Transcript Bioterrorism: Investigation & Prosecution: Anthrax 2001 as
Bioterrorism: Investigation & Prosecution Anthrax 2001 and Beyond
Randall S. Murch, Ph.D
.
Center for Technology, Security and Policy Virginia Polytechnic Institute & State University (Virginia Tech) National Capital Region, Alexandria, VA, USA & Department of War Studies, King’s College London, UK
Key Investigative & Prosecutive Questions
• • • • • • • • • •
Did A Crime (Event of Interest) Occur?
What Happened?
How Did It Occur?
When Did It Occur?
Where Did It Occur?
Why Did It Occur?
Who Was Involved?
What Evidence Exists? What Does It Tell Us? How Strong are the Links?
How Reliable and Credible is the Evidence?
What Alternative Explanations are There for the Evidence?
Similar Questions for Intelligence and Policy as Well?
“Amerithrax”
• Anthrax laden letters mailed 17 – 18 Sept (5 media sites) and 6 – 9 Oct 2001 (US Capitol), both mailings originating from Princeton, NJ • 5 dead inhalational, up to 17 infected– inhalational, cutaneous; Florida, Washington, DC area, New York City/Connecticut • Investigation launched immediately with 1 August 2008 with purported identification of suspect (Ivins, USAMRIID) st victim (FL media), closed • 7-year investigation; estimated $1B direct/indirect measurable costs; terror/fear/uncertainty; massive investments in new biosecurity R&D, system deployment/O&M and preparedness programs; misidentification of suspects (lawsuit, settlement), suspected foreign group/country involvement; endless commentary and speculation from many quarters on various aspects (continues); realization of many vulnerabilities and shortfalls (many remain) Confirmation that “a little can go a long way (make a big mess)…”
Elements of the Crimes
• Was a Crime Committed?
– Microbe used as a weapon with delivery system, could not have originated from natural contamination or accident – Resulted in death and illness – Damage to and misuse of Government-owned property and infrastructure – …….
• Violations of Federal law (Indictment, Prosecution) •
Terrorism
• • • • •
Misuse of biological agents (Biological Weapons Antiterrorism statute) Homicide and attempted homicide “Property” and “misuse” elements Interstate elements ………..(here’s where the prosecutors would have “piled on”)
Course of the Investigation
• Numerous Avenues Pursued – Traditional Investigation, Positive/Negative – Intelligence and Foreign, Positive/Negative – Scientific/Forensic • Numerous Twists, Turns, Dead Ends; External Speculation, Distractions and Stimuli • Science (Ostensibly) Provides Vital Link and Aids in Narrowing Possible Suspects and Sources of “Microbe of Interest”: Q samples (at least two batches)—letters, victims, mailbox, sites to Dugway and USAMRIID • Investigation Focuses on Limited Number of Possible Suspects (Process of Elimination/Inclusion) Ivins
Standards of Proof in US System
• No Cause or Suspicion • Reasonable Suspicion (Events/Circumstances, Contacts, Interviews/Interrogation, Non-Intrusive Methods —No Expectation of Privacy) • Probable Cause (Arrest and Search Warrants, Orders) • Beyond A Reasonable Doubt (Trial, Conviction: What Does a Reasonable Juror Believe?) •Investigation is a Process Which Seeks, Gathers, Develops, Analyzes, Weights and “Packages” Positive and Negative Information and Evidence To Exonerate the Innocent and Prosecute and Convict the Guilty •Evidence is Additive and Subtractive, Reinforcing and Conflicting; Analytical and Interpretative Process is Primarily Not Quantitative, Rather Qualitative and Relies on Human Judgment
• • • • • • •
What We Think We Know (1)
From affidavit in support of a search warrant for Ivins’ house, three vehicles and a safe deposit box At time of attacks, Ivins was custodian of highly purified anthrax that is genetically “identical” to the anthrax analyzed from the attacks (sole custodian of stock culture since 1997 when originated; free access to suite at USAMRIID where stock culture kept) No satisfactory explanation provided for Ivins’ late night laboratory access contemporaneous with the attacks Ivins claimed that he was suffering from serious mental health issues in the months preceding the attacks (to co worker: “incredible paranoid, delusional thoughts at times”) Ivins believed to submit false samples of anthrax for forensic analysis to mislead investigators At time of attacks, Ivins was under pressure to assist company which produced anthrax vaccine and had lost FDA approval; believed vaccine essential for force protection Ivins sent email contemporaneous with attacks with language similar to mailed letters containing anthrax Ivins and wife reportedly had issues with Sens. Leahy and Daschle; Ivins had obsession with sorority, sorority office in Princeton near mailbox used for mailings
• • • • • • •
What We Think We Know (2) Scientific Evidence Publicly Briefed & From Affidavit
• • • • Spores were produced between 1999 – 2001 Two different batches produced No substances were added to make them more dispersable Silicon and oxygen were present in the spore coat, not on the exterior; silicon “signature” not previously described for
B. anthracis
Wild-type
B. anthracis
Ames, with significant numbers of phenotypic variants (substrains); “Unique” phenotypic variants could be detected by 4 indel polymorphisms Of 1070 in known Ames cultures (16 U.S. labs, Canada, Sweden, U.K.), 8 contained all four polymorphisms, none had three out of four, few contained one or two; of 8 that contained all four, all of the 8 with all four polymorphisms were directly related to a single Ames culture (RMR-1029) Presence of
B.subtilis
as contaminant in one set of letters but not the other, suggesting two separate culturing events; genetic analysis of
B. subtilis
demonstrated dissimilarities with other known cultures; RMR-1029 indicated as source for
B. anthracis
in all Q samples (inferred but not stated directly) Source of envelopes used in mailings narrowed to certain distribution sources and Virginia and Maryland; proximity between source of envelopes and source of anthrax Other – “Spores were produced in northeast U.S.” – Trace evidence, tape and ink available for comparison (letters, mailbox)
What We Don’t Know or Have: Examples
• “Smoking gun” (not likely ever will, no eyewitnesses nor Ivins caught in the act) • Specific whereabouts of Ivins during key events related to attacks • Interviews of all co-workers, associates, supervisors, laboratory management • Interviews and investigation of all others at USAMRIID who had access to RMR-1029 stock culture and proximate laboratory facilities • Investigation and interviews of those knowledgeable about and in possession of laboratory access schedules, security procedures, documentation • Details of investigation conducted in community (neighborhood, church, etc) (some reported in media) • Surveillance logs • Cooperating witness interviews Documents Likely Forthcoming, Currently Under Review by FBI and DOJ
The Media and Politics
• Seven year parade of speculators, “experts”, conspiracy theorists, “forensic investigators”, investigative reporters (credentialed, non-credentialed),
most of whom were wrong all or in part
; culminating in media flurry with the identification of Ivins as prime suspect and suicide. – Critically assess: What are the drivers, motivations and agendas for those who rendered “expertise” and opinion?
• Various hearings, particularly recently with identification of Ivins and likely closing of case: summary “FBI evidence not conclusive or convincing, many questions remain unanswered” – Critically assess: What are the drivers, motivations and agendas?
My Skepticism of “Skeptics” and “Talking Heads” • Relevant Knowledge • Relevant Credentials • Relevant Expertise and Experience • Personal Agendas • Personal and Professional Motives • Political Agendas • Personal and Professional Liability
“Forensic Science 101”
Forensic Science
• Application of science in the investigation of legal matters • Scientific knowledge and technology are used to serve as witnesses in both criminal and civil (intelligence) matters • Science may not offer definitive solutions for all scenarios; it does provide a special investigative role • Goal is “attribution” – i.e., who committed the crime
Four Mission Areas
PREVENT Terrorism by tackling underlying causes To reduce the THREAT PURSUE Terrorists and those That sponsor them To reduce the RISK PROTECT The public and Nation interests To reduce VULNERABILITY PREPARE For the consequences
Forensic Science is one “tool in the kit”
Phases of Forensic Investigations
• • • • • • •
Intelligence & Information Gathering Field Investigation Crime Scene Investigation Laboratory Analysis
Leads
Interpretation, Integration, Application Building, Shaping Prosecution Communication and Decision Making
Forensics Integrates Science with the Investigative Process
• Biology • Chemistry • Materials • Trace Evidence • Impression and Pattern • Engineering • Digital-Computer • Reconstructive • Informatics
Key Definitions
• •
Forensics
: Analysis and interpretation of physical evidence to determine relevance to events, people, places, tools, methods, processes, intentions, plans
– –
Identification and Characterization Inclusion toward Attribution, or Exclusion
Attribution
: Assignment of a
sample of questioned origin
to
a source of known origin
to a
high degree of scientific certainty
(at the same time excluding origination from other sources)
“The Forensic Continuum”
Exclusion Attribution Consistent With Having Originated From Power of and Confidence in Analysis, Interpretation, Meaning “Not Guilty” Integrate with Other Evidence & Intelligence “Guilty”
Goals for Forensic Methods
• Robust Collection & Preservation of Evidence • Relevant Exploitation of Sample • High Discrimination • Enables Comparison of K and Q Samples • Utility Across Known, Encountered Sample Types • Accuracy • Reliability • Defined & Acceptable Error Rate • Speed & Responsiveness • Repeatability • Transferability • Validity Can Be Independently Established • Results Probative, Interpretable, Explainable, Defensible
Validation: “Must Have” Component of Effective, Reliable, Credible and Admissible Forensic Methods Characterization & Testing of Methods to Define and Establish
•
Effectiveness
•
Attributes & Limits
•
Accuracy
•
Reliability
•
Repeatability
•
Transferability
•
Influence of Environment & Handling with Appropriate Sample Types
Affects Acceptance, Admissibility, Confidence, Value, Weight
Why are Validation & Quality So Important in Forensics?
• •
Baseline:
–
Foundation has been laid down through 20 years of moving new science and technology into the U.S. Courts
–
Criminal justice community is well sensitized and has developed “tests” (i.e., Daubert v. Merrill Dow Pharmaceuticals, US Supreme Court Decision, 509 U.S. 579) to examine validity of new science and technology for admissibility Courts seek:
–
Evidence that is testable
–
Confidence that evidence is based, on legitimate scientific foundations, has been peer reviewed, is relevant, is applied by trained and qualified personnel in properly equipped, run and managed laboratory systems
-
Application of science and interpretation of results stays within bounds of what science permits Clash of Cultures: Research Science v. Applications Science v. Legal v. Courts:
Challenge in an Adversarial Environment Lawyers (not Scientists) in Charge “Rules of Engagement” are Different Lawyers Influence or Make Key Decisions Deciders of Fact are Non-Scientists Should policy makers and implementers set expectations for the science that informs and supports policy and actions?
Can policy makers become as knowledgeable in the science and practice as lawyers and judges have had to become?
U.S Legal Framework for Admissibility of Scientific Evidence
(Federal Rules of Evidence) • Rule 401
evidence.
• Rule 402
“Relevant evidence” means evidence having any tendency to make the existence of a fact that is of consequence to the determination of the action more probable or less probable than it would be without the Evidence that is not relevant is not admissible
.
• Rule 702
[Expert testimony is admissible if]
– – –
The testimony is based on sufficient facts or data, The testimony is a product of reliable principles or methods, The witness has applied the principles and methods reliably to the facts of the case.
• Rule 901
[There must be foundational evidence] showing that [a scientific] process or system produces an accurate result.
No such framework or set of expectations exists for scientific evidence to inform or support policy decisions.
Should there be? Each nation? Alliances? International?
“Microbial Forensics 101”
Application of Forensic Science and Related Sciences to Problems Involving Biological Threat Agents, Their By Products and Associated Physical Evidence Collect, Preserve & Transport, Triage, Analyze Interpret, Integrate, Decide
What is It? Is it Probative/Relevant?
Can It Be Linked to A Source? How Robustly & Precisely Can It Be Linked? What is the Meaning & Weight of the Conclusion?
Sample from A Questioned Source (Q) Q Identity?
Relevance to Event?
Power of Methods to Characterize - Discriminate? Confidence Limits?
Known Source (K)
Side by Side Comparison
Could Not Have Originated From Consistent With Having Originated From (Weak
Strong) Absolutely Did Originate From
Agents Affecting Human Health or Animal Health Anthrax Foot & Mouth Brucellosis Rift Valley Fever BSE Swine Fever Nipah Hendra Botulinum Influenza Plague VEE/WEE/EEE Rinderpest Glanders JE NDV Q Fever TBE Tularemia Hantavirus Salmonella Microsporidia CCHF Bovine Tuberculosis African Horse Sickness Meliodosis Psittacosis Sheep and Goat Pox Rickettsia rickettsii C perfringens toxin Rabies Ricin SEB E coli VSV Ebola/Marburg Campylobacter Bluetongue Lassa Heartwater Smallpox Swine Vesicular Disease Typhus Yellow Fever Akabane Shigatoxin Monkeypox Dengue S A Hemorrhagic Fevers Shiga-like RIP Lumpy Skin Disease Shigellosis Hepatitis E Fowl Cholera T2- mycotoxin Hydatid Disease Avian Tuberculosis Bovine cystercercosis Dourine Enterovirus Encephalitis Equine Infect Anemia Equine Rhinopneumonia Infectious Bursal Disease Maedi / Visna Nairobi Sheep Disease Herpes B Abrin Malignant Catarrhal Fever Paratuberculosis Theileriosis Alastrim (Variola minor) Menangle Peste des petits Avian Mycoplasmosis Avian Infectious Bronchitis Bovine Anaplasmosis Bovine Genital Aujuszky’s Disease Bovine Babesiosis Campylobacter Contagious Agalactia Coccidiodes posadasii Contagious Equine Metritis Dermatophilosis Pullorum Conotoxin Duck Hepatitis virus Epizootic Lymphangitis Enzootic Bovine Leukemia Equine Piroplasmosis Fowl Pox Marek’s Disease Hemorrhagic Septicemia Horse Mange Infect Bovine Rhinotracheitis Myxomatosis Ovine Pulmonary Adenovirus Porcine cystercercosis Porcine resp & rep syndr Rabbit Hemorrhagic Dis Surra Transmissible Gastroentero Trichinellosis Trichomonosis - Plant pathogens expand list substantially -For vast majority, the forensic analysis has not been worked out or validated to date
Derived from DoD, NIAID, OCIE and others
One View of “The Big Picture”
•
But, Don’t Forget!
Recover Evidence Particle sizing Conceptual Analytic Pathway for Microbial Evidence Issues: Control material Control environment Maximize recovery Analytical chemistry Inorganic Silica Silicates Cations and anions Heavy metals Organic Carbohydrates Agar (Agarobiose) Peptones Headspace Bacteria/Virus ID Classic bacteriology/virology Genetic/Genomic Analysis Strain ID Genetic Engineering Spore density Cfu/ml Percentage viability Dead vs live spores Electron Microscopy (EM) Scanning EM EDX Analysis After B. Budowle, FBI Laboratory and J. Burans, NBACC Transmission EM
•
Traditional Physical Evidence
•
Contaminated Traditional Evidence
•
Adventitious Physical Evidence
•
Good Intelligence and Investigation
•
Apply Proper Interpretation
•
Integrate Forensics into Investigation
•
Validated Methods by Qualified, Certified Personnel
•
Environment of Robust Quality Assurance and Control
Clinical and Genomic Methods
•
Clinical Microscopy (Morphology: Size, Shape, Staining Characteristics)
•
Clinical Culture Methods
•
Metabolic Profiling:
Selective Biochemistry, Biolog TM •
Protein-Based Methods
Enzyme Linked Immunosorbent Assay, Serotyping, Antigen Capture, Matrix Assisted Laser Desorption Ion (MALDI) Time-of-Flight (TOF) Mass Spectroscopy, Multilocus Enzyme Electrophoresis (MLEE) •
DNA Typing
Restriction Enzyme Methodologies:
Restriction Fragment Length Polymorphism (RFLP), Pulse Field Gel Electrophoresis (PFGE), Amplified Fragment Length Polymorphism (AFLP)
PCR-Based:
Intergenic Spacer Regions (ISR), ARDRA, Random Amplification of DNA (RAPD) Analysis, Repetitive Element (REP-PCR), Variable Number Tandem Repeats (VNTR), Multilocus Variable Number Tandem Repeat Analysis (MLVA), Inserted Sequence (IS) Elements, Triangulation Identification for Genetic Evaluation of Risk (TIGER, PCR-Mass Spectroscopy)
Hybridization:
Subtractive Hybridization, Microarray-Single Nucleotide Polymorphisms (SNP), Re-Sequencing, Gene Expression
DNA Sequencing:
Full Genome, Multilocus Sequence Typing (MLST)
Physical and Chemical Methods
Microscopy:
Scanning Electron Microscopy (SEM) without and with Energy Dispersive X-ray (EDX) Microanalysis, Atomic Force Microscopy (AFM)
Spectroscopy:
Raman Spectroscopy, Surface-Enhanced Raman Spectroscopy
Spectrometry:
Liquid Chromatography – Mass Spectrometry (LC/MS), Fourier Transform Infrared (FTIR) Spectrometry, Bio-Aerosol Mass Spectroscopy (BAMS), Matrix-Assisted Laser-Desorption Ionization Mass Spectrometry (MALDI-MS), Isotope Ratio Mass Spectrometry (IRMS), Time-of-Flight Secondary Ion Mass Spectroscopy (TOF-SIMS), Nano-Secondary Ion Mass Spectroscopy (nano-SIMS), Accelerator Mass Spectroscopy (AMS)
Nuclear microscopy:
Particle-Induced X-ray Emission (PIXE) – Scanning Transmission ion microscopy (STIM)
Challenge: Understand all the possible weaponization processes and their variants BW agents are generally mixtures that derive from a
matrix
of possible processing steps
Growth • Carbon sources • Nitrogen source • Complex media • Cell culture • Animal hosts • Agar • • • Separation • Heat shock • Filter • Centrifuge • Precipitation or flocculation • Solvent partitioning • Gradients Washing • Detergents • Water/buffer • Solvents e.g. FCs • Spray-dry • • • Drying • Air dry • Azeotropic • Acetone • Spray dry • Lyophilize • • • Grinding • Ball mill Additives • Flow enhancers • Jet mill • Resins • Mortar & pestle • • • • Stabilizers • Encapsulants • Irritants • • •
Of course, the chosen method may be very crude… or may not involve any “processing” at all
Challenge: Understand the utility of isotopic and trace element signatures to “geolocate” materials used to manufacture an agent
Microbial Forensics is A Young Discipline
• Largely built on science and technology developed and used for other fields and purposes, transposed to forensic applications • Several strategy, review, gap identification and policy papers published; validation guidelines in press now; scientific papers re Anthrax 2001 in preparation, “review and acceptance” by community pending • No independent, external, peer review of science, results, conclusions and validation to date (NAS review expected) • Few court cases to date, few case law precedents • No legal challenges or rulings to date re admissibility of novel scientific evidence or methods, evidence, results or conclusions at trial
Gaps Identified: Scientific Working Group for Microbial Genetics and Forensics
• • • • • •
Effective methods/tools to quickly identify when, where, how & by what means, an outbreak has occurred Ability to quickly discern whether an outbreak is natural or intentional Simultaneous sampling & investigative characterization: forensics – epidemiology Ability to quickly locate and exploit “the crime scene” Fully understand the approaches and methods used by “the perp” Lab capabilities that match investigative questions
More Gaps Identified: Scientific Working Group for Microbial Genetics and Forensics
• • • • • • • •
Independently validated methods and protocols: sample collection through all analytic pathways, and interpretation Exploit microbial and contaminated physical evidence Robust quality assurance & data control systems Understanding of microbial diversity & background Definitive & consistent microbial systematics (phylogeny + taxonomy) Comparative genomics studies, including “near neighbors” “Post-genomics”, including “small molecules” National Microbial Strain Repository
Deepening Cross-Disciplinary Knowledge and Episystemic Capabilities
Epidemiology Genomics Metagenomics Informatics Ecology Biostatistics & Population Forensic Science Genetics
Microbial Forensics
Bacteriology Mycology & Virology Plant Pathology Biomedical Sciences & Public Health
Analytical Chemistry & Biochemistry Food Science
Veterinary Medicine
Physics
Microscopy
Materials Science Process Engineering
Microbial Forensics:
Emerging and Future Technologies, Threats to Address?
• • • • • •
Creative, Even Subtle Genetic Engineering Bioprospecting, Exploiting Natural Diversity Gene Shuffling & Directed Evolution Small Footprint Design & Production Systems Creative Denial and Deception Synthetic Biology Can “Passive” and “Active” Measures be Anticipated? Developed?
Attribution: Effective, Reliable Capabilities for Justice and Policy
• Multilevel, multidisciplinary “tool kit” of defined, supported, validated analytical approaches for full exploitation of “evidentiary” samples • Integrated approaches that enable
definitive analyses that are fully supportive of attribution
, and do so accurately, responsively, adaptively and defensibly • Capabilities built upon well vetted and properly applied science and technology, with attributes and limits fully understood and communicable • Agile leveraging and integration with matched investigative and intelligence capabilities • Methods, applications and experts that can withstand rigorous scientific, legal, policy and political scrutiny
A
BW (WMD) Attribution:
System Which Doesn’t Yet Coherently & Fully Exist Science & Technology Law & Policy Operations, Investigation & Intelligence Strategy, Plans & Doctrine
Microbial Forensics and Policy
• What quantity and quality of evidence is needed to support national or global policy decisions regarding illicit intentions, research and preparation, testing, and delivery of biological weapons?
– How much and what kind of “evidence” should be required to support what decision?
• What should policy makers expect of its national or global microbial forensics capabilities?
• What contribution can or should forensics make to national or global policy decisions involving biological weapons/bioterrorism?
– How should microbial forensics results be best integrated with other forms of relevant information (evidence) and intelligence?
• How much reliance can or should be placed on forensic evidence and analysis for decisions related to attribution and “prosecution” and what “standards” or decision framework should be used?
• Can competent microbial forensics contribute to the deterrence of the possession, development, proliferation and use of biological weapons?
Other Scenarios to Stimulate Your Thinking ---
What Would Happen Next Time
?
• “New strain” of influenza (highly aggressive), covert attack during flu season • FMD clandestinely introduced in Midwestern feed lot • Large scale anthrax attack, mixed strains (including new west Africa strain) • Aerosolized ricin in closed or contained environment, mixed varieties in seed stock used • Botox clandestinely and selectively introduced in food supply, small scale, distributed attacks • Any BW, denial and deception engineered in weapon and modus operandi • Effective attack of any scale using as yet unknown, “naturally occurring” strain • Assassination of unprotected VIP (not necessarily USG) via biotoxin, considerable operational security or serendipity by perpetrator (planning execution) At present, forensic science and microbial forensics may well have limited contributions for various reasons, unless…..