Analyzing a bioterror attack on the food supply: The case of botulinum toxin in milk.

Abstract

We developed a mathematical model of a cows-to-consumers supply chain associated with a single milk-processing facility that is the victim of a deliberate release of botulinum toxin. Because centralized storage and processing lead to substantial dilution of the toxin, a minimum amount of toxin is required for the release to do damage. Irreducible uncertainties regarding the dose–response curve prevent us from quantifying the minimum effective release. However, if terrorists can obtain enough toxin, and this may well be possible, then rapid distribution and consumption result in several hundred thousand poisoned individuals if detection from early symptomatics is not timely. Timely and specific in-process testing has the potential to eliminate the threat of this scenario at a cost of less than 1 cent per gallon and should be pursued aggressively. Investigation of improving the toxin inactivation rate of heat pasteurization without sacrificing taste or nutrition is warranted.

Introduction

Among bioterror attacks not involving genetic engineering, the three scenarios that arguably pose the greatest threats to humans are a smallpox attack, an airborne anthrax attack, and a release of botulinum toxin in cold drinks. The methods of dissemination in these three scenarios are, respectively, the person-to-person spread of a contagious disease, the outdoor dispersal of a highly durable and lethal agent, and the large-scale storage and production and rapid widespread distribution and consumption of beverages containing the most poisonous substance known. The first two scenarios have been the subject of recent systems modeling studies, and here we present a detailed systems analysis of the third scenario. For concreteness, we consider a release in the milk supply, which, in addition to its symbolic value as a target, is characterized by the rapid distribution of 20 billion gallons per year in the U.S.; indeed, two natural Salmonella outbreaks in the dairy industry each infected ≈200,000 people. Nonetheless, our methods are applicable to similar food products, such as fruit and vegetable juices, canned foods (e.g., processed tomato products), and perhaps grain-based and other foods possessing the bow-tie-shaped supply chain.

Discussion

Combating bioterrorism requires an appropriate mix of prevention, mitigation, detection, and response. Our observation that, due to the successive mixing operations in the upstream portion of the supply chain, the impact of a deliberate release upstream of the processing plant is independent of the precise location may aid in prioritizing resources for prevention. A foodborne attack is much more preventable than an airborne or mailborne attack, due to the restricted number of release locations. Requiring all tanks, trucks, and silos to be locked when not being drained or filled would be an obvious step forward, as would security checks for personnel who have access to prebottled milk (farm laborers, truck drivers, receiving labor at the processing facility, and plant engineers) and requiring one person from each stage of the supply chain to be present while milk is transferred from one stage to the next.

Although these and other measures are included in proposed Food and Drug Administration guidelines, they are currently voluntary. Homeland security officials need to engage industry leaders to establish the most appropriate way to guarantee these guidelines are enforced. Although enforcement options range from voluntary guidelines to new laws, the most promising approach may be to develop International Organization for Standardization (ISO) security standards that are analogous to the ISO 9000 standards for quality management and the ISO 14000 standards for environmental management.

Turning to mitigation, botulinum toxin cannot be completely inactivated by radiation or any heat treatment that does not adversely affect the milk's taste. Ultrahigh-temperature (UHT) pasteurization (performed to provide extended shelf life) appears capable of completely inactivating botulinum toxin in milk, but UHT milk has not been embraced by U.S. consumers. Nonetheless, it is worthwhile to perform pasteurization studies to determine whether a more potent inactivation process can be used without compromising nutrition or taste, particularly because the inactivation rate appears to be quite sensitive to the pasteurization temperature and time in the neighborhood of the current pasteurization formula. Reducing the time between silo cleanings decreases the number of people poisoned in, at most, a linear manner, but more frequent cleanings would not only increase variable material and labor costs but would possibly require fixed investments in additional silos.

Before discussing detection, we note that, on the response side, ≈60% of poisoned individuals would require mechanical ventilation. Given the small number of ventilators and limited amount of antitoxin in the national stockpile, the death rate from a large attack would likely be closer to the pre-1950s 60% rate or the 25% rate incurred in the 1950s than to the 6% death rate experienced in the 1990s. Moreover, the current treatment, a passive immunization with equine antitoxin, does not reverse existent paralysis, and postexposure prophylaxis with antitoxin has adverse side effects. Although an economic impact assessment of this scenario is beyond the scope of our study, the economic cost (including direct medical costs and lost productivity due to illness and death) from a hypothetical botulism outbreak that poisons 50,000 people was estimated to be 8.6 billion, using a direct medical cost (assuming ample ventilators and antitoxin) per hospitalized patient of ≈$55,000 (based on Canadian dollars in 1993–1994).

In contrast, two recent U.S. victims receiving injections of “fake Botox” each incurred a $350,000 medical bill in the first 2 weeks of illness [S. Z. Grossman (lawyer of Botox victims), personal communication]. If this latter amount was spent on each survivor in an attack that poisoned several hundred thousand people, then the total medical costs would be tens of billions of dollars.

Our study highlights the value of rapid in-process testing for detecting an attack, and because stockpiling sufficient ventilators and antitoxin in the event of a large-scale attack would be exorbitantly expensive, it seems wise to aggressively invest in rapid, sensitive, and specific in-process testing. A variety of different botulinum testing technologies are being investigated as alternatives to the mouse assay, although published data exist only for the ELISA assay. The current ELISA test appears to be ≈2 orders of magnitude more sensitive than needed: if milk in a truck contains 300 ng per gallon, which is the detection limit of the assay, the milk gets diluted by a factor of ≈20 during processing, and hence each person consumes ≈4 ng in their quart of milk, which is 2 logs less than the estimated ID50 for children, using the human data. Therefore, the current test can afford to lose some of this sensitivity if it leads to increased specificity or speed. An alternative less-sensitive ELISA assay based on the catalytic activity of the toxin is also available for botulinum toxin A and may be more specific in foods (unlike milk) where the toxin is unstable.

Current antibiotic residue testing takes 45 min, during which time the truck waits before having its contents drained into a silo. A test that takes more than 45 min is impractical because it either would increase the waiting time for each truck (if milk is not released to the silo until the test results are received) or would need to have near-perfect specificity (if milk is released before the test results are received). In contrast, three possible approaches can be used to deal with a positive result from a sub-45-min test: the truck can be held until a confirmatory mouse assay is performed, the milk can be discarded, or the milk can be routed to a processing line for ultra-high-temperature pasteurization, which kills all of the botulinum toxin. The likelihood that positively tested milk contains toxin may be extremely small, e.g., by Bayes' rule, if there is a 10% probability of an attack occurring in the U.S. over the next 5 years, and the false-positive rate is 10–4, then the probability that positively tested milk contains toxin is only 5 × 10–5.

Regardless of which of the three options is used, it seems clear that a sub-45-min test is necessary from a practical perspective. Even if such a test is not perfectly specific, it could still be an immensely useful tool that could essentially eliminate the threat of this scenario. Even if the total cost of a test was $50, testing each 5,500-gallon truck would increase the cost of milk by only 1 cent per gallon. In addition, because thousands of people would be poisoned per hour in this scenario, it is imperative to perfect the design and implementation of a near-instantaneous product recall and disposal strategy.

To understand the impact of changing these processing parameters and to assess the danger of bioterror threats to various food industries, we need some understanding of the terrorists' capabilities. To put the release sizes into perspective, we note that the maximum concentration of botulinum toxin in culture is 2–3 × 106 mouse units per ml, where a mouse unit is the mouse intraperitoneal LD50 in micrograms. In the 1980s, the Iraqi bioweapons program apparently increased this concentration 5- to 10-fold with the use of sulfuric acid. If so, it would appear that terrorists should be capable of a concentration of at least 3 × 107 mouse units per ml = 4 g per gallon. That is, a terrorist with this technology could easily deliver 10 g of toxin without any special gear. In the absence of detection, this amount would poison more than 400,000 people. Delivering 100 g or more with this technology would be more cumbersome and would greatly increase the likelihood of intercepting the attack. Amplification technologies have advanced significantly in recent years, and hence terrorists may be capable of concentrations considerably higher than 4 g per gallon.

Section 5 of Supporting Appendix analyzes three additional interrelated issues: secondary cases due to crosscontaminated milk, product tracing, and product recall. Two locations in the supply chain, trucks that are cleaned daily but that make two trips daily and processing lines that are cleaned daily, offer the opportunity for uncontaminated milk to become tainted by uncleaned residue from the primary release. The secondary effect from a release in a truck has an ≈50% chance of causing damage equivalent to a release that is 8 h later and ≈0.5% as large as the primary release. Secondary casualties would be significant only in cases when the primary release poisons nearly all of its consumers (in the absence of detection). The secondary impact due to tainted processing lines is likely to be much smaller, but the resulting milk concentrations are more difficult to estimate.

This potential for crosscontamination, coupled with consumer anxiety, would probably cause the supply chain's entire milk supply to be recalled and discarded at the time of detection. For the values in Tables 4 and 5, which are published as supporting information on the PNAS web site, this amounts to 4.83 million gallons, which includes 2.24-million-gallon containers of partially consumed milk that need to be recalled from consumers.

In addition, 640,000 gallons per day of freshly produced milk would need to be discarded until the attack is effectively investigated, the supply chain is turned back on, and consumer confidence returns. This delay could be hastened by effective product tracing, decontamination, and risk communication. The U.S. dairy industry traces every milk carton back to its processing facility, which, at least in theory, prevents the entire nation's milk supply (≈300 million gallons) from being discarded and recalled. In other food scenarios where there is no risk of crosscontamination (e.g., fresh produce packaged in the field), the ability to trace a product back through the particular path it takes could lead to a significant reduction in the amount of product recalled and discarded. As an illustration, we compute the amount of milk that needs to be discarded as a function of the release location (farm, truck, or silo) and the stage (cow, farm, truck, silo, or processing facility) to which the milk can be traced, hypothetically assuming no crosscontamination.

Our sensitivity analysis suggests there are three types of variables. Variables of the first type (time between silo cleanings, silo size, and number of silos per processing line) cause a vertical shift in the number poisoned vs. release size graphs and underscore the subtle relationship between high production efficiency and the consequences of a bioterror attack. Economies of scale can represent a double-edged sword: increasing the time between silo cleanings, silo size, or number of silos per processing line increases the amount of contaminated milk but reduces the toxin concentration of this milk, thereby mitigating the impact of a small release and exacerbating the effect of a large release. However, for the parameter regimes considered here, the reduction in casualties in a small release is very modest, whereas the increase in casualties in a large release with no testing and poor detection is in the hundreds of thousands.

Variables of the second type (ID50, pasteurization inactivation) result in a horizontal shift in the number poisoned vs. release size graphs. More precisely, to cause equivalent damage, the release size for the monkey ID50s needs to be 70 times larger than the release size for the human ID50s. Similarly, to generate an equivalent casualty level, the release size in the 99% inactivation scenario needs to be 1–0.684/1–0.99 = 31.6 times larger than the release size in the 68.4% inactivation scenario. Variables of the third type (distribution speed, consumption rate, children's incubation, number of symptomatics until detection, and milkborne detection time) all relate to the speed of various events and have no impact on the casualty level if the attack is not detected. In the no-testing case, the resulting graphs are very similar to one another and, for the parameter values considered here, the change in the children's incubation has the biggest impact, and the consumption rate has the smallest impact.

Conclusion

In closing, it is important to stress that several elements of the model contain enough irreducible uncertainty to preclude estimating the impact of an attack to within several orders of magnitude. First and foremost is the dose–response curve. The paucity of human data makes an estimate of the ID50 a difficult task, and a reliable estimate of the probit slope is impossible. The ID50 values used here are not close to the worst-case estimate, due to the possibility that several sublethal (injected or oral) doses collectively containing 1–10% of the LD50 may be lethal, as in guinea pigs, rabbits, and mice.

There are also three aspects of the model that have not been discussed in the open literature, although presumably studies can and perhaps have been performed: the inactivation rate attained by pasteurization, the specificity of an ELISA test in milk, and the release size that a terrorist organization is capable of. Such studies would allow our results to be sharpened considerably. The dose–response curve, pasteurization inactivation rate, and terrorists' release-size capabilities each contain several orders of magnitude of uncertainty, and together they essentially determine the release threshold required to achieve a sufficiently high milk concentration. There is much less uncertainty about how many people would drink this contaminated milk. There is irreducible uncertainty due to the timing of the release within the silo operation cycle, which causes the number poisoned to be roughly uniformly distributed between half and twice the mean values (with an additional point mass at the latter value with probability 0.26) reported.

Taken together, we have a reasonably accurate estimate of the number of people who could be poisoned but a very poor estimate of how much toxin is required to cause a large outbreak. The main uncertainties related to the number of people who could be poisoned are how quickly the attack would be detected via early symptomatics and how quickly and completely consumption would be halted: we optimistically assumed that consumption is halted instantaneously and completely within 24 h after the early symptomatics are detected, even though it took several weeks to identify the source of the two large but more subtle Salmonella outbreaks in the dairy industry. Even if the reducible uncertainty resolves itself favorably (e.g., heat pasteurization inactivates 99% of toxin rather than 68.4%), a catastrophic event is not implausible, and the way forward seems clear: invest in prevention, investigate inactivation processes that do not affect nutrition or taste and, most importantly, develop and deploy a sub-45-min highly specific in-process test.

Although the U.S. government appears to be working diligently on the latter two issues, it is not clear how quickly and thoroughly the dairy supply chain is being secured. The use of voluntary Food and Drug Administration guidelines is not commensurate with the severity of this threat, and the government needs to act much more decisively to safeguard its citizens from such an attack. Moreover, although the dairy industry is an obvious target, the government needs to force other food processing industries to quickly assess the impact of a deliberate botulinum release in their supply chains and to do what is necessary to prevent and mitigate such an event.