BY CHRISTOPHER HAWLEY
In the months following the September 11, 2001, attacks, the emergency response community was hit with a large number of white powder investigations. The public’s fear was that these white powders were anthrax. Having a safe and effective response strategy for these events is key to their successful resolution. This article provides an overview of a response to an unidentified material, such as a white powder.
The classification “unidentified materials” covers a wide spectrum of chemical, biological, and radioactive materials. Emergency responders are called to a multitude of situations where they are required to restore calm to chaos. Having an efficient, safe, and effective detection strategy is one of the keys to success. The information presented will work for a standard haz-mat response as well as a potential WMD response.
When considering either response type, responders should adopt a risk-based philosophy that focuses on science, not fear. Responders are being asked to be experts in a wide variety of topic areas, and most humans have an understandable fear of the unknown. The sooner we overcome our lack of knowledge or information, the sooner our fears will become less of an issue. Previous experience has shown that some responders in different regions view the same situation differently. This doesn’t mean that one response agency is right and another wrong. Rather, it means that there are differences in the risk-assessment process throughout the country. When teaching responders about risk assessment, use an exercise that forces the students to make decisions based on the science, and do not use chemical names. When students use science, they make very different decisions to complete the risk assessment process than they do when they know the chemical names.
WMD-ASSESSMENT PROCESS
The basic elements for a WMD risk-assessment process are the hazardous materials element and the criminal element. The hazardous materials risk assessment process can be broken down into four basic risk categories: fire, corrosive, toxic, and radioactive. Once you identify that the material you are dealing with has one or more of these risk elements, you can begin to plan your response appropriately. You cannot make a true determination of what personal protective equipment is appropriate until you have identified the appropriate risk category. Choosing one protective garment as your “standard garment” for unidentified materials is very risky, as there are occasions when you may choose the wrong garment to enter a hazard area. Choosing the level of protective clothing consists of a number of factors, and the fact that the material is unidentified should not be the major deciding factor. There is a need for a basic level of protective clothing when performing the initial air monitoring and detection, and there is some risk to performing this operation, but then again there is always some risk no matter which avenue you choose.
NOTE: A bomb technician should examine any package or letter that has not been opened. First responders should not be opening any suspicious letters or packages. The leading threat agents used by terrorists are explosive materials, and one should always consider that the package to which they are responding to is an explosive device. Close coordination with your local bomb squad should always be a high priority.
DETERMINING RISK CATEGORY
The ability to determine which risk category or categories you are dealing with is based on the use of several detection devices. Before any material can be sent to a laboratory response network (LRN) lab for biological examination, the unidentified material must be screened for the same risk-based response categories.
Four basic detection devices that are required to make a basic risk assessment determination:
1 A multigas detection device can determine oxygen content and the presence of flammable vapors using an LEL sensor. The device may also be able to detect carbon monoxide and hydrogen sulfide.
2 Detection paper can detect corrosives. The use of a multi-range paper, such as one that detects the 0-13 range of pH, is recommended.
3 A photoionization detector (PID) can detect a large number of toxic materials.
4 A radiation monitor determines if a radiation source is present.
Using these monitors to determine the risk category does not allow users to identify a biological threat agent because there is no handheld, instantaneous, real-time biological detection device. It is for this reason that some form of protective equipment, specifically respiratory protection, should always be a minimum. I prefer to use the term “appropriate levels of protective clothing” rather than recommend a specific type or level. Another reason using the four monitors is important is that not all WMD detection devices are intrinsically safe. It is important to determine if any flammable vapors are present when looking for WMD materials.
When using the basic devices, you are not looking to identify exact concentrations or the material. You are determining which risk categories may be present. If you walk into a room that has a small amount of an unidentified liquid on a table, and the LEL sensor provides a reading of two percent, then the liquid may be emitting flammable vapors and is most likely a flammable liquid. Your risk category and PPE should protect you against a fire risk. If you walk toward a truck with no visible leak or cloud with the four detection devices and the pH paper turns red at 100 feet from the truck, then there is an acid leaking in the back of the truck, and it has a significant vapor pressure. Your protective clothing choice would be appropriate for a high-vapor-pressure corrosive material.
Once you determine the initial risk categories, the next steps can become more complicated. Let’s assume for the remainder of this article that the initial readings in the area of concern are negative and you are not able to identify a risk category. One should assume that a crime has been committed and should treat the scene as a crime scene. Prior coordination with your local FBI WMD oordinator is essential; FBI coordinators are located at each of the FBI’s 56 field divisions throughout the United States. The FBI WMD coordinator is the primary link to accessing the advanced testing at the LRN lab. These laboratories are set up across the United States to identify potential biological threat agents (see “Laboratory Response Network”).
If a threat has been communicated, then a crime has been committed. Treat the scene as a crime scene and the material in question as evidence. Law enforcement at the local, state, or federal level should be coordinating the criminal aspect of the incident, which includes overseeing the evidence collection process. Fire department haz-mat technicians may be physically collecting the evidence, but the appropriate law enforcement agency should be coordinating the effort as it may be the one that will present the evidence in court. In some cases, the fire department may perform all of the necessary tasks through its fire investigation division or other agency.
UNIDENTIFIED MATERIAL SCENARIO
Your department has been called to a suspicious white powder in a commercial building. The crews determine that the powder was contained in an envelope and accompanied by a threat letter, which was written to the high-profile business owner. You should request assistance from the appropriate law enforcement agency and any other required specialized agency. Establish appropriate hazard-control zones, and initiate a unified command structure. Determine if there are any contamination or exposure issues to be addressed, and ensure that proper notifications are made. Screen the area for the basic risk categories of fire, corrosive, toxic, and radioactive categories. Once you get to the point of making entry into the immediate area where the powder is located, make sure everyone knows the plan. Do not allow freelancing.
Everyone entering the crime scene should have a specific purpose and mission. The federal rules of evidence collection are very strict when it comes to the collection process. Certified clean or sterile containers, tools, and equipment are required. Use the clean person/dirty person process to collect the evidence. In this process, only clean tools and equipment is used to come in contact with the evidence. The dirty person is the one who collects the evidence. The clean person assembles and provides clean equipment to the dirty person during the collection process. Only clean and/or sterile equipment should ever come in contact with the evidence. Take great care to ensure that the evidence is not cross-contaminated.
Some responders have been slightly confused after consulting with their FBI WMD Coordinator, or participating in a conference call with the FBI’s Hazardous Materials Response Unit (HMRU) when the FBI’s emphasis has been to get the evidence to the LRN lab. Responders must keep in mind that the FBI’s role is to ensure a successful prosecution. Without the laboratory analysis, the FBI can’t make its case. No matter how well your haz-mat team is trained and equipped, law enforcement representatives need the laboratory analysis. They will always ensure that proper methods are used to get the evidence to an LRN in a manner that will allow them to make a case. They understand that first responders have a world of training, capabilities and experience, but they need their evidence. They also understand that the first responder’s role is one of public safety and understand your desire to conduct street-level testing.
The simplest method to accomplish both goals is to separate the potential evidence into two containers: one for evidence and one for first responder use. Collect the evidence following the proper evidentiary procedures. Following a chain of custody means ensuring that the evidence is always in someone’s custody. When the custody of the evidence changes to another person, a signature, time, and date should be tracked on a chain of custody form. At no point should the evidence be left unattended or unsecured. Failure to ensure that the evidence is properly handled usually results in the evidence being disallowed. Transfer the evidence to the LRN, following the advice of your local FBI WMD coordinator. If there is a small amount of material, it may be best to send all of the material to the laboratory. In general, the laboratory only requires very small amounts of the evidence. For credible events, the laboratory needs as much as it can get, as it must test for the criminal aspect in addition to testing for public health issues. To ensure that the laboratory gets what it needs, you can consult with the laboratory or the WMD coordinator.
For noncredible events, small amounts are adequate to send to the laboratory. As an example, in a pile of powder, many first responders would want to send the whole pile to the laboratory. In reality, the lab only needs a swab that has come in contact with the powder. For a powder that is comparable to artificial sweetener, a gram (about the amount in one packet) is a suitable amount. Before the evidence can be sent to the laboratory, make sure it is tested for fire, corrosive, toxic, and radioactive risks. Haz-mat technicians should open closed containers to sample the vapor space and conduct air monitoring. Any risk categories that are identified should be noted on the paperwork that is sent to the laboratory.
STREET-LEVEL TESTING PROCESS
It is difficult to provide a very specific street-level testing process because a variety of detection devices are available, but there are some options that are available to you. This process works for solids, liquids, and in many cases, gases. Always ensure that you have secured the evidence, and that all the testing described below is done on the field-screening sample.
● Corrosive Risk: For solids, you have two choices. Add a small amount of the sample to wet pH paper, which has been wetted with de-ionized water and look for a leading edge to change on the paper. The other choice to take a small amount, less than the size of a pea, and mix it with neutral water, then check the pH. For liquids, take a pipette and obtain a small amount of liquid to place on the paper. You should check the vapor space above a liquid for corrosive vapors but you should never place the pH paper into the evidence, or the field-screening sample. Gases and vapors will change the pH paper if they are present in an area or above a spill.
● Flammable Vapors Risk: Check the material with an LEL sensor to see if flammable vapors are coming from the sample.
● Toxic Vapors Risk: Check the material with a PID to see if toxic vapors are present.
● Radiation Risk: Check the material for increased radiation readings above background, and make sure you open the container to check for radiation. The container walls may block the movement of the radioactive energy.
Record all of your field screening results for the laboratory and note any hazards for the transportation crew. All of your notes are not evidence, but they are discoverable so be careful what you write. You don’t want to see your notes on the front page of your daily paper or used in a courtroom, so use discretion when making notes. Field screening is done for the safety of the public and the responders, not to provide an exact identification. If called to testify on your field screening results, you should state that they were conducted for public safety and that the results were presumptive. All presumptive results are required to be validated with laboratory analysis and confirmation.
As long as first responders understand that the street testing is considered presumptive, they can use some additional technologies. For chemical threat agents, consider detection devices that can detect chemical warfare agents. There are relatively inexpensive simple test strips and test kits, but some of the military devices have considerable false positive issues. Several manufacturers have test strips that test for a variety of substances that work pretty well and can point you to a potential chemical family. Electronic devices that use Ion Mobility spectrometry (IMS), surface acoustical wave (SAW), or flame spectrophotometry can be used to assist in the detection process and can provide additional confirmation. More sophisticated devices such as the Fourier transform infrared (FTIR) device or a Raman detection device can provide a potential identification or at least a chemical family. If available, a gas chromatograph/mass spectrophotometer could also be used. Haz-mat teams comfortable with colorimetric detection can also do well in determining the chemical family of a material.
Include a test for oxidizers somewhere in your testing procedures. Several available to first responders consist of a testing strip along with other tests. In the realm of potential terrorism agents, the oxidizer tests will identify potentially explosive materials. Although the combination test strips work well, the best oxidizer test is an individual strip that tests only for the presence of oxidizers. You have to add hydrochloric acid to the test strip prior to testing the sample material. It is not difficult, but not many first responders keep a bottle of hydrochloric acid in their pocket. This would be a haz-mat technician skill. Some of the other tests that may be of value are drug screens. Quite a few white powder events in 2001 and 2002 were drug-related; your local narcotics squad can help identify the simple tests for drugs.
For potentially biological materials, the process is a little more complicated, and the testing process can be more expensive since even the electronic devices require disposable supplies. Several options are available to a responder when in it comes to biological threat agents. You could start with the use of an FTIR or Raman device or use a protein screening device. The FTIR and Raman devices do not have any disposable items that would cost the response agency, but the FTIR is not designed to identify biological threat agents. It can identify a considerable amount of typical white powders not biological in nature, such as flour. Some responders who can’t afford the FTIR may elect to use a protein screening tool. It is important to use a protein screening tool that is specific, such as one that looks for specific DNA of the bacterial material. Some broad-spectrum protein testing devices will provide a positive for a wide variety of common materials. This is because it is looking only for generic protein, which is common to many materials such as flour, coffee creamer, and so on. A specific protein testing device should not alert for ordinary proteins and in many cases should be pretty specific to the common biological threat agents. One device is said to identify the 13 high-priority biological threat agents identified by the Centers for Disease Control (CDC). If the FTIR or the Raman reports that it has found a protein, a specific protein test can be run to see if it is one of the biological threat agents.
A positive with an FTIR and a negative with the broad-spectrum DNA-based test would indicate that the material was not a biological threat agent. If you get a positive with the broad-spectrum test, a polymerase chain reaction (PCR) testing device would be the next logical step. In the laboratory, the PCR is a very accurate device, but in the field, sample prep is a major factor in accuracy. Another possibility is to use a handheld assay, making sure you follow the instructions exactly. Only one of these devices has been certified by the Association of Analytical Communities (AOAC) for use as an anthrax detection device in a laboratory setting. Most of these handheld assay devices can determine only the presence of a handful of biological threat agents, and each test has to be done individually.
A positive for one of these devices would be reason for some concern. Always conduct more tests. Getting positives among several of these devices would indicate the possibility that the results are possibly correct, but since none of these devices offers 100-percent accuracy, the laboratory is still the final answer. Even for potential chemical agents, the laboratory must be the final answer, since the accuracy of some of the devices is still questionable. Developing specific sampling protocols and instructions for your devices as well as coordinating your efforts with your local laboratories is essential to success. It is possible that a harmful threat agent could be mixed with a benign substance, and many street-level tests would miss the threat agent.
ADDITIONAL RESOURCES
You can go to several places for additional information including the International Association of Fire Chiefs (IAFC) Web site located at www.iafc.org. It has a model procedure for responding to a suspicious package with a possible biological threat agent. The model procedure was written by a number of committees and federal agencies, including the FBI. Many first responder associations and agencies assisted in the effort. It provides a comprehensive process to follow for potential threat agents. The CDC has an Emergency Preparedness and Response branch with a considerable amount of information on its Web site, www.bt.cdc.gov. The site has specific information on bioterrorism agents, chemical and radioactive emergencies, mass-casualty events, natural disasters, and recent outbreaks and incidents. It has model procedures, very specific threat agent information, and training information.
The response to an unidentified material such as a white powder can be very complicated. Developing relationships with the other interested agencies prior to an incident is one of the keys to successfully mitigating the threat. Understanding the limitations of current technologies is another key factor. Response agencies should develop a standard protocol for responding to such events. Do not widely distribute this protocol. Several associations and federal agencies are working on standardized protocols, which should be published sometime in 2006. None of the information presented in this article reflects information not easily obtained elsewhere, but specific testing processes should be kept to the special operations personnel. ●
● CHRISTOPHER HAWLEY, a 23-year of the fire service and a haz-mat responder for 16 years, is a project manager for Computer Science Corporation and is responsible for International WMD and Haz-mat training provided for the DoD-DTRA International Counterproliferation Program. He is a retired fire specialist with the Baltimore County (MD) Fire Department, where he was the special operations coordinator. He is the author of a number of texts including Hazardous Materials Incidents and Air Monitoring & Detection Devices (Delmar Publishers, 2004). He is the co-author, with Greg Noll and Mike Hildebrand, of Special Operations: Response to Terrorism and HazMat Crimes (Delmar Publishers, 2001). Hawley is the owner of FBN Training & Consulting, a company that provides emergency-response training worldwide.
CRIMINAL RISK ASSESSMENT
There are exceptions to every rule, and in the scientific community there are some gray areas. There are some aspects to risk assessment that will never be black or white; they will be clouded in gray. Never, always, and best are three terms that are difficult to use when discussing response strategies. Making a statement that an event could never happen will invariably result in that very activity’s occurring. With that in mind, responders should keep an open mind and expand their realms of thinking. Involve subject matter experts in tactical and response discussions. When confronted with a potential biological threat agent, consult with a biologist or other public health official. For chemicals, a chemist providing technical assistance would be a high priority. For radiation, a health physicist or radiation specialist would be of great benefit. To assist in making decisions regarding responses for potentially explosive materials, rely on a bomb technician. Having these resources in place prior to an event and developing a relationship long before an event, can save a lot of time and trouble at the emergency scene. For a WMD event, consulting with your local FBI WMD coordinator gets you to all of these resources with one phone call.
Even without the technical assistance, responders should use basic common sense during the risk-assessment process. The use of basic chemical and physical properties should be very high on the initial risk-assessment process. There are significant differences in risk when confronted with a solid, liquid, or a gas. When confronted with victims who exhibit immediate signs and symptoms from an exposure to an unidentified material, one should be thinking that a chemical attack is highly suspect. In most cases, biological threat agents do not cause immediate signs and symptoms. Except in the case of extreme levels of radiation, exposure to a radiation source would not create immediate symptomology. When a suspect material is in a closed container, such as a jar, there is less risk than from a release or an open container. For most of the biological threat agents, there is more than ample time to wait for lab analysis before initiating medication. Although street-level tests have dramatically improved, the decision to medicate victims is a healthcare decision, and multiple types of tests should be conducted before starting large-scale antibiotics distribution.
Both first-response agencies and law-enforcement should determine the credibility of a potential attack. First, consider the target of the event. Is it a target facility? Is there someone specifically targeted? Is the threat specific in nature? Many incidents in the United States are not terrorism but are actually crimes against other persons, such as murder attempts. If the suspected or alleged attackers are known, what is their education level? Do they have the mental or educational ability to manufacture the material that they say they have? Did they have access to raw materials? Did they have access to the equipment necessary to make the suspect material? Do they have a dissemination device, or other mechanism to spread the material? The use of a HVAC system is less credible than most people imagine. Also, consider the motivation to kill. Does the individual have the intestinal fortitude to pull off the event?
Although it is not outside the realm of possibility, it is not likely that Mrs. Smith, a 90-year-old grandmother living in a rural area, with no history that would make her a target, would be targeted by a terrorist. Consider the evidence though. If she got a threat letter, then the event is a crime and should be investigated as such. The lack of a threat letter accompanied by responders that suspect Mrs. Smith spilled her creamer, make the event a lower priority. The incident is real to Mrs. Smith and although the likelihood is very low it could present a risk to her and the responders, we should try to figure out what the suspect material is while working closely with law enforcement.
LABORATORY RESPONSE NETWORK
The Laboratory Response Network (LRN) is an important member of any response to a biological threat agent. LRNs have existed since 1999 but really came into prominence in 2001 after the anthrax attacks. The FBI partnered with the CDC to ensure standardized protocols were implemented and that both public health and evidentiary concerns were addressed. The LRN system is still growing, and there are still issues with the type and amounts of testing performed at the LRN level.
There are 140 LRN labs throughout the United States. They comprise local, state, and federal laboratories. Generally, the local or state health department operates the lab, and receives federal funding to implement the LRN procedures. LRN labs are classified as national, reference, and sentinel. Sentinel labs, numbering in the thousands, are based in hospitals. Reference labs, also known as confirmatory reference laboratories, handle the potential WMD materials. Most responders send their samples to these labs through an FBI WMD coordinator. The national labs are used for highly infectious materials and have the most sophisticated testing capabilities.
There are 62 laboratories that can conduct chemical threat agent analysis in the case of chemical attacks. These labs do not identify chemical samples. There are three levels for chemical laboratories. Be aware that the CDC changed the designation system in early 2005. A level 3 laboratory ensures that proper collection methods are followed and acts as a liaison to the other labs. A level 2 laboratory can conduct basic chemical analysis of human blood and urine. A level 1 laboratory can detect an expanded list of chemical threat agents and have additional resources. Only five laboratories meet the level 1 criteria, with 41 meeting level 2 criteria. Consult with your local health department to see where your local laboratory fits into this system.
