COVID-19: A Test of CBRN Resilience

The outbreak of COVID-19 has had devastating effects on populations and economies and continues to impact everyday lives globally. The virus had a fast onset and spread rapidly, forcing countries into lockdown to prevent overwhelming healthcare sectors. Businesses were forced to close and it was uncertain when they would reopen or resume normal operations. The effects on different sectors have varied, but no sector has been spared significant impact. These consequences were a result of a naturally occurring, low virulence virus with a mortality rate of 3.4%. Compared with Ebola or Anthrax, with mortality rates of 50% or up to 80% respectively, or the potential effects of a chemical, biological, radiological or nuclear attack, the human consequences could be far worse. The lessons that have emerged from the response to COVID-19 will be helpful for organisations preparing for future, unpredictable events.

Threat actors will not be ignorant to the consequences of COVID-19 and the pandemic may re-ignite interest in developing and exploiting CBRN agents. COVID-19 is a mass casualty event and it is feasible that replicating its effects (mortality and transmission rates) will be of interest to a would-be attacker. The methodologies and instruction on how to produce homemade chemical or biological agents is readily available online. There is historical precedent for this type of attack plot but weaponising and deploying a CBRN agent that is capable of causing mass casualties remains infeasible, and plots are vulnerable to failure and disruption.

In April 2020, António Guterres, the Secretary General of the United Nations warned:

“The lack of preparedness exposed by this pandemic provides a window into how a bioterrorist attack might unfold – and may increase its risks. Non-state groups could gain access to virulent strains that could pose similar devastation to societies around the globe”.

For non-state groups, modification of a virus to maximise its mortality rate and transmission rate requires overcoming significant technological and scientific difficulties.

It is well known that weaponising a chemical rather than biological agent is less complex. This is demonstrated by a higher number of attempted and successful chemical attacks. Yet, if a threat actor was determined to weaponise a virus, agents such as Anthrax or Ricin are easy to produce, if not to weaponise. The likelihood of a non-state actor effectively deploying a biological agent remains low, but the impact of an attack would be severe, including mass contamination, a high mortality rate and a heavy burden on public health and health care facilities.

The UK’s National Risk Assessment recognises a CBRN attack requires “additional contingency planning and specialist capabilities”. For businesses, the consequences and response to an attack would be similar to COVID-19. For example:

In the aftermath of a CBRN attack, there would be immediate interruption to business and forced closures of premises with no guarantee of when they could reopen. Sudden closures result in significant loss of revenue, and whilst government support could help navigate this period, businesses which operate with small cash reserves may not be able to survive. Furthermore, in the case of a CBRN attack, the reluctance of communities to return to normal activities would likely be greater due to the psychological effect of it being a targeted CBRN attack.

In the medium to long term, that trend is likely to continue and the return to previous models of working and businesses is unlikely. Businesses may increase their online offerings and rely less on footfall or visitors. There would be a hesitancy to return to congregated areas and a likely longer-term psychological impact on the public. Convincing employees that their work environment is ‘safe’ to travel to and work in would be a challenge for all businesses and require significant resources to convince people to resume normal activities.

COVID-19 has served as a reminder to organisations of the effects of a sudden, adverse incident which drastically changes the way they operate. Businesses may change to become more decentralised, with buildings and premises being used as ‘hubs’ rather than the core working environment, and employees adapting to this ‘new normal’. The pandemic has provided an opportunity to stress-test business continuity and crisis management plans, and flexible policies to allow for remote working. By nature of dealing with gross uncertainty with elevated consequences, business continuity and crisis management plans are likely to be vulnerable. The best plans are designed to be reactive to any situation with built-in flexibility. COVID-19 has provided an opportunity to deal with what was previously a global untested event, and an example of a ‘realistic’ CBRN scenario, albeit as a low virulence agent. It is critical businesses understand their operations and ensure the correct policies and procedures are in place and embedded in the organisation. Planning and preparatory activity should assume any event could happen and build response plans that are flexible enough to deal with any incident. COVID-19 has been an unprecedented event, but the lessons learned from the ongoing situation will be invaluable and might help to shape responses to a CBRN attack.