The Ghost in the Ductwork

Every Building Breathes

Every October, haunted houses promise unseen things moving through the walls. In real buildings, something moves through the walls every minute of every day: air.

A building's heating, ventilation and air conditioning (HVAC) system works like a pair of lungs. It draws in outdoor air, mixes it, conditions it and delivers it to every occupied space. That process helps keep people comfortable and supports a healthy indoor environment.

But the same system that protects occupants can also expose them to harm. If a hazardous airborne agent enters the system, the same ductwork that protects occupants can carry the hazard to them. That is the real ghost in the ductwork, and it is an engineering problem with engineering solutions.

Why Airborne CBR Risk is an Engineering Problem

Airborne chemical, biological and radiological (CBR) threats are usually framed as a problem for emergency responders. Yet much of a building’s protection is determined long before any incident occurs, by the engineers who design, retrofit and maintain it.

That view has deep roots in federal guidance. In 2002, the National Institute for Occupational Safety and Health (NIOSH) set out practical steps that owners and managers of offices, hospitals, schools, laboratories, transit terminals and public venues can take right away to protect occupants from an airborne CBR release (Mead & Gressel, 2002). The Federal Emergency Management Agency (FEMA) followed with a reference manual written for architects and engineers that treats CBR agents alongside blast (FEMA, 2003), later revised as part of the Department of Homeland Security's Buildings and Infrastructure Protection Series (FEMA, 2011).

The engineering profession reached the same conclusion. The American Society of Heating, Refrigerating and Air-Conditioning Engineer’s *ASHRAE) Guideline 29 frames building protection as risk management, covering CBR protection, filtration, contaminant entry paths and the building envelope in both new and existing buildings (ASHRAE, 2019).

Five Places the Ghost Can Get in

Mead and Gressel (2002) point to a handful of physical weak spots that recur from building to building. Most of them hide in plain sight.

1. Outdoor air intakes within reach. An intake at ground level or on an accessible roof is a direct path into the HVAC system, which is why the guidance calls for protecting intakes and keeping the public off roofs.
2. Mechanical spaces left open. Mechanical rooms and building controls should be off-limits to the public and to unsupervised outside personnel.
3. Entry and storage areas that share air with everything else. Physically isolating spaces such as lobbies and loading areas from the rest of the building keeps a problem in one place from becoming a problem everywhere.
4. Return air grilles in public spaces. An unsecured grille can be a way into the air distribution system, and securing it is one of the simplest fixes available.
5. Building information that circulates freely. Drawings and system details amount to a map of a building's vulnerabilities, so access to them should be restricted.

None of these places call for exotic technology. They are layout, access and design decisions, squarely in an engineer's domain.

What Engineers Can Do

Turning those weak spots into a protection plan follows a natural sequence: assess, understand, prioritize, then design and maintain. NIOSH organizes its own recommendations into four groups (things not to do; physical security; ventilation and filtration; and maintenance, administration and training), and the steps below draw on all of them.

The starting point is risk, not hardware. Protective measures should follow a building's threat profile and a security assessment of the building and its occupants (Mead & Gressel, 2002). FEMA (2005) offers a structured, five-step method for that assessment, written for architects, engineers and building owners. Because risk varies so much from one building to the next, no single retrofit fits them all.

Next comes understanding how the building really works. That means walking the HVAC, fire protection and life-safety systems to compare how they were designed to operate with how they operate today. The two pictures often differ, and the gap is where surprises hide.

With that picture in hand, the guiding rule is to do no harm. No change should compromise HVAC, fire protection, life safety or occupants during normal operation (Mead & Gressel, 2002). A well-meant modification that degrades everyday indoor air quality is not a win.

Prioritizing then becomes straightforward: address the most vulnerable items that are easiest to fix first. FEMA (2003) takes the same incremental view, noting that many measures can be put in place quickly and cost-effectively.

Ventilation and filtration deserve dedicated engineering attention. NIOSH (2003) published companion guidance on selecting, installing and maintaining filtration and air-cleaning systems, and those choices should be engineered for the specific building rather than added piecemeal. New designs and major modifications are also the moment to leave room for future CBR sensing technology (Mead & Gressel, 2002).

Finally, protection only lasts if it is maintained. Documentation, upkeep and trained staff keep a sound design working year after year.

One caveat applies throughout. Higher-risk facilities, such as industrial, military, subway and law enforcement sites, need special considerations beyond the scope of general building guidance (Mead & Gressel, 2002).

Don't Wait for a Scare

The scariest thing about airborne CBR risk isn't the threat itself. It's how often basic, low-cost protections go unaddressed because no one has looked at the building through that lens.

If you own, manage or design buildings, start with three questions:

1. Who can reach your outdoor air intakes today?
2. Who can get into your mechanical spaces and building drawings?
3. When did someone last walk the building to confirm the HVAC works the way it was designed?

References

American Society of Heating, Refrigerating and Air-Conditioning Engineers. (2019). Guideline for the risk management of public health and safety in buildings (ASHRAE Guideline 29-2019).

Federal Emergency Management Agency. (2003). Reference manual to mitigate potential terrorist attacks against buildings (FEMA 426).

Federal Emergency Management Agency. (2005). Risk assessment: A how-to guide to mitigate potential terrorist attacks against buildings (FEMA 452).

Federal Emergency Management Agency. (2011). Reference manual to mitigate potential terrorist attacks against buildings (2nd ed., FEMA 426/BIPS-06). U.S. Department of Homeland Security.

Mead, K. R., & Gressel, M. G. (2002). Guidance for protecting building environments from airborne chemical, biological, or radiological attacks (DHHS [NIOSH] Publication No. 2002-139). National Institute for Occupational Safety and Health.

National Institute for Occupational Safety and Health. (2003). Guidance for filtration and air-cleaning systems to protect building environments from airborne chemical, biological, or radiological attacks (DHHS [NIOSH] Publication No. 2003-136). U.S. Department of Health and Human Services.