How secure are labs handling world's deadliest pathogens?

To reach his office in Galveston National Laboratory, where scientists study deadly pathogens such as the Ebola and Marburg viruses, director James Le Duc swipes his key card at the building's single entrance, which is guarded 24/7 by Texas state police.

As he walks the hallways, more than 100 closed-circuit cameras watch him. Seven more locked doors stand between him and his destination. Entering a research lab requires another card swipe and, for labs housing especially dangerous microbes, a fingerprint scan.

To keep deadly viruses from escaping, each lab uses negative air flow and dedicated exhaust systems. Workers wear full-body air-supplied suits. To test its security, Galveston ran an exercise with the Federal Bureau of Investigation simulating a would-be intruder and another, with the University of Texas, war-gaming a campus shooter. The facility passed both tests.

Galveston's strict security underlines a little-known fact about hundreds of labs working with bacteria and viruses that could make the 1918-19 Spanish flu epidemic - when as many as 40 million people died - seem like a summer cold. Many of the precautions it takes are not required by law.

"A lock on the door is the only specified requirement," said Rutgers University virologist Richard Ebright. "There is no explicit requirement for guards, bio-identity checks, or video monitoring like 7-Elevens have. The rules require very strict paperwork but no real physical security."

Labs whose experiments on dangerous pathogens are funded by the US government must follow specific rules to keep the microbes from escaping, but those rules are not enforceable for researchers working with private funds. Outside the country, security and safety requirements vary widely, experts say.

"It's all subject to interpretation," said a scientist close to the US National Science Advisory Board for Biosecurity, which monitors research that might pose a bioterrorism threat.

If a lab receiving US government funding violates the guidelines, the Centers for Disease Control and Prevention can cut off the flow of money, "but it can't shut you down," the scientist said. "I don't have a lot of confidence in our biosafety right now."

Immediate concern over bird flu research

Questions about biosafety - keeping dangerous microbes from escaping labs - and biosecurity - keeping out bad actors intent on releasing or stealing the pathogens - are front and center for global health officials due to a growing controversy over experiments with the bird flu virus.

Scientists and government officials will meet on Thursday and Friday at the World Health Organization in Geneva to hash out the safest way to deal with the studies and address fears that lab-engineered viruses could either escape or be used as a bioterror weapon.

Last year, labs at the University of Wisconsin, Madison, and Erasmus MC in Rotterdam independently created mutant forms of avian influenza, known as H5N1, that can be transmitted directly among mammals. The natural strain can be caught only through close contact with infected birds.

One immediate question is what level of safety should be required for that research. So far, it has been conducted at biosafety-level 3 labs. Under US guidelines, BSL-3 applies to agents that cause "serious or lethal disease" but do not ordinarily spread between people and for which treatments or preventives exist. BSL-4 applies to agents with no preventives or treatment.

The Wisconsin and Erasmus scientists received approval to conduct their experiments under BSL-3 conditions because, they argued, antiviral drugs can treat avian flu. Erasmus was subject to US guidelines because its experiments were funded by the National Institutes of Health.

"The viruses generated here are sensitive to influenza antivirals" so they fit the BSL-3 criteria, said Rebecca Moritz of the University of Wisconsin's Office of Biological Safety. There are "multiple physical barriers and the facilities are monitored at all times."

All lab workers there wear disposable jumpsuits and powered respirators in addition to scrubs, shoes, shoe covers, and double gloves, she said. Each time scientists leave the lab, they must remove their protective equipment and shower before putting on their street clothes. Erasmus does the same.

The labs said they have emergency and security plans for a wide variety of threats. Neither would provide specifics on those security measures on the grounds the details could aid any would-be attackers.

Such precautions are not foolproof, however. According to a 2009 report by the Government Accountability Office, there were 400 accidents at BSL-3 labs in the United States in the previous decade.

Some scientists therefore argue that the experiments creating contagious H5N1 mutants should be done only at BSL-4 facilities.

"An escape would still produce the worst pandemic in history," said Michael Osterholm of the University of Minnesota and a member of the NSABB, at a symposium at the New York Academy of Sciences this month.

"The risk of this agent, if in fact it can be readily transmitted between humans, is catastrophic," he told Reuters. "Until we know how this virus actually acts in humans, I think you have no choice but to move this (research) to BSL-4."

Spacesuits

BSL-4 labs, like the one in Galveston, have all the BSL-3 precautions and are also in isolated facilities with dedicated exhaust, vacuum, and other systems to prevent escape. In addition, workers must wear what are essentially space suits.

But the BSL guidelines relate to biosafety, not security.

The debate over H5N1 experiments has also raised the question of how secure BSL-3 and BSL-4 labs are. It has assumed a greater urgency as the number of known US BSL-3 labs has surged from 415 in 2004 to 1,495 in 2010.

Hundreds or thousands of BSL-3 laboratories may be unknown, however, because "no federal agency is required to track the number of biocontainment labs," found a 2011 report by the National Research Council, an arm of the US National Academy of Sciences.

Globally, BSL-3 labs have recently been built or are under construction in Bangladesh, India, Indonesia, China, Brazil, and Mexico, among others, the NRC found. Yet "many countries have few or no regulations," the NRC concluded.

BSL-4 labs are also proliferating. A 2011 workshop in Istanbul organized by the NRC was told that there are 24 BSL-4 facilities, including in Germany, Gabon, Sweden, Russia, South Africa and Canada. The United States has six, including Le Duc's, which is part of the University of Texas Medical Branch.

"We are now in a proliferation race for BSL-3 and 4 labs," said Laurie Garrett, the senior fellow for global health at the Council on Foreign Relations in New York. "Having such a facility is a mark of national sophistication. But the spread of these labs allows the unfettered proliferation of the world's most dangerous microbes."

Indeed, deadly microbes have escaped high-security labs. Between 1978 and 1999, just over 1,200 people acquired infections from BSL-4 labs around the world; 22 were fatal. Since then, lab workers have been killed by Ebola and SARS, or severe acquired respiratory syndrome. Thieves tried to steal animal pathogens from an Indonesian lab in 2007, the NRC workshop was told.

Guidelines, not law

US research on dangerous human pathogens must follow safety guidelines set by the CDC. They may or may not be followed at labs elsewhere in the world, concluded the NRC workshop.

In part, that is because BSL-3 and BSL-4 designations "have very wide interpretations," said Ren Salerno, senior manager for cooperative threat reduction programs at Sandia National Laboratories, part of the US Department of Energy.

Although US government-funded research must adhere to biosafety guidelines, they "do not have the force of law," said Ebright. "If you're a private lab, privately funded, there is no requirement that you comply." The CDC declined to make a spokesperson available to discuss biosafety and biosecurity.

Many labs in developing countries say they adhere to guidelines as tough as those applied to US facilities. If they receive US funding, lab personnel must pass an FBI security risk assessment, for instance.

In Thailand, police check the background of all staff members and require fingerprints to access freezers containing microbes.

A BSL-4 lab in Australia employs a security staff of 10. It is housed in a fenced, isolated building and has infrared cameras to detect intruders. Gabon's BSL-4 lab is surrounded by electric fences and has a guard on duty at all times. Only three people know the code to the freezer holding Ebola.

US biosecurity requirements are laid out in the 2001 Patriot Act, which says that facilities storing "select agents" - microbes and toxins that could be used as bioweapons - must develop and implement a plan to keep them secure. Such labs must also provide the government the names of everyone with access to the pathogens; none can be on a terrorism watch list.

Experts dismiss Hollywood's nightmare scenarios such as bombing a BSL-4 lab or crashing a 737 jumbo jet into one.

"The one nice thing about pathogens is that they'll self-destruct under intense heat," said Salerno.

What Salerno does give credence to is either an accidental escape or a plot to steal a pathogen by lab employees acting on their own or under duress.

"As more of this kind of research occurs, and it will, especially internationally, the risks of both accidental release or potential theft and misuse will increase as well," Salerno said. "The science is way ahead of governments' ability to regulate the science."