Disarmament Diplomacy

Issue No. 66, September 2002

Opinion & Analysis

Preventing Terrorist Access to Dangerous Pathogens: The Need for International Biosecurity Standards

By Jonathan B. Tucker

Introduction

In autumn 2001, letters containing a highly refined preparation of powdered anthrax spores were sent through the US mail, infecting more than 20 people - of whom five died - and forcing tens of thousands to take powerful antibiotics. The anthrax-tainted letters contaminated federal buildings and post offices, disrupted government operations, and provoked anxiety across the United States and around the world. Coming only weeks after the devastating terrorist attacks of September 11, the malicious use of a lethal biological agent increased the urgency of bolstering international efforts to halt and reverse the spread of biological weapons.

In November 2001, as US public health authorities were coping with the unanticipated ripple effects of the anthrax letter attacks, the Fifth Review Conference of the Biological Weapons Convention (BWC) convened in Geneva. Four months earlier, the United States had rejected a draft inspection protocol to the BWC that had been the result of more than six years of multilateral negotiations. In an effort to deflect international criticism over this move, the US delegation to the Review Conference proposed a package of nine "alternative" measures to strengthen the BWC, including domestic legislation, informal arrangements, and the investigation of alleged biological weapons use and suspicious disease outbreaks under the auspices of the UN Secretary-General. Several countries noted that the US-proposed steps were constructive but did not go far enough to strengthen the biological disarmament regime or to reduce the threat of bioterrorism.¹ This paper argues that the negotiation of a multilateral Biosecurity Convention would provide an effective and politically realistic means of addressing both urgent concerns.²

US Efforts to Control Access to Dangerous Pathogens

Although tight controls on fissile materials have existed from the start of the nuclear age, no comparable regime exists for dangerous biological materials, which have generally been handled as a matter of safety rather than security. One reason is that highly enriched uranium and plutonium have few if any civilian uses, whereas biological pathogens have numerous legitimate applications in scientific research and medical therapeutics. Another reason is that biological pathogens can be obtained from natural sources, such as soil or diseased animals, although doing so demands expertise in microbiology and a fair degree of luck.

Because natural pathogens vary widely in virulence, it can be difficult to isolate a highly lethal strain. This technical hurdle prevented the Japanese doomsday cult Aum Shinrikyo from perpetrating a large-scale bioterrorist attack in the early 1990s despite its intention to do so. Aum microbiologists unwittingly obtained strains of Bacillus anthracis and Clostridium botulinum - the causative agents of anthrax and botulism - that turned out to be "avirulent," or incapable of causing disease. Thus, although the cult successfully mass-produced the bacteria and released them in aerosol form in Tokyo on at least nine occasions, the attacks caused no known casualties.

Given the technical hurdles involved in obtaining virulent microorganisms from natural sources, it would be far easier for would-be bioterrorists to purchase or steal samples of dangerous pathogens from academic, industrial, or commercial labs. Because microbes reproduce rapidly in commercially available equipment such as a stainless-steel fermentation tank, a seed culture can be grown into a large amount of agent in a matter of days or weeks. Thus, even small vials containing dangerous pathogens pose a security risk.

Whereas the purpose of laboratory biosafety measures is to prevent the accidental release of dangerous pathogens, the aim of biosecurity measures is to prevent their deliberate theft or diversion for purposes of biological warfare or terrorism. The US government has already developed extensive guidelines for laboratory biosafety, which are published by the US Centers for Disease Control and Prevention (CDC) in a volume titled Biosafety in Microbiological and Biomedical Laboratories (BMBL). The BMBL, now in its fourth edition, is considered the "gold standard" for laboratory biosafety and has been periodically updated to keep up with technological developments. But comparable biosecurity guidelines for the physical protection, control, and accounting of dangerous pathogens do not yet exist.

In the United States, basic regulations on transfers of dangerous pathogens were introduced in 1997, pursuant to the Anti-Terrorism and Effective Death Penalty Act of 1996 (Public Law 104-132). Anyone shipping or receiving agents on a list of 36 microbial pathogens and toxins (poisonous chemicals made by living organisms), known as "select agents," must register with the CDC and declare a legitimate scientific or medical use for the material; violations are punishable by prison terms and fines of up to $500,000. The 1997 regulations contained a major loophole, however, in that laboratories that simply possess or work with cultures of dangerous pathogens, but do not transfer them, were not required to register.³ Moreover, enforcement of the select agent rules has been minimal: only eight CDC officials have been involved in monitoring transfers and much of the reporting has been done by fax, with little effort at confirmation or verification.

In the aftermath of the autumn 2001 anthrax letter attacks, Congress passed new laws designed to close the loophole in the 1996 law by covering the possession as well as transfer of select agents. The Public Health Security and Bioterrorism Preparedness and Response Act of 2002, signed into law by President George W. Bush on June 12, requires all laboratories that possess, work with, or transfer select agents to register with the CDC within 90 days - that is, by September 10, 2002.⁴ In addition, the Agricultural Bioterrorism Protection Act of 2002 empowers the US Department of Agriculture (USDA) to regulate biological agents and toxins that pose a severe threat to animal and plant health, and requires persons who possess such agents to register with the USDA by October 8, 2002.⁵ The creation of a comprehensive US registry of laboratories that possess select agents will make it easier to prevent the diversion of dangerous pathogens for illicit purposes and to trace the source of agents used in bioterrorist attacks. It has been estimated that tens of thousands of government, academic, and commercial facilities in the United States will be affected by the strengthened regulations.

Pursuant to the new US laws, an Interagency Working Group on Select Agents, chaired by the White House Office of Science and Technology Policy and including representatives from the Departments of Health and Human Services, Defense, Energy, Agriculture, and the intelligence community, is writing new regulations on the possession and transfer of select agents. After these rules have been promulgated, federal laboratories will have 60 days to come into full compliance, although university and commercial labs may take somewhat longer. Given the large number of facilities that will be captured by the select agents list, it seems likely that the deadlines will slip.

The International Dimension

Ee Even as the United States strives to put its own house in order by developing strengthened biosecurity regulations, the international dimension of the problem remains to be addressed. Thousands of companies and laboratories around the world possess or work with dangerous pathogens, yet guidelines for protecting and limiting access to these agents vary from country to country. Because few culture collections are adequately secured and regulated, many are vulnerable to theft or diversion by proliferant states and terrorists. An international association of germ banks, the World Federation for Culture Collections, has urged its members to establish tighter rules on access to dangerous microbes, but it lacks the authority to force compliance. Moreover, less than a third of the more than 1,500 germ banks worldwide belong to the federation.⁶

Trade in microbial cultures for research and commercial purposes is also poorly regulated, both within countries and among them. Dangerous pathogens are shipped around the world in an insecure manner, and the existing export control regime is far from universal. The United States and 32 other countries participate in an informal forum called the Australia Group, which "harmonises" national controls on exports of dangerous pathogens (and dual-use biotechnology equipment) to countries assessed to be seeking biological weapons.⁷ Nevertheless, would-be proliferators have employed numerous strategies to circumvent the Australia Group, including transshipment points, shell companies, and the purchase of controlled agents from non-member states.

At the 2001 BWC Review Conference, the United States proposed that each state party to the treaty pass domestic legislation to control access to dangerous pathogens. In the absence of agreed international biosecurity standards, however, this approach would result in an uneven patchwork of national laws, creating areas of lax regulation and enforcement that could be exploited by proliferators and terrorists. Because US pharmaceutical and biotechnology companies that work with select agents already face strengthened domestic regulations, they would benefit from a level regulatory playing-field vis-à-vis competitors in Europe and Japan. Moreover, uniform biosecurity standards would facilitate US collaborative research with allied governments on the development of new vaccines and drugs for defensive purposes, as well as commercial joint ventures involving select agents. Both of these areas are likely to expand significantly as government biodefence programs receive a major infusion of funds. Reportedly, US-Russian collaborative research on defences against anthrax and smallpox has been blocked by incompatible national regulations on the export of dangerous pathogens.⁸

The Need for a Biosecurity Convention

The negotiation of a Biosecurity Convention imposing uniform international standards for the physical protection, control, and accounting of dangerous pathogens and toxins would put significant obstacles in the path of would-be bioterrorists and proliferators. The central aim of the Convention would be to prevent the diversion of biological agents for warfare and terrorism, while permitting their use for legitimate scientific, therapeutic, and defensive purposes. By focusing exclusively on measures for biosecurity rather than laboratory biosafety, the Biosecurity Convention would avoid conflicts with existing treaties such as the Cartagena Protocol to the Convention on Biodiversity, which includes biosafety rules for genetically modified organisms.

The Biosecurity Convention would enable the participating states to reduce the risk that dangerous pathogens and toxins could fall into the hands of proliferators and terrorists, creating a new regulatory norm that is widely recognised as the price of working with dual-use biological materials in the post-September 11 era. Such a control regime should, at a minimum, cover all states engaged in "germ commerce," including developing countries such as China, India, and Iran. Biosecurity standards developed exclusively by the Western industrialised states that belong to the Organisation for Economic Cooperation and Development (OECD) would not be effective unless they were adopted more broadly.

The Biosecurity Convention would also serve to support and complement the basic prohibitions in the BWC. In contrast to proposals for investigating allegations of biological warfare, the Convention would help to prevent the proliferation of biological weapons at the beginning of the acquisition cycle rather than at its conclusion. Moreover, all governments presumably have an interest in preventing terrorists from acquiring these weapons and in making it easier to trace the source of pathogens and toxins employed in bioterrorist attacks. The limited number of agents subject to regulation should not impose major constraints on legitimate scientific research and drug development, although academic researchers will have to bear additional costs.

Structure of the Convention

The Biosecurity Convention could be modelled after the Nuclear Safety Convention, which was adopted in Vienna on June 17, 1994. This treaty obligates the member states to apply basic safety guidelines to the location, design, construction, and operation of civilian nuclear power plants, including radiation protection, quality assurance, and emergency preparedness. To implement the international benchmarks, each state party must establish a nuclear regulatory agency that is effectively separate from the regulated industry and from government organisations that promote nuclear power.

The Nuclear Safety Convention is an "incentive instrument" in that it does not enforce compliance through formal verification mechanisms, such as on-site inspections, but rather through the common interest of the parties in achieving higher levels of nuclear plant safety. Member states are required to submit periodic reports on the steps they are taking to implement the safety guidelines. At regularly scheduled "review meetings" of the parties, each member has an opportunity to discuss its own actions and to seek clarification of the reports submitted by others. Political pressure, and the need for governments to appear responsible, create incentives for countries to participate and to comply with the agreed nuclear safety standards.

Like the Nuclear Safety Convention, the Biosecurity Convention would mandate the application of multilaterally agreed principles and guidelines, which would be implemented by each member state through national legislation. The treaty would consist of three basic elements: (1) a legal commitment by the contracting parties; (2) a set of universal standards for the physical protection, control, licensing, and reporting of dangerous pathogens and toxins; and (3) mechanisms for the oversight of national implementation through periodic meetings of the parties, and for modifying the list of controlled agents and the biosecurity standards in response to advances in biological science and technology. More specifically, the Convention would:

• Require member countries to specify a "core list" of microbial and toxin agents of concern for biological warfare and terrorism, to which the biosecurity standards would apply. The US Select Agents List would provide a good model, although the core list would need to be easily amended to add or delete pathogens as warranted. If the core list expands significantly, it may be necessary to define different categories of agents according to the level of security threat they pose. Those agents most likely to be targeted for terrorist diversion and use because of their infectivity, virulence, and ease of production and delivery would require higher levels of physical protection and access control. Beyond the core list, individual countries would be free to include additional microbial and toxin agents in their national regulations.
• Establish uniform international guidelines for registering and licensing laboratories that possess, work with, or transfer listed pathogens and toxins, as well as genetically modified strains and engineered microorganisms containing virulence factors and toxin genes derived from the listed agents. Possession of controlled pathogens or toxins by an unlicensed individual or facility, or their transfer to an unlicensed individual or facility, would be prohibited. Although member states would be required to submit progress reports on their efforts to implement the agreed guidelines, they would be allowed to keep the lists of registered facilities confidential.
• Establish uniform international standards for the physical protection, control, accounting, and transportation security of listed pathogens and toxins, along with personnel vetting procedures to ensure the reliability of scientists granted access to these agents. In developing protective measures, it will be essential to address both insider and outsider diversion threats by not relying exclusively on fences or other forms of perimeter security. Instead, the primary emphasis should be on policies, procedures, and protocols for the control and accounting of listed agents, whether they are under industry, government, or commercial auspices. To avoid interfering with medical diagnosis and treatment, clinical specimens containing listed pathogens should be exempt from the reporting requirements. Here again, the national biosecurity measures developed by the United States under the new bioterrorism legislation could provide a useful model for the internationally negotiated standards.
• Require each member state to establish export and import controls over listed pathogens and toxins transferred across national borders, and to create a national regulatory body (if one does not already exist) to implement this system.
• Establish cooperative procedures to assist technologically less advanced member states in implementing the biosecurity measures mandated by the Convention.
• Require member states to be in compliance with the agreed biosecurity standards as soon as possible, but no later than a specified period of months (or years) after the treaty's entry into force.
• Call for the convening of regular review meetings at which the member states are required to report on the development and implementation of their national regulatory systems and to answer questions from other parties. Although the Biosecurity Convention would not include formal mechanisms for verifying or enforcing compliance, states assessed to be non-compliant on the basis of national intelligence could be subjected to probing questions and political pressure during review meetings.
• Create a small International Secretariat to organise the review meetings and perform administrative duties, but without serving a verification function.

Numerous technical details of the Biosecurity Convention remain to be clarified. For example, how fine-grained should each national registry be? Should laboratories that possess listed agents be required to report them at the level of strains, sub-strains, or unique identifiers (e.g., DNA markers) to permit forensic analysis and tracing? Moreover, should custom-made fragments of DNA (oligonucleotides) that could be assembled into dangerous viruses also be regulated? This issue arose recently after US scientists announced that they had synthesized infectious poliovirus in the test tube from its published DNA sequence by assembling a series of oligonucleotides that had been ordered from a commercial biotechnology firm.⁹ A few weeks later, reporters from the London Sunday Times ordered several of the DNA strands that would be needed to make the highly lethal Ebola virus from a British biotech company, with no questions asked.¹⁰

Next Steps

When the Fifth Review Conference of the BWC reconvenes in November 2002, it might consider requesting the World Health Organisation or the UN Department of Disarmament Affairs to convene a Technical Working Group on Biosecurity Standards. This expert body would be similar to the Ad Hoc Group of Governmental [Verification] Experts (VEREX), which met four times in 1992-93 to assess the scientific and technical feasibility of verifying the BWC.¹¹ In addition to government scientists, the Technical Working Group might include representatives or observers from the national academies of science and medicine of participating states, the International Union of Microbiological Societies, the International Federation of Pharmaceutical Manufacturers Associations, and the International Standards Organisation. Based on the final report of the Technical Working Group, the participating governments could establish a political body to begin formal negotiations.

The Biosecurity Convention would be a relatively simple document because it would lack on-site verification provisions and avoid politically contentious topics such as export controls on dual-use equipment or technology transfer among the parties. For this reason, it should be possible to negotiate the Biosecurity Convention far more quickly than a highly complex treaty such as the Chemical Weapons Convention, whose detailed verification mechanisms required some two decades to work out. Indeed, the Nuclear Safety Convention took only three years to negotiate and drew heavily on a 'strawman' text submitted by the United States. The negotiating process began in September 1991, when the General Conference of the International Atomic Energy Agency adopted a resolution directing the IAEA to develop an international treaty on nuclear safety. The agency held seven expert group meetings, which produced a draft text by February 1994. In June of that year, the IAEA convened a diplomatic conference that was attended by representatives of more than 80 countries. This conference approved the final text of the Nuclear Safety Convention, which was opened for signature on September 20, 1994.¹²

What should be the formula for the entry into force of the Biosecurity Convention? Although the rapid establishment of international biosecurity standards would be highly desirable, it is also important to encourage broad adherence. Here again, the case of the Nuclear Safety Convention is instructive. To enter into force, that treaty had to be ratified or approved by 22 states, of which at least 17 possessed at least one nuclear reactor that had achieved criticality, or roughly half of the 32 states that had developed civilian nuclear power at the time.¹³ Along similar lines, the Biosecurity Convention might enter into force after it has been signed and ratified by half or two-thirds of states that possess culture collections containing listed agents. Although the Convention would not have to be universal to be useful, the greater the number of states parties, the more effective it would become.

In conclusion, the Biosecurity Convention would not be a traditional arms control treaty but would focus instead on preventing the theft or diversion of dangerous pathogens and toxins for warfare and terrorism, while permitting their use for human benefit. In so doing, the Convention would serve to augment and reinforce the core principles of the BWC, which have been seriously weakened by unpunished non-compliance and the recent collapse of multilateral efforts to strengthen the treaty.

Notes and References

1. Jonathan B. Tucker and Raymond A. Zilinskas, "Assessing US Proposals to Strengthen the Biological Weapons Convention," Arms Control Today, vol. 32, no. 3 (April 2002), pp. 10-14.

2. This article further refines the Biosecurity Convention idea developed by my colleagues Michael Barletta, Amy Sands, and myself at the Monterey Institute's Center for Nonproliferation Studies. For the original proposal, see Michael Barletta, Amy Sands, and Jonathan B. Tucker, "Keeping Track of Anthrax: The Case for a Biosecurity Convention," Bulletin of the Atomic Scientists, May/June 2002, pp. 57-62.

3. Joby Warrick and Steve Fainaru, "Access to Microbes is Easily Obtained: Federal Oversight of Laboratories Lax," Washington Post, October 28, 2001, p. A1.

4. US Department of Health and Human Services, Centers for Disease Control and Prevention, "Notice of OMB Approval of Data Collection," Federal Register, vol. 67, no. 151, August 6, 2002, p. 51058.

5. US Department of Agriculture, Animal and Plant Health Inspection Service, "Agricultural Bioterrorism Protection Act of 2002; Listing of Biological Agents and Toxins and Requirements and Procedures for Notification of Possession," Federal Register, vol. 67, no. 155, August 12, 2002, pp. 52383-52389.

6. William J. Broad, "World's Largest Germ-Bank Union Acts to Keep Terrorists From Stealing Deadly Stocks," New York Times, October 23, 2001, p. B9.

7. For information on the Australia Group, see http://www.australiagroup.net.

8. Peter Eisler, "US, Russia Tussle Over Deadly Anthrax Sample," USA Today, August 19, 2002, pp. 1-2.

9. J. Cello, A. V. Paul, and E. Wimmer, "Chemical Synthesis of Poliovirus cDNA: Generation of Infectious Virus in the Absence of Natural Template," Science, vol. 297, no. 5581 (August 9, 2002), pp. 1016-1018.

10. Gareth Walsh and Tom Robbins, "Deadly Ebola Virus 'Kit' for Sale Over Internet," London Sunday Times, August 4, 2002.

11. Ad Hoc Group of Governmental Experts to Identify and Examine Potential Verification Measures From a Scientific and Technical Standpoint, Report, BWC/CONF.III/VEREX/9, Geneva, September 24, 1993.

12. Carl E. Behrens and Warren H. Donnelly, "The Convention on Nuclear Safety-A Fact Sheet," CRS Report for Congress, Congressional Research Service, Report No. 96-434 ENR, May 16, 1996.

13. Ibid.

Dr. Jonathan B. Tucker is Director of the Chemical & Biological Weapons Nonproliferation Program at the Center for Nonproliferation Studies, Monterey Institute of International Studies, USA. He is currently on leave from the Center as a 2002-03 Senior Fellow at the United States Institute of Peace in Washington, D.C.

Back to the Top of the Page

© 2002 The Acronym Institute.