CARVER + SHOCK PRIMER

AN OVERVIEW OF THE CARVER PLUS

SHOCK METHOD FOR FOOD SECTOR

VULNERABILITY ASSESSMENTS1

1
For further information please contact Kim Green, USDA/FSIS, via email at
Kim.Green@fsis.usda.gov or Jon Woody, FDA/CFSAN, via email at Jon.Woody@fda.hhs.gov.

9/23/2009 1
 CARVER PLUS SHOCK METHOD FOR FOOD SECTOR VULNERABILITY

ASSESSMENTS

Overview

The CARVER plus Shock method is an offensive targeting prioritization tool that
has been adapted for use in the food sector. This tool can be used to assess the
vulnerabilities within a system or infrastructure to an attack. It allows you to think
like an attacker by identifying the most attractive targets for attack. By
conducting such a vulnerability assessment and determining the most vulnerable
points in your infrastructure, you can then focus your resources on protecting
your most vulnerable points.

CARVER is an acronym for the following six attributes (discussed in further detail
later) used to evaluate the attractiveness of a target for attack:

• Criticality - measure of public health and economic impacts of an attack

• Accessibility – ability to physically access and egress from target
• Recuperability – ability of system to recover from an attack
• Vulnerability – ease of accomplishing attack
• Effect – amount of direct loss from an attack as measured by loss in
production
• Recognizability – ease of identifying target

In addition, the modified CARVER tool evaluates a seventh attribute, the

combined health, economic, and psychological impacts of an attack, or the
SHOCK attributes of a target.

The attractiveness of a target can then be ranked on a scale from one to ten on
the basis of scales that have been developed for each of the seven attributes.
Conditions that are associated with lower attractiveness (or lower vulnerability)
are assigned lower values (e.g., 1 or 2), whereas, conditions associated with
higher attractiveness as a target (or higher vulnerability) are assigned higher
values (e.g., 9 or 10). Evaluating or scoring the various elements of the food
sector infrastructure of interest for each of the CARVER-Shock attributes can
help identify where within that infrastructure an attack is most likely to occur.
Federal agencies, such as the Food Safety and Inspection Service (FSIS) and
the Food and Drug Administration (FDA), have used this method to evaluate the
potential vulnerabilities of farm-to-table supply chains of various food
commodities. The method can also be used to assess the potential
vulnerabilities of individual facilities or processes.

9/23/2009 2
 Steps for Conducting a CARVER + Shock Analysis

Step 1 – Establishing Parameters

Before any scoring can begin, the scenarios and assumptions you wish to use in
the analysis must be established in order to guide all further steps. That is, you
need to answer the question of what you are trying to protect and what you are
trying to protect it from. Those parameters include:

- what food supply chain you are going to assess (e.g., hot dog production
versus deli meat production versus chicken nugget production, overall
assessment based on generic process from farm to table versus post-
slaughter processing in a specific facility, etc.);
- what is the endpoint of concern (e.g., foodborne illness and death versus
economic impacts, etc.);
- what type of attacker and attack you are trying to protect against. Attackers
could range from disgruntled employees to international terrorist
organizations. Those different attackers have different capabilities and
different goals. For example, a major assumption used by FSIS and FDA in
their vulnerability assessments is that one of the goals of terrorist
organizations is to cause mass mortality by adding acutely toxic agents to
food products. That assumption has a major impact on the scoring of the
various parts of the supply chain and the scales for the attributes (see below)
have been developed with that in mind;
- what agent(s) might be used. The agent used in your scenario will impact the
outcome of the assessment. Potential agents include biological, chemical or
radiological agents. Different agents have different properties—potency, heat
stability, pH stability, half-life, etc.—that will determine the impact of an
intentional contamination incident.

Step 2 – Assembling Experts

A team of subject matter experts should be compiled to conduct the assessment.
The team should consist, at a minimum, of experts in food production
(specifically for the food process being evaluated), food science, toxicology,
epidemiology, microbiology, medicine (human and veterinarian), radiology, and
risk assessment. The team will apply the CARVER-Shock method to each
element of food system infrastructure and come to a consensus on the value
from one to ten for each attribute, using the scenario and assumptions
established in Step 1.

Step 3 – Detailing Food Supply Chain

The analysis begins by developing a description of the system under evaluation.
A graphical representation (flow chart) of the system and its subsystem,
complexes, components and nodes (its smaller structural parts) should be
developed to facilitate this process. For example, if you are evaluating hot dog
production, the food system is hot-dog production, which can be broken down
into subsystems (production of live animals subsystem, slaughter/processing

9/23/2009 3
subsystem, distribution subsystem). Those subsystems can be further broken
down into complexes (e.g., slaughterhouse facility and processing facility) Those
can be broken down into components and would include the raw materials
receiving area, processing area, storage area, shipping area, etc.), and to the
smallest possible nodes (e.g., individual pieces of equipment).

Step 4 – Assigning Scores

Once the infrastructure has been broken down into its smallest parts (i.e.,
components and nodes), these can be ranked or scored for each of the seven
CARVER-Shock attributes to calculate an overall score for that node. The nodes
with the higher overall scores are those that are potentially the most vulnerable
nodes (i.e., most attractive targets for an attacker). The rationale for a particular
consensus score should be captured.

Step 5 – Applying What Has Been Learned

Once the critical nodes of the system have been identified, a plan should be
developed to put countermeasures in place that minimize the attractiveness of
the nodes as targets. Countermeasures might include enhancements to physical
security, personnel security, and operational security that help to minimize
aggressor access to the product or process.

Description of Attributes and Scales

The following section defines the attributes used by FDA and USDA to conduct
their vulnerability assessments and provides the scales used by the agencies for
scoring each attribute. These scales were developed with the mindset that mass
mortality is a goal of terrorist organizations. It is important to remember, however,
that any intentional food contamination could also have major psychological and
economic impacts on the affected industry. Tables to assist in calculating the
public health impacts and the overall CARVER+Shock scores, as well as
individual node scores can be found in Appendix A, B and C, respectively.

Criticality: A target is critical when introduction of threat agents into food at this
location would have significant health or economic impact. Example metrics are:

Criticality Criteria Scale

Loss of over 10,000 lives OR loss of more than $100 billion. (Note: if looking 9 – 10
on a company level, loss of > 90 % of the total economic value for which you
are concerned.*)
Loss of life is between 1,000 – 10,000 OR loss of between $10 billion and 7–8
$100 billion. (Note: if looking on a company level, loss of between 61% and
90 % of the total economic value for which you are concerned.*)
Loss of life between 100 and 1000 OR loss of between $1 and $10 billion. 5–6
(Note: if looking on a company level, loss of between 31% and 60% of the
total economic value for which you are concerned.*)

9/23/2009 4
 Loss of life less than 100 OR loss of between $100 million and $1 billion. 3–4
(Note: if looking on a company level, loss of between 10% and 30% of the
total economic value for which you are concerned.*)
No loss of life OR loss of less than $100 million. (Note: if looking on a 1 – 2
company level, loss of < 10% of the total economic value for which you are
concerned.*)
* The total economic value for which you are concerned depends on your perspective. For example, for a
company this could be the percent of a single facility’s gross revenues, or percentage of a company’s gross
revenues lost from the effect on a single product line. Likewise, a state could evaluate the effect of the
economic loss caused by an attack of a facility or farm by the proportion of the state’s economy contributed
by that commodity.

Accessibility: A target is accessible when an attacker can reach the target to

conduct the attack and egress the target undetected. Accessibility is the
openness of the target to the threat. This measure is independent of the
probability of successful introduction of threat agents. Example metrics are:

Accessibility Criteria Scale

Easily Accessible (e.g., target is outside building and no perimeter fence). 9 – 10
Limited physical or human barriers or observation. Attacker has relatively
unlimited access to the target. Attack can be carried out using medium or
large volumes of contaminant without undue concern of detection. Multiple
sources of information concerning the facility and the target are easily
available.
Accessible (e.g., target is inside building, but in unsecured part of facility). 7–8
Human observation and physical barriers limited. Attacker has access to the
target for an hour or less. Attack can be carried out with moderate to large
volumes of contaminant, but requires the use of stealth. Only limited specific
information is available on the facility and the target.
Partially Accessible (e.g. inside building, but in a relatively unsecured, but 5–6
busy, part of facility). Under constant possible human observation. Some
physical barriers may be present. Contaminant must be disguised, and time
limitations are significant. Only general, non-specific information is available
on the facility and the target.
Hardly Accessible (e.g., inside building in a secured part of facility). Human 3–4
observation and physical barriers with an established means of detection.
Access generally restricted to operators or authorized persons. Contaminant
must be disguised and time limitations are extreme. Limited general
information available on the facility and the target.
Not Accessible. Physical barriers, alarms, and human observation. Defined 1–2
means of intervention in place. Attacker can access target for less than 5
minutes with all equipment carried in pockets. No useful publicly available
information concerning the target.

9/23/2009 5
Recuperability: A target’s recuperability is measured in the time it will take for
the specific system to recover productivity. The effect of a possible decrease in
demand is considered in this criterion. Example metrics are:

Recuperability Criteria Scale

> 1 year 9 – 10
6 months to 1 year 7–8
3-6 months 5–6
1-3 months 3–4
< 1 month 1–2

Vulnerability: A measure of the ease with which threat agents can be introduced
in quantities sufficient to achieve the attacker’s purpose once the target has been
reached. Vulnerability is determined both by the characteristics of the target
(e.g., ease of introducing agents, ability to uniformly mix agents into target) and
the characteristics of the surrounding environment (ability to work unobserved,
time available for introduction of agents). It is also important to consider what
interventions are already in place that might thwart an attack. Example metrics
are:

Vulnerability Criteria Scale

Target characteristics allow for easy introduction of sufficient agents to 9 – 10
achieve aim.
Target characteristics almost always allow for introduction of sufficient agents 7–8
to achieve aim.
Target characteristics allow 30 to 60% probability that sufficient agents can 5–6
be added to achieve aim.
Target characteristics allow moderate probability (10 to 30 %) that sufficient 3–4
agents can be added to achieve aim.
Target characteristics allow low probability (less than 10%) sufficient agents 1–2
can be added to achieve aim.

Effect: Effect is a measure of the percentage of system productivity damaged by

an attack at a single facility. Thus, effect is inversely related to the total number
of facilities producing the same product. Example metrics are:

Effect Criteria Scale

Greater than 50% of the system’s production impacted 9 – 10
25-50% of the system’s production impacted 7–8
10-25% of the system’s production impacted 5–6
1-10% of the system’s production impacted 3–4
Less than 1% of system’s production impacted 1–2

9/23/2009 6
Recognizability: A target’s recognizability is the degree to which it can be
identified by an attacker without confusion with other targets or components.
Example metrics are:

Recognizability Criteria Scale

The target is clearly recognizable and requires little or no training for 9 – 10
recognition
The target is easily recognizable and requires only a small amount of training 7–8
for recognition
The target is difficult to recognize or might be confused with other targets or 5–6
target components and requires some training for recognition
The target is difficult to recognize. It is easily confused with other targets or 3–4
components and requires extensive training for recognition
The target cannot be recognized under any conditions, except by experts. 1–2

Shock: Shock is the final attribute considered in the methodology. Shock is the
combined measure of the health, psychological, and collateral national economic
impacts of a successful attack on the target system. Shock is considered on a
national level. The psychological impact will be increased if there are a large
number of deaths or the target has historical, cultural, religious or other symbolic
significance. Mass casualties are not required to achieve widespread economic
loss or psychological damage. Collateral economic damage includes such items
as decreased national economic activity, increased unemployment in collateral
industries, etc. Psychological impact will be increased if victims are members of
sensitive subpopulations such as children or the elderly.

The metrics for this criterion are:

Shock Scale
Target has major historical, cultural, religious, or other symbolic 9-10
importance. Loss of over 10,000 lives. Major impact on sensitive
subpopulations, e.g., children or elderly. National economic impact more
than $100 billion.
Target has high historical, cultural, religious, or other symbolic 7-8
importance. Loss of between 1,000 and 10,000 lives. Significant impact
on sensitive subpopulations, e.g., children or elderly. National economic
impact between $10 and $100 billion.
Target has moderate historical, cultural, religious, or other symbolic 5-6
importance. Loss of life between 100 and 1,000. Moderate impact on
sensitive subpopulations, e.g., children or elderly. National economic
impact between $1 and $10 billion.
Target has little historical, cultural, religious, or other symbolic 3-4
importance. Loss of life less than 100. Small impact on sensitive
subpopulations, e.g., children or elderly. National economic impact
between $100 million and $1 billion.
Target has no historical, cultural, religious, or other symbolic importance. 1-2
Loss of life less than 10. No impact on sensitive subpopulations, e.g.,
children or elderly. National economic impact less than $100 million.

9/23/2009 7
By definition, terrorists attempt to achieve strong emotional responses from
their target audience. Aspects of targets that terrorists view as increasing a
target’s shock value are symbolism (e.g., the Pentagon), large number of
casualties, sensitive nature of facilities (e.g., nuclear facilities), and the ability to
strike at core values and primal emotions (e.g., targeting children).

Calculation of Final Values and Interpretation

Once the ranking on each of the attribute scales has been calculated for a given
node within the food supply system, the ranking on all of the scales can then be
totaled to give an overall value for that node. This should be repeated for each
node within a food supply system. The overall values for all the nodes can then
be compared to rank the vulnerability of the different nodes relative to each other.
The summary table provided in Appendix B can assist in summarizing the
rankings. The nodes with the highest total rating have the highest potential
vulnerability and should be the focus of countermeasure efforts.

9/23/2009 8
 APPENDIX A

This appendix provides a table that can be used to calculate the potential number
of deaths and illnesses resulting from addition of a particular adulterant at a
particular point in a given food production process. Details of the batch size to
which the adulterant is added, the number of servings that will be sold and eaten
from that batch, and the characteristics of the adulterant (including its lethality)
must be known to use this worksheet. The numbers generated in this worksheet
will help determine where on the criticality scale a given attack will fall.

9/23/2009 9
Table A: WORKSHEET FOR CALCULATING CRITICALITY

Product:
A B C D E F G
Entry Point Agent Batch Size Serving Servings Dose Total Distribution Units
Size per Batch Required Amount Unit Produced
per Serving Required
per Batch
A/B CxD A/F

H I J K L M N O
% of Units Units for Consumers Number of % of Units Number of Morbidity/ Number of
Sold Before Potential per Potential Consumed Exposures Mortality Illnesses/
Warning Consumption Distribution Exposures Before Rate Deaths
H/100 x G Unit IxJ Warning K x L/100 MxN

9/23/2009 10
 APPENDIX B

This appendix provides a table that can be used to total the scores across the
CARVER+Shock attributes for each node. The totals can then be compared
across the various nodes to determine which nodes are critical. The nodes with
the highest scored are the ‘critical nodes’ and should be the focus for beginning
to implement countermeasures.

9/23/2009 11
Table B: Summary sheet for totally scores for nodes across CARVER+Shock attributes.

FOOD: _________________________________

RECUPERABILITY

RECOGNIZABILITY

OVERALL SCORE
VULNERABILITY
ACCESSIBILITY
CRITICALITY
TARGET (Nodes)

EFFECT

SHOCK
9/23/2009 12
 APPENDIX C

This appendix provides a table that can be used to summarize the

CARVER+Shock score on each attributes for given node. The table includes a
place for a brief narrative of the rational or justification for giving a node a
particular score, allowing the thoughts that went into the scoring to be captured.

9/23/2009 13
Table C: Summary sheet for analysis of individual nodes, including the justification for the score given.

Product:
Target Complex:
Target Node:
FACTOR SCORE JUSTIFICATION

CRITICALITY

ACCESSIBILITY

RECUPERABILITY

VULNERABILITY

EFFECT

RECOGNIZABILITY

SHOCK

OVERALL
RANK

9/23/2009 14