification for the score given.

Product:
Target Complex:
Target Node:
FACTOR	SCORE	JUSTIFICATION
CRITICALITY
ACCESSIBILITY
RECUPERABILITY
VULNERABILITY
EFFECT
RECOGNIZABILITY
SHOCK
OVERALL
RANK

¹For further information please contact Kim Green, USDA/FSIS, via email at Kim.Green@fsis.usda.gov or Jon Woody, FDA/CFSAN, via email at Jon.Woody@fda.hhs.gov.