UK guidance published on preventing food fraud and attacks

The UK Food Standards Agency and the British Standards Institute have published revised guidance for food and drink businesses on how to protect against adulteration, counterfeiting and other attacks on food and food supply.

The report – titled PAS 96:2017 Guide to protecting and defending food and drink from deliberate attack – replaces the previous guidance published in 2014 and provides “approaches and procedures to improve the resilience of supply chains to fraud or other forms of attack” and “aims to assure the authenticity and safety of food by minimising the chance of an attack and mitigating the consequences of a successful attack.”

There are six forms of deliberate attack noted in the report: economically motivated adulteration by passing off a cheaper material as a more expensive one or using a less expensive ingredient to replace or extend the more expensive one for economic gain; malicious contamination with chemicals, bacteria, added allergens or dangerous material, generally to cause localised or widespread illness or death; extortion by committing or threatening contamination in order to obtain money from the victim organisation; espionage where businesses seek commercial advantage by accessing intellectual property of their competitors; counterfeiting by fraudulently passing off inferior goods as established and reputable brands for financial gain; and cybercrime, such as scams, IT and database hacks, misuse of interconnected devices and identity theft, which is a rapidly growing area of attack.

The report also notes the different types of attacker personality from the extortionist and opportunist to the disgruntled individual and professional criminal.

The report focuses on the risk management methodology Threat Assessment Critical Control Points (TACCP) and outlines the steps under this that can deter an attacker or give early detection of an attack.

TACCP essentially evaluates threats and identifies vulnerabilities, prioritises threats, explores who a potential attacker might be, and works to implement control measures to materials and products, purchasing, processes, premises, people, distribution networks and business systems in a bid to reduce the risk of attack and reduce the consequences should an attack occur. The report uses fictitious case studies to show how TACCP can be applied.

“Broadly, TACCP places food business managers in the position of an attacker to anticipate their motivation, capability and opportunity to carry out an attack, and then helps them devise protection. It also provides other sources of information and intelligence that may help identify emerging threats,” the guidance says.

“The common factor behind all such deliberate acts is people,” the FSA said. “These people may be within a food business, may be employees of a supplier to the food business, or may be complete outsiders with no connection to the food business. The key issue being their motivation, they may aim to cause harm to human health, business reputation, or make financial gains at the expense of the business. In any of these situations it is in the interests of the food business to protect itself from such attacks.”

The report notes that TACCP works alongside Hazard Analysis Critical Control Point (HACCP) principles for food safety management, which has been effective against accidental contamination, adding that “many precautions taken to assure the safety of food are likely to also deter or detect deliberate acts.”

Measures to reduce the risk of attack include controlling access to the target, tamper detection, and assuring personnel security.

“No process can guarantee that food and food supply are not the target of criminal activity, but the use of PAS 96 can make it less likely,” the report concludes.