Biosafety in DIY‐bio laboratories: from hype to policy

Abstract

Policymakers should treat DIY‐biology laboratories as legitimate parts of the scientific enterprise and pay attention to the role of community norms.

DIY biology – very broadly construed as the practice of biological experiments outside of traditional research environments such as universities, research institutes or companies – has, during the past decade, gained much prominence. This increased attention has raised a number of questions about biosafety and biosecurity, both in the media and by policy makers who are concerned about safety and security lapses in “garage biology”. There are a number of challenges here though when it comes to policies to regulate DIY biology. For a start, the term itself escapes easy definition: synonyms or related terms abound, including garage biotechnology, bio‐hacking, self‐modification/grinding, citizen science, bio‐tinkering, bio‐punk, even transhumanism. Some accounts even use ‘DIY‐bio’ interchangeably with synthetic biology, even though these terms refer to different emerging trends in biology. Some of these terms are more charged than others but each carries its own connotations with regard to practice, norms and legality. As such, conversations about the risk, safety and regulation of DIY‐bio can be fraught.

Synonyms or related terms abound, including garage biotechnology, bio‐hacking, self‐modification/grinding, citizen science, bio‐tinkering, bio‐punk, even transhumanism.

Given the increasing policy discussions about DIY‐bio, it is crucial to consider prevailing practice thoughtfully, and accurately. Key questions that researchers, policy makers and the public need to contemplate include the following: “How do different DIY‐bio spaces exist within regulatory frameworks, and enact cultures of (bio)safety?”, “How are these influenced by norms and governance structures?”, “If something is unregulated, must it follow that it is unsafe?” and “What about the reverse: does regulatory oversight necessarily lead to safer practice?”.

The DIY‐bio movement emerged from the convergence of two trends in science and technology. The first one is synthetic biology, which can broadly be defined as a conception of genetic engineering as systematic, modular and programmable. While engineering living organisms is obviously a complex endeavour, synthetic biology has sought to re‐frame it by treating genetic components as inherently modular pieces to be assembled, through rational design processes, into complex but predictable systems. This has prompted many “LEGO” metaphors and a widespread sense of democratisation, making genetic engineering accessible not only to trained geneticists, but also to anyone with an “engineering mindset”.

The second, much older, trend stems from hacker‐ and makerspaces, which are – usually not‐for‐profit – community organisations that enable groups of enthusiasts to share expensive or technically complex infrastructure, such as 3D printers or woodworking tools, for their projects. These provide a model of community‐led initiatives based on the sharing of infrastructure, equipment and knowledge. Underpinning these two trends is an economic aspect. Many of the tools of synthetic biology – notably DNA sequencing and synthesis – have seen a dramatic drop in cost, and much of the necessary physical apparatus is available for purchase, often second‐hand, through auction sites.

DIY‐bio labs are often set‐up under widely varying management schemes. While some present themselves as community outreach labs focusing on amateur users, others cater specifically to semi‐ or professional members with advanced degrees in the biosciences. Other such spaces act as incubators for biotech startups with an explicitly entrepreneurial culture. Membership agreements, IP arrangements, fees, access and the types of project that are encouraged in each of these spaces can have a profound effect on the science being done.

The regulatory picture is often misunderstood and misreported

Since DIY‐bio emerged almost directly from the democratisation implicitly promised by synthetic biology, fears about DIY‐bio are often manifestations of fears about synthetic biology itself. Some critics claim – falsely – that synthetic biology is “virtually unregulated” (https://foe.org/projects/synthetic‐biology/), and DIY‐bio spaces would be simply an even riskier, less regulated extension. On top of this, DIY‐bio has been seen philosophically as having “a streak of anti‐establishment at heart” (Wall, 2015). At a more practical level, sweeping and unsupported concerns have been raised that, for instance, “most DIY biologists have little or no formal training in safety and ethics” or, again, that they enjoy “unregulated status” (Kolodziejczyk, 2017).

Since DIY‐bio emerged almost directly from the democratisation implicitly promised by synthetic biology, fears about DIY‐bio are often manifestations of fears about synthetic biology itself.

These misapprehensions can reach policy‐relevant audiences. In their submission to the Convention on Biological Diversity, the environmental NGO EcoNexus claim that “[t]raditional approaches to the regulation of work places (including safety issues) and products cannot provide any risk assessment in such settings”, that there is “an apparent lack of risk awareness, risk management and safety procedures” and, referring to specific legislation, that “‘contained use’ is defined differently to garage biotech facilities” (https://www.cbd.int/doc/emerging‐issues/econexus‐synthetic‐biology‐2011‐013‐en.pdf). However, they present little‐to‐no evidence for any of these claims.

When regulation of DIY‐bio is reported on, it too can be sensationalised and raise the impression that regulators share the extreme concerns of such NGOs. For instance, it has been claimed that “Germany is Threatening Biohackers with Prison" (https://gizmodo.com/germany‐is‐threatening‐biohackers‐with‐prison‐1792143993); this has been uncritically repeated in newspapers, science blogs (https://theplosblog.plos.org/2018/05/biosecurity‐do‐synthetic‐biologists‐need‐a‐licence‐to‐operate/) and academic papers (Gronvall, 2018), not to mention content aggregators and Internet forums. The statement “[c]ertain countries such as Singapore are considering issuing licenses so that biohackers will have to pass ethics and safety tests or risk fines or jail" (Kolodziejczyk, 2017) gives a similar impression, with no evidence. In truth, both of these statements refer merely to existing and long‐standing health and safety legislation being applied to DIY‐bio settings, as one would expect it to.

When regulation of DIY‐bio is reported on, it too can be sensationalised and raise the impression that regulators share the extreme concerns of such NGOs.

The regulatory situation as it stands

Few‐to‐no governments have laws in place specifically concerning DIY‐bio; this is part of why it is often assumed that the field is unregulated. Similar criticisms have been levelled at synthetic biology as a whole. In fact, “regulation need not be specific to a particular scientific field in order to be applicable to it” (Rhodes, 2014) and there are frequently several layers of regulatory and legal oversight that are already ‘on the books’ (Bar et al, 2012).

Legislation and regulation concerning “work with biological organisms” is often spread across different instruments, which reflects the varied purposes of these tools. When it comes to biosafety, there are several overlapping desired outcomes for legislation. Biological research is predominantly performed by people, so protecting them from harm is naturally at the fore. Concerns about public safety usually stem from concerns about public health and infection – by workers whose own safety has been compromised – or, in the case of agricultural or pharmaceutical biotechnology, the safety of products. More recently, environmental safety is also addressed. Frequently, the different aims – protecting practitioners, protecting the public, protecting the environment – manifest as operationally similar rules and guidelines around registration, control measures and accident reporting.

Of course, there are numerous governance mechanisms beyond biosafety and biosecurity legislation that effectively regulate biotechnology, and many of these have implications for DIY biologists. For instance, intellectual property rights, trade agreements and export controls may restrict or allow the flow of materials and knowledge.

While much of the DIY‐bio discourse exists online, its practitioners often live in different national contexts. This trend is likely to continue, as access to the physical equipment needed for genetic engineering itself continues to improve. These national contexts can have different legal tools in place when dealing with biotechnology. The difference between the USA and the UK, for instance, is stark. In the latter, genetic modification in any locale must be notified to the Health and Safety Executive, owing to a definitional expansion of a law originally intended for an employment context. The GMO(CU) Regulation 4 “ensures that all contained uses, irrespective of who carries them out, fall within the scope of the Regulations and general duties of the HSW Act” while the COSHH Regulations cover “any persons carrying out such an activity”, for “any activity involving the consignment, storage or use of a Group 2, 3 or 4 biological agent”. The USA has no such definitional expansion, and therefore no similar blanket GM regulation; the upshot is a perceived “freewheeling” (Olmstead, 2017) approach to regulating DIY‐bio labs.

In the EU, DIY‐bio practitioners must adhere to the “blanket” EU Directive 2009/41/EC on the contained use of genetically modified micro‐organisms if they wish to perform such work legally, no matter their institutional or commercial context. Directive 2000/54/EC on the protection of workers from risks related to exposure to biological agents at work is also relevant, dealing with non‐GM uses. These Directives are implemented in each Member State through national legislation. In the UK, for instance, these processes are administered by the Health and Safety Executive, and this continues to be the case post‐Brexit. Importantly, and unlike the situation in the USA, this legislation applies regardless of whether the activity occurs in the context of employment or not.

Because the regulation of GMOs at the federal level in the USA proceeds largely around “product” rather than “process”, the relevant authorities are the Food and Drug Administration, Environmental Protection Agency and Department of Agriculture under the Office of Science Technology Policy’s Coordinated Framework for Regulation of Biotechnology. They usually only become involved once a particular product is envisaged as being destined “for the market” or released from the laboratory context including for field trials. Thus, it is not necessary to obtain any particular permit for conducting GM work per se, as long as the products of this research do not fall foul of the product‐based regulations covered by these agencies. That said, there are some guidelines and regulations that might encompass possession and work with biological organisms. These include the Select Agent Rules, the National Institutes of Health Guidelines for Research Involving Recombinant Molecules and OSHA legislation. Of these, the Select Agent Rules are the only “blanket” provision that apply to “any individual or entity” (Centers for Disease Control and Prevention (CDC), 2017). Beyond this, OSHA rules apply solely to employment or commercial contexts, and the NIH guidelines only to institutions where any participant receives NIH funding. Importantly, while this means that DIY‐bio laboratories are not governed by any legal mechanism beyond the Select Agent Rules – or local statutes such as in the city of Cambridge MA – this is also true of any laboratory that operates without NIH funding.

Overall, current legislation rarely addresses DIY‐bio spaces as a separate locus in need of regulation in most countries. While there is no overall DIY‐bio‐specific legal framework, these spaces operate in the same legal landscape as conventional laboratories. As a result, any attempt to develop policy for these spaces must be considered carefully within an already complex regulatory milieu. Moreover, any such attempt should include honest reflection about the outcomes that these tools seek to achieve, and whom they might affect: whether regulation beyond what already exists is really necessary. Are there compelling reasons to regulate, beyond being able to say “this is regulated”?

While there is no overall DIY‐bio‐specific legal framework, these spaces operate in the same legal landscape as conventional laboratories.

Other regulations and rules

Aside from legislation, there are other mechanisms that influence practice in DIY‐bio laboratories and, again, there are different levels at which these operate. DIYbio.org, an online resource devoted to the practice of DIY biology, is making a global community‐wide effort most notably by its Codes of Ethics (https://diybio.org/codes/). Several DIY‐bio entities have extensive publicly available information on their websites and so can have a strong normative role to play in both letter (the “nuts and bolts” of how safe laboratory practice should take place) and spirit (reiterating commitments to ethics, responsibility and other key values). Individual laboratories often have policies with a direct effect on the culture of biosafety, even though those policies may not always explicitly have that as a goal. For instance, a policy of only allowing group projects can lead to additional internal scrutiny.

One issue that policy makers should consider is the potential of “the GMO question” to overshadow biosafety. In the UK, for example, any “first‐use” experiment involving genetic modification requires notification to the HSE, whereas non‐GM work at Hazard Level 1 does not. Because there is no proactive step elicited here, this could be misconstrued as meaning that a non‐GM experiment requires no action. That is not the case, however: work even at this level requires risk assessment and the adoption of certain protective measures. It is not difficult to imagine a scenario where a practitioner, aware that GM work requires notification, opts to do a non‐GM experiment instead, with the flawed belief that no protective action needs to be taken. This could easily become problematic if, for example, practitioners decided to culture bacteria from environmental samples. They may not realise that their sample might contain pathogenic bacteria, placing the experiment (and premises) firmly in Hazard Group 2, not to mention themselves at risk of harm. This is not to argue that any and all biological work should require notification. Not only would this be wholly unnecessary from a safety perspective, it would also represent a huge increase in workload for practitioners – many of whom do follow the guidance – and regulators. It is, however, an important point to consider when engaging in conversations about the safety and regulation of DIY‐bio: regulation can be understood in unexpected ways, but the details matter.

The policy audience is unclear in both size and scope

In order to apply effective policy to a particular field, it is necessary for that field to be understood as one and this is difficult in DIY‐bio. At the moment, DIYbio.org’s DIYbiosphere project (https://sphere.diybio.org/) is the closest there is to a comprehensive directory of organisations that self‐identify with the term. However, the directory has some gaps, partly owing to the fact that it is crowd‐sourced and may not be completely up to date. Moreover, there is a large variety of groups interested in DIY‐bio: physical laboratories, online networks, one‐off events, non‐biological makerspaces, to name a few. There is also the difficulty that several high‐profile examples of non‐institutional biology, such as some proponents of pharmaceutical self‐injection, for example, may operate outside the groupings that DIYbiosphere is able to capture, and their numbers, scope and practices are difficult to assess without depending on perhaps sensationalised media accounts. In turn, these individual actors may not represent the bulk of DIY‐bio activity, but end up receiving outsized attention, perhaps even from policy makers. Practitioners engaging in more traditional types of work may want to distance themselves from what they see as extreme behaviour; indeed, some users of community laboratories do not consider themselves DIY biologists at all, largely due to how they see the more extreme practitioners portrayed. On the other hand, there is an argument to be made that including these more “extreme” activities under the DIY‐bio umbrella is an opportunity to better understand what is actually going on and perhaps exert some influence. As a consequence, it is difficult to know “what’s out there” in the realm of non‐institutional biology. Policy makers should therefore be mindful of this non‐homogenous landscape when deciding on their intended audiences.

Institutional policies can reach non‐Institutional Spaces

Many in the DIY‐bio community have extensive experience of working in institutional laboratories – indeed, many hold “day jobs” there – and so naturally use those spaces as a comparator. Furthermore, many DIY‐bio initiatives have close associations with universities or research centres, whether this is in terms of physical premises, monetary sponsorship, partnership or mentorship. As a result, many safety practices within DIY‐bio spaces can be easily adopted from institutional ones: this is often the quickest way to establish internal policies rather than “reinventing the wheel”. A now‐defunct project, a collaboration between DIYbio.org and the Woodrow Wilson Center for International Scholars’s Synthetic Biology Project, “Ask a Biosafety Expert” sought to provide this service by having a panel of biosafety experts answer anonymously‐submitted questions from the DIY‐bio community. As well as providing authoritative safety information and contact details for local biosafety experts and regulators, such a service could act as an informal means of “taking the temperature” of the community, of understanding what sorts of issues practitioners are wondering about, what new trends are emerging. This in itself could be a valuable resource for setting policy. Whether in person or online, empowering and equipping existing biosafety groups to engage with local non‐traditional actors and vice versa could be a beneficial use of existing biosafety capacity.

“many safety practices within DIY‐bio spaces can be easily adopted from institutional ones: this is often the quickest way to establish internal policies rather than ‘reinventing the wheel”.

A similar but far more comprehensive initiative is the Community Biology Biosafety Handbook, launched in 2020 (Armendariz et al, 2020). The near 300‐page open‐source document is intended as a “shared foundation” for community laboratories of any size and scope. With a focus on biosafety, the handbook covers virtually every aspect of establishing a community laboratory including access arrangements, laboratory design, emergency procedures, risk assessments and PPE, material transfer, waste management, and, of course, a discussion of national biosafety regulations. The authors come from a combination of community laboratory and “established” backgrounds: one, for example, served as the president of the American Biological Safety Association until 2020. In so far as the institutional approach to biosafety can be considered the “gold standard”, there are thus clearly opportunities for such traditional biosafety actors to have impact: the collaborative nature of a “living” document like the Handbook is an example of active community engagement, rather than top‐down regulations alone.

Further recognition that biosafety needs to be a key component of DIY‐bio work is demonstrated by Just One Giant Lab (JOGL)’s OpenCOVID‐19 project (https://app.jogl.io/program/opencovid19). This is an online international collaboration to tackle several aspects of the current pandemic using open‐source tools and community engagement, including DIY biology. Given that experimentation related to a pathogenic virus – even one that is circulating freely – obviously requires care, a key part of the project was the establishment of a dedicated Biosafety Advisory Board.

The “gold standard” needs evaluation

Whether through application of the legal standard or through deeply ingrained habit, many DIY‐bio practitioners behave, or seek to behave, very similarly in community spaces as they do or used to in institutional labs. However, this may not always be the appropriate standard, either in practice or in theory. How well laboratory biosafety is practised in institutional settings clearly varies. This can result from the national regulatory context but is often a matter of culture in individual labs or departments. The pressures of academia or industry (to obtain results fast, and to publish; pressures that likely do not apply to DIY biologists in the same way) can result in corners being cut. Moreover, the knowledge that experiments are being done in a “sanctioned” space can bring about a certain complacency towards biosafety. In DIY‐bio laboratories on the other hand, if practitioners wish to abide by biosafety best‐practice, legally required or not, they are likely to be intimately involved with the day‐to‐day application of it, from obtaining GM permissions to performing and writing risk assessments. In an institutional setting, these tasks are usually undertaken by the Principal Investigator who, though retaining overall responsibility for the project, will rarely be the person performing the experiments. So, the very fact that DIY biologists are required to participate in creating a safety infrastructure could be an opportunity for greater sensitisation and engagement.

This situation may change, however, as DIY‐bio gains in popularity and as these spaces become established, as practitioner numbers increase, as procedures become routine: as DIY‐bio laboratories come to resemble traditional labs. At a certain point, a “train the trainers” quasi‐hierarchical biosafety system may see messages diluted. This is, however, the same issue that is continuously faced by traditional laboratories, where new students and staff are trained by existing lab‐members and where, as a result, those existing lab‐members’ quirks and foibles get passed on as well.

A more theoretical approach to the question of whether institutional laboratories are an appropriate “gold standard” deals with residual risk: the additional risks that all practices of biological science are likely to face regardless of existing control measures. For example, despite control measures being in place and ever more sophisticated screening methods being implemented, it is nevertheless possible to order complex genetic constructs online. Desktop synthesis is on the horizon, and this will present challenges for the governance of both institutional research and non‐institutional research. It is not clear that challenges such as these can be usefully delineated based on where the work is done. As Todd Kuiken, an expert in DIY biology governance argues, traditional biosafety may have much to learn from DIY‐bio communities and their tools, such as Codes of Conduct, decentralised governance and an overall proactive approach, which may be more appropriate means of handling novel technologies such as gene editing (Kuiken, 2016).

Would a DIY‐bio space truly be a more amenable venue for a “bad actor” than a conventional laboratory? Conversations about the security of DIY‐bio spaces often lead to theoretical “loopholes” by which a “bad actor” could remain undetected while cooking up nefarious experiments. More often than not, such “loophole scenarios” exist in conventional laboratories too. What exactly would prevent a “bad actor” from seeking and obtaining a position at a traditional institution, and is there evidence that those safeguards are missing from DIY‐bio? DIY‐bio spaces often engage in in‐person discussions with potential members prior to awarding membership, akin to a job interview for an institutional research position. Few university laboratories have published and easily accessible Codes of Conduct, let alone Codes of Ethics. Although its enforcement power is limited, there are published community‐wide DIY‐bio Codes of Ethics with strong normative reinforcement: many DIY‐bio spaces link to them on their own websites and use them as a basis for local Codes that members must sign. Thus, beyond a very few check points, much institutional science appears to rely on the same informal, normative mechanisms as communal DIY‐bio spaces: the power of joint working and trust. Codes and regulations governing practice, whether applied to institutions or DIY‐bio, are not written with dedicated lawbreakers in mind as an audience and so it is necessary to go beyond regulation here and look at culture.

What exactly would prevent a ‘bad actor’ from seeking and obtaining a position at a traditional institution, and is there evidence that those safeguards are missing from DIY‐bio?

Organisational structures and internal policies as indicators of practice

The way that many DIY‐bio spaces have been set up is to intentionally promote a culture of trust, accountability and responsibility. Apart from publishing Codes of Conduct and/or Ethics, specific internal policies can foster a certain atmosphere. For example, buddy systems and group projects promote a culture of safety and internal scrutiny, but also contribute to a higher likelihood of success in the experimental outcome. Numerous clear lines of communication between management and members are another indicator that problems are likely to picked up at an early stage. Engagement in collaborations with other groups including universities and companies also encourages transparency in how internal practice proceeds. From a policy perspective, the existence of these internal systems, even when they do not explicitly relate to biosafety, can be useful signposts that promote responsible and safe behaviour.

An underreported motivation for DIY‐bio practitioners is almost academic in nature: a desire to practice scientific research of the same calibre as in conventional laboratories, to learn new laboratory skills and gain experience in managing and conducting research. These members do not join in order to gain access to the technology needed to achieve a specific preconceived goal. They join in order to develop such a goal collaboratively and work towards it as a team. Thus, to view DIY‐bio spaces merely as toolboxes that accelerate amateurs’ perhaps dangerous or misguided projects is inaccurate. A desire to perform “good science” in these spaces can also translate to a high degree of care in terms of biosafety practice. An experiment that is done without contamination is likely to have been done with appropriate containment, and the result is a successful, but also safe experiment. Moreover, many DIY‐bio practitioners will be keenly aware of the reputational risks that can come from poor practice, biosafety‐related or otherwise. If the intent of policy makers is to promote safe behaviour, then, one way of doing this might be quite simply to take DIY‐bio seriously as a valued setting for scientific research. To accept that work from non‐traditional locales can produce research at a “competitive” standard could be an incentive to achieving that standard – scientifically, but also in terms of safety.

For many DIY biologists, the incentives for undertaking their work are similar to those in institutional settings: a desire to perform “interesting” and challenging experiments, frequently with an aim of achieving some notion of “public good”. This is demonstrated by the OpenCOVID‐19 project, but also in other, pre‐existing initiatives, such as the institutionally supported Biomaker Challenge (https://www.biomaker.org), where one of the aims is to use the methods of DIY biology to help institutional research in low‐resource settings. Thus, the boundaries between institutional and community biology are already porous and are likely to become more so. As the structures surrounding scientific experimentation continue to change, as models of ownership and access evolve, often facilitated by increased digitisation, it should not be forgotten however, there is a ultimately a physicality to biological experimentation that cannot be denied: that physicality will always have consequential biosafety implications. But by seeing DIY biology as a welcome part of the changing ecosystem of “how biology is done”, rather than as an aberrant wild west, policy makers can not only ensure that society can benefit from it but do so safely.

For many DIY‐biologists, the incentives for undertaking their work is similar to those in institutional settings: a desire to perform “interesting” and challenging experiments…

EMBO Reports (2021) 22: e52506.