 |
   |
||||
|
|
|
 |
||
|
 |
 |
 |
||
|
in Publications: Font size:    
|
|
Insider Risk at High Biocontainment Labs: Dr. Bruce Ivins’ Alleged Anthrax Crime Revisited
For most of the past 50 years, there were only two (2) entities with BSL-4 (Biosafety Level 4) laboratories in the US: federal laboratories at US Army Medical Research Institute of Infectious Diseases (USAMRIID) at Fort Detrick Maryland, and the Centers for Disease Control and Prevention (CDC) in Atlanta, Georgia. (1) The anthrax attacks in 2001 set off a veritable explosion in high containment laboratory construction by various actors, including the federal government, state governments, academia, non-profits, and commercial entities. No one organization has oversight of high-containment laboratories, which is a situation that a group of appropriately concerned U.S. Senators and Representatives, led by Senators Lieberman and Collins, want improved. Staff at the Government Accountability Office (GAO) studied the situation for the past four years (September 2005 to June 2009), and compiled a kind of reference report summarizing basic data and bad experiences pertaining to high containment laboratories in the U.S., to the degree they are known and understood.
As of this writing, thirteen (13) BSL-4 laboratories (most dangerous pathogens, e.g., Ebola) are currently registered, under construction, or in the planning stage. Their names and owners are:
Meanwhile, the number of BSL-3 laboratories in the U.S. has tripled from 415 in 2004 to 1,362 in 2008! (8-9)Examples of microbes that may be handled in a BSL-3 lab are: Mycobacterium tuberculosis, Bacillus anthracis, West Nile virus, Venezuelan equine encephalitis virus, Eastern equine encephalitis virus, Hendra virus, SARS coronavirus, Salmonella typhi, Coxiella burnetii, Rift Valley fever virus, Rickettsia rickettsii, and yellow fever virus. Yersinia pestis (plague) can be managed in a BSL-3 lab. In 2008, the federal government owned 395/1362, state/local government owned 295/1362, academia owned 474/1362, private entities (nonprofit) owned 125/1362, and commercial (for profit) entities owned 73/1362. (9) The number of individuals with active access approvals to high containment laboratories, from CDC’s Division of Select Agents and Toxins (DSAT) (10) in 2004 was 8,335, and in 2008, 10,365! (11) The largest growth in number of individuals with active access approvals was in the academic sector (from 2,309 to 3,110). GAO staff note, “Not much is known about the characteristics of this workforce because there are no requirements in the select agent regulations to report on qualifications. In addition, there are no national standards for training of workers or standardized certification programs to test the proficiency of these workers.” (11-12)
The GAO report “High-Containment Laboratories: National Strategy for Oversight is Needed” provides an excellent update on the U.S. military investigation into the anthrax poisonings initiated (allegedly) by “insider” scientist, Dr. Bruce Ivins, at USAMRIID. (1) The discussion is reproduced here in full:
“In September and October 2001, letters containing spores of B. anthracis powder were distributed through the U.S. postal system to two senators, Thomas Daschle and Patrick Leahy, and members of the media. The letters led to the first U.S. cases of anthrax disease related to bioterrorism, and the subsequent investigation by FBI has been called “Amerithrax.” On August 6, 2008, the FBI alleged that the “sole culprit” in the 2001 anthrax attacks was Dr. Bruce Ivins, a U.S. Army scientist with a Ph.D. in microbiology who had worked for 28 years at the U.S. Army Medical Research Institute for Infectious Diseases (USAMRIID) at Ft. Detrick, Maryland. USAMRIID is the only DOD laboratory with the capability to study highly dangerous pathogens requiring maximum containment at BSL-4. Dr. Ivins had helped develop an anthrax vaccine for U.S. troops and was in charge of producing large quantities of wet anthrax spores for research. Immediately following the anthrax mailings in 2001, FBI took contaminated evidence to USAMRIID for analysis. Dr. Ivins was tasked by USAMRIID management to analyze the samples of spores sent through the mail and was also a technical consultant to the FBI in the early months of investigation. In March 2003, Dr. Ivins and two of his colleagues at USAMRIID received the Decoration for Exceptional Civilian Service—the highest award given to DOD civilian employees—for helping solve technical problems in the manufacturing of licensed anthrax vaccine. In December 2001, one of Dr. Ivins’ coworkers told Dr. Ivins that she observed on several occasions unsafe handling procedures by Diagnostic System Division personnel. She also told him that she might have been exposed to anthrax spores when handling an anthrax-contaminated letter. Dr. Ivins began sampling areas in the laboratory space that might have been contaminated with anthrax. He took samples from the shared office areas and later decontaminated her desk, computer, keypad, and monitor. However, he neither documented this incident in the Army record log book nor notified his superiors. He later acknowledged to Army officials that this was a violation of protocol. Dr. Ivins’ behavior was detailed in an Army investigation0 conducted in response to a second round of sampling he conducted in April, but his name did not surface at that time as a suspect in the anthrax attacks. After a spill incident inside of suite B-3 in building 1425 in April 2002, Dr. Ivins conducted a second round of unauthorized sampling of his shared office space and cold side areas outside of suite B-3. These findings were reported and sparked a buildingwide sampling inspection. An inspection conducted by the Army 7 months after the anthrax mailing found that suite B-3 in building 1425 at USAMRIID was contaminated with anthrax in four rooms of suite B-3 (306, 304, cold room, and 313 (Dr. Ivins’s laboratory)) and that the bacteria had escaped from secure to unprotected areas in the building. All the areas outside of suite B-3 that tested positive were associated with Dr. Ivins and members of the Bacteriology Division. The inspection report stated that “safety procedures at the facility and in individual laboratories were lax and inadequately documented; that safety supervision sometimes was carried out by junior personnel with inadequate training; and that exposures of dangerous bacteria at the laboratory, including anthrax, had not been adequately reported. In 2005, the FBI investigation began to shift to a particular laboratory at USAMRIID, and it began to focus on Dr. Ivins as a suspect in 2007. According to the FBI, Dr. Ivins had the necessary expertise and equipment to make the anthrax powder in his laboratory. Specifically, at the time of the anthrax mailings, Dr. Ivins possessed extensive knowledge of various anthrax production protocols. He was adept at manipulating anthrax production and purification variables to maximize sporulation and improve the quality of anthrax spore preparations. He also understood anthrax aerosolization dosage rates and the importance of purity, consistency, and spore particle size due to his responsibility for providing liquid anthrax spore preparations for animal aerosol challenges. He also had used lyophilizers, biological safety cabinets, incubators, and centrifuges in vaccine research. Such devices are considered the production of the highly purified, powdered anthrax spores used in the fall 2001 mailings. According to the FBI’s application for a search warrant, at the time of the attack, Dr. Ivins “(1) was the custodian of a large flask of highly purified anthrax spores that possess certain genetic mutations identical to the anthrax used in the attacks; (2) Ivins has been unable to give investigators an adequate explanation for his late night laboratory work hours around the time of both anthrax mailings; (3) Ivins has claimed that he was suffering serious mental health issues in the months preceding the attacks, and told a coworker that he had ‘incredible paranoid, delusional thoughts at times’ and feared that he might not be able to control his behavior; (4) Ivins is believed to have submitted false samples of anthrax from his laboratory to the FBI for forensic analysis in order to mislead investigators; (5) at the time of the attacks, Ivins was under pressure at work to assist a private company that had lost its FDA approval to produce an anthrax vaccine the Army needed for U.S. troops, and which Ivins believed was essential for the anthrax program at USAMRIID; and (6) Ivins sent an e-mail to a friend a few days before the anthrax attacks warning her that ‘Bin Laden terrorists for sure have anthrax and sarin gas’ and have ‘just decreed death to all Jews and all Americans,’ language similar to the anthrax letters warning ‘WE HAVE THIS ANTHRAX ...DEATH TO AMERICA ... DEATH TO ISRAEL.’” The FBI stated that in late 2005, forensic science (genetic analysis) used to trace the anthrax used in the 2001 attack had genetic markers consistent with the anthrax spores kept in a flask in the refrigerator in Dr. Ivins’s laboratory at Ft. Detrick, Maryland, to spores in the letters.
During this time, Dr. Ivins kept his security clearance and passed a polygraph-assisted interrogation (also known as a “lie detector test”) in which he was questioned about his possible participation in the anthrax attacks. In November 2007, he was denied access to all high-containment laboratories and, in March 2008, to all laboratories at USAMRIID. It should be noted that while Dr. Ivins was denied access to the high-containment suites in November 2007, he was certified at that time into the personnel reliability program. On July 10, 2008, Dr. Ivins attended a briefing on a new pneumonic plague vaccine under development at the Army’s laboratory. After this briefing, he was escorted to a psychiatric evaluation off the essential for USAMRIID were withdrawn by the laboratory commander. An order was subsequently issued to installation security to prevent Dr. Ivins from entering the installation unescorted. A written bar order was signed with a plan to serve the document to Dr. Ivins. Before service of the order occurred, he died of a drug overdose on July 29, 2008. This incident highlights two lessons: (1) an ill-intentioned insider can pose a risk not only by passing on confidential information but also by removing dangerous material from a high-containment laboratory, and (2) it is impossible to have completely effective inventory control of biological material with currently available technologies. It is impossible to know the exact number of bacteria or virus in a laboratory’s inventory or working stocks at any specific time. At Ft. Detrick, ineffective procedures for the control of inventories and the unlimited use of laboratory facilities allegedly allowed Dr. Ivins the opportunity to pursue his own ends. As the number of high-containment laboratories increases, there will be an increase in the pool of scientists with expertise and, thus, the corresponding risk from insiders may also increase. There are arguably two aspects to insider risk: the motive of the insider and the ability to misuse material and laboratory facilities. These two elements need to be understood if effective countermeasures are to be instituted in a proportionate manner. In this case, assuming Dr. Ivins was the culprit, no one can conclusively determine what motivated his actions since he committed suicide before his motive could be determined. With regard to the ability to misuse the facility, FBI records show that Dr. Ivins had unlimited access to material and laboratory facilities. However, it is still unclear whether the spores in the letters came directly from the flask under Dr. Ivins’s control or involved some further illicit culturing. In either case, material was illegally removed and laboratory facilities were misused—at a minimum, to dry and process the spores. It follows that research laboratories clearly represent a significant capability that can be potentially misused, and this capability is growing with the increasing number of high-containment laboratories. While efforts to strengthen inventory controls, assess and monitor personnel, and prevent facility misuse (for example, by video monitoring) have been undertaken effectiveness of these measures. While there are clearly major difficulties in imposing such controls in research laboratories, insider risk needs to be recognized and evaluated. Assuming that Dr. Ivins was the perpetrator in the anthrax attacks, he represents one rogue insider in a period of some 60 years, during which several thousand scientists and technicians had the opportunity to commit similar crimes. Thus, the probability of repeating that one event is, historically, very small. Devising any program to reliably reduce that figure for biological laboratory personnel is challenging. Furthermore, some DOD biological laboratory scientists and academicians we spoke with have pointed out that highly intrusive personnel reliability programs, which rely on profiling to identify insider threats, can have a negative effect on staff morale and performance by institutionalizing the concept that no one can be trusted. The National Science Advisory Board for Biosecurity reported that there is little evidence that personnel reliability measures are effective or have predictive value in identifying individuals who may pose an insider threat. In its report, the board recommended that “it is appropriate to enhance personnel reliability measures for individuals with access to select agents, but promulgation of a formal, national personnel reliability program is unnecessary at this time.” On February 11, 2004, DOD issued a directive (5210.88), “Safeguarding Biological Select Agents and Toxins” (BSAT). This directive established security policies and assigned responsibilities for safeguarding select things, the following DOD policy: “Individuals who have a legitimate need to handle or use biological select agents and toxins, or whose duties afford access to storage and work areas, storage containers and equipment containing biological select agents or toxins shall be screened initially for suitability and reliability. This means that they shall be emotionally and mentally stable, trustworthy, and adequately trained to perform the assigned duties and shall be the subject of a current and favorably adjudicated National Agency Check with Local Agency Checks and Credit Checks for military and contractor employees and an Access National Agency Check with credit checks and written inquiries for civilian employees with a reinvestigation every 5 years and they shall be evaluated on a continuing basis using the criteria issued by the [Under Secretary of Defense for Intelligence.]” On April 18, 2006, DOD issued Instruction 5210.89, “Minimum Security Standards for Safeguarding Select Agents and Toxins.” This instruction established, among other things, the criteria and requirements for personnel regarding a biological personnel reliability program (BPRP). The purpose of a BPRP is to (1) ensure that each individual, who has authorized access to BSAT and/or supervises personnel with access to biological restricted areas and BSAT, including responsible and certifying officials, meets the highest standards of integrity, trust, and personal reliability and (2) identify any potential risk to public health, safety, and national security. Following the announcement of the FBI anthrax investigation at USAMRIID, the Secretary of the Army organized a task force on August 7, 2008, to evaluate the U.S. Army biological surety program, including safety, security, and personnel reliability. In response, the Inter-Service Council for Biosecurity and Biosafety, General Officer Steering Committee, issued a report on December 12, 2008. This report focused on seven areas: transportation of select agents and toxins; biological safety; biological security/physical security; inspection; personnel reliability program/foreign personnel; inventory/accountability of select agents and toxins; and training of personnel. Review of all seven areas indicated that armed service policies, regulations, standards, and procedures in effect before 2008 met or exceeded all federal and DOD requirements. The services, however, agreed on the need to establish common standards in each area. In addition, on March 10, 2008, the Interagency Security Committee Standard defined the criteria and process to be used in implementing government-wide facility security standards. In October 2008, the office of the Under Secretary of Defense for Acquisition, Technology, and Logistics asked the Defense Science Board Task Force on DOD Biological Safety and Security to address the following questions: In May 2009, the Defense Science Board published its report. With regard to insider risk, the report concluded that “a determined adversary cannot be prevented from obtaining very dangerous biological materials intended for nefarious purposes, if not from DOD laboratories, then from other sources. The best we can do is to make it more difficult. We need to recognize this reality and be prepared to mitigate the effects of a biological attack.” [Bolding added] In October 2008, the White House Office of Science and Technology Policy asked the National Science Advisory Board for Biosecurity (NSABB) to recommend strategies for enhancing personnel reliability among individuals with access to biological select agents and toxins. Specifically, the NSABB was asked to identify the optimal framework for ensuring personnel reliability so that the need for biosecurity was balanced with rapid progress in the life sciences. The NSABB concluded in its report that “there is currently insufficient evidence of the effectiveness of personnel reliability program measures towards mitigating the risk of an insider threat to warrant the additional significant burden on research institutions.” However, the NSABB did recommend a number of ways to enhance the culture of research responsibility and accountability at institutions that conduct select agent research, noting that the recommended actions could be accomplished without significant expenditures, resources, or disruptions of research. On January 9, 2009, an executive order established a governmentwide working group to strengthen laboratory biosecurity in the United States. The executive order asked the working group to submit to the President, no later than 180 days after the date of the order, an unclassified report, with a classified annex as required, that sets forth the following: According to HHS, the draft report is to be formally reviewed and accepted by the co-chairs—the Secretaries of Defense and Health and Human Services—before it is made public. While it may be possible to quantify the financial costs required to initiate and maintain enhanced oversight procedures—such as controls of inventories and laboratory usage—the impact of such procedures on work output is unquantifiable but nevertheless very real. According to some experts and high-containment laboratory scientists, intrusive personnel reliability programs can also have an adverse impact on staff work effectiveness. Accordingly, the security benefits achieved by such procedures must be evaluated to obtain some understanding of the cost/benefit ratio. Such an evaluation could incorporate various stress tests and assessments of procedures against a range of risk scenarios. Effective evaluation could improve the cost/benefit ratio by concentrating on procedures with higher returns on investment and could be more acceptable to laboratory personnel by demonstrating objective benefits. Regular reevaluation is critical to avoid adding oversight procedures on a subjective rather than objective basis. Prior to the fall of 2001, there were no effective inventory control procedures at USAMRIID—or indeed other institutions that worked with select agents—that would have impeded insider misuse of such agents. Anthrax spores were held in a liquid solution in a flask (RMR-1029) that originally (October 22, 1997) contained 1000 ml of spore suspension with a concentration of 3x1010 spores/ml. While the flask had been under the control of Dr. Ivins since 1997, other laboratory staff may also have had access to it. However, no one in USAMRIID was specifically responsible for monitoring the use of materials by scientists. According to USAMRIID officials, Dr. Ivins’s laboratory notebook contained a record of the amounts of material removed at various times between 1997 and 2004, when the FBI finally removed the flask from USAMRIID. Additional undocumented removals from the flask could have been disguised simply by adding water to restore the volume. This would have reduced the spore concentration, but this concentration was apparently never checked. Even if it had been, experts told us that the normal biological experimental error involved in counting spores could have disguised the loss of up to 5 percent of the material. It is unclear whether the anthrax spores put in the letters came directly from the flask after being dried or whether a very small and undetectable quantity from the flask was cultured to produce enough new spores for the letters. In either scenario, the self-replicating nature of microorganisms and the inherent error associated with determining the absolute number of microorganisms in solution make inventory control a formidable if not impossible task with currently available technologies. According to DSAT (Division of Select Agents and Toxins) officials, even though Dr. Ivins’ alleged crime occurred prior to the expansion of the select agent regulations in 2002, DSAT performed an extensive 2-week inspection of the entire USAMRIID facility in September 2008. DSAT believes that its findings regarding USAMRIID’s inventory records contributed to the decision of DOD to stand down USAMRIID operations pending a thorough review of its inventories. In addition, DSAT referred USAMRIID to the HHS-OIG for further investigation regarding the entity’s apparent noncompliance with the select agent regulations. According to HHS-OIG, this referral is still an ongoing investigation.” (13) Notes:
|
Copyright
2007 - SEMP INC., All Rights Reserved.