Anthrax is an acute infectious disease caused by the spore-forming bacterium Bacillus anthracis. The anthrax bacterium is commonly found in the soil and forms spores (like seeds) that can remain dormant in the environment for many years. Human anthrax infections are rare in the United States and are usually the result of occupational exposure to infected animals or contaminated animal products, such as wool, hides, or hair. Although infection in humans is rare, a person can die if airborne anthrax spores are inhaled into the lungs. Once airborne, there is greater possibility that the spores will be inhaled. Medical experts believe that symptoms of inhalation anthrax (sore throat, muscle aches, and mild fever) typically appear within 4 to 6 days of exposure, depending on how the disease is contracted. While anthrax is potentially fatal, individuals who are exposed to anthrax spores will not necessarily develop the disease. Inhalation anthrax can be treated with antibacterial drugs, but medical treatment does not necessarily ensure recovery. Anthrax is not contagious. Anthrax is a potential terrorist weapon because, if refined and introduced into letters and packages, anthrax spores can be released into the air as letters are processed or opened. The use of the mail as a vehicle for transmitting anthrax threatens the nation’s mail stream and places the American public and federal employees at risk. This is what occurred in 2001, when letters containing anthrax contaminated at least 23 Postal Service facilities and killed five of 22 individuals diagnosed with anthrax, including two Postal Service employees. Anthrax spores can be killed, however, through a process known as irradiation, which renders anthrax in the mail harmless for humans. Detecting anthrax involves many types of activities, including developing a sampling strategy for deciding how many samples to collect, where to collect them, and what collection methods to use; collecting samples using, for example, dry or premoistened swabs; transporting samples to laboratories for extraction and analysis; extracting the sample material using specific procedures and fluids (such as sterile saline or water); and analyzing the samples using a variety of methods. To provide a coordinated clinical diagnostic testing approach for detecting anthrax and other bioterrorism threats, CDC, the Association of Public Health Laboratories, the FBI, and others collaboratively developed the Laboratory Response Network (LRN) in 1999. LRN laboratories (1) perform standard testing methods specified by CDC to either rule out or confirm the presence of anthrax and (2) provide public health organizations and others with rapid test results for use in making public health decisions. Generating a final test result involves both a presumptive and confirmatory test. Presumptive tests can be obtained within 2 hours and are considered “actionable” from a public health perspective. According to CDC, antibiotic medical treatment is recommended as soon as possible after the LRN has obtained a presumptive positive test result. Confirmatory tests take longer—generally 24 to 48 hours. The National Response Plan (NRP), which was developed by the federal government under the leadership of DHS, provides one part of the coordinated framework for how the United States will prepare for, respond to, and recover from domestic incidents. The Secretary of Defense, as well as the heads of 31 other federal departments and agencies, signed the Letter of Agreement contained in the NRP, indicating their agreement to abide by the NRP’s incident management protocols. The December 2004 plan includes a Biological Incident Annex, which specifies actions that agencies should take when they become aware of a possible threat involving a biological agent. The annex also identifies the roles and responsibilities of various agencies that would respond to such an event. For example, as specified in the annex, HHS is the primary federal agency for coordinating a public health response involving an actual or potential biological terrorism attack. Table 1 identifies selected agency actions specified in the NRP’s Biological Incident Annex. The other part of the federal framework is the National Incident Management System (NIMS), which was released in March 2004. NIMS is intended to provide a consistent and coordinated nationwide approach for federal, state, and local governments to work effectively and efficiently together to prepare for, respond to, and recover from domestic incidents, including those involving biological incidents, regardless of their cause, size, and complexity. NIMS applies to all levels of government, and for the federal government, including DOD, it is prescriptive. A key component of NIMS is the incident command system, which is designed to integrate the communications, personnel, and procedures of different agencies and levels of government within a common organizational structure during an emergency. Another key component of NIMS is the establishment of a joint information center—with representatives from all affected parties and jurisdictions—to provide a unified communication message to the public during emergencies. GSA and DOD have requirements for agencies to follow in protecting employees in mail facilities and ensuring effective mail operations. For example, GSA’s federal mail management regulation requires every federal agency and agency location with one or more full-time personnel processing mail to have a written mail security plan including, among other things, procedures for safe and secure mail room operations, plans for security training for mail employees, and plans for annual reviews of the agency’s mail security plan and facility-level mail security plans; and large agencies, such as DOD, that spend over $1 million annually on postage to annually (1) verify that facility-level mail security plans have been reviewed and (2) report to GSA that all facility-level mail security plans have been reviewed by a competent authority within the past year. GSA also issues guidance and recommendations for effectively managing mail programs, including recommendations on the content of mail security plans. For example, GSA recommends that agencies develop a communication plan for responding to threats that includes names and phone numbers to call during emergencies; establish and maintain partnerships with personnel who respond to emergencies (first responders); and create a program for training employees on how to respond to biological threats, including refresher training on a regular basis. DOD’s mail manual, effective December 2001, implements DOD’s mail- related requirements. DOD requires its components to comply with GSA’s federal mail management regulation, including the requirement that each mail center develop a written mail security plan and have it reviewed annually by a competent authority. Beyond mail-related requirements, GSA also requires the highest-ranking federal official of the largest agency in GSA-controlled (leased) office space to develop an occupant emergency plan. GSA guidance related to this requirement recommends that the occupant emergency plan describe, among other matters, critical information about the office space and actions to be taken during emergencies. The GAO Comptroller General’s Standards for Internal Control in the Federal Government provides the overall framework for agency management to establish and maintain effective internal control. Establishing effective internal controls is a major part of managing an organization. Such controls include the plans, methods, and procedures to be used to meet an organization’s mission, goals, and objectives by, among other things, monitoring performance, training employees, and ensuring that federal requirements, such as GSA and DOD mail security requirements, are followed. The Pentagon receives its mail from the Postal Service as well as from commercial courier services. The Postal Service irradiates almost all first- class mail delivered to the Pentagon and other federal agencies in the Washington, D.C., area, from its facilities on V Street, N.E. in Washington, D.C. (the V Street Operation). In March 2005, Pentagon mail was delivered from the V Street Operation to a mail-screening facility located within the Pentagon remote delivery facility—a 250,000-square-foot shipping and receiving facility adjoining the Pentagon. Technicians dressed in protective gear then screened the mail over a custom-designed table equipped with four filters intended to capture any particles that might fall from the mail. The table used a negative airflow system that was intended to keep microscopic particles from dispersing back into the mail-screening facility. At the time of the March 2005 incident at the Pentagon, employees of Vistronix Incorporated (Vistronix)—the Pentagon’s mail-screening contractor—collected and sent daily samples from each of the four filters to Commonwealth Biotechnologies Incorporated (CBI)—a private laboratory in Richmond, Virginia. Vistronix subcontracted the daily testing of the Pentagon’s mail to CBI. The opened mail was then shrink-wrapped and quarantined in a secure room until CBI notified Vistronix of negative test results by either fax or e-mail. Upon receipt of negative test results, a Vistronix employee released the mail from quarantine. Once released from quarantine, mail employees placed the mail into mailboxes at the Defense Post Office, where it awaited pickup by Pentagon employees. The TRICARE Management Activity (TMA) mail room at the Skyline Complex received and processed mail differently from the Pentagon. It received a small amount of its mail from the Pentagon, but most of its mail came from a Postal Service facility in Merrifield, Virginia, according to a TMA mail room official. The TMA mail room had a biosafety cabinet, an X- ray machine, and two full-time employees. The biosafety cabinet had a negative airflow system with filters for capturing and holding any particles that fell from envelopes or packages being opened. While the cabinet was used for mail screening, it was not capable of detecting anthrax. The two incidents involving the suspicion of anthrax occurred over several days, but the most significant actions occurred the same day—Monday, March 14, 2005. The Pentagon incident occurred first and was the result of positive test results for anthrax in the mail. The Skyline Complex incident occurred later that day when an alarm sounded on the biosafety cabinet that employees took as a sign that contaminated mail had been passed from the Pentagon to the Skyline Complex.