How to fix biosecurity?

High-security labs that deal with the deadliest pathogens - biosafety level (BSL) 4 facilities - are boosting their security in light of recent mishaps, but experts say those changes, while welcome, aren't nearly enough. What's more, safety experts disagree on the best solutions for making labs more secure. BSL4 labs are "an almost infinitesimally small" part of the problem of potential safety and security mishaps, linkurl:Richard Ebright,;http://rutchem.rutgers.edu/content_dynamic/faculty/richard_h_ebright.shtml a microbiologist and biosecurity expert at Rutgers University, told The Scientist. The much larger problem, he said, lies in some 400 labs one safety level down, staffed by about 15,000 people across the country. "Most persons who have access to these agents [eg anthrax] are at BSL3 labs," he said, and current security requirements at BSL3 labs are not sufficient. The Centers for Disease Control and Prevention (CDC) and the US Department of Agriculture (USDA), which jointly regulate research on the group of highly infectious pathogens referred to as linkurl:"select agents,";http://www.selectagents.gov/ do not have specific requirements for either BSL3 or BSL4 facilities, beyond the fact that access to those pathogens be restricted and the stock be well-accounted for. Instead, institutions must write out detailed security plans, which are then approved by one of the agencies (CDC for human disease work, and USDA for animal disease work). "The sole specific requirement for physical security is a requirement that there be a lock on the door to the laboratory," wrote Ebright in an Email. It's been a rocky few months for high-security pathogen research -- from this summer's linkurl:suicide;http://www.the-scientist.com/blog/display/54907/ of Bruce Ivins, the government's prime suspect in the 2001 anthrax mailings, to last month's Government Accountability Office(GAO) report highlighting linkurl:glaring security gaps;http://www.the-scientist.com/blog/display/55093/ at two of the country's five highest-security labs. To assuage security concerns, Boston University, which is constructing a controversial BSL4 facility, last month revealed its planned linkurl:security measures.;http://www.the-scientist.com/blog/display/55087/ In addition to background checks and psychological testing, the facility will include "physical measures, including but not limited to, the two-person rule [which requires working in pairs], video surveillance [of work spaces], audit system, iris scans, etc.," Ellen Berlin, a spokesperson at the facility, wrote in an Email to The Scientist. Had just two of those factors -- workspace video surveillance and a two-person rule -- been in place in 2001 at labs such as the BSL3 facility in which Ivins worked, "in all likelihood the anthrax mailings would not have occurred," Ebright said. Having labs design their own security plans isn't working, he added. "There's only one source for effective regulation, and that will be federal legislation." The CDC has no plans to increase security requirements for select agents, according to Von Roebuck, a spokesman for the agency. And not everyone agrees that rules imposed from above would help. "We have so many monitoring systems in place," said linkurl:Joan Nichols,;http://microbiology.utmb.edu/faculty/nichols.shtml who is in charge of biocontainment policies at the Galveston National Laboratory, a University of Texas Medical Branch facility, one of five institutions in the US with a BSL4 lab. "A level above that I don't think" will add oversight. The Boston lab is one of an additional handful of BSL4 labs being built around the country. Two of the five BSL4 labs running now are operated by the US Army, which this summer finalized its linkurl:safety and security regulations;http://www.army.mil/usapa/epubs/pdf/r50_1.pdf relating to select agents and has appointed a special taskforce to conduct further long-term review of safety and security in its labs, according to Caree Vander Linden, a spokesperson at USAMRIID, the Fort Detrick, Md., facility in which Ivins worked. Two other existing BSL4 labs -- Southwest Foundation for Biomedical Research in San Antonio, Texas, and Georgia State University in Atlanta, Georgia -- scored poorly in the GAO's recent assessment. The results of the GAO report were not as clear-cut as they may seem, however, linkurl:Gigi Kwik Gronvall;http://www.upmc-biosecurity.org/website/center/staff/gronvall.html of the Center for Biosecurity at the University of Pittsburgh Medical Center, told The Scientist. "The GAO came up with this list of criteria and measured labs against it," she said. "And there's no analysis saying that those are the security characteristics a lab should have -- that's kind of a problem." In the long-term, the Galveston National Laboratory is evaluating different ways that other professions, such as pilots and astronauts, assess their work force, and determining how to integrate such metrics into their own scheme, said Nichols. Galveston also relies on camera surveillance tracking all comings and goings, and in some workspaces. Nichols said she believed that a rule requiring that scientists work in pairs "causes more problems than it answers" because of the potential to create pressure on researchers to rush their work. Galveston's newly built BSL4 facility is set to open on November 11. BSL3 labs also vary in the security measures they employ. For example, the Southern Research Institute (SRI), a not-for-profit contract research organization with a BSL3 lab in Frederick, Md (staffed by about 30 people) and one in Birmingham, Ala (staffed by about 80), employs around-the-clock security guards, cameras in workspaces, a two-person rule, and other measures, according to linkurl:Debra Sharpe,;http://www.bslsolutions.com/about.html director of compliance and security at SRI. Those requirements stem from a linkurl:2004 snafu;http://www.sfgate.com/cgi-bin/article.cgi?file=/c/a/2004/06/11/ANTHRAX.TMP in which SRI accidentally shipped live anthrax virus to a lab at Children's Hospital Oakland Research Institute in California. "At that time, we did not have much institutional control" over security, said Sharpe. "We temporarily suspended our work and really evaluated what we were doing." In March, Sharpe also became the president of a spin-out company, Biosafety Solutions, which consults with labs about biosafety and security issues. Facilities are taking security issues increasingly more seriously, she said, "but probably not at the level that we have." In part, many facilities simply can't afford major security overhauls. "The [cost of] initial construction doesn't even hold a candle to the ongoing operation and maintenance of these facilities," she said, adding that this money doesn't come from the NIH, and there's no other source of federal funds for facilities maintenance. "I've heard a lot of people talk about security measures that one could put in place, but these things are not without cost," agreed Gronvall. That cost is not just monetary, she added; increased surveillance is likely to have a negative effect on recruiting the best scientists, so before instituting such measures, it's crucial to make sure they work. "If you could work somewhere else, why would you work where you're under a microscope?" Indeed, Sharpe noted, at academic labs, "there is a lot of scientific pushback" from researchers who don't want the red tape and surveillance interfering with their work. Still, both Sharpe and Ebright noted that video surveillance throughout a facility, including work spaces, is relatively cheap to install and can go a long way. Few BSL3 labs have such a feature, according to Ebright. But it's unlikely that any amount of security controls will ever completely override the danger. "The reality is, if somebody wanted to get a select agent out of a BSL3 laboratory, they could do that," said Sharpe.Editor's note (November 5): This post has been updated from a previous version.

How to fix biosecurity?

Interested in reading more?

Become a Member of