Bioterrorism: Investigation & Prosecution - Anthrax 2001 and Beyond

1. Bioterrorism: Investigation & Prosecution -Anthrax 2001 and Beyond Randall S. Murch, Ph.D. Center for Technology, Security and Policy Virginia Polytechnic Institute & State University (Virginia Tech) National Capital Region, Alexandria, VA, USA & Department of War Studies, King’s College London, UK

2. Key Investigative & Prosecutive Questions • Did A Crime (Event of Interest) Occur? • What Happened? • How Did It Occur? • When Did It Occur? • Where Did It Occur? • Why Did It Occur? • Who Was Involved? • What Evidence Exists? What Does It Tell Us? How Strong are the Links? • How Reliable and Credible is the Evidence? • What Alternative Explanations are There for the Evidence? Similar Questions for Intelligence and Policy as Well?

3. “Amerithrax” • Anthrax laden letters mailed 17 – 18 Sept (5 media sites) and 6 – 9 Oct 2001 (US Capitol), both mailings originating from Princeton, NJ • 5 dead inhalational, up to 17 infected– inhalational, cutaneous; Florida, Washington, DC area, New York City/Connecticut • Investigation launched immediately with 1st victim (FL media), closed August 2008 with purported identification of suspect (Ivins, USAMRIID) • 7-year investigation; estimated $1B direct/indirect measurable costs; terror/fear/uncertainty; massive investments in new biosecurity R&D, system deployment/O&M and preparedness programs; misidentification of suspects (lawsuit, settlement), suspected foreign group/country involvement; endless commentary and speculation from many quarters on various aspects (continues); realization of many vulnerabilities and shortfalls (many remain) Confirmation that “a little can go a long way (make a big mess)…”

4. Elements of the Crimes • Was a Crime Committed? • Microbe used as a weapon with delivery system, could not have originated from natural contamination or accident • Resulted in death and illness • Damage to and misuse of Government-owned property and infrastructure • ……. • Violations of Federal law (Indictment, Prosecution) • Terrorism • Misuse of biological agents (Biological Weapons Antiterrorism statute) • Homicide and attempted homicide • “Property” and “misuse” elements • Interstate elements • ………..(here’s where the prosecutors would have “piled on”)

5. Course of the Investigation • Numerous Avenues Pursued • Traditional Investigation, Positive/Negative • Intelligence and Foreign, Positive/Negative • Scientific/Forensic • Numerous Twists, Turns, Dead Ends; External Speculation, Distractions and Stimuli • Science (Ostensibly) Provides Vital Link and Aids in Narrowing Possible Suspects and Sources of “Microbe of Interest”: Q samples (at least two batches)—letters, victims, mailbox, sites to Dugway and USAMRIID • Investigation Focuses on Limited Number of Possible Suspects (Process of Elimination/Inclusion) Ivins

6. Standards of Proof in US System • No Cause or Suspicion • Reasonable Suspicion (Events/Circumstances, Contacts, Interviews/Interrogation, Non-Intrusive Methods—No Expectation of Privacy) • Probable Cause (Arrest and Search Warrants, Orders) • Beyond A Reasonable Doubt (Trial, Conviction: What Does a Reasonable Juror Believe?) • Investigation is a Process Which Seeks, Gathers, Develops, Analyzes, • Weights and “Packages” Positive and Negative Information and Evidence • To Exonerate the Innocent and Prosecute and Convict the Guilty • Evidence is Additive and Subtractive, Reinforcing and Conflicting; • Analytical and Interpretative Process is Primarily Not Quantitative, • Rather Qualitative and Relies on Human Judgment

7. What We Think We Know (1)From affidavit in support of a search warrant for Ivins’ house, three vehicles and a safe deposit box • At time of attacks, Ivins was custodian of highly purified anthrax that is genetically “identical” to the anthrax analyzed from the attacks (sole custodian of stock culture since 1997 when originated; free access to suite at USAMRIID where stock culture kept) • No satisfactory explanation provided for Ivins’ late night laboratory access contemporaneous with the attacks • Ivins claimed that he was suffering from serious mental health issues in the months preceding the attacks (to co-worker: “incredible paranoid, delusional thoughts at times”) • Ivins believed to submit false samples of anthrax for forensic analysis to mislead investigators • At time of attacks, Ivins was under pressure to assist company which produced anthrax vaccine and had lost FDA approval; believed vaccine essential for force protection • Ivins sent email contemporaneous with attacks with language similar to mailed letters containing anthrax • Ivins and wife reportedly had issues with Sens. Leahy and Daschle; Ivins had obsession with sorority, sorority office in Princeton near mailbox used for mailings

8. What We Think We Know (2)Scientific Evidence Publicly Briefed & From Affidavit • Spores were produced between 1999 – 2001 • Two different batches produced • No substances were added to make them more dispersable • Silicon and oxygen were present in the spore coat, not on the exterior; silicon “signature” not previously described for B. anthracis • Wild-type B. anthracis Ames, with significant numbers of phenotypic variants (substrains); • “Unique” phenotypic variants could be detected by 4 indel polymorphisms • Of 1070 in known Ames cultures (16 U.S. labs, Canada, Sweden, U.K.), 8 contained all four polymorphisms, none had three out of four, few contained one or two; of 8 that contained all four, all of the 8 with all four polymorphisms were directly related to a single Ames culture (RMR-1029) • Presence of B.subtilis as contaminant in one set of letters but not the other, suggesting two separate culturing events; genetic analysis of B. subtilis demonstrated dissimilarities with other known cultures; • RMR-1029 indicated as source for B. anthracis in all Q samples (inferred but not stated directly) • Source of envelopes used in mailings narrowed to certain distribution sources and Virginia and Maryland; proximity between source of envelopes and source of anthrax • Other • “Spores were produced in northeast U.S.” • Trace evidence, tape and ink available for comparison (letters, mailbox)

9. What We Don’t Know or Have: Examples • “Smoking gun” (not likely ever will, no eyewitnesses nor Ivins caught in the act) • Specific whereabouts of Ivins during key events related to attacks • Interviews of all co-workers, associates, supervisors, laboratory management • Interviews and investigation of all others at USAMRIID who had access to RMR-1029 stock culture and proximate laboratory facilities • Investigation and interviews of those knowledgeable about and in possession of laboratory access schedules, security procedures, documentation • Details of investigation conducted in community (neighborhood, church, etc) (some reported in media) • Surveillance logs • Cooperating witness interviews Documents Likely Forthcoming, Currently Under Review by FBI and DOJ

10. The Media and Politics • Seven year parade of speculators, “experts”, conspiracy theorists, “forensic investigators”, investigative reporters (credentialed, non-credentialed), most of whom were wrong all or in part; culminating in media flurry with the identification of Ivins as prime suspect and suicide. • Critically assess: What are the drivers, motivations and agendas for those who rendered “expertise” and opinion? • Various hearings, particularly recently with identification of Ivins and likely closing of case: summary “FBI evidence not conclusive or convincing, many questions remain unanswered” • Critically assess: What are the drivers, motivations and agendas?

11. My Skepticism of “Skeptics” and “Talking Heads” • Relevant Knowledge • Relevant Credentials • Relevant Expertise and Experience • Personal Agendas • Personal and Professional Motives • Political Agendas • Personal and Professional Liability

12. “Forensic Science 101”

13. Forensic Science • Application of science in the investigation of legal matters • Scientific knowledge and technology are used to serve as witnesses in both criminal and civil (intelligence) matters • Science may not offer definitive solutions for all scenarios; it does provide a special investigative role • Goal is “attribution” – i.e.,who committed the crime

14. Four Mission Areas PREVENT Terrorism by tackling underlying causes To reduce the THREAT PURSUE Terrorists and those That sponsor them To reduce the RISK PROTECT The public and Nation interests To reduce VULNERABILITY PREPARE For the consequences Forensic Science is one “tool in the kit”

15. Phases of Forensic Investigations • Intelligence & Information Gathering • Field Investigation • Crime Scene Investigation • Laboratory Analysis • Interpretation, Integration, Application • Building, Shaping Prosecution • Communication and Decision Making Who, What, When, Where, Why, How? Leads

16. Forensics Integrates Science with the Investigative Process • Biology • Chemistry • Materials • Trace Evidence • Impression and Pattern • Engineering • Digital-Computer • Reconstructive • Informatics

17. Key Definitions • Forensics: Analysis and interpretation of physical evidence to determine relevance to events, people, places, tools, methods, processes, intentions, plans • Identification and Characterization • Inclusion toward Attribution, or Exclusion • Attribution: Assignment of a sample of questioned origin to a sourceof knownorigin to a high degree of scientific certainty(at the same time excluding origination from other sources)

18. “The Forensic Continuum” Attribution Exclusion Consistent With Having Originated From Could Not Have Come From Power of and Confidence in Analysis, Interpretation, Meaning Did Absolutely Come From “Not Guilty” Integrate with Other Evidence & Intelligence “Guilty”

19. Robust Collection & Preservation of Evidence Relevant Exploitation of Sample High Discrimination Enables Comparison of K and Q Samples Utility Across Known, Encountered Sample Types Accuracy Reliability Defined & Acceptable Error Rate Speed & Responsiveness Repeatability Transferability Validity Can Be Independently Established Results Probative, Interpretable, Explainable, Defensible Goals for Forensic Methods

20. Validation: “Must Have” Component of Effective, Reliable, Credible and Admissible Forensic Methods • Characterization & Testing of Methods to Define and Establish • Effectiveness • Attributes & Limits • Accuracy • Reliability • Repeatability • Transferability • Influence of Environment & Handling with Appropriate Sample Types Affects Acceptance, Admissibility, Confidence, Value, Weight

21. Baseline: Foundation has been laid down through 20 years of moving new science and technology into the U.S. Courts Criminal justice community is well sensitized and has developed “tests” (i.e., Daubert v. Merrill Dow Pharmaceuticals, US Supreme Court Decision, 509 U.S. 579) to examine validity of new science and technology for admissibility Courts seek: Evidence that is testable Confidence that evidence is based, on legitimate scientific foundations, has been peer-reviewed, is relevant, is applied by trained and qualified personnel in properly equipped, run and managed laboratory systems Why are Validation & Quality So Important in Forensics? Clash of Cultures: Research Science v. Applications Science v. Legal v. Courts: Challenge in an Adversarial Environment Lawyers (not Scientists) in Charge “Rules of Engagement” are Different Lawyers Influence or Make Key Decisions Deciders of Fact are Non-Scientists Should policy makers and implementers set expectations for the science that informs and supports policy and actions? Can policy makers become as knowledgeable in the science and practice as lawyers and judges have had to become? • Application of science and • interpretation of results stays • within bounds of what science • permits

22. U.S Legal Framework for Admissibility of Scientific Evidence(Federal Rules of Evidence) • Rule 401“Relevant evidence” means evidence having any tendency to make the existence of a fact that is of consequence to the determination of the action more probable or less probable than it would be without the evidence. • Rule 402 Evidence that is not relevant is not admissible. • Rule 702 [Expert testimony is admissible if] • The testimony is based on sufficient facts or data, • The testimony is a product of reliable principles or methods, • The witness has applied the principles and methods reliably to the facts of the case. • Rule 901 [There must be foundational evidence] showing that [a scientific] process or system produces an accurate result. No such framework or set of expectations exists for scientific evidence to inform or support policy decisions. Should there be? Each nation? Alliances? International?

23. “Microbial Forensics 101” Application of Forensic Science and Related Sciences to Problems Involving Biological Threat Agents, Their By Products and Associated Physical Evidence Collect, Preserve & Transport, Triage, Analyze Interpret, Integrate, Decide

24. What is It? Is it Probative/Relevant?Can It Be Linked to A Source? How Robustly & Precisely Can It Be Linked? What is the Meaning & Weight of the Conclusion? Identity? Relevance to Event? Power of Methods to Characterize - Discriminate? Confidence Limits? Sample from A Questioned Source (Q) Q Known Source (K) Side by Side Comparison Could Not Have Originated From Consistent With Having Originated From (Weak  Strong) Absolutely Did Originate From

25. Agents Affecting Human Health or Animal Health Duck Hepatitis virus Epizootic Lymphangitis Enzootic Bovine Leukemia Equine Piroplasmosis Fowl Pox Marek’s Disease Hemorrhagic Septicemia Horse Mange Infect Bovine Rhinotracheitis Myxomatosis Ovine Pulmonary Adenovirus Porcine cystercercosis Porcine resp & rep syndr Rabbit Hemorrhagic Dis Surra Transmissible Gastroentero Trichinellosis Trichomonosis Anthrax Foot & Mouth Brucellosis Rift Valley Fever BSE Swine Fever Nipah Hendra Botulinum Influenza Plague VEE/WEE/EEE Rinderpest Glanders JE NDV Q Fever TBE Tularemia Hantavirus Salmonella Microsporidia CCHF Bovine Tuberculosis African Horse Sickness Meliodosis Psittacosis Sheep and Goat Pox Rickettsia rickettsii C perfringens toxin Rabies Ricin SEB E coli VSV Ebola/Marburg Campylobacter Bluetongue Lassa Heartwater Smallpox Swine Vesicular Disease Typhus Yellow Fever Akabane Shigatoxin Contagious Caprine Pleuro. Monkeypox Dengue S A Hemorrhagic Fevers Shiga-like RIP Lumpy Skin Disease Shigellosis Hepatitis E Fowl Cholera T2- mycotoxin Hydatid Disease Herpes B Abrin Malignant Catarrhal Fever Peste des petits Avian Infectious Bronchitis Aujuszky’s Disease Bovine Babesiosis Coccidiodes posadasii Contagious Equine Metritis Fowl Typhoid Pullorum Conotoxin Avian Tuberculosis Bovine cystercercosis Dourine Enterovirus Encephalitis Equine Infect Anemia Equine Rhinopneumonia Infectious Bursal Disease Maedi / Visna Nairobi Sheep Disease Paratuberculosis Theileriosis Alastrim (Variola minor) Menangle Avian Mycoplasmosis Bovine Anaplasmosis Bovine Genital Campylobacter Contagious Agalactia Dermatophilosis - Plant pathogens expand list substantially • For vast majority, the forensic analysis has not been worked out or validated to date Derived from DoD, NIAID, OCIE and others

26. Conceptual Analytic Pathway for Microbial Evidence Strain ID Genetic Engineering Bacteria/Virus ID Classic bacteriology/virology Genetic/Genomic Analysis Issues: Control material Control environment Maximize recovery Recover Evidence Spore density Cfu/ml Percentage viability Dead vs live spores Particle sizing Electron Microscopy (EM) Analytical chemistry Transmission EM Inorganic Silica Silicates Cations and anions Heavy metals Organic Carbohydrates Agar (Agarobiose) Peptones Headspace Scanning EM EDX Analysis One View of “The Big Picture” • But, Don’t Forget! • Traditional Physical Evidence • Contaminated Traditional Evidence • Adventitious Physical Evidence • Good Intelligence and Investigation • Apply Proper Interpretation • Integrate Forensics into Investigation • Validated Methods by Qualified, Certified Personnel • Environment of Robust Quality Assurance and Control After B. Budowle, FBI Laboratory and J. Burans, NBACC

27. Clinical and Genomic Methods • Clinical Microscopy (Morphology: Size, Shape, Staining Characteristics) • Clinical Culture Methods • Metabolic Profiling: Selective Biochemistry, BiologTM • Protein-Based Methods Enzyme Linked Immunosorbent Assay, Serotyping, • Antigen Capture, Matrix Assisted Laser Desorption Ion (MALDI) Time-of-Flight • (TOF) Mass Spectroscopy, Multilocus Enzyme Electrophoresis (MLEE) • DNA Typing • Restriction Enzyme Methodologies:Restriction Fragment Length Polymorphism • (RFLP), Pulse Field Gel Electrophoresis (PFGE), Amplified Fragment Length • Polymorphism (AFLP) • PCR-Based:Intergenic Spacer Regions (ISR), ARDRA, Random Amplification of DNA (RAPD) Analysis, Repetitive Element (REP-PCR), Variable Number Tandem Repeats (VNTR), Multilocus Variable Number Tandem Repeat Analysis (MLVA), Inserted Sequence (IS) Elements, Triangulation Identification for Genetic Evaluation of Risk (TIGER, PCR-Mass Spectroscopy) • Hybridization:Subtractive Hybridization, Microarray-Single Nucleotide • Polymorphisms (SNP), Re-Sequencing, Gene Expression • DNA Sequencing:Full Genome, Multilocus Sequence Typing (MLST)

28. Physical and Chemical Methods Microscopy: Scanning Electron Microscopy (SEM) without and with Energy Dispersive X-ray (EDX) Microanalysis, Atomic Force Microscopy (AFM) Spectroscopy: Raman Spectroscopy, Surface-Enhanced Raman Spectroscopy Spectrometry: Liquid Chromatography – Mass Spectrometry (LC/MS), Fourier Transform Infrared (FTIR) Spectrometry, Bio-Aerosol Mass Spectroscopy (BAMS), Matrix-Assisted Laser-Desorption Ionization Mass Spectrometry (MALDI-MS), Isotope Ratio Mass Spectrometry (IRMS), Time-of-Flight Secondary Ion Mass Spectroscopy (TOF-SIMS), Nano-Secondary Ion Mass Spectroscopy (nano-SIMS), Accelerator Mass Spectroscopy (AMS) Nuclear microscopy: Particle-Induced X-ray Emission (PIXE) – Scanning Transmission ion microscopy (STIM)

29. Challenge: Understand all the possible weaponization processes and their variants BW agents are generally mixtures that derive from a matrix of possible processing steps Washing Drying Separation Growth Grinding Additives • Detergents • Water/buffer • Solvents e.g. FCs • Spray-dry • Carbon sources • Nitrogen source • Complex media • Cell culture • Animal hosts • Agar • Air dry • Azeotropic • Acetone • Spray dry • Lyophilize • Heat shock • Filter • Centrifuge • Precipitation or flocculation • Solvent partitioning • Gradients • Ball mill • Jet mill • Mortar & pestle • Flow enhancers • Resins • Stabilizers • Encapsulants • Irritants • • • • • • • • • • • • • • • Of course, the chosen method may be very crude… or may not involve any “processing” at all

30. Challenge: Understand the utility of isotopic and trace element signatures to “geolocate” materials used to manufacture an agent

31. Microbial Forensics is A Young Discipline • Largely built on science and technology developed and used for other fields and purposes, transposed to forensic applications • Several strategy, review, gap identification and policy papers published; validation guidelines in press now; scientific papers re Anthrax 2001 in preparation, “review and acceptance” by community pending • No independent, external, peer review of science, results, conclusions and validation to date (NAS review expected) • Few court casesto date, few case law precedents • No legal challenges or rulings to date re admissibility of novel scientific evidence or methods, evidence, results or conclusions at trial

32. Gaps Identified: Scientific Working Group for Microbial Genetics and Forensics • Effective methods/tools to quickly identify when, where, how & by what means, an outbreak has occurred • Ability to quickly discern whether an outbreak is natural or intentional • Simultaneous sampling & investigative characterization: forensics – epidemiology • Ability to quickly locate and exploit “the crime scene” • Fully understand the approaches and methods used by “the perp” • Lab capabilities that match investigative questions

33. More Gaps Identified: Scientific Working Group for Microbial Genetics and Forensics • Independently validated methods and protocols: sample collection through all analytic pathways, and interpretation • Exploit microbial and contaminated physical evidence • Robust quality assurance & data control systems • Understanding of microbial diversity & background • Definitive & consistent microbial systematics (phylogeny + taxonomy) • Comparative genomics studies, including “near neighbors” • “Post-genomics”, including “small molecules” • National Microbial Strain Repository

34. Deepening Cross-Disciplinary Knowledge and Episystemic Capabilities Genomics Metagenomics Epidemiology Informatics Ecology Biostatistics & Population Genetics Forensic Science Bacteriology Mycology & Virology Microbial Forensics Plant Pathology Biomedical Sciences & Public Health Food Science Analytical Chemistry & Biochemistry Veterinary Medicine Physics Microscopy Materials Science Process Engineering

35. Microbial Forensics:Emerging and Future Technologies, Threats to Address? • Creative, Even Subtle Genetic Engineering • Bioprospecting, Exploiting Natural Diversity • Gene Shuffling & Directed Evolution • Small Footprint Design & Production Systems • Creative Denial and Deception • Synthetic Biology Can “Passive” and “Active” Measures be Anticipated? Developed?

36. Attribution: Effective, Reliable Capabilities for Justice and Policy • Multilevel, multidisciplinary “tool kit” of defined, supported, validated analytical approaches for full exploitation of “evidentiary” samples • Integrated approaches that enable definitive analyses that are fully supportive of attribution, and do so accurately, responsively, adaptively and defensibly • Capabilities built upon well vetted and properly applied science and technology, with attributes and limits fully understood and communicable • Agile leveraging and integration with matched investigative and intelligence capabilities • Methods, applications and experts that can withstand rigorous scientific, legal, policy and political scrutiny

37. BW (WMD) Attribution: ASystem Which Doesn’t Yet Coherently & Fully Exist Science & Technology Strategy, Plans & Doctrine Law & Policy Operations, Investigation & Intelligence

38. Microbial Forensics and Policy • What quantity and quality of evidence is needed to support national or global policy decisions regarding illicit intentions, research and preparation, testing, and delivery of biological weapons? • How much and what kind of “evidence” should be required to support what decision? • What should policy makers expect of its national or global microbial forensics capabilities? • What contribution can or should forensics make to national or global policy decisions involving biological weapons/bioterrorism? • How should microbial forensics results be best integrated with other forms of relevant information (evidence) and intelligence? • How much reliance can or should be placed on forensic evidence and analysis for decisions related to attribution and “prosecution” and what “standards” or decision framework should be used? • Can competent microbial forensics contribute to the deterrence of the possession, development, proliferation and use of biological weapons?

39. Other Scenarios to Stimulate Your Thinking ---What Would Happen Next Time? • “New strain” of influenza (highly aggressive), covert attack during flu season • FMD clandestinely introduced in Midwestern feed lot • Large scale anthrax attack, mixed strains (including new west Africa strain) • Aerosolized ricin in closed or contained environment, mixed varieties in seed stock used • Botox clandestinely and selectively introduced in food supply, small scale, distributed attacks • Any BW, denial and deception engineered in weapon and modus operandi • Effective attack of any scale using as yet unknown, “naturally occurring” strain • Assassination of unprotected VIP (not necessarily USG) via biotoxin, considerable operational security or serendipity by perpetrator (planning  execution) At present, forensic science and microbial forensics may well have limited contributions for various reasons, unless…..

40. Given What Transpired in Totality With and During Anthrax 2001, What Would Transpire Should An Event of International Importance Occur? How Should We Best Build, Test and Configure and Manage A System of Capabilities to Address Possible Risks, Events, Actors, Processes and Outcomes?

41. Questions? Discussion?