“If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.”
—Sun Tzu, The Art of War

There is no surprise in the statement, “We live in a complex world.” Economies are struggling worldwide, U.S. debt is massive, global competition is fierce, the U.S. food supply chain increasingly relies on products of foreign origin and then there’s those troubling issues of security. The world is at risk and the United States is at risk, including our food supply.

The litany of problems is not meant to discourage. The U.S. has faced existential threats many times before, and successfully overcome them with courage and imagination. Still, the list of potential problems indicates the complexity of the issues, which are now intertwined in a way unique to the twenty-first century. Problem solving has become more difficult, because most remaining problems are likely to be hard, “wicked” or even worse.

“Wicked” problems are altogether different from difficult ones because they are so complex that they resist solutions. So many factors are interwoven that one solution never really fits or, if it fits, the solution is transitory because the problem has evolved into something different. A good example of a wicked problem for food corporations is the inherent conflicts between federal regulations and customer requirements. Federal Agency A produces a regulation that is in conflict with that of another regulation from Federal Agency B. If the food corporation complies with regulation A, it violates regulation B. On top of this, imagine that Customer M requires the corporate product to meet its standards, which may be entirely different from Customer B’s requirements.

Ingredients for the corporate product come from 30 different countries, with half of them with problematic conditions. Organized crime may also be a problem in the countries that are the source of many of the remaining ingredient. Food corporations are accustomed to producing products with different specifications. What they are not used to (nobody is for that matter, including the federal government) is the level of complexity created by the combination of all these issues and events, which creates a business ecology plagued by a myriad of continually shifting problems.

What is a food corporation to do? Worse is likely to come, where those seeking to solve the problem may only make it worse. Don’t think this could happen to your corporation? Don’t have 10,000 people in your corporation to put on the problem? Then ask yourself how many employees you do have. However many there are, each should be part of the solution and not part of the problem. In other words, get your employees to buy in, so they recognize that what happens to the company happens to them. Employees are the backbone of a corporation, and, in a very real sense, they are the corporation itself. Therefore every one of them needs to be a major player in the protection of the investment (both the financial capital and the human capital).

Think of food defense in terms of what is called a “layered defense.” What does that mean? Think about how castles were defended in the old days. Castles were not designed to be today’s quaint and historic tourist attractions. They were complex defense systems, designed to repel protracted adversarial assaults and protect the riches inside by using layered defensive elements, including a berm or a moat or both, the gate house and barbican, the outer curtain wall, the inner curtain wall, towers and turrets, and—if all else failed—the keep. Defenses were designed to impede, delay and defeat, giving time for others to come to the rescue. A food corporation can be thought of as a castle defending the most precious treasure inside its keep—the corporate brand. A strong corporate brand makes known its standards for defense, both in terms of safety and in terms of security. An adversary will most likely look elsewhere for a victim.

So what are the layers that need to be protected in the modern food safety/security context? Again, imagine 1000 defenders (your employee safety/security warriors) and layering of the defenses. These then are the Food Safety/Security Ten Commandments by which you must live.

Thou shalt:
1. Know your suppliers. Harmonize their security plans with yours to ensure ingredients arrive unadulterated and are maintained as such throughout the processes that end in a safe and secure food product. Know where ingredients come from and keep careful records, so trace back, if ever necessary, will be quick and efficient.

2. Know your transportation elements. Ingredients and products also must be protected as they leave corporate control. If you carefully note the process, you will see that your product spends the most time out of your direct control, under the control of transporters. This creates both vulnerabilities and liabilities. Of all of the vulnerabilities faced by food corporations, this is probably the greatest and therefore has to be prioritized.

3. Know your process. Start by doing a very detailed self-assessment of the system/processes, identifying points of vulnerability. Then have third-party audit look at the very same things. This is critical, since your familiarity with the system can be a problem. Something that is invisible to you might be readily apparent to fresh eyes.

4. Know your people. Your employees really are your best defense when they are motivated, engaged and rewarded to do so. Allow them to look for and report any safety/security deficiencies they observe, and give them a way to rapidly report any potential hazard they observe.

5. Know your perimeter. Know how people and stuff enter your system, monitoring the input and output as well as everything in between. Obviously, keep people out who do not belong. This involves the usual gates and fences, but also entails layering of perimeter controls throughout your operation and limiting employee access to areas where they don’t belong. A well-designed perimeter inside company facilities (e.g. access to the ammonia refrigeration plant) can be as important as, or perhaps even more important than, a barrier enclosing building facilities.

6. Know your water supply. Do not depend on the supplier of your water to assure its quality and safety. Regularly monitor and assay.  Just ask the people of Flint, MI, what happens when a government entity is the only source of information about the safety of the water consumed by the public. Government was not a friend to the people of Flint. Government was, in many ways, the source of the problem. As President Reagan used to say, “Trust, but verify.” In other words, this is your corporate responsibility, if for no other reason than you will be the target of litigation should unsafe water make it into your food process. Government entities that screw up usually are not punished—there are no consequences. If bad water makes it into (and more importantly out of) your system, your corporation will not be so lucky.

7. Know your OPSEC. What is OPSEC? OPSEC is an acronym meaning Operational Security. Operational Security is the stuff of information, of schedules, proprietary information and personnel information, not in the sense of identity theft, but in the sense of information about your corporation, its employees and its operations. This is the kind of information that if acquired by the adversary can and will be used against you. This layer of security is often overlooked, but in these perilous times must be addressed both quickly and robustly. OPSEC is a big vulnerability for many. 

8. Know your customers. Your customers could, given the right circumstances, become a problem for you, particularly if they are not thinking about food defense in the same way as your corporation is thinking (or perhaps is not thinking) about food defense. Think in terms of liability. Who has the deepest pockets if a food defense breach occurs, and your product is somehow involved? Even if the incident is not directly your “fault,” it could become your liability. Therefore, you as a food corporation have to ensure all of your customers are adequately protecting your products. Remember that unless you sell directly to the public, your most frequent customers are wholesalers/distributors and food retailers (grocery stores, restaurants, etc.).

9. Know your brand. Think about how various types of security events could hurt your corporate image—your corporate brand. Your brand is, after all, the most important thing you own. Corporate facilities, if lost or damaged, can be replaced. You must practice for disaster, promoting first and foremost the ability to remain agile in crisis. A corporation that lacks agility in the face of a successful adversarial attack is a corporation that is going to be damaged, with the degree depending on the type and severity of the attack. In a worst-case scenario, brand quality, once lost, may spell immediate doom. At best, consumer confidence is not going to be easily recovered.

10. Know thyself. Corporate managers, as well as non-managerial employees, all have strengths and weaknesses. Know your employees and what they are capable of doing. Some managers are very good when all systems are “go,” but might not be so good if bad things happen. It is a rare individual who can stay calm and focused in the midst of chaos and disaster—but they do exist, and one might be located just down the hall. Find those individuals in your organization at every level, cultivate their skills and then hold onto them for dear life. Your corporation will need them one day.

Think not in terms of whether a food defense problem will occur, but rather when. Those calm and level headed employees alone can make the difference between a disaster resolved and one that takes full effect inside your organization and on top of your brand. Think about the sinking of the Titanic. Many people died because lifeboats were released from the ship without being filled to capacity. Why? The crew did not load the passengers properly. Command and management also failed at every level before and after the Titanic struck the iceberg. In the midst of the sinking, precious time was wasted and wrong decisions were made repeatedly.

Hubris and wrong decision killed the Titanic. The iceberg strike was just the precipitating event. The accident became a disaster when the people who should have protected the passengers failed in their duty. It didn’t have to be that way. Don’t let your food corporation become the next Titanic disaster.

Robert A. Norton, Ph.D., is a professor at Auburn University and a member of the Auburn University Food System Institute’s core faculty. A long-time consultant to federal and state law enforcement agencies, the Department of Defense and industry, he specializes in intelligence analysis, weapons of mass destruction defense and national security. For more information on the topic or for more detailed discussions about specific security related needs, he can be reached at nortora@auburn.edu or by phone at (334) 844-7562.