Bioterrorism: Investigation & Prosecution -Anthrax 2001 and Beyond

Randall S. Murch, Ph.D.Center for Technology, Security and Policy

Virginia Polytechnic Institute & State University (Virginia Tech) National Capital Region, Alexandria, VA, USA

&Department of War Studies, King’s College London, UK

Key Investigative & Prosecutive Questions

• Did A Crime (Event of Interest) Occur?

• What Happened?• How Did It Occur?• When Did It Occur?• Where Did It Occur?• Why Did It Occur?• Who Was Involved?• What Evidence Exists? What

Does It Tell Us? How Strong are the Links?

• How Reliable and Credible is the Evidence?

• What Alternative Explanations are There for the Evidence?

Similar Questions for Intelligence and Policy as Well?

“Amerithrax”

• Anthrax laden letters mailed 17 – 18 Sept (5 media sites) and 6 – 9 Oct 2001 (US Capitol), both mailings originating from Princeton, NJ

• 5 dead inhalational, up to 17 infected– inhalational, cutaneous; Florida, Washington, DC area, New York City/Connecticut

• Investigation launched immediately with 1st victim (FL media), closed August 2008 with purported identification of suspect (Ivins, USAMRIID)

• 7-year investigation; estimated $1B direct/indirect measurable costs; terror/fear/uncertainty; massive investments in new biosecurity R&D, system deployment/O&M and preparedness programs; misidentification of suspects (lawsuit, settlement), suspected foreign group/country involvement; endless commentary and speculation from many quarters on various aspects (continues); realization of many vulnerabilities and shortfalls (many remain)

Confirmation that “a little can go a long way (make a big mess)…”

Elements of the Crimes• Was a Crime Committed?

– Microbe used as a weapon with delivery system, could not have originated from natural contamination or accident

– Resulted in death and illness– Damage to and misuse of Government-owned property and

infrastructure– …….

• Violations of Federal law (Indictment, Prosecution)• Terrorism• Misuse of biological agents (Biological Weapons Antiterrorism statute)• Homicide and attempted homicide• “Property” and “misuse” elements• Interstate elements• ………..(here’s where the prosecutors would have “piled on”)

Course of the Investigation

• Numerous Avenues Pursued– Traditional Investigation, Positive/Negative– Intelligence and Foreign, Positive/Negative– Scientific/Forensic

• Numerous Twists, Turns, Dead Ends; External Speculation, Distractions and Stimuli

• Science (Ostensibly) Provides Vital Link and Aids in Narrowing Possible Suspects and Sources of “Microbe of Interest”: Q samples (at least two batches)—letters, victims, mailbox, sites to Dugway and USAMRIID

• Investigation Focuses on Limited Number of Possible Suspects (Process of Elimination/Inclusion) Ivins

Standards of Proof in US System• No Cause or Suspicion• Reasonable Suspicion (Events/Circumstances, Contacts,

Interviews/Interrogation, Non-Intrusive Methods—No Expectation of Privacy)

• Probable Cause (Arrest and Search Warrants, Orders)• Beyond A Reasonable Doubt (Trial, Conviction: What

Does a Reasonable Juror Believe?)

•Investigation is a Process Which Seeks, Gathers, Develops, Analyzes,Weights and “Packages” Positive and Negative Information and Evidence To Exonerate the Innocent and Prosecute and Convict the Guilty

•Evidence is Additive and Subtractive, Reinforcing and Conflicting; Analytical and Interpretative Process is Primarily Not Quantitative, Rather Qualitative and Relies on Human Judgment

What We Think We Know (1)From affidavit in support of a search warrant for Ivins’

house, three vehicles and a safe deposit box

• At time of attacks, Ivins was custodian of highly purified anthrax that is genetically “identical” to the anthrax analyzed from the attacks (sole custodian of stock culture since 1997 when originated; free access to suite at USAMRIID where stock culture kept)

• No satisfactory explanation provided for Ivins’ late night laboratory access contemporaneous with the attacks

• Ivins claimed that he was suffering from serious mental health issues in the months preceding the attacks (to co-worker: “incredible paranoid, delusional thoughts at times”)

• Ivins believed to submit false samples of anthrax for forensic analysis to mislead investigators

• At time of attacks, Ivins was under pressure to assist company which produced anthrax vaccine and had lost FDA approval; believed vaccine essential for force protection

• Ivins sent email contemporaneous with attacks with language similar to mailed letters containing anthrax

• Ivins and wife reportedly had issues with Sens. Leahy and Daschle; Ivins had obsession with sorority, sorority office in Princeton near mailbox used for mailings

What We Think We Know (2) Scientific Evidence Publicly Briefed & From Affidavit

• Spores were produced between 1999 – 2001• Two different batches produced• No substances were added to make them more dispersable• Silicon and oxygen were present in the spore coat, not on the exterior; silicon “signature” not

previously described for B. anthracis• Wild-type B. anthracis Ames, with significant numbers of phenotypic variants (substrains); • “Unique” phenotypic variants could be detected by 4 indel polymorphisms• Of 1070 in known Ames cultures (16 U.S. labs, Canada, Sweden, U.K.), 8 contained all four

polymorphisms, none had three out of four, few contained one or two; of 8 that contained all four, all of the 8 with all four polymorphisms were directly related to a single Ames culture (RMR-1029)

• Presence of B.subtilis as contaminant in one set of letters but not the other, suggesting two separate culturing events; genetic analysis of B. subtilis demonstrated dissimilarities with other known cultures;

• RMR-1029 indicated as source for B. anthracis in all Q samples (inferred but not stated directly)• Source of envelopes used in mailings narrowed to certain distribution sources and Virginia and

Maryland; proximity between source of envelopes and source of anthrax

• Other– “Spores were produced in northeast U.S.” – Trace evidence, tape and ink available for comparison (letters, mailbox)

What We Don’t Know or Have: Examples• “Smoking gun” (not likely ever will, no eyewitnesses nor Ivins caught

in the act)• Specific whereabouts of Ivins during key events related to attacks• Interviews of all co-workers, associates, supervisors, laboratory

management• Interviews and investigation of all others at USAMRIID who had

access to RMR-1029 stock culture and proximate laboratory facilities

• Investigation and interviews of those knowledgeable about and in possession of laboratory access schedules, security procedures, documentation

• Details of investigation conducted in community (neighborhood, church, etc) (some reported in media)

• Surveillance logs• Cooperating witness interviews

Documents Likely Forthcoming, Currently Under Review by FBI and DOJ

The Media and Politics

• Seven year parade of speculators, “experts”, conspiracy theorists, “forensic investigators”, investigative reporters (credentialed, non-credentialed), most of whom were wrong all or in part; culminating in media flurry with the identification of Ivins as prime suspect and suicide. – Critically assess: What are the drivers, motivations and agendas

for those who rendered “expertise” and opinion?

• Various hearings, particularly recently with identification of Ivins and likely closing of case: summary “FBI evidence not conclusive or convincing, many questions remain unanswered”– Critically assess: What are the drivers, motivations and

agendas?

My Skepticism of “Skeptics” and “Talking Heads”

• Relevant Knowledge• Relevant Credentials• Relevant Expertise and Experience• Personal Agendas• Personal and Professional Motives• Political Agendas• Personal and Professional Liability

“Forensic Science 101”

Forensic Science

• Application of science in the investigation of legal matters

• Scientific knowledge and technology are used to serve as witnesses in both criminal and civil (intelligence) matters

• Science may not offer definitive solutions for all scenarios; it does provide a special investigative role

• Goal is “attribution” – i.e., who committed the crime

Four Mission AreasPREVENT

Terrorism by tackling underlying causes

PURSUETerrorists and thoseThat sponsor them

PROTECTThe public and Nation

interests

PREPAREFor the consequences

To reduce theTHREAT

To reduceVULNERABILITY

To reduce the

RISK

Forensic Science is one “tool in the kit”

Phases of Forensic Investigations

• Intelligence & Information Gathering• Field Investigation• Crime Scene Investigation• Laboratory Analysis• Interpretation, Integration, Application• Building, Shaping Prosecution• Communication and Decision Making

Leads

Wh

o, W

hat

, Wh

en,

Wh

ere,

Wh

y, H

ow?

Forensics Integrates Science with the Investigative Process

• Biology• Chemistry• Materials• Trace Evidence• Impression and Pattern• Engineering• Digital-Computer• Reconstructive• Informatics

Key Definitions

• Forensics: Analysis and interpretation of physical evidence to determine relevance to events, people, places, tools, methods, processes, intentions, plans– Identification and Characterization– Inclusion toward Attribution, or Exclusion

• Attribution: Assignment of a sample of questioned origin to a source of known origin to a high degree of scientific certainty (at the same time excluding origination from other sources)

“The Forensic Continuum”

Exclusion Attribution

Co

uld

No

t H

ave

Co

me

Fro

m

Did

Ab

solu

tely

C

om

e F

rom

Power of and Confidence in Analysis, Interpretation, Meaning

Integrate with Other Evidence & Intelligence“Not Guilty” “Guilty”

Consistent With Having Originated From

Goals for Forensic Methods

• Robust Collection & Preservation of Evidence

• Relevant Exploitation of Sample

• High Discrimination• Enables Comparison of K and Q Samples• Utility Across Known,

Encountered Sample Types

• Accuracy

• Reliability• Defined & Acceptable

Error Rate• Speed & Responsiveness• Repeatability• Transferability• Validity Can Be

Independently Established

• Results Probative, Interpretable, Explainable, Defensible

Validation: “Must Have” Component of Effective, Reliable, Credible and Admissible

Forensic MethodsCharacterization & Testing of Methods to

Define and Establish•Effectiveness

•Attributes & Limits•Accuracy•Reliability

•Repeatability•Transferability

•Influence of Environment & Handling with Appropriate Sample Types

Affects Acceptance, Admissibility, Confidence, Value, Weight

Why are Validation & Quality So Important in Forensics?

• Baseline:– Foundation has been laid down

through 20 years of moving new science and technology into the U.S. Courts

– Criminal justice community is well sensitized and has developed “tests” (i.e., Daubert v. Merrill Dow Pharmaceuticals, US Supreme Court Decision, 509 U.S. 579) to examine validity of new science and technology for admissibility

• Courts seek:– Evidence that is testable– Confidence that evidence is based, on legitimate scientific

foundations, has been peer-reviewed, is relevant, is applied

by trained and qualified personnel in properly equipped, run and managed laboratory systems

Clash of Cultures: Research Science v. Applications Science v. Legal v. Courts:

Challenge in an Adversarial EnvironmentLawyers (not Scientists) in Charge

“Rules of Engagement” are DifferentLawyers Influence or Make Key Decisions

Deciders of Fact are Non-Scientists

- Application of science and interpretation of results stays within bounds of what science permits

Should policy makers and implementersset expectations for the science that

informs and supports policy and actions? Can policy makers become as

knowledgeable in the science and practice as lawyers and judges

have had to become?

U.S Legal Framework for Admissibility of Scientific Evidence

(Federal Rules of Evidence)

• Rule 401 “Relevant evidence” means evidence having any tendency to make the existence of a fact that is of consequence to the determination of the action more probable or less probable than it would be without the evidence.

• Rule 402 Evidence that is not relevant is not admissible.• Rule 702 [Expert testimony is admissible if]

– The testimony is based on sufficient facts or data,– The testimony is a product of reliable principles or methods,– The witness has applied the principles and methods reliably to

the facts of the case.• Rule 901 [There must be foundational evidence] showing

that [a scientific] process or system produces an accurate result. No such framework or set of expectations exists for

scientific evidence to inform or support policy decisions.Should there be? Each nation? Alliances? International?

“Microbial Forensics 101”Application of Forensic Science and Related

Sciences to Problems Involving Biological Threat Agents, Their By Products and Associated

Physical Evidence

Collect, Preserve & Transport, Triage, Analyze Interpret, Integrate, Decide

What is It? Is it Probative/Relevant?Can It Be Linked to A Source?

How Robustly & Precisely Can It Be Linked? What is the Meaning & Weight of the Conclusion?

Sample from A Questioned Source (Q)

Identity?

Relevance to Event?

Power of Methods to Characterize - Discriminate?

Confidence Limits?

Q Known Source (K)

Side by Side Comparison

Could Not Have Originated From

Consistent With Having Originated From (Weak

Strong)

Absolutely Did Originate From

Duck Hepatitis virusEpizootic Lymphangitis Enzootic Bovine Leukemia Equine PiroplasmosisFowl PoxMarek’s DiseaseHemorrhagic Septicemia Horse MangeInfect Bovine Rhinotracheitis

Myxomatosis Ovine Pulmonary Adenovirus Porcine cystercercosis Porcine resp & rep syndr Rabbit Hemorrhagic Dis Surra Transmissible Gastroentero TrichinellosisTrichomonosis

AnthraxFoot & MouthBrucellosisRift Valley FeverBSE Swine Fever Nipah HendraBotulinum Influenza PlagueVEE/WEE/EEE

Rinderpest Glanders JE NDV Q Fever TBE Tularemia Hantavirus Salmonella Microsporidia CCHF Bovine TuberculosisAfrican Horse Sickness Meliodosis

Psittacosis Sheep and Goat PoxRickettsia rickettsiiC perfringens toxinRabies Ricin SEB E coli VSV Ebola/MarburgCampylobacter BluetongueLassa HeartwaterSmallpox Swine Vesicular Disease Typhus Yellow Fever Akabane ShigatoxinContagious Caprine Pleuro. Monkeypox Dengue

S A Hemorrhagic FeversShiga-like RIP Lumpy Skin DiseaseShigellosis Hepatitis EFowl CholeraT2- mycotoxin

Hydatid Disease

Herpes BAbrinMalignant Catarrhal FeverPeste des petits Avian Infectious Bronchitis

Aujuszky’s DiseaseBovine BabesiosisCoccidiodes posadasii Contagious Equine Metritis Fowl TyphoidPullorumConotoxin

Avian TuberculosisBovine cystercercosisDourineEnterovirus Encephalitis Equine Infect Anemia Equine Rhinopneumonia Infectious Bursal Disease Maedi / VisnaNairobi Sheep Disease ParatuberculosisTheileriosisAlastrim (Variola minor) MenangleAvian MycoplasmosisBovine AnaplasmosisBovine Genital Campylobacter Contagious AgalactiaDermatophilosis

Agents Affecting Human Health or Animal Health

Derived from DoD, NIAID, OCIE and others

- Plant pathogens expand list substantially

-For vast majority, the forensic analysis has not been worked out or validated to date

One View of “The Big Picture”

Conceptual Analytic Pathway forMicrobial Evidence

Issues:Control materialControl environmentMaximize recovery

Recover Evidence

Bacteria/Virus ID Classic bacteriology/virologyGenetic/Genomic Analysis

Strain IDGenetic Engineering

Spore densityCfu/ml

Percentage viabilityDead vs live spores

Particle sizing

Analytical chemistry

InorganicSilicaSilicatesCations and anionsHeavy metals

OrganicCarbohydratesAgar (Agarobiose)PeptonesHeadspace

Electron Microscopy (EM)

Scanning EMEDX Analysis

Transmission EM

•But, Don’t Forget!

•Traditional Physical Evidence

•Contaminated Traditional Evidence

•Adventitious Physical Evidence

•Good Intelligence and Investigation

•Apply Proper Interpretation

•Integrate Forensics into Investigation

•Validated Methods by Qualified, Certified Personnel

•Environment of Robust Quality Assurance and Control

After B. Budowle, FBI Laboratory and J. Burans, NBACC

•Clinical Microscopy (Morphology: Size, Shape, Staining Characteristics)•Clinical Culture Methods•Metabolic Profiling: Selective Biochemistry, BiologTM

•Protein-Based Methods Enzyme Linked Immunosorbent Assay, Serotyping, Antigen Capture, Matrix Assisted Laser Desorption Ion (MALDI) Time-of-Flight (TOF) Mass Spectroscopy, Multilocus Enzyme Electrophoresis (MLEE)•DNA Typing Restriction Enzyme Methodologies: Restriction Fragment Length Polymorphism (RFLP), Pulse Field Gel Electrophoresis (PFGE), Amplified Fragment Length Polymorphism (AFLP)

PCR-Based: Intergenic Spacer Regions (ISR), ARDRA, Random Amplification of DNA (RAPD) Analysis, Repetitive Element (REP-PCR), Variable Number Tandem Repeats (VNTR), Multilocus Variable Number Tandem Repeat Analysis (MLVA), Inserted Sequence (IS) Elements, Triangulation Identification for Genetic Evaluation of Risk (TIGER, PCR-Mass Spectroscopy)Hybridization: Subtractive Hybridization, Microarray-Single Nucleotide Polymorphisms (SNP), Re-Sequencing, Gene ExpressionDNA Sequencing: Full Genome, Multilocus Sequence Typing (MLST)

Clinical and Genomic Methods

Microscopy: Scanning Electron Microscopy (SEM) without and with Energy Dispersive X-ray (EDX) Microanalysis, Atomic Force Microscopy (AFM)

Spectroscopy: Raman Spectroscopy, Surface-Enhanced Raman Spectroscopy

Spectrometry: Liquid Chromatography – Mass Spectrometry (LC/MS), Fourier Transform Infrared (FTIR) Spectrometry, Bio-Aerosol Mass Spectroscopy (BAMS), Matrix-Assisted Laser-Desorption Ionization Mass Spectrometry (MALDI-MS), Isotope Ratio Mass Spectrometry (IRMS), Time-of-Flight Secondary Ion Mass Spectroscopy (TOF-SIMS), Nano-Secondary Ion Mass Spectroscopy (nano-SIMS), Accelerator Mass Spectroscopy (AMS)

Nuclear microscopy: Particle-Induced X-ray Emission (PIXE) – Scanning Transmission ion microscopy (STIM)

Physical and Chemical Methods

BW agents are generally mixtures that derive from a matrix of possible processing steps

Growth

• Carbon sources

• Nitrogen source

• Complex media

• Cell culture

• Animal hosts

• Agar

Separation

• Heat shock

• Filter

• Centrifuge

• Precipitation or flocculation • Solvent partitioning

• Gradients

Washing

• Detergents

• Water/buffer

• Solvents e.g. FCs

• Spray-dry

Grinding

• Ball mill

• Jet mill

• Mortar & pestle

Additives

• Flow enhancers

• Resins

• Stabilizers

• Encapsulants

• Irritants

•••

•••

•••

•••

•••

Challenge: Understand all the possible weaponization processes and their variants

Drying

• Air dry

• Azeotropic

• Acetone

• Spray dry

• Lyophilize

Of course, the chosen method may be very crude…or may not involve any “processing” at all

Challenge: Understand the utility of isotopic and trace element signatures to “geolocate” materials

used to manufacture an agent

Microbial Forensics is A Young Discipline

• Largely built on science and technology developed and used for other fields and purposes, transposed to forensic applications

• Several strategy, review, gap identification and policy papers published; validation guidelines in press now; scientific papers re Anthrax 2001 in preparation, “review and acceptance” by community pending

• No independent, external, peer review of science, results, conclusions and validation to date (NAS review expected)

• Few court cases to date, few case law precedents• No legal challenges or rulings to date re admissibility of

novel scientific evidence or methods, evidence, results or conclusions at trial

Gaps Identified: Scientific Working Group for Gaps Identified: Scientific Working Group for Microbial Genetics and ForensicsMicrobial Genetics and Forensics

• Effective methods/tools to quickly identify when, where, how & by what means, an outbreak has occurred

• Ability to quickly discern whether an outbreak is natural or intentional

• Simultaneous sampling & investigative characterization: forensics – epidemiology

• Ability to quickly locate and exploit “the crime scene”

• Fully understand the approaches and methods used by “the perp”

• Lab capabilities that match investigative questions

More Gaps Identified: Scientific Working More Gaps Identified: Scientific Working Group for Microbial Genetics and ForensicsGroup for Microbial Genetics and Forensics

• Independently validated methods and protocols: sample collection through all analytic pathways, and interpretation

• Exploit microbial and contaminated physical evidence

• Robust quality assurance & data control systems

• Understanding of microbial diversity & background

• Definitive & consistent microbial systematics (phylogeny + taxonomy)

• Comparative genomics studies, including “near neighbors”

• “Post-genomics”, including “small molecules”

• National Microbial Strain Repository

Forensic ScienceBacteriology Mycology &

Virology

EpidemiologyGenomics

MetagenomicsEcology

Analytical Chemistry &Biochemistry

Informatics

Biostatistics & Population

Genetics

Plant Pathology Biomedical Sciences& Public Health

Veterinary Medicine

Microbial Forensics

MaterialsScience

Process Engineering

Food Science

MicroscopyPhysics

Deepening Cross-Disciplinary Knowledge and Episystemic Capabilities

Microbial Forensics: Emerging and Future Technologies, Threats to Address?

• Creative, Even Subtle Genetic Engineering• Bioprospecting, Exploiting Natural Diversity• Gene Shuffling &

Directed Evolution• Small Footprint Design &

Production Systems• Creative Denial and Deception• Synthetic Biology

Can “Passive” and “Active” Measures be Anticipated? Developed?

Attribution: Effective, Reliable Capabilities for Justice and Policy

• Multilevel, multidisciplinary “tool kit” of defined, supported, validated analytical approaches for full exploitation of “evidentiary” samples

• Integrated approaches that enable definitive analyses that are fully supportive of attribution, and do so accurately, responsively, adaptively and defensibly

• Capabilities built upon well vetted and properly applied science and technology, with attributes and limits fully understood and communicable

• Agile leveraging and integration with matched investigative and intelligence capabilities

• Methods, applications and experts that can withstand rigorous scientific, legal, policy and political scrutiny

BW (WMD) Attribution: A System Which Doesn’t Yet Coherently & Fully Exist

Science &Technology

Law & Policy

Operations, Investigation & Intelligence

Strategy, Plans & Doctrine

Microbial Forensics and Policy • What quantity and quality of evidence is needed to support national

or global policy decisions regarding illicit intentions, research and preparation, testing, and delivery of biological weapons?– How much and what kind of “evidence” should be required to support

what decision?• What should policy makers expect of its national or global microbial

forensics capabilities?• What contribution can or should forensics make to national or global

policy decisions involving biological weapons/bioterrorism?– How should microbial forensics results be best integrated with other

forms of relevant information (evidence) and intelligence?• How much reliance can or should be placed on forensic evidence

and analysis for decisions related to attribution and “prosecution” and what “standards” or decision framework should be used?

• Can competent microbial forensics contribute to the deterrence of the possession, development, proliferation and use of biological weapons?

Other Scenarios to Stimulate Your Thinking ---What Would Happen Next Time?

• “New strain” of influenza (highly aggressive), covert attack during flu season

• FMD clandestinely introduced in Midwestern feed lot• Large scale anthrax attack, mixed strains (including new west Africa

strain)• Aerosolized ricin in closed or contained environment, mixed

varieties in seed stock used • Botox clandestinely and selectively introduced in food supply, small

scale, distributed attacks• Any BW, denial and deception engineered in weapon and modus

operandi• Effective attack of any scale using as yet unknown, “naturally

occurring” strain• Assassination of unprotected VIP (not necessarily USG) via

biotoxin, considerable operational security or serendipity by perpetrator (planning execution)

At present, forensic science and microbial forensics may well have limited contributions for various reasons, unless…..

Given What Transpired in Totality With and During

Anthrax 2001, What Would Transpire Should An Event of

International Importance Occur? How Should We Best Build, Test and Configure and

Manage A System of Capabilities to Address Possible Risks, Events, Actors, Processes and

Outcomes?

Questions?

Discussion?