The “Tylenol” moment the food industry needed

Meat processing giant JBS paid out an $11-million ransom following a cyberattack, according to reports. Most of its meat packing facilities, including the one in Alberta, remained idle for a few days. For years, most of us linked the concept of cyberattacks with IT companies, governments and media. Experts have been warning the food industry for years about the threat of becoming an active target for hackers. What was once purely academic has now become a reality.

Until now, efforts to counter cyberattacks in the industry have been timid, at best. At the very least, it was not an openly discussed topic amongst industry leaders. The fact that the world’s largest processor of beef and pork was targeted by hackers earlier this month is certainly a cause for concern and can serve as a major wake-up call. We can easily imagine that other companies like Cargill, Olymel, Maple Ridge Farms, McCain, Maple Leaf, Lassonde, Sysco, Loblaw’s, Sobeys, Metro and other major players could also become a target.

Managing systemic risks is not new to the food industry – far from it. Threats related to food safety, food fraud and, of course, pandemics have been considered critical issues for years. The focus has always been on the integrity and quality of ingredients and products coming in and out of facilities. The pandemic made companies focus more on worker safety and how humans play a role in manufacturing the food we consume every day. It has always been about keeping everyone safe, starting with consumers. Cybersecurity goes to the core of the operational nature of a company, as it goes beyond the food we eat. Ransoms aren’t intuitively compatible with how food companies manage risks.

The food industry is a critical piece of our economy, and changes in the industry are making it a more likely target in the future. Operations are adopting high-tech innovations like drones, GPS mapping, soil sensors, autonomous tractors, artificial intelligence and more. These changes in the industry are needed, but they can also make it a primary target. As the industry becomes more data-driven, it will also become more vulnerable to cyberattacks. On the other side of the digital spectrum, many food operations still use outdated operating systems like Windows 98. One can only hope that most management teams in the food industry are reviewing their IT systems and figuring out how vulnerable they are to cyberattacks.

For consumers, the potential consequences of these attacks are not trivial. Disruptions can lead to food shortages and higher prices at retail. Or worse, cybersecurity breaches could lead to procurement issues and inadvertent alterations to ingredients put into the food sold at retail. Ransom requests are just the beginning. Evil has no shame, no limits and it can harm a great number of consumers within days, perhaps even hours. The fact that JBS did pay a ransom signalled to perpetrators that it can work. We should expect more attacks to occur in the future.

Virtually no mandatory cybersecurity rules govern the billions of agri-food businesses that account for close to 20 per cent of the Canadian economy. Some trade groups may have voluntary guidelines, but that would be the extent of it. The Canadian Food Inspection Agency (CFIA) has no material on cybersecurity – not a single mention of this on its website. Its world is often exclusively about pathogens and allergens. Its focus requires a broader view, now more than ever. For the industry to protect itself, more information sharing mechanisms would be required, and our federal agency should be playing a more active role.

In essence, with the attack on JBS, the food industry has just experienced its own “Tylenol” moment. In 1982, some people tampered with bottles of Tylenol in Chicago-area retail stores and poisoned several people, killing at least seven. Many bottles were laced with potassium cyanide. At the time, bottle packaging practices were not the same and the murderers took the industry completely by surprise. That incident led to significant changes in how bottles were sealed and secured. Hopefully, the JBS incident will also lead to increased security and protection.

Dr. Sylvain Charlebois is the senior director of Agri-food Analytics Lab at Dalhousie University, Halifax.