[Paleopsych] PNAS: Analyzing bioterror attack on the food supply: The case of botulinum toxin in milk

Premise Checker checker at panix.com
Wed Jun 29 20:40:16 UTC 2005

Analyzing bioterror attack on the food supply: The case of botulinum toxin in 
Proceedings of the National Academy of Sciences
9984-9989 PNAS July 12, 2005 vol. 102 no. 28 Lawrence M. Wein* and Yifan Liu

[First the summary from CHE. Reading the article, I don't see what the fuss 
from the feds was about. The article did not tell anyone how to pull off the 
botulinum attack, only about how the poision would spread and what should be 
done to prevent such attacks. Sorry about the bad formatting, but that's the 
best Adobe Professional can do, and I spent a lot of time cleaning even that 

In Defiance of Federal Agency, Scientific Journal Describes How to Poison
Milk Supply
News bulletin from the Chronicle of Higher Education, 5.6.29


    Disregarding a request from the federal government, the National
    Academy of Sciences published a paper on Tuesday that describes how
    terrorists could kill tens of thousands of people by dropping a few
    grams of botulinum toxin into a milk truck or storage silo.

    The Proceedings of the National Academy of Sciences had planned on
    publishing the paper, by two Stanford University researchers, a month
    ago, but the academy balked when it received a letter from the U.S.
    Department of Health and Human Services. The letter described the
    paper as "a road map for terrorists" and said that "publication is not
    in the interests of the United States" ([69]The Chronicle, June 17).

    But after meeting with government representatives, the academy's
    leaders decided that the benefits of publishing the paper outweighed
    any threats it posed.

    In an editorial accompanying the paper, Bruce Alberts, the academy's
    president, said that "we are convinced that the guidance offered in
    this article on how to anticipate, model, and minimize a
    botulinum-toxin attack can be valuable for biodefense."

    The paper, "Analyzing a Bioterror Attack on the Food Supply: The Case
    of Botulinum Toxin in Milk," was written by Lawrence M. Wein, a
    professor of management science at Stanford's business school, and
    Yifan Liu, a graduate student in computational and mathematical

    Bill Hall, a spokesman for the Health and Human Services Department,
    said the agency does not agree with the academy's decision. "Our
    concern is that if the academy is wrong on this," he said, "the
    consequences could be severe and could be dire, and it will be HHS and
    not the academy that will end up having to deal with it."

    In their paper, Mr. Wein and Mr. Liu describe how the milk industry is
    vulnerable because individual farmers send their product to central
    processing facilities, thereby allowing milk from many locations to
    mix. Terrorists could poison the supply by putting botulinum toxin
    into one of the 5,500-gallon trucks that picks up milk daily at farms
    or by dropping the toxin into raw-milk silos, which hold roughly
    50,000 gallons each. Pasteurization would destroy some but not all of
    the toxin, and a millionth of a gram of toxin may be enough to kill a

    The standard tests to detect botulinum toxin take too long to be
    useful, Mr. Wein said in an interview, although he recently learned of
    a new test that takes only 15 minutes to perform. Such assays could
    mitigate, or even thwart, an attack, he said.

    To alleviate the risk of such an attack, the Food and Drug
    Administration has issued guidelines for the dairy industry, such as
    making sure that milk trucks and tanks are locked. But Mr. Wein argues
    that those voluntary measures should be required by law. "If a dairy
    industry in the hands of a terrorist is as dangerous as a nuclear
    facility or a chemical facility," he said, "then voluntary is not
    commensurate with the threat."

    James S. Cullor, associate dean and director of a teaching and
    research center on veterinary medicine at the University of California
    at Davis, said Mr. Wein should not have submitted his paper for
    publication. "He put millions of children at risk, not only in this
    country, but around the world," he said. "And for what? It's an issue
    that the industry is already working on. In fact, these are issues
    that the industry taught him about. We all knew this was sensitive
    information, and we should handle it with care."

    But Mr. Wein said he did not provide any information that was not
    already available. "Anyone who could seriously pull off this kind of
    attack," he said, "is sophisticated enough to track what was going on
    in the bioterror world." Using Google, he said, "it would take you all
    of 30 seconds to pull up these things."

    The paper is available on the journal's[70] Web site.

    Background articles from The Chronicle:
      * [71]Federal Officials Ask Journal Not to Publish Bioterrorism
        Paper (6/17/2005)
      * [72]Final Rules Issued on Microbes (4/1/2005)
      * [73]Journal Editors and Scientists Call for More Caution in
        Publishing Potentially Dangerous Research (2/17/2003)
      * [74]Publish and Perish? As the Nation Fights Terrorists,
        Scientists Weigh the Risks of Releasing Sensitive Information
      * [75]One More Frightening Possibility: Terrorism in the Croplands


   54. mailto:rich.monastersky at chronicle.com
   70. http://www.pnas.org/cgi/reprint/0408526102v1
   71. http://chronicle.com/weekly/v51/i41/41a01102.htm
   72. http://chronicle.com/weekly/v51/i30/30a03802.htm
   73. http://chronicle.com/daily/2003/02/2003021704n.htm
   74. http://chronicle.com/weekly/v49/i07/07a01601.htm
   75. http://chronicle.com/weekly/v48/i09/09a02001.htm

E-mail me if you have problems getting the referenced articles.


*Graduate School of Business and Institute for Computational and Mathematical 
Engineering, Stanford University, Stanford, CA 94305
Edited by Barry R. Bloom, Harvard University, Boston, MA, and approved April 
20, 2005 (received for review November 16, 2004)

To whom correspondence should be addressed. E-mail: lwein at stanford.edu.


We developed a mathematical model of a cows-to-consumers supply chain 
associated with a single milk-processing facility that is the victim of a 
deliberate release of botulinum toxin. Because centralized storage and 
processing lead to substantial dilution of the toxin, a minimum amount of toxin 
is required for the release to do damage. Irreducible uncertainties regarding 
the dose–response curve prevent us from quantifying the minimum effective 
release. However, if terrorists can obtain enough toxin, and this may well be 
possible, then rapid distribution and consumption result in several hundred 
thousand poisoned individuals if detection from early symptomatics is not 
timely. Timely and specific in-process testing has the potential to eliminate 
the threat of this scenario at a cost of <1 cent per gallon and should be 
pursued aggressively. Investigation of improving the toxin inactivation rate of 
heat pasteurization without sacrificing taste or nutrition is warranted.

Keywords: bioterrorism, mathematical modeling

Among bioterror attacks not involving genetic engineering, the three scenarios 
that arguably pose the greatest threats 
tohumansareasmallpoxattack,anairborneanthraxattack,and release of botulinum 
toxin in cold drinks (1) The methods of dissemination in these three scenarios 
are, respectively, the person-to-person spread of contagious disease, the 
outdoor dispersalofahighlydurableandlethalagent,andthelarge-scale storage and 
production and rapid widespread distribution and consumption of beverages 
containing the most poisonous substance known. The first two scenarios have 
been the subject of recent systems modeling studies (2–5) and here we present 
detailedsystemsanalysisofthethirdscenario.Forconcreteness, we consider release 
in the milk supply, which, in addition to its symbolic value as target, is 
characterized by the rapid distribution of 20 billion gallons per year in the 
U.S. indeed, two natural Salmonella outbreaks in the dairy industry each 
infected 200,000people(6).Nonetheless,ourmethodsareapplicableto similar food 
products, such as fruit and vegetable juices, canned foods (e.g. processed 
tomato products) and perhaps grain- based and other foods possessing the 
bow-tie-shaped supply chain pictured in Fig. 1.

The Model

The mathematical model considers the flow of milk through nine-stage 
cows-to-consumers supply chain associated with single milk-processing facility 
(Fig. 1) Supporting Appendix, which is published as supporting information on 
the PNAS web site, contains detailed mathematical formulation of the model, 
discussion of the modeling assumptions, and the specification of parameter 
values, some of which are listed in Table 1. The supply-chain parameter values 
are representative of the California dairy industry, which produces20% of the 
nation‘ milk (California dairy facts, www.dairyforum.orcdf.html, accessed 
onMay18,2004).Inourmodel,cowsaremilkedtwicedaily,and the milk from each farm is 
picked up once per day by 5,500-gallon truck, which makes two round trips daily 
between various farms and the processing plant. Upon truck’s arrival at the 
processing plant, the milk is piped into one of several raw milk silos, each 
capable of holding 50,000 gallons. Raw milk is piped into the processing 
facility, goes through sequence of processes (e.g. separation, pasteurization, 
homogenization, and vitamin fortification) where each processing line may 
simultaneously receive milk from several silos, and is held in 
10,000gallonpostpasteurizationtanksbeforebeingbottled. Inourbase case, we 
assume that milk from different silos does not mix during downstream processing 
and relax this assumption later; although downstream mixing is physically 
possible at many facilities, it is not always done. Bottled milk is stored as 
finished- goods inventory before traveling through the downstream distribution 
channel, eventually being purchased and consumed.

We assume that botulinum toxin is deliberately released in 
milkfromafarmtotheprocessingplant,orarawmilksiloatthe processing facility. Each 
of these release locations leads to identical consequences, because the toxin 
is eventually well mixed throughout the contents of a raw milk silo. The crux 
of our analysis is to calculate the amount and toxin concentration of 
contaminated milk (see Fig. 4, which is published as supporting information on 
the PNAS web site) By California state law, raw milk silo must be cleaned after 
72 of operation. During these 72 h, the silo is initially filled up, then 
replenished (i.e. simultaneously filled and drained) for most of the 72- 
period, and finally drained empty by 72 h. Because the toxin concentration in 
the silo drops exponentially during the replenishment interval, each 
postpasteurization holding tank has different concentration level. Moreover, 
the amount of contaminated milk and the concentration distribution are 
themselves random quantities,dependinguponwheninthe72-hsilooperationcycle the 
deliberate release occurs. Because of the difficulty of terrorist in scheduling 
the release for maximum impact, we assume the release occurs randomly 
throughout the filling and replenishment intervals and report the mean number 
of poisoned people averaged over the random release time within the 
cycle.Usingheat-inactivationdataforfoodswithsimilarpH(7) we estimate that the 
heat-pasteurization process [170° (77°C) for 15 min] inactivates 68.4% of the 

Each gallon of purchased milk is continuously consumed by four people (one 
child and three adults) over 3.5-day period. Children aged 2–11 and adults have 
differential milk consumption rates and dose–response curves in our model. 
probit dose–response model dictates the precise timing of each poisoning. 
Ourdose–responserelationshipisbasedonscanthuman data for adults, ID50 0.43 for 
children) (8, 9) The attack can be detected via either early symptomatics or 
in-process testing results, whichever occurs first. We assume the outbreak is 
detected when the 100th person develops symptoms [the incubation period, which 
is the interval between the time of poisoning and the onset of symptoms, is log 
normal with median of 48 and dispersal factor of 1.5 (10)] and an

Fig. 1. The milk supply chain.

additional 24 are required to identify the attack as being milkborne, at which 
time all consumption is halted. As with current antibiotic residue testing, we 
assume in-process botulinumtestingisperformedonmilkfromeachtruckjustbeforethe 
milk is piped into raw milk silo at the processing facility. We have two tests 
at our disposal: the Food and Drug Administration- approved mouse assay with 
detection limit of 16 pml (11) and testing delay of 48 h, and an ELISA test 
with detection limit of 80 pml (12) and testing delay of h. Because the mouse 
assay is not practical for widespread use (assays are processed at only several 
U.S. laboratories, and the 
mousesupplyislimited),weassesstwostrategies:theELISAtest used in isolation 
(i.e. consumption is stopped after positive 
ELISAresult)andasequentialstrategyinwhichthemouseassay is used as confirmatory 
test after positive ELISA result (i.e. consumption is halted after positive 
mouse result) The latter strategy has detection limit of 80 pml and testing 
delay of 51 h. The ELISA test in isolation is practical only if the test has an 
extremely small false-positive rate (no data have been published on ELISA test 
specificity in milk) otherwise, the sequential strategy is the only viable 


In the absence of any detection (i.e. every gallon of contaminated milk is 
consumed) the mean number of people who consume contaminated milk is 568,000 
(Fig. 2) Less than1gof 
toxinisrequiredtocause100,000meancasualties(i.e.,poisoned individuals) and 10 
poison the great majority of the 568,000 consumers (Fig. 2) Most of the 
casualties occur on days 3–6, although they happen somewhat faster for larger 
releases, because less consumption is required for poisoning. Due to children’s 
higher consumption rate and greater toxin sensitivity, the percentage of 
casualties who are children in Fig. decreases 
from99.97%fora0.1-grelease,to61%fora1-grelease,to28% for 10- release.

Early symptomatic detection avoids of the casualties in Fig. (see Fig. 3) but 
still allows100,000 mean casualties for release of 10 g. Relative to no 
testing, the sequential testing strategy cuts the number poisoned approximately 
in half, resulting in tens of thousands of cases. The ELISA testing strategy 
used in isolation prevents nearly all cases, e.g. if kg is released then the 
mean number poisoned is 2.82, and six people are 
poisonedeveniftheterroristchoosestheworst-casereleasetime within the silo 
cleaning cycle.

Table 2 contains the results of sensitivity analysis of isolated 
changesin10keyparametersintheno-testingcase.Fiveofthese 10 changes impact the 
number of casualties in the no-detection case (Table 3) Graphs corresponding to 
Tables and appear in Supporting Appendix. The first of these 10 changes involve 
milk storage and processing. Reducing the time between silo cleanings from 72 
to 48 lowers the number poisoned by 30% in large attack with no detection but 
otherwise has modest impact. Increasing the silo size from 50,000 to 100,000 
gallons (several raw milk silos in California hold up to 200,000 gallons) while 
varying the number of silos so that the total silo capacity is fixed at 400,000 
gallons, and maintaining dedicated processing line for each silo leads to 
slightly fewer casualties for small releases but up to twice as many poisoned 
for large releases and no detection. Similarly, allowing milk from four silos 
to mix during downstream processing can quadruple the number of casualties in 
large attack with no detection. Because the toxin inactivation rate may be very 
sensitive to the pasteurization temperature and time in the neighborhood of the 
current pasteurization formula (7) we consider pasteurization process that 
causes 2-log reduction in active toxin. This leads to huge reduction in 
casualties if the release size is 10 or less but has no impact for 1-kg 

The remaining six changes are from the downstream portion 
ofthesupplychain.Wecouldnotfindreliabledataonthespeed of the distribution 
channel. More rapid distribution leads to

Table 1. Base-case values for model parameters

Parameter description Value
Production rate 10 gallons per cow per day
Silo size 50,000 gallons
Silos per processing line 1
Time between silo cleanings 72 hr
Speed of distribution channel 80% of milk purchased within 48 hr
Consumers per gallon of milk 4
Time to consume 1 gallon of milk 84 hr
Dose-response probit slope 4.34 Median incubation (adult and child) 48 hr
Dispersal factor of incubation 1.5
Number of symptomatics until detection 100
Time to detect attack is milkborne 24 hr
Testing-detection limit (mouse, ELISA) 60.6 ngallon, 303 ngallon
Testing-time delay (mouse, ELISA) 48 hr, 3 hr
Fraction of toxin not inactivated by pasteurization 0.316
Fraction of milk consumers who are children 0.25
Fraction of milk consumed by children 0.4

earlier consumption and faster diagnosis, and the former effect appears to 
dominate, leading to larger attack sizes. Our base- case value for the time to 
drink gallon of milk is based on the conservative assumption that everyone has 
the same consumption rate. However, there is considerable heterogeneity in 
consumption rates across the population, which causes heavier consumers to buy 
milk more frequently. Hence, we assume it takes 24 rather than 84 for gallon to 
be consumed. As in the case of rapid distribution, higher consumption rate 
leads to more casualties. The dose–response data in Tables and are based on 
monkey data, which are more plentiful than human data. As in the pasteurization 
case, the monkey data lead to drastic reduction in casualties for small release 
but have little effect in large release. Because children rarely eat in 
restaurants or eat home-canned food, nearly all of the historical 

Fig. 2. The mean cumulative number of people poisoned over time for various 
release sizes in the absence of any detection.

Fig. 3. The mean total number of people poisoned vs. release size for various 
detection scenarios.

incubation time for children is reduced from 48 to 12 because of their smaller 
mass and larger consumption of tainted milk, which lead to earlier detection 
and many fewer casualties. Our last two changes relate to detection time. The 
Centers for Disease Control and Prevention maintains well established national 
surveillance system for botulism (14) that has been enhanced in the last 
several years. Botulism in virtually all jurisdictions is an immediately 
reportable disease, and the characteristic clinical features of botulism 
suggest that the outbreakmightberecognizedpromptly(e.g.,bythepresentation of 
the 10th case) Moreover, because most metropolitan areas 
haveonlyoneortwochildren’shospitals,andbecausemilkisone of the few staples in 
children’s diets, the time to detect the outbreak as milkborne might be rather 
quick (e.g. 12 h) Not surprisingly, both changes lead to reduction in the 
number of people poisoned.


Combating bioterrorism requires an appropriate mix of prevention, mitigation, 
detection, and response. Our observation that, due to the successive mixing 
operations in the upstream portion of the supply chain, the impact of 
deliberate release upstream 
oftheprocessingplantisindependentofthepreciselocationmay aid in prioritizing 
resources for prevention. foodborne attack is much more preventable than an 
airborne or mailborne attack, due to the restricted number of release 
locations. Requiring all tanks, trucks, and silos to be locked when not being 
drained or filledwouldbeanobviousstepforward,aswouldsecuritychecks 
forpersonnelwhohaveaccesstoprebottledmilk(farmlaborers, truck drivers, 
receiving labor at the processing facility, and plant engineers) and requiring 
one person from each stage of the supply chain to be present while milk is 
transferred from one stage to the next (15) Although these and other measures 
are included in proposed Food and Drug Administration guidelines (16) they are 
currently voluntary. Homeland security officials need to engage industry 
leaders to establish the most appropriate way to guarantee these guidelines are 
enforced. Although enforcement options range from voluntary guidelines to new 
laws, the most promising approach may be to develop International Organization 
for Standardization (ISO) security standards that are analogous to the ISO 9000 
standards for quality management and the ISO 14000 standards for environmental


Table 2. Sensitivity analysis for 10 parameters in the no-testing case

Release size

Case description 0.1 g 1 g 10 g 100 g 1 kg
Base case 1.7
103 3.2
104 1.2
105 1.6
105 1.7
Time between silo cleanings
48 hr 2.0
103 3.5
104 1.2
105 1.5
105 1.5
Silo size
100,000 gallons 2.1
102 3.2
104 1.6
105 2.7
105 3.0
Silos per processing line
4 4.4
101 2.7
104 1.9
105 4.5
105 5.3
Inactivation by pasteurization
0.99 6.6
103iigggChild ID50 0.43 11 5.0 1.3
104 7.3
104 1.5
Distribution: 90% purchased
24 hr 2.0
103 4.5
104 1.8
105 2.4
105 2.6
Time to consume a gallon
24 hr 1.9
103 6.2
104 1.5
105 1.7
105 1.7
ID50 (adult, child)
g 1.8
10g, 30 70 16 6.7
103 4.3
103 4.2
104 1.3
Median child incubation
12 hr 6.4
102 7.5
103 3.4
104 5.6
104 6.0
Symptomatics until detection
10 1.1
103 2.0
104 8.4
104 1.2
105 1.2
Milkborne detection time
12 hr 1.5
103 2.0
104 6.9
104 9.3
104 9.6

Each change from the base-case value in Table 1 was made in isolation and shown 
are the mean number of poisoned people computed for five different release 

management (www.iso.ciseiso9000–1400index.html, accessed on November 12, 2004)

Turning to mitigation, botulinum toxin cannot be completely inactivated by 
radiation (17) or any heat treatment that does not adversely affect the milk’s 
taste. Ultrahigh-temperature (UHT) pasteurization (performed to provide 
extended shelf life) 
appearscapableofcompletelyinactivatingbotulinumtoxininmilk, but UHT milk has 
not been embraced by U.S. consumers. Nonetheless, it is worthwhile to perform 
pasteurization studies to determine whether more potent inactivation process 
can be used without compromising nutrition or taste, particularly because the 
inactivation rate appears to be quite sensitive to the pasteurization 
temperature and time in the neighborhood of the current pasteurization formula 
(7) Reducing the time between silo cleanings decreases the number of people 
poisoned in, at most, linear manner, but more frequent cleanings would not 
onlyincreasevariablematerialandlaborcostsbutwouldpossibly require fixed 
investments in additional silos.

Before discussing detection, we note that, on the response side, 60% of 
poisoned individuals would require mechanical 
amountofantitoxininthenationalstockpile,thedeathratefrom large attack would 
likely be closer to the pre-1950s 60% rate (18) or the 25% rate incurred in the 
1950s than to the 6% death rate experienced in the 1990s (19) Moreover, the 
current treatment, passive immunization with equine antitoxin, does 
notreverseexistentparalysis,andpostexposureprophylaxiswith antitoxin has 
adverse side effects (19) Although an economic impact assessment of this 
scenario is beyond the scope of our study, the economic cost (including direct 
medical costs and lost productivity due to illness and death) from hypothetical 
botulism outbreak that poisons 50,000 people was estimated to be 8.6 billion 
(20) using direct medical cost (assuming ample ventilators and antitoxin) per 
hospitalized patient of $55,000 (based on Canadian dollars in 1993–1994) In 
contrast, two recent U.S. victims receiving injections of ‘‘fake Botox’ each 
incurred $350,000 medical bill in the first weeks of illness [S. Z. Grossman 
(lawyer of Botox victims) personal communication] If this latter amount was 
spent on each survivor in an attack that poisoned several hundred thousand 
people, then the total medical costs would be tens of billions of dollars. Our 
study highlights the value of rapid in-process testing for detecting an attack, 
and because stockpiling sufficient ventilators and antitoxin in the event of 
large-scale attack would be exorbitantly expensive, it seems wise to 
aggressively invest in rapid, sensitive, and specific in-process testing. 
variety of different 
botulinumtestingtechnologiesarebeinginvestigatedasalternatives to the mouse 
assay [summary of the National Institute of Allergy and Infectious Diseases 
(NIAID) expert panel on botulinum diagnostics, May 23, 2003, 
www2.niaid.nih.goNrdonlyres BB1DDC43-1906-4450-8983-DB0BE374474bottoxinsmtg. 
onlyfortheELISAassay.ThecurrentELISAtestappearstobe orders of magnitude more 
sensitive than needed: if milk in truck contains 300 ng per gallon, which is 
the detection limit of the assay (12),themilkgetsdilutedbyafactorof 
20duringprocessing,and hence each person consumes

ng in their quart of milk, which is logs less than the estimated ID50 for 
children, using the human data. Therefore, the current test can afford to lose 
some of this sensitivityifitleadstoincreasedspecificityorspeed.Analternative 
less-sensitive ELISA assay based on the catalytic activity of the toxin is also 
available for botulinum toxin (21) [List Biological 
Laboratories(Campbell,CA),www.listlabs.com,accessedonJuly1, 2004] and may be 
more specific in foods (unlike milk) where the toxin is unstable.

Current antibiotic residue testing takes 45 min, during which 
timethetruckwaitsbeforehavingitscontentsdrainedintoasilo. -----------

Table 3. Sensitivity analysis for five parameters in the no-detection case

Release size

Case description 0.1 g 1 g 10 g 100 g 1 kg


Base case 2.3
103 1.5
105 5.0
105 5.7
105 5.7
Time between silo cleanings
48 hr 2.8
103 1.6
105 3.8
105 3.9
105 3.9
Silo size
100,000 gallons 2.1
102 1.4
105 8.4
105 1.1
106 1.1
Silos per processing line
4 4.4
101 1.1
105 1.2
106 2.2
106 2.2
Inactivation by pasteurization
0.99 6.6
1006Rv0noh11 5.0 3.8
104 3.6
105 5.7
ID50 (adult, child)
g 1.8
10g, 30 70 16 6.7
103 7.5
103 2.1
105 5.3

Each change from the base-case value in Table 1 was made in isolation, and the 
mean number of poisoned people was computed for
four different release sizes.

test that takes45 min is impractical because it either would increase the 
waiting time for each truck (if milk is not released to the silo until the test 
results are received) or would need to have near-perfect specificity (if milk 
is released before the test results are received) In contrast, three possible 
approaches can be used to deal with positive result from sub-45-min test: the 
truckcanbehelduntilaconfirmatorymouseassayisperformed, the milk can be 
discarded, or the milk can be routed to processing line for 
ultra-high-temperature pasteurization, which kills all of the botulinum toxin. 
The likelihood that positively 
testedmilkcontainstoxinmaybeextremelysmall,e.g.,byBayes’ rule, if there is 10% 
probability of an attack occurring in the

U.S.overthenext5years,andthefalse-positiverateis104,then the probability that 
positively tested milk contains toxin is only 105. Regardless of which of the 
three options is used, it seems clear that sub-45-min test is necessary from 
practical perspective. Even if such test is not perfectly specific, it could 
still be an immensely useful tool that could essentially eliminate 
testingeach5,500-gallontruckwouldincreasethecostofmilkby only cent per gallon. 
In addition, because thousands of people would be poisoned per hour in this 
scenario, it is imperative to perfect the design and implementation of 
near-instantaneous product recall and disposal strategy. To understand the 
impact of changing these processing parameters and to assess the danger of 
bioterror threats to various food industries, we need some understanding of the 
terrorists’ capabilities. To put the release sizes in Figs. and into 
perspective, we note that the maximum concentration of 
botulinumtoxinincultureis2– 106mouseunitsperml(22),where mouse unit is the 
mouse intraperitoneal LD50 in micrograms. 
Inthe1980s,theIraqibioweaponsprogramapparentlyincreased this concentration 5-to 
10-fold with the use of sulfuric acid (23) If so, it would appear that 
terrorists should be capable of concentration of at least 107 mouse units per 
ml per gallon. That is, terrorist with this technology could easily deliver 10 
of toxin without any special gear. Referring to Fig. 2, in the absence of 
detection, this amount would poison 400,000 people. Delivering 100 or more with 
this technology would be more cumbersome and would greatly increase the 
likelihood of intercepting the attack. Amplification technologies have advanced 
significantly in recent years (24) and hence terrorists may be capable of 
concentrations considerably higher than per gallon. Section of Supporting 
Appendix analyzes three additional interrelated issues: secondary cases due to 
crosscontaminated milk, product tracing, and product recall. Two locations in 
the supplychain,trucksthatarecleaneddailybutthatmaketwotrips daily and 
processing lines that are cleaned daily, offer the opportunity for 
uncontaminated milk to become tainted by uncleaned residue from the primary 
release. The secondary effect from release in truck has an 50% chance of 
causing damage equivalent to release that is later and 0.5% as large as the 
primary release. According to Figs. and 3, secondary casualties would be 
significant only in cases when the primary release poisons nearly all of its 
consumers (in the absence of detection) The secondary impact due to tainted 
processing lines is likely to be much smaller, but the resulting milk 
concentrations are more difficult to estimate.

Thispotentialforcrosscontamination,coupledwithconsumer anxiety, would probably 
cause the supply chain’s entire milk supply to be recalled and discarded at the 
time of detection. For the values in Tables and 5, which are published as 
supporting information on the PNAS web site, this amounts to 4.83 million 
gallons, which includes 2.24-million-gallon containers of partially consumed 
milk that need to be recalled from consumers (Eq. 29 in SupportingAppendix) In 
addition, 640,000 gallons per 
dayoffreshlyproducedmilkwouldneedtobediscardeduntilthe attack is effectively 
investigated, the supply chain is turned back on, and consumer confidence 
returns. This delay could be 
communication.TheU.S.dairyindustrytraceseverymilkcarton back to its processing 
facility, which, at least in theory, prevents 300milliongallons)frombeing 
discardedandrecalled.Inotherfoodscenarioswherethereisno risk of 
crosscontamination (e.g. fresh produce packaged in the field) the ability to 
trace product back through the particular path it takes in Fig. could lead to 
significant reduction in the amount of product recalled and discarded. As an 
illustration, we compute (Eq. 30 in Supporting Appendix and Table 6, which is 
published as supporting information on the PNAS web site) the amount of milk 
that needs to be discarded as function of the release location (farm, truck, or 
silo) and the stage (cow, farm, 
truck,silo,orprocessingfacility)towhichthemilkcanbetraced, hypothetically 
assuming no crosscontamination.

Our sensitivity analysis suggests there are three types of 
silosize,andnumberofsilosperprocessingline)causeavertical shift in the number 
poisoned vs. release size graphs (Fig. a–c, which is published as supporting 
information on the PNAS web site) and underscore the subtle relationship 
between high production efficiency and the consequences of bioterror attack. 
Economies of scale can represent double-edged sword: increasing the time 
between silo cleanings, silo size, or number of silos per processing line 
increases the amount of contaminated milk but reduces the toxin concentration 
of this milk, thereby mitigating the impact of small release and exacerbating 
the effect of large release. However, for the parameter regimes considered 
here, the reduction in casualties in small release is very modest, whereas the 
increase in casualties in large release with no testing and poor detection is 
in the hundreds of thousands. Variables of the second type (ID50, 
pasteurization inactivation) result in horizontal shift in the number poisoned 
vs. release size graphs (Fig. and g) More precisely, to cause equivalent 
damage, the release size for the monkey ID50s needs to be 70 times larger than 
the release size for the human ID50s. Similarly, to generate an equivalent 
casualty level, the release 
31.6timeslargerthanthereleasesizeinthe68.4%inactivation scenario. Variables of 
the third type (distribution speed, consumption rate, children’s incubation, 
number of symptomatics until detection, and milkborne detection time) all 
relate to the speed of various events and have no impact on the casualty level 
if the attack is not detected. In the no-testing case, the resulting graphs 
(Fig. e– and h–j) are very similar to one another and, for the parameter values 
considered here, the change in the children’s incubation has the biggest 
impact, and the consumption rate has the smallest impact.


In closing, it is important to stress that several elements of the model 
contain enough irreducible uncertainty to preclude estimating the impact of an 
attack to within several orders of magnitude. First and foremost is the 
dose–response curve. The paucity of human data makes an estimate of the ID50 
difficult task,andareliableestimateoftheprobitslopeisimpossible.The ID50 values 
used here are not close to the worst-case estimate, due to the possibility that 
several sublethal (injected or oral) doses collectively containing 1–10% of the 
LD50 may be lethal, as in guinea pigs, rabbits, and mice (25) There are also 
three aspects of the model that have not been discussed in the open literature, 
although presumably studies can and perhaps have 
beenperformed:theinactivationrateattainedbypasteurization, the specificity of 
an ELISA test in milk, and the release size that terrorist organization is 
capable of. Such studies would allow our results to be sharpened considerably. 
The dose–response curve, pasteurization inactivation rate, and terrorists’ 
release- size capabilities each contain several orders of magnitude of 
uncertainty, and together they essentially determine the release threshold 
required to achieve sufficiently high milk concentration. There is much less 
uncertainty about how many people would drink this contaminated milk. There is 
irreducible uncertainty due to the timing of the release within the silo 
operation cycle,whichcausesthenumberpoisonedtoberoughlyuniformly distributed 
between half and twice the mean values (with an additional point mass at the 
latter value with probability 0.26) reported in Figs. and 3.

Takentogether,wehaveareasonablyaccurateestimateofthe number of people who could 
be poisoned but very poor 
estimateofhowmuchtoxinisrequiredtocausealargeoutbreak. The main uncertainties 
related to the number of people who could be poisoned are how quickly the 
attack would be detected via early symptomatics and how quickly and completely 
consumption would be halted: we optimistically assumed that consumption is 
halted instantaneously and completely within 24 after the early symptomatics 
are detected, even though it took several weeks to identify the source of the 
two large but more subtle Salmonella outbreaks in the dairy industry (26, 27) 
Even if the reducible uncertainty resolves itself favorably (e.g. heat

pasteurization inactivates 99% of toxin rather than 68.4%) 
clear:investinprevention,investigateinactivationprocessesthat do not affect 
nutrition or taste and, most importantly, develop and deploy sub-45-min highly 
specific in-process test.

Although the U.S. government appears to be working diligently on the latter two 
issues, it is not clear how quickly and thoroughly the dairy supply chain is 
being secured. The use of voluntary Food and Drug Administration guidelines is 
not commensurate with the severity of this threat, and the government needs to 
act much more decisively to safeguard its citizens 
fromsuchanattack.Moreover,althoughthedairyindustryisan obvious target, the 
government needs to force other food processing industries to quickly assess 
the impact of deliberate botulinum release in their supply chains and to do 
what is necessary to prevent and mitigate such an event.


L.M.W. thanks Stephen Arnon, Larry Barrett, Seth Carus, Richard Danzig, Clay 
Detlefson, Leland Ellis, Jerry Gillespie, Steve Jerkins, Eric Johnson, Laura 
Kelley, David Montague, Keith Ward, and Dennis Wilson for helpful 
conversations. This research was partially supported by the Center for Social 
Innovation, Graduate School of Business, Stanford University. 16. U.S. Food and 
Drug Administration (2003) Dairy Farms, Bulk Milk Transporters, Bulk Milk 
Transfer Stations and Fluid Milk Processors: Food Security 
PreventiveMeasuresGuidance (U.S.FoodandDrugAdmin.,Washington,DC)

1. Danzig, R. (2003) Catastrophic Bioterrorism–What is to be Done? (Center for 
TechnologyandNationalSecurityPolicy,NationalDefenseUniversity,Washington, DC)

2. Kaplan, E. H. Craft, D. L. Wein, L. M. (2002) Proc. Natl. Acad. Sci. USA 99, 

3. Halloran, M. Longini, I. M. Jr. Nizam, A. Yang, Y. (2002) Science 298, 

4. Eubank, S. Guclu, H. Kumar, V. S. A. Marathe, M. V. Srinivasan, A. 
Toroczkai, Z. Wang, N. (2004) Nature 429, 180–184.

5. Wein, L. M. Craft, D. L. Kaplan, E. H. (2003) Proc. Natl. Acad. Sci. USA 
100, 4346–4351.

6. Sobel, J. Khan, A. S. Swerdlow, D. L. (2002) Lancet 359, 874–880.

7. Woodburn, M. J. Somers, E. Rodriguez, J. Schantz, E. J. (1979) J.FoodSci. 
44, 1658–1661.

8. Meyer, K. F. Eddie, B. (1951) Zeitschr. Hyg. 133, 255–263.

9. Morton, H. E. (1961) The Toxicity of Clostridium botulinum Type Toxin for 
Various Species of Animals (Institute of Cooperative Research, University of 
Pennsylvania, Philadelphia)

10. Terranova, W. Breman, J. G. Locey, R. P. Speck, S. (1978) Am.J.Epidemiol. 
108, 150–156.

11. Schantz, E. J. Sugiyama, H. (1974) J. Agr. Food Chem. 22, 26–30.

12. Ferreira, J. L. Maslanka, S. Johnson, E. Goodnough, M. (2003) J. AOAC Int. 
86, 314–331.

13. Herrero, B. A. Ecklund, A. E. Streett, C. S. Ford, D. F. King, J. K. (1967) 
Exp. Mol. Pathol. 6, 84–95.

14. Shapiro, R. L. Hatheway, C. Becher, J. Swerdlow, D. L. (1997) J. Am. Med. 
Assoc. 278, 433–435.

15. Reed, B. A. Grivetti, L. E. (2000) J. Dairy Sci. 83, 2988–2991.

17. Siegel, L. S. (1993) in Clostridium botulinum: Ecology and Control in 
Foods, eds. Hauschild, A. H. W. Dodds, K. L. (Dekker, New York) pp. 323–341. 
18. U.S. Department of Defense (1996) Army Field Manual 8-9, Navy Medical 
Publication 5059 and Air Force Joint Manual 44-151 (U.S. Department of Defense, 
Washington, DC) 19. Arnon, S. S. Schechter, R. Inglesby, T. V. Henderson, D. A. 
Bartlett, J. G. Ascher,M.S.,Eitzen,E.,Fine,A.D.,Hauer,J.,Layton,M. etal. (2001) 
J.Am. Med. Assoc. 285, 1059–1070. 20. St. John, R. Finlay, B. Blair, C. (2001) 
Can. J. Infect. Dis. 12, 275–284. 21. Wictome, M. Newton, K. A. Jameson, K. 
Dunnigan, P. Clarke, S. Gaze, J. Tauk,A.,Foster,K.A.&Shone,C.C.(1999) 
FEMSImmunol.Med.Microbiol. 24, 319–323. 22. Dasgupta, B. R. (1971) J. 
Bacteriol. 108, 1051–1057. 23. Miller, J. (April 27, 2003) N.Y. Times,p.22. 24. 
Danzig, R. (2005) in The Challenge of Proliferation: Report of the Aspen 
Strategy Group, ed. Campbell, K. (The Aspen Institute, Washington, DC) in 
press. 25. Matveev, K. I. (1959) J. Microbiol. Epidemiol. Immunobiol. 30, 
71–78. 26. Ryan, C. A. Nickels, M. K. Hargrett-Bean, N. T. Potter, M. E. Endo, 
T. Mayer, L. Langkop, C. W. Gibson, C. MacDonald, R. C. Kenney, R. T. et al. 
(1987) J. Am. Med. Assoc. 258, 3269–3274. 27. Hennessy, T. W. Hedberg, C. W. 
Slutsker, L. White, K. E. Besser-Wiek, J. M. Moen, M. E. Feldman, J. Coleman, 
W. W. Edmonson, L. M. MacDonald, K. L. et al. (1996) New Engl. J. Med. 334, 

Adult ID50 1 2ggg3iig(ID50 g

More information about the paleopsych mailing list