How to prevent the next biological agent attack

The recent revelation that Bruce Ivins, a scientist at the U.S. Army Medical Research Institute of Infectious Diseases, was the likely perpetrator of the anthrax mailings was a welcome break in the case that has gone unsolved since October 2001.

The 2001 incidents prompted a series of studies, hearings, and policy changes regarding biodefense, and the federal government has spent considerable sums of money on programs and activities intended to respond to and protect against biological attacks. Only time will tell whether any of these efforts makes us better off.

Despite all that has been written and speculated about the perpetrator of these incidents, their intent, and the methods of attack it is unclear what lessons the law enforcement community, scientific researchers, and the public can draw from what is now known about the bioattacks and the FBI's investigation. To jumpstart this discussion, I've put together a short list of lessons that would be a good place to start.

Lesson #1: The threat is real

The threat and potential impact of the malevolent use of biological agents for political, social, and economic reasons continues to be real. Knowledge and technology are widespread and access to biological agents that can be weaponized is relatively facile. In spite of what we've learned of Ivins's background and capabilities, the range of potential actors includes those outside of government laboratories. In response to these potential threats, the United States needs to build a robust, layered defensive system that is capable of addressing a range of threats, from individual perpetrators working on a small scale for narrow purposes all the way to large, well-resourced, state-sponsored programs.

At present, the United States isn't demonstrably able to anticipate, prevent, or protect the public against the range and scale of threats with a reasonable degree of certainty and agility. A majority of federal research and preparedness activities--in science and emergency response--focuses on cataclysmic, mass destruction scenarios, yet the simple and straightforward personnel security, law enforcement, and intelligence issues, such as the insider threat, the "lone wolf," or a small group with focused objectives and limited means receive far less attention and resources. The Ivins case reminds one that a small amount of material in the hands of just one person--not just hypothetical pandemic attacks--can create considerable political, fiscal, and societal costs. Perhaps Congress and the new administration should commission the complete and objective scrutiny of national biosecurity capabilities from a systems perspective using performance-based metrics to determine whether U.S. programs, initiatives, and investments are properly configured and balanced to address the likely scale and range of risks.

Lesson #2: A shift to prevention

As a nation, we should adjust our current position on the time-risk continuum from reaction, response, and recovery to anticipation, dissuasion, interdiction, disruption, and containment. At the core of criminal and terrorist activities, including activities involving biological weapons, are people with intent, motives, resources, means, and tools.

Sustained preventive systems are needed. Such systems should be designed to identify and resolve problems while they are small and containable, ideally well before they amplify to catastrophes. As part of the new approach, government, academia, and the private sector must work in concert to give greater attention to scientists who do and could work with dangerous biological materials, and those who otherwise have access to them. Scientists, researchers, and those closely associated in positions of public or corporate trust should expect to live and work under more restrictive and intrusive systems of control, that are not so oppressive and debilitating as to prohibit proper science from being conducted and managed.

Additionally, those closest to the science of dangerous materials should have more refined, responsive processes for reporting on and resolving suspicious or aberrant behavior among their peers and associates. A unified national program that educates, trains, and mentors scientists (and those who perform related activities on dangerous agents) about their moral, legal, ethical, and social responsibilities as they conduct research would also help to reduce the risk of misuse and misapplication and further sensitize the public. At present, several such programs exist, but they are fragmented and disconnected. The scientific and medical communities must be crucial partners in this effort. These measures, if part of a comprehensive preventive system, will aid in reducing the potential risks that result in malicious and malevolent behavior within scientific, medical, and associated communities.

Lesson #3: Cooperation is needed

If law enforcement needs to respond to a biological attack, then the system has failed. In this event, it is unlikely that failure resulted from a single fault. Though it would be easy to blame an agency such as the FBI for not preventing harm, focusing on the wrong suspects, or taking too long to resolve a case for prosecution, responding to a biological attack is not just a law enforcement problem. Law enforcement is in the business of answering questions such as "what," "where," "how," "why," "when," and ultimately "who" after the fact. It pursues proof beyond a reasonable doubt against the culpable, while excluding the innocent and protecting the uninvolved, so that a prosecution will be successful and defensible. Successful investigations integrate the skills of personnel, other resources, and sources of information--from the traditional to the scientific--within a system of legal and judicial requirements and expectations. Is the U.S. system robust and agile enough to enable the swift, effective, and defensible resolution of such cases? Probably not. Further, it is not well configured or resourced to prevent, disrupt, or interdict manifestations of biological threats. Nor are U.S. intelligence agencies or the policy system able to effectively and adaptively address bioviolence originating outside of the United States. A range of improvements should be pursued and implemented in this decidedly difficult problem space.

Lesson #4: Technology is not a panacea

The 2001 anthrax cases highlighted the existence and utility of new forensic tools and capabilities to identify and characterize microbial evidence and support identifying the source of a microbe. These new capabilities are not ends in themselves. Forensic science works hand in glove with the investigative and legal processes. It helps build a case; it is not attribution, but informs attribution. The documents the FBI revealed about its investigation into Bruce Ivins confirmed that these capabilities indeed provided useful links from the anthrax spores mailed to various figures in 2001 to closely related cultures and, by inference, to the limited number of people who had access to them.

Important questions about this new forensics capability still exist: Is the capability mature and complete enough? What are its limits? Has it been properly validated? Will it be accepted by the judicial process and survive adversarial scrutiny during trial? Bruce Ivins took his life before these questions could be answered, but we shouldn't wait for another episode to put them to the test. As a nation, we should build on the lessons available from the 2001 anthrax attacks and be wise enough and willing to cooperatively and innovatively improve the way we anticipate and address future challenges.