Since September 11, 2001, there has been an increase in the funding for research in biomedicine. This increase is intended to develop effective medical countermeasures, against emerging infectious diseases and biological agents, which can only be performed safely in BSL-3 and BSL-4 labs. A large part of this funding has been used to construct additional high-containment BSL-3 and BSL-4 labs. The BSL labs are classified by the type of agents used and the risk posed to personnel, the environment, and the community by those agents. The Department of Health and Human Services’s (HHS) Biosafety in Microbiological and Biomedical Laboratories (BMBL) guidelines specify four biosafety levels, with BSL-4 being the highest. The levels include combinations of laboratory practices and techniques, safety equipment, and facilities that are recommended for labs that conduct research on potentially dangerous agents and toxins. These labs are to be designed, constructed, and operated in a manner to (1) prevent accidental release of infectious or hazardous agents within the laboratory and (2) protect lab workers and the environment external to the lab, including the community, from exposure to the agents. Work in BSL-3 labs involves agents that may cause serious and potentially lethal infection. In some cases, there are vaccines or effective treatments available. Types of agents that are typically handled in BSL-3 labs include, for example, anthrax, West Nile Virus, Q fever, tularemia, and avian flu. Work in BSL-4 labs involves the most dangerous agents for which there are no effective vaccines or treatments available. Types of agents that are typically handled in BSL-4 labs include, for example, Ebola, hemorrhagic fevers, and smallpox. Many different federal agencies have some connection with BSL-3 and BSL-4 labs in the United States. These agencies are involved with these labs in various capacities, including as users, owners, regulators, and funding sources. For example, the Centers for Disease Control and Prevention (CDC) has its own high-containment labs and regulates that portion of labs working with select agents and toxins that represent a risk to human health and safety. Similarly, the U.S. Department of Agriculture (USDA) has its own labs and regulates labs working with select agents and toxins posing a risk to animal and plant health. The NIAID has its own labs and is a major funding source for construction and research involving high-containment labs. The National Institutes of Health (NIH) both funds research requiring high containment and provides guidance that is widely used to govern many of the activities in high-containment labs. The Food and Drug Administration (FDA) has its own labs and regulates manufacturing of biological products, some of which require high- containment labs. The Department of Commerce (DOC) regulates the export of agents and equipment that have both military and civilian uses, which are often found in high-containment labs. The Department of Defense (DOD) has its own labs and funds research requiring high- containment labs. The Department of Labor’s (DOL) Occupational Safety and Health Administration (OSHA) regulates some activities within high- containment labs, as well as general safety in most high-containment labs. The Department of State (DOS) regulates the export of agents and equipment that are specifically designed for military use from defense- related high-containment labs and maintains a listing of some high- containment labs, as part of the U.S. commitments under the Biological and Toxin Weapons Convention (BWC). The Department of Justice’s (DOJ) Federal Bureau of Investigation (FBI) uses high-containment labs when their forensic work involves dangerous biological agents. The Department of Homeland Security (DHS) has its own labs and funds a variety of research requiring high-containment labs. The Department of Energy (DOE) has several BSL-3 labs doing research to develop detection and response systems to improve preparedness for biological attack. The Department of Interior (DOI) has its own BSL-3 labs for work with infectious animal diseases. The Department of Veterans Affairs (VA) has research and clinical BSL-3 labs for its work with veterans. The Environmental Protection Agency (EPA) has its own labs and also coordinates use of various academic, state, and commercial high- containment labs nationwide, as part of its emergency response mission. The Antiterrorism and Effective Death Penalty Act of 1996 includes provisions to regulate the transfer, between laboratories, of certain biological agents and toxins and requires the Secretary of HHS to implement these provisions. As part of the implementation of this act, the first list of regulated biological agents was created. This became known as the select agent list. The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 revised and expanded the Select Agent Program. Among other requirements, the new law (1) revised the list of agents deemed “select agents,” which possess the “potential to pose a severe threat” to public health and safety, to animal or plant health, or to animal or plant products; (2) directed the Secretaries of HHS and Agriculture to biennially review and publish the select agent list, making revisions as appropriate to protect the public; (3) required all facilities possessing select agents to register with the Secretary of HHS, Agriculture, or both, not just those facilities sending or receiving select agents; (4) restricted access to biological agents and toxins by persons who do not have a legitimate need and who are considered a risk by federal law enforcement and intelligence officials; (5) required transfer registrations to include information regarding the characterization of agents and toxins to facilitate their identification, including their source; (6) required the creation of a national database with information on all facilities and persons possessing, using, or transferring select agents; and (7) required the Secretaries of HHS and Agriculture to impose more detailed and different levels of security for different select agents, based on their assessed level of threat to the public. Pertinent guidance includes NIH and CDC BMBL guidance, as well as NIH guidelines. NIH and CDC BMBL Guidance The NIH and CDC prepared the BMBL as a guidance document for working with particular select agents. According to the BMBL guidelines, (1) BSL-1 laboratories house agents and toxins that do not consistently cause disease in healthy adult humans; (2) BSL-2 laboratories are capable of housing agents and toxins that are spread through puncture, absorption through mucous membranes, or ingestion of infectious materials; (3) BSL-3 laboratories are capable of housing agents and toxins that have a potential for aerosol transmission and that may cause serious and potentially lethal infection; (4) BSL-4 laboratories are capable of housing agents and toxins that pose a high individual risk of life-threatening disease, which may be aerosol transmitted and for which there is no available vaccine or therapy. The BMBL states that (1) biosafety procedures must be incorporated into the laboratory’s standard operating procedures or biosafety manual; (2) personnel must be advised of special hazards and are required to read and follow instructions on practices and procedures; and (3) personnel must receive training on the potential hazards associated with the work involved and the necessary precautions to prevent exposure. Further, the BMBL contains guidelines for laboratory security and emergency response, such as controlling access to areas where select agents are used or stored. The BMBL also states that a plan must be in place for informing police, fire, and other emergency responders as to the type of biological materials in use in the laboratory areas. NIH Guidelines for Research Involving Recombinant DNA Molecules Much of the work in BSL-3 and BSL-4 labs in the United States involves recombinant DNA (rDNA), and the NIH Guidelines for Research Involving Recombinant DNA Molecules (NIH rDNA Guidelines) set the standards and procedures for research involving rDNA. Institutions must follow these guidelines when they receive NIH funding for this type of research. The guidelines include the requirement to establish an institutional biosafety committee (IBC). The IBC is responsible for (1) reviewing rDNA research conducted at or sponsored by the institution for compliance with the NIH rDNA Guidelines and (2) approving those research projects that are found to conform with the NIH rDNA Guidelines. IBCs also periodically review ongoing rDNA research to ensure continued compliance with the NIH rDNA Guidelines. The CDC is responsible for the registration and oversight of laboratories that possess, use, or transfer select agents and toxins that could pose a threat to human health. USDA is responsible for the registration and oversight of laboratories that possess, use, or transfer select agents and toxins that could pose a threat to animal or plant health or animal or plant products. Some select agents, such as anthrax, pose a threat to both human and animal health and are regulated by both agencies (see appendix III for the list of select agents and toxins). The select agent regulations require registration for U.S.-based research institutions, government agencies, universities, manufacturers, and other entities that possess, use, or transfer select agents. Registration is for 3 years. As part of the registration process, facilities must demonstrate in their applications that they meet the recommendations delineated in the BMBL for working with particular select agents. Such requirements include having proper laboratory and personal protective equipment, precautionary signage, and ventilation; controlled access; and biosafety operations manuals. Facilities must also describe the laboratory procedures that will be used, provide a laboratory floor plan showing where the select agent will be handled and stored, and describe how access will be limited to authorized personnel. In addition, facilities must describe the objectives of the work that requires the select agent. Each facility must identify a responsible facility official who is authorized to transfer and receive select agents on behalf of the facility. Individuals making false, fictitious, or fraudulent statements on registration forms may be punished, under the False Statements Act, by a fine of up to $250,000, imprisonment up to 5 years, or both. Violations by organizations are punishable by a fine of up to $500,000 per violation. To ensure compliance with these requirements, the program established a goal of inspecting these facilities once during the 3-year registration period. Facilities may be inspected before and after registration, but there is no requirement that inspections be performed. An expansion in the number of BSL-3 and BSL-4 labs is taking place across most of the United States, according to the literature, federal agency officials, and experts. Most federal officials and experts believe that the number of BSL-4 labs in the United States is generally known. But the number of BSL-3 labs is unknown. Information on expansion is available about high-containment labs that are (1) registered with the CDC-USDA’s Select Agent Program, and (2) federally funded. However, much less is known about the expansion of labs outside the Select Agent Program and the nonfederally funded labs, including location, activities, and ownership. For both BLS-3 and BSL-4, the expansion is taking place across many sectors—federal, state, academic, and private—and all over the United States. For most of the last 50 years, there were only two sites with BSL-4 labs in the United States. These were federal labs at the U.S. Army’s Research Institute for Infectious Diseases (USAMRIID) in Fort Detrick, Maryland, and at the CDC in Atlanta, Georgia. Between 1990 and 2000, three new BSL-4 labs were built: a BSL-4 lab at Georgia State University in Atlanta— the first BSL-4 lab in a university setting; a small BSL-4 lab on the NIH campus in Bethesda, Maryland; and a privately funded BSL-4 lab in San Antonio, Texas. Since the terror attacks of 2001, nine new facilities and one major remodeling effort containing BSL-4 space will either be operational, in construction, or in planning by this year’s end. The number of BSL-4 laboratories has increased from 5, before 2001, to 15, including at least 1 in planning. Moreover, expansion is taking place across all sectors. Before 1990, all BSL-4 labs were federal labs—either at USAMRIID or at the CDC. Today, while expansion is taking place within the federal sector as well—there are seven new federal facilities recently built, currently under construction, or planned, which have one or more BSL-4 labs—there are also BSL-4 labs at universities, as part of state response, and in the private sector. (See table 1 for expansion in BSL-4 labs by sector.) While the number is difficult to quantify, many more BSL-3 labs are thought to exist compared with BSL-4 labs. Many lab owners—when building new labs or upgrading existing ones—are building to meet BSL-3 level containment, often anticipating future work, even though they intend for some time to operate at the BSL-2 level with BSL-2 recommended agents. In addition, much biodefense work, for example, involves aerosolization of agents for challenge studies, and most of this type of activity is often recommended for containment at the BSL-3 level. The expansion of BSL-3 labs is in all sectors. However, the only definitive data available are on labs registered with the CDC-USDA Select Agent Program. Within that program, two-thirds of registered BSL-3 labs are outside the federal sector (see table 2). Within the academic sector, for example, NIAID has provided funding for 13 Regional Biocontainment Laboratories (RBL) to provide regional BSL-3 capability for academic research requiring such containment. Expansion at the state level is also taking place (see table 3). According to a survey conducted by the Association of Public Health Laboratories (APHL) in August 2004, since 2001 state public health labs have used public health preparedness funding to build, expand, and enhance BSL-3 labs. In 1998, for example, APHL found that 12 of 38 responding states reported having a state public health laboratory at the BSL-3 level. Today, at least 46 states have at least one state public health BSL-3 lab. Expansion of BSL-3 and BSL-4 labs is starting to take place geographically as well as by sector. For example, before 1990, BSL-4 labs were clustered at either USAMRIID at Fort Detrick or at CDC. Today, there are BSL-4 labs built, under construction, or in planning in four states other than Maryland and Georgia. The expansion of BSL-3 labs is widespread across most states. Because of the need for individual state response to bioterrorist threats, most states now have some level of BSL-3 capacity—at least for diagnostic and analytical services—in support of emergency response. In addition, within the academic research community, the RBLs being constructed by the NIAID are intended to provide regional BSL-3 laboratory capacity to support NIAID’s Regional Centers of Excellence for Biodefense and Emerging Infectious Diseases Research (RCE). Hence, the RBLs are distributed regionally around the country. Operational, under construction, or currently planned BSL-4 labs and some of the major BSL-3 facilities in the United States are shown in figure 1. No single federal agency has the mission to track and determine the risk associated with the expansion of BSL-3 and BSL-4 labs in the United States, and no single federal agency knows how many such labs there are in the United States. Consequently, no one is responsible for determining the aggregate risks associated with the expansion of these high- containment labs. None of the federal agencies that responded to our survey indicated that they have the mission to track and know the number of BSL-3 and BSL-4 labs within the United States (see table 4). Some federal agencies do have a narrow mission to track a subset of BSL-3 and BSL-4 labs, and they do know the number of those labs. For example, the CDC and USDA together know the number of high-containment labs working with select agents because, by federal regulation, such labs are required to register with them. But these regulations only require that the entities registering with the Select Agent Program do a risk assessment of their individual labs. No agency, therefore, has the mission to determine the aggregate risks associated with the expansion of high-containment labs that work with select agents. According to the federal agency officials, the oversight of these labs is fragmented and relies on self- policing. While the number and location of all BSL-3 and BSL-4 labs is not known, several federal agencies indicated that they have a need to know this information in support of their agency missions. Some intelligence agencies, for example, indicated that they need to know a subset of the number and location of high-containment labs within the United States because these labs represent a capability that can be misused by terrorists or people with malicious intent. Without knowledge of the number and location of the BSL-3 and BSL-4 labs, some agencies’ work is made more difficult. For example, the FBI has a need to know the number and location of BSL-3 and BSL-4 labs for forensic purposes. Without this information, the FBI’s work is made more difficult. According to the experts, there is a baseline risk associated with any high- containment. With expansion, the aggregate risks will increase. However, the associated safety and security risks will be greater for new labs with less experience. In addition, high-containment labs have health risks for individual lab workers as well as the surrounding community. According to a CDC official, the risks due to accidental exposure or release can never be completely eliminated, and even labs within sophisticated biological research programs—including those most extensively regulated—have had and will continue to have safety failures. In addition, while some of the most dangerous agents are regulated under the CDC-USDA’s Select Agent Program, many high-containment labs work with agents not covered under this program. Labs outside the Select Agent Program also pose risks, given that many unregulated agents can cause severe illness or even death (see appendix IV for a list of some agents, but not select agents, recommended to be worked on in high-containment labs). These labs also have associated risks because of their potential as targets for terrorism or theft from either external or internal sources. Even labs outside the Select Agent Program can pose security risks in that such labs represent a capability that can be paired with the necessary agents to become a threat. While the United States has regulations governing select agents, many nations do not have any regulations governing the transfer or possession of dangerous biological agents. We identified six lessons from three recent incidents: failure to report to CDC exposures to select agents, in 2006, by TAMU (see appendix V); power outage at CDC’s new BSL-4 lab, in 2007; and the release of foot-and- mouth disease virus, in 2007, at Pirbright, the U.K. These lessons highlight the importance of (1) identifying and overcoming barriers to reporting in order to enhance biosafety through shared learning from mistakes and to assure the public that accidents are examined and contained; (2) training lab staff in general biosafety as well as in specific agents being used in the labs to ensure maximum protection; (3) developing mechanisms for informing medical providers about all the agents that lab staff work with to ensure quick diagnosis and effective treatment; (4) addressing confusion over the definition of exposure to aid in the consistency of reporting; (5) ensuring that BSL-4 labs’ safety and security measures are commensurate with the level of risk these labs present; and (6) maintenance of high-containment labs to ensure integrity of physical infrastructure over time. While the Select Agent Program and the rDNA Guidelines have reporting requirements, institutions sometimes fail to report incidents. According to CDC, there were three specific types of incidents that TAMU officials failed to report to CDC: (1) multiple incidents of exposure, including illness; (2) specific types of experiments being conducted by researchers; and (3) missing vials and animals. In addition, in November 2006, during our first visit to TAMU—a meeting in which all key officials who knew about these incidents were present— we asked if there had been any incident in which a lab worker was exposed to a select agent. TAMU officials did not disclose any of these incidents. Moreover, in August 2007, during our second visit, the biosafety officer said that he had conducted an investigation of the incident, in which the lab worker was exposed to Brucella, and wrote a report. However, the report that was provided to us was dated June 17, 2006, but discussed other incidents that had occurred in 2007, a discrepancy that TAMU failed to explain to us. According to the literature and discussion with federal officials and experts, accidents in labs are expected, mostly as a result of human error due to carelessness, inadequate training, or poor judgment. In the case of theft, loss, occupational exposure, or release of the select agent, the lab must immediately report certain information to CDC or USDA. However, there is a paucity of information on barriers to reporting by institutions. It has been suggested that there is a disincentive to report acquired infections and other mishaps at research institutions because of (1) negative publicity for the institution or (2) the scrutiny from a granting agency, which might result in the suspension of research or an adverse effect on future funding. Further, it is generally believed that when a worker acquires an infection in the lab, it is almost always his or her fault, and neither the worker nor the lab is interested in negative publicity. In order to enhance reporting, barriers need to be identified and targeted strategies need to be applied to remove those barriers. It is also important that these incidents be analyzed so (1) biosafety can be enhanced through shared learning from mistakes and (2) the public may be reassured that accidents are thoroughly examined and contained. One possible mechanism for analysis, discussed in the literature, is the reporting system used for aviation incidents, administered by the National Transportation Safety Board and the Federal Aviation Administration. When mistakes are made, they are analyzed and learned from without being attributed to any one individual. Experts have agreed that some form of personal anonymity would encourage reporting. Training is a key requisite for safe and secure work with dangerous agents. Moreover, it is important that this training is specific to the agent to be worked with and activities to be performed. The lab worker at TAMU who was exposed was not authorized to work with Brucella but was, we were told, being escorted in the lab only to help out with the operating of the aerosolization chamber. According to the select agent regulations, all staff are required to be trained in the specifics of any agent before they work with it. However, the worker did not receive training in the specifics of Brucella, including its characteristics, safe handling procedures, and potential health effects. While the worker was experienced in general BSL-3 procedures, her normal work regimen involved working with Mycobacterium tuberculosis, and her supervisor surmised that the differential potential for infection from Brucella was partially to blame for the exposure. In particular, the exposed lab worker was highly experienced in handling M. tuberculosis, an infectious agent. A lab director of a BSL-2 lab for the last 5 years, she had a PhD in medical sciences and was, by many accounts, highly competent and reliable. She had applied the procedures governing safe work with M. tuberculosis to the Brucella experiment. However, her experience with M. tuberculosis might have provided a false sense of security. Had training been given in Brucella, the worker might have been more aware when cleaning the aerosol chamber. Typical routes of infection differ between M. tuberculosis and Brucella and normal procedures, including gowning and respiratory equipment, vary between the two agents. For example, the lab worker wore protective glasses, but they were not tight fitting. This was adequate when working with M. tuberculosis, but not with Brucella. The investigation concluded that the agent entered the lab worker through the eyes. According to one expert who has managed high-containment labs, there are risks working alternately in BSL-2 and BSL-3 labs, with their different levels of procedures and practices. The fear is that lab workers may develop a routine with BSL-2 procedures that might be difficult to consciously break when working with the more dangerous agents and activities requiring BSL-3 containment. Severe consequences for the worker can result from delays in (1) recognizing when an exposure has occurred or (2) medical providers’ accurately diagnosing any resulting infection. Further, if the worker acquires a disease that is easily spread through contact, there can also be severe consequences for the surrounding community. In the Brucella incident at TAMU, at the time of the exposure on February 9, 2006, the lab worker did not know she was infected nor did anyone else in the lab. In fact, the CDC conducted a routine inspection of TAMU on February 22, 2006—13 days after the exposure—but had no way of knowing that it had happened. According to the exposed worker, it was more than 6 weeks after the exposure that she first fell ill. Then, the first consultation with her physician indicated that she had the flu; it was only after the symptoms persisted that a consultation with an infectious disease specialist confirmed that her blood contained an unknown microorganism. It was at this point that she recalled her work with Brucella weeks earlier. Confirmation of infection with brucellosis was made on April 16, 2006, by the Texas State Public Health Lab—62 days after the exposure. During much of this time, the worker had resumed her normal activities, interacting with many people. In fact, the exposed lab worker had become seriously ill and the delay in recognizing her infection as brucellosis aggravated her condition. Such misdiagnosis is not uncommon with infectious diseases, as the initial symptoms often appear flu-like and brucellosis is not generally endemic in the population. If the worker had not recalled the experiment with Brucella and alerted her physician to this fact, according to the CDC, she might have developed an even more severe infection, possibly affecting her central nervous system or the lining of her heart. In this incident, it was also fortunate that the disease was such that transmission beyond the initial exposed individual was difficult and that there were no risk of spread to the surrounding community. While brucellosis is not easily transferred between humans, many agents cause diseases that are easily transferred from human to human through coughing or fluid transfer, including some agents that are not select agents, such as SARS and tuberculosis. According to BMBL, the causative incident for most laboratory-acquired infections is often unknown. It can only be concluded that an exposure took place after a worker reports illness—with symptoms suggestive of a disease caused by the relevant agent—some time later. Since clinical symptoms can take weeks to become apparent, during which time an infected person may be contagious, it is important that exposure be identified as soon as possible and proper diagnosis and prompt medical treatment provided. In addition to the incident of exposure to Brucella, the CDC noted several incidents of potential exposure to Coxiella burnetii that TAMU had failed to report. While the Brucella exposure eventually became apparent because of clinical symptoms in the lab worker, the C. burnetii incidents illustrate situations where the determination of exposure can be more problematic. In attempting to address the failure to report, questions were raised about what constitutes sufficient evidence of an exposure that the entity must report to the CDC. One indication of exposure that can be used for C. burnetii and other agents is to periodically measure the titer levels—antibody levels—within the blood serum of lab workers working with those agents. If a person has a raised level over his or her baseline level, then a conclusion can be drawn that the person has been exposed to the agent. However, there are issues with using titer levels as an indication of exposure. For example, determining when the exposure took place is not straightforward. TAMU has a program of monitoring blood serum for workers with C. burnetii—a select agent and the causative agent for Q fever in humans. While humans are very susceptible to Q fever, only about one-half of all people infected with C. burnetii show signs of clinical illness. During the CDC inspection, triggered by the uncovering of the Brucella incident, CDC came across clinical records that showed that several lab workers were found to have elevated titers for C. burnetii. But no reports had been sent to the CDC. The CDC noted this issue and, on April 24, 2007, TAMU submitted the required Form 3 to report the possible exposure. However, as a result of subsequent discussion with the individuals who had the elevated titers, TAMU officials began to have doubts about whether or not the elevated titers resulted from exposures that had occurred at TAMU. In one case, TAMU said, one of the infected lab workers had only recently been hired by TAMU but had worked in a clinical lab in China, where C. burnetii was known to have been present. In another, the worker claimed to have been exposed many years earlier and had always registered high, although the actual levels varied. CDC officials disagree with this interpretation and believe the high titers resulted from exposures at TAMU. TAMU initially responded to the uncovering of the elevated titer incidents by reporting, to the CDC, any subsequent elevated titer level uncovered in any of their lab workers. But TAMU is now unsure how to proceed. It has notified the CDC that, in its opinion, an exposure suggested by an elevated titer should be defined to have occurred only after clinical symptoms appear in the individual. TAMU has, therefore, ceased reporting incidents of merely elevated titers. In the absence of clarity over the definition of exposure, TAMU officials have chosen to define it as they see fit. When we asked the CDC about the confusion over the definition of an exposure, officials agreed that terms need to be clearly defined and are drafting new guidance. CDC officials noted, however, that it is unwise to wait until clinical symptoms appear before determining that an exposure has taken place, as this could potentially endanger a worker’s life and potentially, in the case of a communicable disease, others. Experts have told us that correctly interpreting the meaning of elevated titers—whose characteristics can vary by agent, host, and testing lab—is challenging since many serological testing methods have not been validated. Gaps in the scientific understanding of infectious diseases— such as the meaning of elevated titers—may become more problematic as the expansion of labs continues. The development of scientifically sound and standardized methods of identifying exposure is critical, so that individual lab owners are not left to determine for themselves what is and what is not reportable. An hour-long power outage, in June 2007, at the CDC’s newest BSL-4 facility raised questions about safety and security, as well as the backup power system design. The incident showed that, even in the hands of experienced owners and operators, safety and security of high- containment labs can still be compromised. The incident also raises concerns about the security of other similar labs being built around the nation. On June 8, 2007, the CDC campus in Atlanta experienced lightning strikes in and around its new BSL-4 facility, and both primary and backup power to that facility were unavailable. The facility was left with only battery power—a condition that provides limited power for functions such as emergency lighting to aid in evacuation. Among other things, the outage shut down the negative air pressure system, one of the important components in place to keep dangerous agents from escaping the containment areas. In looking into the power outage, the CDC determined that, some time earlier, a critical grounding cable buried in the ground outside the building had been cut by construction workers digging at an adjacent site. The cutting of the grounding cable, which had gone unnoticed by CDC facility managers, compromised the electrical system of the facility that housed the BSL-4 lab. According to CDC officials, the new BSL-4 facility is still in preparation to become fully operational and no live agents were inside the facility at the time of the power outage. However, given that the cable was cut, it is apparent that the construction was not supervised to ensure the integrity of necessary safeguards that had been put in place. Further, according to CDC officials, it was not standard procedure to monitor the integrity of the electrical grounding of the new BSL-4 facility. However, CDC has now instituted annual testing of the electrical grounding system. Because of the power outage incident, questions about the design of the backup power system for the new facility resurfaced. When the CDC designed the backup power system for the new BSL-4 facility, it used backup generators at a central utility plant which serve other facilities, as well as functions such as chillers, on campus besides the new BSL-4 facility. According to internal documents provided to us, during design phase for the facility, some CDC engineers had questioned the remotely placed, integrated design rather than a simpler design using local backup generators near the facility. According to CDC facility officials, the full backup power capabilities for the new BSL-4 facility are not in place yet, but are awaiting completion of other construction projects on campus. Once these projects are completed, these officials said, the new BSL-4 facility will have multiple levels of backup power, including the ability to get power from a second central utility plant on campus, if needed. But some CDC engineers that we talked to questioned the degree of complexity in the design. They are worried that an overly integrated backup might be more susceptible to failure. As a result of this power outage incident, CDC officials said, the CDC is doing a reliability assessment for the entire campus power system, which will include the backup power design for the new BSL-4 facility. Some experts have suggested that BSL-4 labs be similar in design to a nuclear power plant, with a redundant backup-to-backup power system, along with adequate oversight. Like such plants, BSL-4 labs are considered targets for terrorists and people with malicious intent. Release of an agent from any of these labs could have devastating consequences. Therefore, appropriate design of labs and adequate oversight of any nearby activities—such as adjacent construction with its potential to compromise buried utilities—are essential. High-containment labs are highly sophisticated facilities, which require specialized expertise to design, construct, operate, and maintain. Because these facilities are intended to contain dangerous microorganisms, usually in liquid or aerosol form, even minor structural defects—such as cracks in the wall, leaky pipes, or improper sealing around doors—could have severe consequences. Supporting infrastructure, such as drainage and waste treatment systems, must also be secure. In August 2007, contamination of foot-and-mouth disease was discovered at several local farms near Pirbright in the U.K., the site of several high- containment labs that work with live foot-and-mouth disease virus. Foot- and-mouth disease is one of the most highly infectious livestock diseases and can have devastating economic consequences. For example, a 2001 epidemic in the U.K. cost taxpayers over £3 billion, including some £1.4 billion paid in compensation for culled animals. Therefore, the U.K. government officials worked quickly to contain and investigate this recent incident. The investigation of the physical infrastructure at the Pirbright site found evidence of long-term damage and leakage of the drainage system servicing the site, including cracked and leaky pipes, displaced joints, debris buildup, and tree root ingress. While the definitive cause of the release has not been determined, it is suspected that contaminated waste water from Pirbright’s labs leaked into the surrounding soil from the deteriorated drainage pipes and that live virus was then carried offsite by vehicles splashed with contaminated mud. The cracked and leaky pipes found at Pirbright are indicative of poor maintenance practice at the site. The investigation found that (1) monitoring and testing for the preventative maintenance of pipework for the drainage system was not a regular practice on site and (2) the investigation found that a contributing factor might have been a difference of opinion over responsibilities for maintenance of a key pipe within the drainage system. High-containment labs are expensive to build and expensive to maintain. Adequate funding for each stage needs to be addressed. Typically, in large- scale construction projects, funding for initial construction comes from one source. But funding for ongoing operations and maintenance comes from somewhere else. For example, in the NIAID’s recent funding of the 13 BSL-3 labs as RBLs and 2 BSL-4 labs as National Biocontainment Labs (NBL), the NIAID contributed to the initial costs for planning, design, construction, and commissioning. But the NIAID did not provide funding to support the operation of these facilities. In this case, the universities themselves are responsible for funding any maintenance costs after initial construction. The Pirbright incident shows that beyond initial design and construction, ongoing maintenance plays a critical role in ensuring that high- containment labs operate safely and securely over time. Because even the smallest of defects can affect safety, ensuring the continuing structural integrity of high-containment labs is an essential recurring activity. The expansion of BSL-3 and BSL-4 labs taking place in the United States is proceeding in a decentralized fashion, without specific requirements as to the number, location, activity, and ownership of such labs. While some expansion may be justified to address deficiencies in lab capacity for the development of medical countermeasures, unwarranted expansion without adequate oversight is proliferation, not expansion. Since the full extent of the expansion is not known, it is unclear how the federal government can ensure that sufficient but not superfluous capacity—that brings with it additional, unnecessary risk—is being created. The limited federal oversight that does exist for high-containment labs is fragmented among different federal agencies, and for the most part relies on self-policing. The inherent weaknesses of an oversight system based on self-policing are highlighted by the Texas A&M University case. While CDC inspected the labs at Texas A&M in April 2006, as part of its routine inspection, its inspectors failed to identify that (1) a worker became exposed and ill; (2) unauthorized experiments were being conducted and unauthorized individuals were entering the labs; and (3) agents and infected animals were missing. It was not until a public advocacy group found out about the Brucella incident and, according to this group, applied pressure—by demanding records about the incident—that TAMU reported this incident to the CDC. This report prompted the subsequent in-depth investigations by the CDC. However, this incident raises serious concerns about (1) how well the CDC polices select agent research being conducted in over 400 high- containment labs at various universities around the country, which are registered under the Select Agent Program, and (2) whether the safety of the public is compromised. Moreover, if similar safety breaches are occurring at other labs, they are not being reported. And the CDC is not finding them either. According to the experts, no one knows whether the Texas A&M incidents are the tip of the iceberg or the iceberg. Mr. Chairman, this concludes my prepared remarks. I would be happy to respond to any questions that you or other members of the subcommittee may have at this time. For further information regarding this statement, please contact Keith Rhodes, at (202) 512-6412 or rhodesk@gao.gov, or Sushil K. Sharma, Ph.D., Dr.PH, at (202) 512-3460 or sharmas@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. William Carrigg, Jeff McDermott, Jean McSween, Jack Melling, Laurel Rabin, Corey Scherrer, Rebecca Shea, and Elaine Vaurio made key contributions to this statement. To determine the extent of expansion in the number of high-containment facilities and the areas experiencing the growth, we interviewed agency officials and experts, as well as reviewed documents provided by agencies and the literature. To determine which federal agency has the mission to track and determine the aggregate risks associated with the proliferation of BSL-3 and BSL-4 labs in the United States, we surveyed 12 federal agencies that are involved with BSL-3 or BSL-4 labs in some capacity—for example, research, oversight, or monitoring. The survey requested information on the agency’s involvement with high-containment labs—specifically, whether the agency has a mission to track the number of high-containment labs, whether it has a need to know, and whether it knows the number of operating BSL-3 and BSL-4 labs. The agencies that received our survey include the U.S. Department of Agriculture (USDA); the Department of Commerce; the Department of Defense; the Department of Energy; the Environmental Protection Agency; the Department of Health and Human Services (HHS), including the Centers for Disease Control and Prevention (CDC); the Department of Homeland Security; the Department of Interior; the Department of Justice, including the Federal Bureau of Investigation (FBI); the Department of Labor, including Occupational Safety and Health Administration (OSHA); and the Department of States. In addition, we sent our survey to intelligence agencies, including the Central Intelligence Agency (CIA), the National Counter-Terrorism Center (NCTC); the Defense Intelligence Agency (DIA); and the Office of Intelligence Analysis within DHS. We also met with officials of the Select Agent Program at both the CDC and the USDA to gain additional information about the expansion of high-containment labs. Finally, we reviewed documents these agencies provided, including pertinent legislation, regulation, and guidance, and reviewed scientific literature on risks associated with high-containment labs. To develop lessons learned from recent incidents at three high- containment labs, we interviewed academic experts in microbiological research involving human, animal, and plant pathogens, and conducted site visits at selected federal, civilian, military, academic, and commercial BSL-3 and BSL-4 labs, including the sites involved in the recent incidents. Specifically, we conducted site visits to the CDC and Texas A&M University (TAMU); talked to the U.K. officials at Health Safety Executive and the Department for Environment, Food, and Rural Affairs; and reviewed documents and inspection reports. To discuss the incidents at TAMU and the CDC, we conducted site visits and interviewed the relevant officials. We also conducted a site visit to the CDC and interviewed relevant officials, including the officials of CUH2A, Inc.—the contractor who designed the backup power system for the new BSL-4 lab in Atlanta—as well as the expert hired by this firm to conduct the reliability study for the backup power system. The regulations governing the Select Agent Program became effective on April 15, 1997, and were revised in March 2005. The regulations include six primary components: (1) a list of select agents that have the potential to pose a severe threat to public health and safety; (2) registration of facilities before the domestic transfer of select agents; (3) a process to document successful transfer of agents; (4) audit, quality control, and accountability mechanisms; (5) agent disposal requirements; and (6) research and clinical exemptions. For facilities registered with the CDC and the USDA that possess, use, or transfer select agents, the select agent regulations require (1) an FBI security risk assessment for a number of individuals, including each person who is authorized to have access to select agents and toxins; (2) written biosafety and incident response plans; (3) training of individuals with access to select agents and of individuals who will work in or visit areas where select agents or toxins are handled and stored; (4) a security plan sufficient to safeguard the select agent or toxin against unauthorized access, theft, loss, or release, and designed according to a site-specific risk assessment that provides protection in accordance with the risk of the agent or toxin; (5) possible inspection by the CDC or USDA of the facility and its records before issuance of the certificate of registration; (6) maintenance of records relating to the activities covered by the select agent regulations; and (7) facility registration with the CDC or the USDA that indicates (a) each select agent that the entity intends to possess, use, or transfer; (b) the building where the agent will be used and stored; (c) the laboratory safety level; (d) a list of people authorized to have access to each select agent; (e) the objectives of the work for each select agent, including a description of the methodologies or laboratory procedures to be used; (f) a description of the physical security and biosafety plans; and (g) assurance of security and biosafety training for individuals who have access to areas where select agents are handled and stored. HHS Select Agents and Toxins Abrin Cercopithecine herpesvirus 1 (Herpes B virus) Coccidioides posadasii Conotoxins Crimean-Congo haemorrhagic fever virus Diacetoxyscirpenol Ebola virus Lassa fever virus Marburg virus Monkeypox virus Reconstructed 1918 influenza virus Ricin Rickettsia prowazekii Rickettsia rickettsii Saxitoxin Shiga-like ribosome inactivating proteins South American Haemorrhagic Fever viruses Flexal Guanarito Junin Machupo Sabia Tetrodotoxin Tick-borne encephalitis complex (flavi) viruses Central European Tick-borne encephalitis Far Eastern Tick-borne encephalitis Kyasanur Forest disease Omsk Hemorrhagic Fever Russian Spring and Summer encephalitis Variola major virus (Smallpox virus) and Variola minor virus (Alastrim) Yersinia pestis USDA Select Agents and Toxins African horse sickness virus African swine fever virus Akabane virus Avian influenza virus (highly pathogenic) Bluetongue virus (Exotic) Bovine spongiform encephalopathy agent Camel pox virus Classical swine fever virus Cowdria ruminantium (Heartwater) Foot-and-mouth disease virus Goat pox virus Japanese encephalitis virus Lumpy skin disease virus Malignant catarrhal fever virus (Alcelaphine herpesvirus type 1) Menangle virus Mycoplasma capricolum/ M.F38/M. mycoides Capri (contagious caprine pleuropneumonia) Mycoplasma mycoides mycoides (contagious bovine pleuropneumonia) Newcastle disease virus (velogenic) Peste des petits ruminants virus Rinderpest virus Sheep pox virus Swine vesicular disease virus Vesicular stomatitis virus (exotic) Overlap Select Agents and Toxins Bacillus anthracis Botulinum neurotoxins Botulinum neurotoxin producing species of Clostridium Brucella abortus Brucella melitensis Brucella suis Burkholderia mallei (formerly Pseudomonas mallei) Burkholderia pseudomallei (formerly Pseudomonas pseudomallei) Clostridium perfringens epsilon toxin Coccidioides immitis Coxiella burnetii Eastern Equine Encephalitis virus Francisella tularensis Hendra virus Nipah virus Rift Valley fever virus Shigatoxin Staphylococcal enterotoxins T-2 toxin Venezuelan Equine Encephalitis virus USDA Plant Protection and Quarantine (PPQ) Select Agents and Toxins Candidatus Liberobacter africanus Candidatus Liberobacter asiaticus Peronosclerospora philippinensis Ralstonia solanacearum race 3, biovar 2 Schlerophthora rayssiae var zeae Synchytrium endobioticum Xanthomonas oryzae pv. Oryzicola Xylella fastidiosa (citrus variegated chlorosis strain) There are a number of biological agents causing severe illness or death that are not select agents. For example, there are five agents that are recommended for containment at BSL-4 because of (1) their close antigenic relationship with a known BSL-4 agent and (2) the fact that there is insufficient experience working with them (see table 5). BMBL containment and safety recommendations for B. anthracis, the causative agent for anthrax and a select agent, are to include the use of BSL-2 practices, containment equipment, and facilities for clinical and diagnostic quantities of infectious cultures. However, BSL-3 practices, containment equipment, and facilities are recommended for (1) work involving production quantities or high concentrations of cultures, screening environmental samples especially with powders, and (2) for activities with a high potential for aerosol production. Safety and containment recommendations for some agents, which are not regulated under the Select Agent Program, are as strict or stricter than the recommendations for B. anthracis. Some nonselect agents, to which containment recommendations at BSL-3 under certain conditions apply, are listed in table 6. TAMU is registered with CDC’s Select Agent Program and approved for work on several select agents. TAMU has several BSL-3 laboratories and works extensively on animal diseases, including those caused by the select agents Brucella melitensis, Brucella abortus, and Brucella suis. Brucella can cause brucellosis in humans, a disease causing flu-like symptoms such as fever and fatigue. But in severe cases, it can cause infections of the central nervous system. TAMU is also registered for use of Coxiella burnetii, an animal agent that can cause Q fever in humans. According to the CDC, in February 2006, a lab worker was helping out with an experiment to aerosolize Brucella. The lab worker had no familiarity with the specifics of working with Brucella, but did have experience working with the aerosol chamber. It was determined that the lab worker got exposed to the agent during cleaning of the chamber after the experiment was run. At the time of the exposure, neither the exposed worker nor anyone else had any indication that an exposure had taken place. In fact, CDC inspectors were on campus days after the Brucella exposure for a routine inspection but uncovered nothing that alerted them to the fact that an incident had taken place. Symptoms did not start to appear in the exposed worker until more than a month after the exposure, and then the symptoms were flu-like. Confirmation of brucellosis was not made until another month had passed and symptoms had worsened. However, once the brucellosis determination had been made, the worker notified appropriate authorities at TAMU. But no report was subsequently made to the CDC as required by federal regulation and a year passed before—by chance—an independent watchdog group reviewing unrelated documentation, acquired through the Freedom of Information Act (FOIA), uncovered the lapse in reporting and forced TAMU to notify the CDC. The subsequent investigation by the CDC revealed a number of other violations of the select agent regulations including (1) TAMU was not authorized to aerosolize Brucella in the first place; (2) a number of lab workers from another BSL-3 lab had tested positive for Coxiella antigens in their blood serum, suggesting potential exposures had taken place for that agent as well, but without reports going to CDC; (3) unauthorized access to select agents and toxins; (4) missing vials and animals; (5) and other protocol and procedural deficiencies. On April 20, 2007, the CDC issued a cease-and-desist order for all work on Brucella within the affected high-containment lab, as well as all aerosolization work at TAMU involving select agent and toxins. That order was subsequently expanded to include all work with select agents and toxins at TAMU—the first time the CDC has ever issued such an order entitywide under the select agent regulations. That order remains in effect as of the date of this testimony. Export Controls: Vulnerabilities and Inefficiencies Undermine System’s Ability to Protect U.S. Interests. GAO-07-1135T. Washington, D.C.: July 26, 2007. Biological Research Laboratories: Issues Associated with the Expansion of Laboratories Funded by the National Institute of Allergy and Infectious Diseases. GAO-07-333R. Washington, D.C.: February 22, 2007. Export Controls: Challenges Exist in Enforcement of an Inherently Complex System. GAO-07-265. Washington, D.C.: December 20, 2006. Export Controls: Agencies Should Assess Vulnerabilities and Improve Guidance for Protecting Export-Controlled Information at Universities. GAO-07-70. Washington, D.C.: December 5, 2006. Defense Technologies: DOD’s Critical Technologies Lists Rarely Inform Export Control and Other Policy Decisions. GAO-06-793. Washington, D.C.: July 26, 2006. Homeland Security: Management and Coordination Problems Increase the Vulnerability of U.S. Agriculture to Foreign Pests and Disease. GAO-06-644. Washington, D.C.: May 19, 2006. Plum Island Animal Disease Center: DHS and USDA Are Successfully Coordinating Current Work, but Long-Term Plans Are Being Assessed. GAO-06-132. Washington, D.C.: December 19, 2005. Homeland Security: Much Is Being Done to Protect Agriculture from a Terrorist Attack, but Important Challenges Remain. GAO-05-214. Washington, D.C.: March 8, 2005. Combating Bioterrorism: Actions Needed to Improve Security at Plum Island Animal Disease Center. GAO-03-847. Washington, D.C.: September 19, 2003. Homeland Security: CDC’s Oversight of the Select Agent Program. GAO-03-315R. Washington, D.C.: November 22, 2002. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: In response to the global spread of emerging infectious diseases and the threat of bioterrorism, high-containment biosafety laboratories (BSL)--specifically biosafety level (BSL)-3 and BSL-4--have been proliferating in the United States. These labs--classified by the type of agents used and the risk posed to personnel, the environment, and the community--often contain the most dangerous infectious disease agents, such as Ebola, smallpox, and avian influenza. This testimony addresses (1) the extent to which there has been a proliferation of BSL-3 and BSL-4 labs, (2) federal agencies' responsibility for tracking this proliferation and determining the associated risks, and (3) the lessons that can be learned from recent incidents at three high-containment biosafety labs. To address these objectives, GAO asked 12 federal agencies involved with high-containment labs about their missions and whether they tracked the number of labs overall. GAO also reviewed documents from these agencies, such as pertinent legislation, regulation, and guidance. Finally, GAO interviewed academic experts in microbiological research. A major proliferation of high-containment BSL-3 and BSL-4 labs is taking place in the United States, according to the literature, federal agency officials, and experts. The expansion is taking place across many sectors--federal, academic, state, and private--and all over the United States. Concerning BSL-4 labs, which handle the most dangerous agents, the number of these labs has increased from 5--before the terrorist attacks of 2001--to 15, including at least 1 in planning stage. Information on expansion is available about high-containment labs that are registered with the Centers for Disease Control and Prevention (CDC) and the U.S. Department of Agriculture's (USDA) Select Agent Program, and that are federally funded. However, much less is known about the expansion of labs outside the Select Agent Program, as well as the nonfederally funded labs, including location, activities, and ownership. No single federal agency, according to 12 agencies' responses to our survey, has the mission to track the overall number of BSL-3 and BSL-4 labs in the United States. Though several agencies have a need to know, no one agency knows the number and location of these labs in the United States. Consequently, no agency is responsible for determining the risks associated with the proliferation of these labs. We identified six lessons from three recent incidents: failure to report to CDC exposures to select agents by Texas A&M University (TAMU); power outage at the CDC's new BSL-4 lab in Atlanta, Georgia; and release of foot-and-mouth disease virus at Pirbright in the United Kingdom. These lessons highlight the importance of (1) identifying and overcoming barriers to reporting in order to enhance biosafety through shared learning from mistakes and to assure the public that accidents are examined and contained; (2) training lab staff in general biosafety, as well as in specific agents being used in the labs to ensure maximum protection; (3) developing mechanisms for informing medical providers about all the agents that lab staff work with to ensure quick diagnosis and effective treatment; (4) addressing confusion over the definition of exposure to aid in the consistency of reporting; (5) ensuring that BSL-4 labs' safety and security measures are commensurate with the level of risk these labs present; and (6) maintenance of high-containment labs to ensure integrity of physical infrastructure over time.