Randall S. Murch

The threat and dangers presented by the potential use of biological weapons as instruments of terrorism and warfare against the United States are real. Important recent discussions confirm the conclusion that nation states and other actors have placed large investments in the development and possession of biological organisms or their byproducts for nefarious purposes (Alibek and Handelman, 1999; Anderson, 1998; Commission, 1999; Falkenrath et al., 1998; Kaplan, 1998; MacKenzie, 1998; Rimmington, 1999). The possible public health implications have been described at length (Bardi, 1999, Bartlett, 1999; Franz, 1999; Kortepeter and Parker, 1999; Hamburg, 1999; Henderson, 1999; Hughes, 1999; Inglesby, 1999, O'Toole, 1999; Pavlin, 1999; Siegrist, 1999). Although some analysts debate the likelihood and extent to which bioweapons would be used against the United States (Stern, 1999; Tucker, 1999), the motive, technology, source materials, and knowledge—at least for what might be termed crude attacks—are widely available and accessible.

Over one dozen nations are suspected or known to have biological weapons development programs. Many are, or have been, openly hostile to the United States. The former Soviet Union had an extraordinarily well-developed program and since its “dismantlement” in 1992 has had very little or no control over the loss of seed cultures or experts to other countries or to the lure of entrepreneurism (Alibek and Handelman, 1999). Further, the recent rash of anthrax and ricin incidents and hoaxes in the United States being investigated by the Federal Bureau of Investigation

(FBI) and other authorities should remind us to take these dangers seriously. Thus, the list of possible actors expands to right-wing militia and white supremacist groups, those loosely affiliated with foreign terrorist groups, religious and millennialist groups, and lone perpetrators. We might do well to reflect often on former Senator Sam Nunn's well-known 1996 quote about bioterrorism: “It is not a matter of if, but a matter of when.” An essential part of our defense against the illicit possession or use of biological weapons should be a national bioforensics network. Similar networks could be established for other weapons of mass destruction (WMD).

For just a few moments, step into the shoes of those responsible for protecting against or responding to these threats. Consider the topology they must plan for and prepare against. One dimension might include the array of hazardous materials that could be employed, accessibility to source or seed materials, and availability of relevant information, while another might include the possible delivery means and scenarios. In still another the categories of targets that exist, whether viewed as locations, environments, events, populations or infrastructures, might be found, and yet another might include level of sophistication, operational capabilities, psychology, motivations, categories, and numbers of adversaries. Still another dimension is that of time and distance. The threat matrix soon becomes daunting, if not overwhelming.

Over the past four years great concerns have been raised and expressed about gaps and shortfalls in U.S. preparedness and response to and recovery from the illicit use of biological agents. Most often these concerns arise in the context of bioterrorism conducted either at home or abroad. As a result, substantial funding has flowed forth in an attempt to address various aspects of these deficiencies, ranging from supplying personal protective equipment, instruments, and training to “first responders” (Pavlin, 1999), to research on advanced decontamination methods, to suggested new approaches for improving or boosting individual broad-spectrum immunity against disease agents (Alibek and Handelman, 1999), to stockpiling and improving vaccines and diagnostics against threat organisms (Anderson, 1998; Clarke, 1999; Hamburg, 1999; Pavlin, 1999). Clearly, full and robust defense and recovery from bioattacks must be a national priority; however, it should not be the only priority. There is another important chapter to this story that needs to come to life, namely a national bioforensics network.

This nation will not only expect its government to provide protection from and ensure complete and lasting recovery from a bioterrorism attack

but will also demand the rapid and accurate identification of the cause, the means, and those involved. It will further expect that subsequent attacks will be prevented, that full and robust attribution is achieved, and that the perpetrators will be brought to justice, either through the U.S. courts or a political or military action. If we concentrate resources only on the medical consequences and disaster relief aspects of a bioattack, we will not be positioning ourselves properly against our adversaries or necessarily know who attacked us. Fully competent attribution supports investigation, resolution, and prosecution. The law enforcement and intelligence communities have significant responsibilities in this domain.

Over the past four years volumes of written and spoken words have been devoted to the consequence management aspects of bioterrorism and the proliferation of biological weapons. However, insufficient attention has been given to enhancing our ability to effectively predict, locate, disrupt, prevent, investigate, resolve, and deter such activities, either after the fact or, more importantly, before the fact. Obviously, several resource and policy implications must be considered, including one that is perhaps not so obvious. These considerations include:

• Increasing the number of trained intelligence and law enforcement personnel who collect, investigate, and analyze information as well as operate against WMD and those who possess them.

• Providing those individuals with better information management tools to make them more efficient and effective in finding and using relevant open- and closed-source information.

• Producing new technical capabilities via a national integrated research and development strategy to better detect, locate, identify, frustrate, disrupt, and defeat WMD production and use.

• Developing robust national policies for actions that would be taken against those who use biological weapons.

The not-so-obvious implication noted above is the critical role of attribution and forensics in response to and defense against WMD.

Given how a biological attack is likely to unfold—as an unobtrusive, unexpected release of an organism or toxin with effects detected days to weeks later—traditional law enforcement, intelligence, or even medical methods alone will very likely be insufficient. Forensic evidence will play a crucial role in investigating and solving the bioterrorism crime. Perhaps it will also play an important role in counterproliferation or even non-proliferation. For the purposes of this paper, forensics does not simply mean characterization of material to determine what it is; rather the more traditional definition is used, which also has the critical ingredient of relevance. This often requires that the origin of the sample be determined

to a high degree of scientific certainty, which involves the use of highly discriminating analyses that compare samples from known and questioned sources.

Beginning in 1995, the FBI laboratory began articulating and addressing the need for integrating and advancing forensics capabilities for WMD investigation and resolution. Based on decades of experience with criminal and terrorism investigations and the investigation and prosecution of terrorist bombings, the FBI realized that an important void existed. No one had considered that forensics investigation would play a critical role in responding to WMD. Thus, in 1996 the FBI created the unique Hazardous Materials Response Unit (HMRU), which focuses on forensics investigation of such events (Ember, 1996). HMRU is an operational responder that quickly provides forensics leadership and integrates required expertise from the FBI laboratory and other agencies for on-scene commanders. Since its inception, HMRU has responded to dozens of suspected WMD (both criminal and terrorism) cases and is investigating many more.

HMRU and FBI laboratory management have also pursued aggressive outreach with a number of federal and professional scientific and medical organizations, which has resulted in merging forensics thinking, requirements, plans, and operations into theirs. The HMRU and its counterpart Bomb Data Center (advanced render safe) have been included in many interagency planning activities and exercises. Additionally, through joint efforts, various first-responder communities (law enforcement, fire/rescue, medicine, public health, hazardous materials) increasingly are becoming sensitive to requirements for the protection, preservation, collection, and analysis of physical evidence and will incorporate these into their practices and operations whenever possible. Evidence response teams in FBI field offices are being trained and equipped to respond to WMD crime scenes in order to provide more immediate response while the HMRU and its partners mobilize. HMRU has a small research budget that is focused on advancing field detection and laboratory analysis technologies and methods for biological and chemical agents.

We are still a long way from having the needed forensics capabilities and resources. Research, development, and validation in WMD forensics must be expanded considerably. Increased resources need to be appropriated to accelerate the training, equipping, and exercising of WMD crime scene responders and forensics experts. Advanced forensics facilities must

be constructed or provided to accommodate the analysis and storage of contaminated evidence. Logically, these should be in close proximity to or easily accessible by centers that provide related capabilities. Mobile scientific response should be optimized to permit the maximal amount and array of analyses to be performed in the field. An integrated laboratory architecture for WMD forensics should be established that builds on existing capabilities in key federal agencies.

Such traditional fields as latent fingerprint, trace evidence, computer forensics, DNA analysis, document examination, materials analysis, and forensics informatics routinely develop critical and timely leads and contribute evidence toward identifying perpetrators, scenes, instruments and methods of crimes. This would very likely also be true with crimes involving WMD and, specifically for the purpose of this paper, biological agents or toxins. A lack of resources has prevented the development or modification of technologies and methods to validly apply traditional forensics science to physical evidence that may be contaminated with a highly infectious or otherwise dangerous biological or chemical agent. It is the experience of the forensics community that considerable validation is required of novel forensics approaches before their use on probative evidence. Reversing this order means almost certain exclusion of key trial evidence.

Those of us involved in the scientific investigation of WMD bioevents also envision that medical microbiology, epidemiology, advanced microbial genomics, and bioinformatics must play a crucial role in attributing and prosecuting these crimes. We are not alone in this proposition (Fox, 1998; Snyder, 1999). The organism or toxin itself should be viewed not only as the causative agent of an unnatural disease outbreak but also as evidence in a crime. The forensics perspective is crucial. The forensics biologist (as well as investigators and attorneys or, alternatively, the FBI, the intelligence community, and the White House) would seek to answer the following questions:

• What is the material in question?

• What is its relationship or relevance to the incident being investigated?

• What is the source of the material?

• Can the source of the material in question be individualized or at least significantly narrowed?

• Can a link be established between the crime and the perpetrators? If so, how strong is that link?

The better the answers to these questions, in series, the greater the probative value of the evidence.

Our position would be much stronger if we were able to fully and robustly identify and characterize a bioweapon and if we were able to establish a link between those involved and the victims, crime scenes, and methods and tools of the crime. Identifying and uniquely determining the origin of a microorganism in a bioterrorism case would have the same high probative value that is achieved when, in a sexual assault case, semen from the accused is identified using evidence collected from the victim. With current technology, forensics scientists often achieve statistically robust attributions of biological evidence, for which the probability of a random match is less than 1 in 260 billion. By convention this is considered to be absolute identification. Exclusions of suspected sources, which are of equal or greater importance, are usually made very swiftly and protect the accused from false allegations, conviction, or punishment. Because of its power and impact, forensics DNA technology is widely considered to be the greatest scientific advancement in the U.S. criminal justice system in the last century. One could easily envision the impact of a similar capability for the type of biological evidence relevant to this discussion.

Building on FBI laboratory leadership in forensics DNA analysis, we have begun to explore the potential of bioforensics with the U.S. Department of Energy, the U.S. Army Medical Institute of Infectious Disease, the Centers for Disease Control and Prevention, the U.S. Department of Agriculture, and the academic community. Not surprisingly, similar interests exist among these agencies for rapid, accurate, and complete identification of the etiologic agent as well as the desire to identify the source of a bioweapon with as much uniqueness and statistical confidence as possible. This naturally leads to thinking about ways to maximally achieve the phenotypic and genotypic discrimination of microorganisms well beyond strain or isolate. Earlier discussion in this volume on the genetic variability of HIV is instructive. Jenks's 1998 commentary on microbial heterogeneity (including the presence of “orphans,” reminiscent of non-coding regions used for forensics purposes with human samples) also is useful. A focus on core diagnostic technology alone is insufficient. To achieve success, this must be part of an end-to-end system with several components fitted together and a range of issues and equities considered.

A national end-to-end architecture should be established that enables the coherent, efficient, fully exploitative, and legally and politically defensible capability to collect, preserve, analyze, and interpret physical and biological evidence associated with an illicit biological event. A consortium consisting of law enforcement, defense, intelligence, public health,

and agriculture agency laboratories could be formed to design, operate, and manage this system. Through this consortium, relevant capabilities could be identified, coordinated, integrated, and optimized in a systems approach. This proposed system, or portions thereof, would address not only evidence collected after the fact but also “evidence ” collected before the fact. (Reference samples as isolates of infectious disease micro-organisms would fall into the latter category.)

All biological and other physical evidence would be properly collected and preserved and its “chain-of-custody” documented in accordance with accepted forensics and legal requirements. Rapid preliminary diagnostics would be accommodated in a network of specially certified public health or medical (Centers for Disease Control and Prevention, 1999; McDade, 1999) and veterinary or plant pathology diagnostic laboratories. Confirmatory identifications and in-depth characterizations would be conducted in designated bioforensics laboratories.

In addition, a limited number of secure government biocontainment facilities would be modified to allow for safe and effective forensics analysis of contaminated physical evidence by qualified, certified, and specially trained forensics specialists. Evidence handling and examination practices by and between all laboratories in this system would be in accordance with accepted forensics practices and legal requirements to incorporate chain-of-custody practices as well as prevent the alteration, cross-contamination, or deleterious change of any evidence. Provisions for subsequent examination by the defense may be required. Secure facilities would have to be constructed for the safe storage of contaminated probative evidence. This could conceivably mean that hundreds or thousands of exhibits would have to be maintained, possibly for years, until the adjudication occurs. Quality assurance standards, which would ensure accuracy, consistency, validity, and confidence in the practitioners, technologies, methods, and results should be instituted and audited across this enhanced bioforensics laboratory system. Research funding should be appropriated to develop, validate, and advance forensics capabilities with biological as well as associated forms of WMD evidence.

The ability to maximally attribute an organism of interest to a source with a very high degree of scientific certainty is a keystone of this proposed architecture. Bioforensics reaches its full potential and impact when we design, build, and integrate several critical components. We must begin with a set of validated, highly informative, and discriminating approaches to characterizing microbial genotypes and perhaps phenotypes. Further development of the model occurs by drawing from what

already exists in the United States in forensics (human) DNA analysis, including through the national forensics DNA informatics system known as CODIS (Combined DNA Indexing System) and the well-described high-throughput or batch science laboratories proposed by Layne and Beugelsdijk (1998, 1999).

To meet anticipated demand, the subsystem for bioforensics would require automated microbial analysis systems that are fully validated for biomedical, forensics, and agricultural samples and purposes. Large computerized reference libraries would need to be created or interfaced that contain all of the pertinent data on all of the microbes of interest, including all isolates known and newly collected. This implies the need to accommodate a constant flow of samples into the system and a surge capacity in response to a bioevent or when an investigation is undertaken. Interconnectivity and interoperability between databases is a requirement. At the same time, full data security and integrity must be maintained. Needed would be informatics that permit full and rapid description and discrimination between microorganisms from known and questioned sources, using perhaps both phenotypic and genotypic data. Finally, statistical approaches would be required that quantify and communicate the power and confidence of the identification (or exclusion).

As noted, there is a corollary for this in forensics science (Kirby, 1993). Beginning in 1989 the FBI envisioned a DNA informatics system that embodies several of these features. CODIS was first deployed in 1992. Today, it is used in more than 110 forensics laboratories in the United States and increasingly in international forensics laboratories. CODIS permits law enforcement agencies to share key investigative information, such as DNA profiles, that can link and focus investigations and facilitate the rapid identification of perpetrators. Since its inception, CODIS has facilitated the solution of violent crimes, whether committed recently or years ago and whether they involved neighboring or widely separated jurisdictions.

One poignant example came to light in 1999. Approximately 9 years earlier a number of women were murdered in the Oklahoma City, Oklahoma, area. Bloodstain evidence in those cases was submitted to the Oklahoma Bureau of Investigation (OBI) Laboratory. The cases remained unsolved until, while reviewing this case, the OBI provided DNA profiles to be uploaded into various state CODIS databases. A “hit” (match) with a known offender profile was obtained from the California CODIS database almost immediately. Through this a suspect was identified, whose specific whereabouts were at that time unknown. The FBI was contacted and very quickly located the suspect and arrested him, all in a matter of days. Attribution, via biological evidence and forensics DNA technology, was key to providing direction to the investigators in resolving this matter.

Since its conception, CODIS has evolved significantly. Today, U.S. CODIS laboratories are connected through a high-speed telecommunications network, known as the CJISWAN, which is owned and operated by the FBI. By convention, CODIS accommodates standard sets of DNA loci (RFLP, STR, PCR, and mtDNA) and fundamentally contains two types of DNA information. All 50 states permit the collection, analysis, and submission to CODIS of DNA profiles from known samples from individuals convicted of violent felonies. (The FBI is awaiting passage of federal legislation to permit the collection, analysis, and uploading of federal convicted-offender samples.) Known convicted-offender samples are entered into CODIS as analyzed by state, local, or contract laboratories. These data, in fact, form a system of interconnected “libraries” against which samples of unknown origin are compared. Samples from unidentified sources, such as human remains or John Does can also be submitted in an attempt to identify the donors. CODIS is arranged in a hierarchy of local, state, and national layers and uses a protocol for access and use of the information. Legal requirements, such as privacy protections, have been incorporated and are meticulously enforced. CODIS laboratories are regularly audited from several perspectives. New search engines are being developed at present to accommodate faster response for rapidly expanding databases. The impact of bioforensics and beyond to other domains of WMD forensics can easily be envisioned.

A national forensics capability can be established in the near term, which would provide a powerful tool for the investigation and prosecution of the possession or use of biological weapons, whether through acts of terrorism, proliferation, or even war. Several key components and characteristics have been identified in this paper, with high-throughput laboratories prominent among them. The approach suggested here encourages convergence and integration of a number of different fields, expertise, technologies, and interests toward effectively dealing with a national prioritized threat. The relationship to infectious disease surveillance is also evident. A relatively small investment, perhaps in the range of a few tens of millions of dollars, could provide a capability with farreaching and even global implications.

This paper has concentrated on the role of forensics in attributing acts of bioterrorism or bioproliferation and has suggested that national capabilities could be enhanced considerably by establishing a laboratory network that includes advanced diagnostics, high-throughput robotics, and powerful informatics interconnected by a high-speed telecommunications backbone. This system would be supported by robust evidence manage-

ment processes and complemented by advanced traditional forensics that would permit full exploitation of any physical evidence associated with these acts. Finally, I present this question for your consideration: Would a powerful bioforensics capability also contribute to deterring the use of biological weapons?

Alibek, K., and S. Handelman. 1999. Biohazard. New York: Random House.

Anderson, J. H. 1998. Microbes and Mass Casualties: Defending America Against Bio-terrorism Washington, D.C.: The Heritage Foundation.

Bardi, J. 1999. Aftermath of a hypothetical smallpox disaster. Emerging Infectious Diseases (www.cdc.gov/NCIDOD/EID/vol5no4/bardi.htm).

Bartlett, J. G. 1999. Applying lessons learned from anthrax case history to other scenarios Emerging Infectious Diseases (www.cdc.gov/NCIDOD/EID/vol5no4/bartlett.htm).

Centers for Disease Control and Prevention. 1999. Preventing Emerging Infectious Diseases: A Strategy for the 21^st Century (www.cdc.gov/NCIDOD/emergplan/index.htm).

Clarke, R. A. 1999. Finding the right balance against bioterrorism. Emerging Infectious Diseases (www.cdc.gov/NCIDOD/EID/vol5no4/clarke.htm ).

Commission to Assess the Organization of the Federal Government to Combat the Proliferation of Weapons of Mass Destruction. 1999. Combating Proliferation of Weapons of Mass Destruction. Washington, D.C.: U.S. Government Printing Office.

Ember, L. 1996. Science center to handle terrorism at Olympics. Chemical and Engineering News, 74(29):11-12.

Falkenrath, R. A., R. D. Newman, and B. A. Thayer. 1998. America's Achilles' Heel: Nuclear, Biological and Chemical Terrorism and Covert Attack Belfer Center for Science and International Affairs, Harvard University, Cambridge, Mass.

Fox, J. 1998. Bioterrorism: Microbiology key to dealing with threats. American Society for Microbiology News, 64(5):255-257.

Franz, D. R. 1999. Defense against toxin weapons. The DTIC Review, 4(3):1-51.

Hamburg, M. A. 1999. Addressing bioterrorist threats: Where do we go from here? Emerging Infectious Diseases (www.cdc.gov/NCIDOD/EID/vol5no4/hamburg.htm).

Henderson, D. A. 1999. The looming threat of bioterrorism. Science, 283(5406):1279-1282.

Hughes, J. M. 1999. The emerging threat of bioterrorism. Emerging Infectious Diseases (www.cdc.gov/NCIDOD/EID/vol5no4/hughes.htm).

Inglesby, T. V. 1999. Anthrax: A possible case history. Emerging Infectious Diseases (www.cdc.gov/NCIDOD/EID/vol5no4/inglesby.htm).

Jenks, P. J. 1998. Sequencing microbial genomes: What will it do for microbiology? Journal of Medical Microbiology, 47:375-382.

Kaplan, D. 1998. Cult at the End of the World. New York: Random House.

Kirby, L. T. 1993. The Combined DNA Indexing System (CODIS): A theoretical model. In DNA Fingerprinting, A Practical Introduction. New York: W. H. Freeman.

Kortepeter, M. G., and G. W. Parker. 1999. Potential biological weapons threats. Emerging Infectious Diseases (www.cdc.gov/NCIDOD/EID/kortepeter.htm).

Layne, S. P., and T. J. Beugelsdijk. 1998. Mass customized testing and manufacturing via the Internet. Robotics and Computer-Integrated Manufacturing, 14:377-387.

Layne, S. P., and T. J. Beugelsdijk. 1999. Laboratory firepower for infectious disease research. Nature Biotechnology, 16:825-829.

MacKenzie, D. 1998. Bioarmegeddon. New Scientist, 42-46.

McDade, J. E. 1999. Addressing the potential threat of bioterrorism: Value added to an improved public health infrastructure. Emerging Infectious Diseases (www.cdc.gov/NCIDOD/EID/vol5no4/mcdade.htm).

O'Toole, T. 1999. Smallpox: An attack scenario. Emerging Infectious Diseases (www.cdc.gov/NCIDOD/EID/vol5no4/otoole.htm).

Pavlin, J. A. 1999. Epidemiology of bioterrorism. Emerging Infectious Diseases (www.cdc.gov/NCIDOD/EID/vol5no4/pavlin.htm).

Rimmington, A. 1999. Anti-Livestock and Anti-Crop Offensive Biological Warfare Programmes in Russia and the Newly Independent Republics. Report from the Centre for Russian and East European Studies, University of Birmingham, England.

Siegrist, D. W. 1999. The threat of biological attack: Why concern now? Emerging Infectious Diseases (www.cdc.gov/NCIDOD/EID/vol5no4/siegrist.htm).

Snyder, J. W. 1999. Responding to bioterrorism: The role of the microbiology laboratory American Society of Microbiology News, 65(8):524-525.

Stern, J. 1999. The prospect of domestic bioterrorism. Emerging Infectious Diseases (www.cdc.gov/NCIDOD/EID/vol5no4/stern.htm).

Tucker, J. B. 1999. Bioterrorism is the least of our worries. New York Times, October 16.