Modeling attacks on the food supply

The publication in this issue of PNAS of the article by Wein and Liu (1) titled “Analyzing a bioterror attack on the food supply: the case of botulinum toxin in milk,” raises important issues concerning the type of information that should be presented in the open scientific literature.

Through the work of the National Academies on homeland security issues, the National Academy of Sciences (NAS) has been at the forefront of the critical effort to find the appropriate balance between openness and secrecy since 9/11 (for example, see refs. 2–6). Of particular relevance to this case is the National Academies' report Biotechnology Research in an Age of Terrorism (the “Fink report”; ref. 3). This report, prepared by a committee of security experts and scientists, carefully considered the balance between openness and secrecy with regard to minimizing both bioterrorism and naturally occurring infectious diseases. The report recommended a specific system of self-governance by scientists that is now being established in the United States. But the committee also recognized the need for government advice, guidance, and leadership for the scientific community's system of review and oversight. For this purpose, the committee proposed the creation of a high-level National Science Advisory Board, whose tasks should include providing “case-specific advice on the oversight of research and the communication and dissemination of life sciences information that is relevant for national security and biodefense purposes” (3).

The Fink report was released in October 2003, and the establishment of the recommended high-level board, the National Science Advisory Board for Biosecurity (NSABB), was announced in March 2004 by the then-Secretary of the U.S. Department of Health and Human Services, Tommy Thompson. The NSABB's first meeting is scheduled to take place on June 30, 2005, but it will take considerably more time for the board to become truly operational (see www.biosecurityboard.gov/news.asp). Given the controversy concerning this publication (see below), we suggest that the Wein and Liu article be used by the NSABB as a case study to help guide both the government and the scientific community in further matters of this kind.

It is important to recognize that publishing terrorism-related analysis in the open scientific literature can make the nation safer in at least two different ways. First, science can make many important contributions to the design of our defenses. Because science advances through the combination of knowledge in unexpected ways, the discoveries of each individual scientist must be made available to a wide variety of other scientists, who can then either build upon or criticize them. This scientific free-for-all in the open literature leads to a refinement of the original findings that will, over time, always make any analysis much more reliable and better understood. In addition, new ideas to improve our defenses will often come from unanticipated sources that cannot be predicted in advance. In this case, for example, it may well be possible to find new methods for detecting the presence of botulinum toxin in milk that are much more reliable than the presently used assays, and so the speed, sensitivity, and specificity required for an optimal assay should be broadcast as widely as possible.

There is a second advantage to openness. Protecting ourselves optimally against terrorist acts will require that both national and state governments, as well as the public, be cognizant of the real dangers. If the types of calculations and analyses in the Wein and Liu article are carried out only by government contractors in secrecy, not only are the many actors in the U.S. system who need to be alerted unlikely to be well informed, but also the federal government itself may become misled—either greatly overestimating or underestimating the seriousness of a particular danger relative to other concerns. The Wein and Liu article has been widely circulated in preprint form, generating a great deal of discussion. For this reason, we are already aware of scientists who plan to publish challenges to some of its conclusions. This type of give-and-take lies at the heart of scientific progress and is precisely why scientific analyses are made available in the open literature. Most importantly, this normal scientific process has proven to be highly effective in establishing the broad base of reliable knowledge that the government requires for wise decision-making.

The great advantage of openness in science must, of course, be weighed against the possibility that a particular publication could hamper national security by improving our defenses to a lesser extent than it potentially aids terrorists. The NAS takes very seriously our obligation not to publish information that could compromise national or homeland security; consequently, we have decided to publish the Wein and Liu article only after the extensive review process described in the following paragraphs.

The review of the paper was initially carried out by normal PNAS procedures (7). Dr. Barry R. Bloom, Dean of the Harvard School of Public Health, served as the supervising editor, and he obtained separate reviews from experts in mathematical modeling, in botulinum toxin, and in biosecurity. Possible security issues were explicitly recognized during the PNAS review by following the recommendations in the National Academies' Fink report. To prevent dangerous information from reaching the hands of terrorists, that committee recommended a system of self-governance by scientists in which scientific journals are to apply special scrutiny to publications that:

1. Would demonstrate how to render a vaccine ineffective;

2. Would confer resistance to therapeutically useful antibiotics or antiviral agents;

3. Would enhance the virulence of a pathogen or render a nonpathogen virulent;

4. Would increase transmissibility of a pathogen;

5. Would alter the host range of a pathogen;

6. Would enable the evasion of diagnostic/detection modalities; or

7. Would enable the weaponization of a biological agent or toxin.

The PNAS review considered both the above criteria and a more general sense that our publication of an article must not constitute a “roadmap for terrorists” by providing anyone who intends to do harm with key information that is otherwise difficult to obtain. Our reviewers and members of the PNAS Editorial Board decided that this was not the case. All of the critical information in this article that could be useful to a terrorist—in particular, the LD₅₀ dose of botulinum toxin for humans, toxin heat sensitivity, milk pasteurization conditions, and the size of the milk containers into which milk collections are pooled for pasteurization—are immediately accessible on the World Wide Web through a simple Google search.

After being revised as specified by the scientific review, the Wein and Liu article was approved for publication in PNAS on April 20, 2005. The authors' uncorrected proof in PDF format then was provided under embargo to reporters, with anticipated online publication during the week of May 30. Publication was delayed, and the embargo extended, in response to a May 27 letter to me from Stewart Simonson, Assistant Secretary for Public Health Emergency Preparedness of the U.S. Department of Health and Human Services.

NAS and PNAS representatives met with government representatives to discuss their specific concerns about the Wein and Liu article on June 7. Following this meeting, the Council of the National Academy of Sciences decided to publish the article as originally accepted (after a standard round of final copyediting), accompanied by this editorial to make clear our reasons for doing so.

To summarize, we are convinced that the guidance offered in this article on how to anticipate, model, and minimize a botulinum toxin attack can be valuable for biodefense. The details of the mathematics used are presented in a lengthy Supporting Appendix for others to criticize and improve upon. The modeling is useful in demonstrating what changes can and cannot improve our safety. At the same time, three simple facts that are available to anyone interested are sufficient to reproduce the lethality of various doses of the toxin calculated in the Wein and Liu article within a factor of 10—using no mathematics except simple arithmetic. These are the LD₅₀ of the toxin, the size of the pasteurization tanks, and the average amount of milk drunk per person in a household. The authors acknowledge that such unknowns as the true LD₅₀ for humans and the effects of pasteurization on the toxin make their own estimates good only to orders of magnitude. A terrorist who wants to do great damage will therefore not find anything in the article that is likely to increase his or her certainty concerning the minimum level of toxin to use, and we can detect no other information in this article important for a terrorist that is not already immediately available to anyone who has access to information from the World Wide Web.

As pointed out in the Wein and Liu article, one of the most critical variables in estimating the effects of the introduction of botulinum toxin into our milk supply is the percentage of deliberately introduced toxin that will be inactivated by milk pasteurization procedures. We learned in our discussion with government representatives that a great deal has been done to improve the pasteurization of milk since 9/11, and Wein and Liu may have underestimated the possibilities in this regard. But although we appear to be considerably safer from an attack than they have calculated, both these improvements in pasteurization and the important Food and Drug Administration guidelines for protecting the U.S. milk supply described in the article are voluntary. There is, therefore, everything to be gained by alerting the public and state governments to the dangers so that they can help the federal government in its ongoing, highly laudatory attempts to reach 100% compliance with its guidelines.

In closing, it is important to note that the scientific community has an enormous amount to contribute to both national security and homeland defense. To optimize these contributions, it will be critical to “build high fences around narrow areas,” as emphasized in National Security Decision Directive 189, issued in 1985 (8), while permitting free scientific debate in areas that can provide valuable information for improving our ability to defend against terrorism.