Drug Makers’ Protection Prescription

As I gulped down a couple of Tylenol tablets while writing this article on security at pharmaceutical facilities in Puerto Rico, I remembered that the pills were, coincidentally, made at the very location I was describing. Before researching this topic, I would not have known that all of Johnson & Johnson’s Tylenol tablets are manufactured in the U.S. commonwealth of Puerto Rico, an archipelago located east of the Dominican Republic, 1,000 miles southeast of Miami.

Chances are good that you too have swallowed, inserted, or injected medicine that has originated in Puerto Rico, because 16 of the top 20 best-selling drugs in the United States are made in Puerto Rico, according to the government-run Puerto Rico Industrial Development Company and the private Pharmaceutical Industry Association of Puerto Rico. Many other countries around the world import drugs from the commonwealth as well. Eight drugs other than Tylenol are manufactured exclusively there.

More than 60 pharmaceutical plants dot the 3,500 square miles of Puerto Rico’s main island, ranging from Mayaguez on the western tip to Fajardo on the east coast. All of the U.S.-based heavyweights are there, along with some European counterparts: Pfizer, Bristol-Myers Squibb, Merck Sharp & Dohme, Amgen, Johnson & Johnson, Abbott Labs, Wyeth, Schering-Plough, Eli Lilly, AstraZeneca, and GlaxoSmithKline. They churn out powerhouse drugs such as the cholesterol-lowering medications Lipitor (Pfizer) and Zocor (Merck), the antibiotic Zithromax (Pfizer), and the antipsychotic Zyprexa (Eli Lilly). Despite being fierce competitors at the drugstore, these companies collaborate closely on their security.

The following is a look at how these companies are battling one of their top concerns, terrorism, and how they are preparing for the worst through emergency planning.

Antiterrorism

The pharmaceutical industry as a whole has been mentioned by the Department of Homeland Security as being a potentially soft target. In Puerto Rico, the danger is expected to come, if it arises, from foreign terrorists, explains Luis Fernandez, regional security director, corporate security, technical operations, Puerto Rico, at Bristol-Myers. He and others say that it is far less likely that an attack would come from home-grown agitators because so many locals are dependent on the chemical and drug industries.

The presence of foreign terrorists is more than theoretical. The FBI and other federal agencies have documented that foreign terrorists travel through Puerto Rico to go elsewhere, he says.

“Puerto Rico isn’t under a [specific] threat, but we want to dissuade” terrorism, says Jose A. Cruz, CPP, security manager at Abbot Laboratories.

Abbott Labs is one of several pharmaceutical campuses in the coastal village of Barceloneta, which is about a 45-minute drive west from San Juan. Wooed by favorable tax laws, Pfizer was the first to arrive in Barceloneta in 1973, with Abbott, Bristol-Myers, and Merck following later.

Pharmaceutical plants cluster in various locations around the island, with Barceloneta being one. Over in Carolina, just a cough and a sneeze east of the capital city, AstraZeneca, Wyeth, and Eli Lilly plants form another hive.

This practice of collocating facilities creates both problems and benefits. One negative is that it puts many dangerous chemicals in proximity to one another. Ammonia, chlorine, dimethyl sulfide, and sulfuric acid, all used in the pharmaceutical production process, are potential weapons in a terrorist attack (or potential hazards in an accidental release).

“You could have a scenario where tank farms [where chemicals are stored] are attacked,” says Cruz. “You don’t need to build a WMD [weapon of mass destruction]; this is a WMD in a tank.”

On the plus side, however, the close proximity of campuses helps the facilities coordinate their security efforts. Every security professional interviewed for this story remarked on the extraordinary security cooperation among companies that are bitter rivals in the marketplace.

“There’s lots of sharing of experience, sharing of best practices,” says Jose Aponte, CPP, security manager at AstraZeneca. “We see ourselves as a working team even as we’re competitors.”

Collectively, they have developed antiterrorism programs that consist of these primary elements: general staff awareness, security staff awareness focused on countersurveillance, and targeted use of technology for perimeter protection and general physical security.

Security awareness.

Everything begins with instilling a sense of responsibility for security in all members of the staff, from product inspectors to loading dock personnel. The training begins at week one of the job, where new hires at all of the companies interviewed receive a course on security awareness that lasts for at least an hour, sometimes significantly longer.

Issues addressed include workplace violence, employee theft, improper access to sites, and diversion/counterfeiting, but antiterrorism is always a significant component of the classes. A primary aspect of the lesson is the importance of observation, of detecting when something is out of place or just doesn’t look right.

The emphasis on awareness doesn’t end at orientation. At Merck, for example, employees receive a steady flow of security-related e-mail tips and updates, says Security Manager José M. Sampayo, such as advisories when internal access procedures have changed.

At Bristol-Myers, says Fernandez, “Our mandate is that we have a responsibility to provide training to the whole plant population.” To that end, refresher training is provided monthly. At “town hall meetings,” general staff and security personnel discuss incidents that have occurred in the company and how workers dealt with them. These yield lessons for improving security vigilance.

Under federal law, contractors who move about these facilities unescorted must receive security instruction, and awareness training is a large component of that. Under the Occupational Safety and Health Act, all visitors must be escorted at all times. At Merck and elsewhere, anyone who will be traveling unaccompanied on the property must receive security awareness training.

Because employees may consider security briefings to be drudgery, some companies attempt to make them enjoyable. Sampayo says Merck holds an annual security awareness week in which lessons are inculcated through hands-on demonstrations, colorful speakers, engaging exhibits, and lively video. Other members of the Pharmaceutical Industry Association of Puerto Rico have recently followed suit in holding more entertaining security events, he says.

Countersurveillance.

While all staff members are encouraged to keep their eyes out for anomalies, the contract guard forces are even more highly trained in what clues to look for as indications of possible terrorist planning or industrial espionage; this is the art of countersurveillance: always keep your eyes open.

At Merck, Sampayo says that his contract force looks for indicators such as cars pulling over near the plants or passersby snapping photographs. If activity raises concerns, the company will send out a patrol to ensure that nothing untoward is afoot. Suspicions are promptly reported to the authorities. “Even a low-flying helicopter might be reported to the FBI, Sampayo says.

In January, says Abbott Labs’ Cruz, he got a call from a security officer who had intercepted someone just outside the fence line of one of the campuses. The person had been videotaping the property. Concerned about possible surveillance, Cruz interviewed the cameraman.

It turned out that he was a television reporter looking for footage for a report he was doing on layoffs in the pharmaceutical industry. Cruz called the station the reporter worked for to verify the story and concluded he wasn’t a threat.

Countersurveillance is a common topic of discussion at the private monthly meetings of the security subcommittee of the Pharmaceutical Industry Association of Puerto Rico. Members share concerns, findings of suspicious activity, and suggestions for improvements in techniques.

If an incident or specific threat occurs, countersurveillance, along with other antiterrorist measures, is ratcheted up in accordance with the color-coded Homeland Security Advisory System.

Layered protection.

Pharmaceutical campuses in Puerto Rico can span hundreds of acres. The typical plant secures this territory by establishing concentric rings of physical protection. Plants also use overlapping layers of human and technological protective measures. These measures achieve multiple purposes—deterring theft, ensuring quality control, and reducing the risk of a terrorist attack.

It starts at the perimeter, where there is typically both an outer and inner security fence. Sensors are aligned along the fencing, and they are set to send alarms to the central control station if any suspicious activity is detected.

Augmenting both physical patrols and the data that sensors can provide, some campuses have “virtual patrols” conducted by digital cameras posted along the perimeter. (Whenever a Puerto Rican company wants to use CCTV, it must notify its staff and anyone entering the property.) Typical for the industry are long-range, low-light cameras that operate well at night. Cameras tie with alarms to provide the central station with video of activity at any alarm point.

Natural terrain. Companies also take advantage of the natural terrain in considering how their perimeter is secured. For example, campuses in Barceloneta are ensconced among limestone mogotes, conical hills that rise to about 160 feet. This rough terrain is difficult to traverse, and presents an imposing barrier to any type of vehicle bomb.

Some campuses intentionally leave a portion of their land undeveloped to create a buffer zone of mogotes and surrounding inhospitable land. This natural landscaping also buffers the outside world from any leak, explosion, or fire on the property.

The mogotes could also be seen as offering cover for someone looking to sneak onto the property. However, that person would have to navigate dense foliage and rough terrain, then at minimum, scale a barbed-wire-topped fence equipped with sensors to get into production areas.

Access controls. To get into or out of the property, vehicles must pass through controlled entry points, where some inspection and ID process is typical. For example, Bristol-Myers has a program in which all vehicles entering and leaving the plants get scrutinized by security staff.

Officers check drivers’ credentials and compare shipping manifests to the actual content of the vehicle. The program primarily identifies theft, but it is an excellent deterrent against an attempted truck bombing.

A few years ago, Fernandez says, a comparison of a manifest and the contents of a truck revealed the presence of 14 extra pallets of Pravachol, a cholesterol-lowering drug, worth $1.7 million. To identify the discrepancy, a worker had to snake through tightly packed boxes on the truck.

The company recovered the goods, and the fallout from the incident—including the firing of some Bristol-Myers staff—sent a strong message about security. That kind of message is helpful for deterring terrorism as well, says Fernandez.

Inner defenses. Moving inward from the perimeter, cameras also help to surveil other key points, such as the chemical-storage facilities, called tank farms, which are typically placed well inside the campus perimeter. For example, the Bristol-Myers tank farm in Humacao, which is located on the east coast of the main island, is patrolled by guards and cameras and ringed by a 16-foot alarmed fence that uses a photoelectric beam system to detect intruders.

Quality control. Integrity of the manufacturing process, while a safety issue, also has security components. “Contamination of product by terrorists is always a concern,” says Fernandez of Bristol-Myers. Accordingly, Bristol-Myers has full CCTV coverage in all of its production lines, an access control system that limits entry to the production floor, and alarm systems in the production areas.

Quality control departments constantly test for integrity. For example, before Bristol-Myers’ product leaves the premises, it goes into a numbered, sealed container. If the seal is broken, the number on that seal is reported back to the plant so that the company can figure out which batch of product may have to be kept off store shelves. Merck has a similar quality control program.

The types and quantities of the chemicals on site, as well as the potential for pharmaceutical plants to attract terrorists, make emergency preparedness planning essential. In fact, a tapestry of laws and regulations require these companies to have certain measures in place. For example, the Occupational Safety and Health Administration requires each site to have emergency response brigades.

Pharmaceutical companies work closely with the community and with each other to prevent and prepare for disasters. Much of this effort occurs through a local Community Awareness and Emergency Response (CAER) group, operated in conjunction with local fire departments. (CAER groups are required of companies that wish to adhere to the American Chemistry Council’s CAER Code of Management Practices, intended to ensure that each facility has adequate emergency response capability.) The local CAER group typically coordinates one mock disaster scenario per year and conducts an annual tabletop exercise. Individual companies augment these with their own full-scale exercises for responding to spills, fires, and other crises.

The CAER group also reaches out to children through schools and camps. A couple of years ago, for example, members of the Bristol-Myers Squibb emergency response team in the town of Manatí were among those at a CAER outreach activity at the Antonio Velez Alvarado Elementary School. The members displayed emergency equipment and educated the children and teachers on fire prevention.

CAER is also the point of contact in a real emergency. If any facility has an emergency, staff knows to notify (via phone or radio) CAER, which will put out the word to the members, requesting specific equipment or expertise that the afflicted facility might not have. For example, Merck sends members of its fire brigade to a special school in Texas where they learn the latest techniques in emergency preparedness. For its part, Abbott Labs has specialized nuclear and chemical detectors, says Cruz.

This cooperation depends on the goodwill of the various emergency brigades, and the companies work to foster positive relationships. From time to time, groups of brigades will hold joint family days involving food and friendly competitions, including tug of war and rapid dressing in a hazmat suit. These informal contacts break down barriers and ensure that personnel from different companies will be familiar with each other in an emergency situation.

Pharmaceutical companies also contribute extensively to the knowledge base of local emergency responders. AstraZeneca works closely with the community, says Aponte. Like Merck, Astra-Zeneca brings first responders to its sites to familiarize them with the layout and activities there. They train with the staff emergency response team.

The situation is similar at Merck. Instead of private industry depending on the government to offer training or resources, it’s the other way around, Sampayo says. “We offered them training in 2005 for local, state, and municipal police in the northern region.”

Merck brought in about 50 or 60 officers, walked them through plant operations, and showed them how the company responds to leaks, spills, fires, and explosions. After three or four days of intensive training, the officers went through a full-dress mock drill where they responded to simulated disasters. The exercise was complete with a smoke machine, fire trucks, hazmat suits, and ambulances. “The whole idea was to familiarize them,” Sampayo says, so they would know how to deal with a spill or other scenario.

“These are courses that are not taught in the police academy in Puerto Rico,” he explains. “The police are first responders, but if they’re not properly trained, they will become the first victims.”

Eventually, Sampayo says, he would like to conduct advanced training for this group of officers and repeat the basic training for a new cadre of police. The ultimate objective is to put all the elements in place for the right kind of chain reaction if a real accident or attack occurs at a chemical facility.

SYNOPSIS

Puerto Rico has become home to a prominent pharmaceutical industry; more than 60 pharmaceutical plants dot the 3,500 square miles of Puerto Rico’s main island. Chief among the industry’s security worries is the risk that the chemicals they handle could be used as explosives should they fall into the wrong hands.

Many of the pharmaceutical campuses in Puerto Rico cover hundreds of acres, making perimeter protection a major concern. The typical plant, say experts, uses concentric rings of protection—specifically, outer and inner perimeter fencing. Random guard patrols also surveil the perimeter. Tank farms receive special attention.

The types and quantities of chemicals on site, and the potential for pharmaceutical plants to attract terrorists, make emergency preparedness planning essential. Pharmaceutical companies work closely with the community and with each other to prevent and prepare for disasters. They do this through local Community Awareness and Emergency Response (CAER) groups, operated in conjunction with local fire departments.

Do This, Don’t Do That

Pharmaceutical companies face the challenge of complying with a host of overlapping regulatory schemes. While each has its purpose, and all of the requirements may be well-intentioned, they can lead to some redundancy. For example, one security manager’s facilities were inspected at least ten times in 2006 alone. (He did not complain about it, but merely cited it as evidence of how strict the requirements are.) Here’s a look at some of the compliance regimes with which companies must deal.

The Customs-Trade Partnership Against Terrorism (C-TPAT) program is designed to give companies an incentive to raise security standards. Companies that meet standards of supply-chain security get through U.S. Customs and Border Protection faster, saving time and money. Validation teams from C-TPAT go on site at pharmaceutical firms that want to be C-TPAT members; they conduct detailed reviews of personnel and physical security, access controls, conveyance security, manifest procedures, and other areas.

Other government agencies—such as the Food and Drug Administration, the Department of Transportation, and the Drug Enforcement Administration, to name a few—have security regulations that apply to the pharmaceutical industry as well. For example, FDA regulations attempt to ensure the integrity of pharmaceutical products. Some regulations are designed to prevent terrorists from tampering with the drug supply.

Some companies also comply with the American Chemistry Council’s Responsible Care Security Code, which calls on companies that use or work with chemicals to conduct comprehensive vulnerability assessments of their facilities, put in place security enhancements, and obtain independent verification that those enhancements have been made.

More regulatory hurdles are on their way. As this issue went to press, DHS had received comments on its draft interim rules on antiterrorism security requirements for chemical facilities. (The rules were passed pursuant to the DHS Appropriations Act of 2007.) Those rules would require chemical facilities that present a “high level of security risk” to conduct vulnerability assessments and develop and implement site security plans based on those assessments. (The final rule was released April 4, 2007.)