The Narrowing Margin: Degradation of American Biosecurity
The views expressed are those of the author alone and do not reflect the official policy or position of the Department of the Army, the Department of Defense, or the United States Government.
The United States is immune to conventional invasion and acutely exposed to biological disruption. No adversary can plausibly project ground forces into the American homeland, but a pathogen requires no logistics chain, crosses no defended border, and produces no radar signature. The defenses that make conventional attack unthinkable are, against this class of threat, largely irrelevant.
This report assesses the full spectrum of biological threats to the United States as of September 2026, drawing on federal budget documents, congressional research products, arms control compliance reporting, epidemiological surveillance data, and the public record of recent enforcement actions. It reaches five principal findings:
The highest-probability events are natural; the highest-consequence events are deliberate; and the same infrastructure determines outcomes in both cases. Detection, attribution, and countermeasure capacity are agent-agnostic. A surveillance gap that permits an engineered agent to circulate undetected is the same gap that permits a natural spillover to circulate undetected.
Highly pathogenic avian influenza A(H5N1) clade 2.3.4.4b is not currently dangerous to the American public, but it is being given an unusually large number of evolutionary opportunities. Between January 2025 and March 2026, the virus was detected in 37 mammalian species across the Americas. Seventy-one human cases were confirmed in the United States between 2024 and May 2026, with two deaths and no identified person-to-person transmission.
The regulatory architecture governing biological materials has a structural hole large enough to have concealed a multi-year clandestine laboratory operation operated by a foriegn national. The Federal Select Agent Program regulates declared entities holding listed agents, while the Clinical Laboratory Improvement Amendments govern clinical diagnostics. A privately funded, non-clinical laboratory working with unlisted material falls between them.
Nucleic acid synthesis screening is the single most consequential chokepoint in the biosecurity system, and it remains substantially voluntary. Executive Order 14292 directed the Office of Science and Technology Policy to replace the 2024 screening framework within 90 days of May 5, 2025. As of the most recent congressional review, a replacement had been issued.
Federal defensive capacity is contracting on nearly every measured axis at the same moment that offensive barriers are eroding. Biodefense funding fell from $8.16 billion enacted in fiscal year 2025 to $5.12 billion requested for fiscal year 2026; the Centers for Disease Control and Prevention lost roughly one quarter of its civilian workforce between fiscal years 2024 and 2026; the National Counterproliferation and Biosecurity Center was dissolved by statute; and the United States completed withdrawal from the World Health Organization in January 2026.
The central judgment of this product is not that an attack is imminent. Nothing in the open record supports that conclusion. It is that the margin between an event the United States would detect and one it would not is narrowing each year, and it is narrowing primarily as a consequence of domestic budgetary and organizational choices rather than adversary action.
Introduction
For generations, many have regarded the United States as an impregnable bastion, an immense continental fortress buffered by two vast oceans and protected by unmatched military power. Strategic planners and defense analysts widely agree that mounting a large-scale, conventional attack against the United States homeland is, for all practical purposes, impossible. The nation’s global network of alliances, its forward-deployed forces, and its unparalleled nuclear arsenal ensure that any adversary contemplating a direct assault would face catastrophic retaliation. The deterrent effect is so overwhelming that no serious actor would consider such an approach.
Yet this raises a critical question: if the United States were ever to be attacked in a way that threatened national stability, how would such an attack occur? To explore this question, this report begins with one of the most symbolically and operationally significant locations in the country: the District of Columbia.
Washington, D.C. is arguably the most heavily defended urban center on the planet. Within its boundaries reside 177 foreign embassies, more than 550 elected federal officials, and approximately 23,000 military personnel assigned to various commands and agencies. Publicly available documents, along with information gleaned from declassified materials and occasional leaks, allow observers to piece together the broad contours of the federal response to a major attack. These measures include the rapid evacuation of key leaders, activation of hardened shelters, deployment of ground forces to secure critical infrastructure, and the immediate establishment of a restricted airspace regime over the capital.
Given this level of preparation, it is difficult to imagine the heart of American governance descending into chaos. Scenes such as gunfire along Pennsylvania Avenue, mass graves dug near the National Mall, or the withdrawal of military units from the capital appear implausible, even fantastical. Yet history demonstrates that even the most sophisticated defense plans can fail under the right conditions. The uncomfortable truth is that the United States could face internal collapse without a single foreign soldier ever setting foot on American soil.
That vulnerability is not hypothetical, and the clearest illustration of it comes from the laboratory rather than the battlefield. In the first decade of this century, the world witnessed the destructive potential of H5N1, commonly known as avian influenza, as it swept through parts of Asia and the Middle East. As of 2011, of 565 confirmed human infections reported to the World Health Organization, 331 resulted in death, a mortality rate that alarmed global health authorities. Rapid scientific intervention allowed researchers to analyze the virus, characterize its mechanisms, and develop candidate vaccines.
In September 2011, however, Dutch virologist Ron Fouchier announced work that reignited global concern. His laboratory had produced a mutated strain of H5N1 that transmitted more efficiently among ferrets, the standard model organism for studying human respiratory viruses. More troubling still, the methods involved were not exotic, raising profound questions about accessibility and misuse (National Academies of Sciences, Engineering, and Medicine, 2018).
To the general public, the relevance of a ferret-based experiment may seem obscure. Yet within the scientific community, the implications were immediately understood. Ferrets possess a respiratory physiology and immune response strikingly similar to those of humans, making them indispensable for evaluating the transmissibility and pathogenicity of respiratory diseases. As Fouchier himself acknowledged, the engineered strain was “probably one of the most dangerous viruses you can make” (Enserink, 2011). Paul Keim, a leading anthrax researcher then chairing the National Science Advisory Board for Biosecurity, said he could not think of another pathogen “as scary as this one” (Enserink, 2011). The announcement triggered a wave of international criticism. Health organizations, government officials, and prominent scientists warned that artificially enhancing a virus’s transmissibility and lethality, even in the name of research, posed unacceptable risks. The concern
was not merely theoretical. By demonstrating that such a pathogen could be produced using modest resources, the research inadvertently illuminated a potential vulnerability for every nation, including the United States.
The controversy intensified when Fouchier and a parallel team at the University of Wisconsin moved to publish full methodologies and results. Many in the scientific community were stunned. Critics argued that the research should never have been conducted, and that publishing the details would effectively supply a blueprint. The National Science Advisory Board for Biosecurity took the unprecedented step of recommending that the manuscripts be redacted before publication, a recommendation it later reversed. The fear was not rooted in speculation but in precedent: low-cost biological research, when misused, has the potential to circumvent even the most robust national defense systems (National Academies of Sciences, Engineering, and Medicine, 2018).
Donald Kennedy, the former editor-in-chief of Science, captured the gravity of the issue when he reflected on the first anniversary of the September 11 attacks. Asked how he would handle a submission describing how to construct what was essentially a biological weapon, he said he would decline to publish it on the basis of editorial self-regulation rather than any government restriction. His position underscored a broader truth: modern threats to national security increasingly emerge not from armies or missiles, but from laboratories, computer networks, and the unintended consequences of scientific advancement.
This white paper extends that observation into a systematic assessment. It examines the biological threat environment facing the United States across four vectors: naturally occurring emergence, accidental release, state programs, and non-state deliberate use. It then evaluates the American defensive posture across detection, attribution, legal authority, countermeasure capacity, and international governance, and closes with prioritized recommendations. The paper deliberately declines to treat these four vectors as independent. They are conventionally separated because they differ in intent, and intent matters for law and for retaliation. They are not separable in practice, because the systems that would detect, characterize, attribute, and counter a biological event are the same systems in all four cases. A recurring error in this field is to fund against a category rather than against a capability.
One refinement of the opening premise of fortress America that governs the remainder of this paper. A fortress is not defined by its walls alone. It is defined by the relationship among its walls, its gates, and its garrison. Walls deny approach; gates admit what the fortress must have in order to function; the garrison detects and responds to what passes through. American continental defense is a wall of historically unmatched quality. It is also irrelevant to any threat that arrives through the gate, and the gate cannot be closed without ending the trade, travel, scientific exchange, and open scientific publication on which national prosperity and biomedical capability both depend.
Stated in the language of joint planning, the American center of gravity against conventional attack is military power. Against biological threats it is something else entirely: the national capacity to detect an anomalous biological event, characterize the agent, attribute the act, and mount a medical and civil response at scale. The critical requirements supporting that capacity are surveillance, laboratory infrastructure, forensic and intelligence attribution, and a countermeasure industrial base. The critical vulnerability, developed at length in Sections 10 and 11, is that each of those requirements is presently being reduced. This paper is in substantial part an assessment of the garrison rather than of the wall.
This assessment relies exclusively on unclassified, publicly available sources: federal budget justifications and appropriations documents, Congressional Research Service products, Government Accountability Office audits, Department of State arms control compliance reporting, Centers for Disease Control and Prevention and Pan American Health Organization surveillance data, Department of Justice charging documents and press releases, peer-reviewed literature, and analysis from established policy institutions. Where sources conflict, the conflict is noted rather than resolved.
Three limitations should be stated plainly. First, the most consequential intelligence regarding state biological weapons programs is classified; the compliance reporting cited here represents the declassified summary of a much larger and inaccessible body of assessment. Second, capability assessments concerning artificial intelligence and biological design tools are rapidly changing and poorly benchmarked, and confidence in any specific claim about them should be low. Third, the risk positioning offered in Section 12 is the author’s structured judgment, not a quantitative model; it is presented to make reasoning legible and contestable, not to convey false precision.
This paper deliberately excludes technical detail concerning the production, enhancement, formulation, or dissemination of biological agents. Such material provides no analytic value to a policy audience and carries obvious risk. Discussion throughout remains at the level of governance, epidemiology, law, and institutional capacity.
Naturally Occurring Threats
Naturally emerging pathogens represent the highest-probability category of biological threat to the United States by a wide margin. Every pandemic in modern American history has originated here, and the expected mortality burden of this category over any ten-year horizon exceeds that of all deliberate-use scenarios combined. It is also the category most directly degraded by reductions in public health capacity, because the detection systems are identical.
H5N1 clade 2.3.4.4b remains the most closely watched pathogen in the American surveillance system. Descended from the goose/Guangdong lineage identified in commercial poultry in China in 1996, the clade was introduced to North America in late 2021 through migratory waterfowl on the trans-Atlantic and Pacific flyways. What began as an epizootic affecting commercial poultry and wild birds has become a multi-species event. Between 2022 and 2024, nearly 97 million commercial and backyard birds died or were culled in the United States, and in March 2024 the first multi-state outbreak in dairy cattle was documented (American Academy of Ophthalmology, 2026).
Human infection has remained limited and occupationally bounded. From 2024 through May 2026, 71 human cases were identified in the United States, distributed across California, Colorado, Iowa, Louisiana, Michigan, Missouri, Nevada, Ohio, Oregon, Texas, Washington, Wisconsin, and Wyoming, and overwhelmingly linked to direct contact with infected dairy cattle or poultry. There were two associated deaths and three cases in which the exposure source could not be determined.
No person-to-person transmission has been identified in the United States, and the CDC continues to assess general public risk as low (American Academy of Ophthalmology, 2026; Centers for Disease Control and Prevention, 2026b). A notable clinical feature is that conjunctivitis predominated in most patients, prompting CDC guidance that clinicians consider avian influenza in patients presenting with conjunctivitis and relevant animal exposure.
The reason H5N1 stays on national threat lists despite reassuring human epidemiology is ecological rather than clinical. Between 1 January 2025 and 9 March 2026, influenza A(H5N1) was detected in 37 mammalian species across two countries and 94 bird species across 11 countries and territories in the Americas, with a decline in wild bird detections observed since mid-2025 (Pan American Health Organization, 2026). Sustained circulation in a wide array of mammalian hosts supplies precisely the ecological conditions under which reassortment and progressive mammalian adaptation occur.
The correct framing is therefore probabilistic. The virus is not presently well adapted to humans. It is, however, being afforded an unusually large number of independent attempts at adaptation, across an unusually large number of host species, over an unusually long period. Swine co-infection is the specific scenario meriting the closest surveillance attention, as swine can support co-infection with human-adapted influenza viruses and thus reassortment.
H5N1 is also not the only natural pressure and may not be the most consequential. Antimicrobial resistance carries a higher expected cumulative mortality burden over the next decade than any bioterrorism scenario, and it is progressing steadily with limited countervailing investment. Declining vaccination coverage has produced measles resurgence in multiple states. Vector-borne expansion, including Oropouche virus, is being driven by climate and travel patterns. Each of these is a slower-moving story than an outbreak, which is precisely why each is chronically underfunded relative to its expected harm.
Taken together, these pressures support a clear judgment. Naturally occurring emergence is assessed as high likelihood and high consequence. It should absorb the largest share of biodefense investment on expected-value grounds alone. Critically, nearly every dollar spent on natural-emergence detection and response also purchases capability against deliberate and accidental events, which is not true in reverse.
Dual-Use Research and the Governance of Enhance Pathogens
The Fouchier controversy described in Section 1 was not an isolated episode. It initiated a policy cycle that remains unresolved fifteen years later and that has become materially less stable in the last eighteen months. That cycle concerns a specific and narrow class of work, and the first requirement of any useful discussion is to say precisely which class.
The term gain of function is used in public argument far more broadly than it is used in science, and the imprecision is not harmless. In its literal sense the phrase covers any modification that increases some biological function of an organism, which describes an enormous share of routine molecular biology: making a production strain yield more of a therapeutic protein, making a model organism express a fluorescent marker, restoring a function deleted in an earlier experiment. None of that is a biosecurity concern, and a governance regime that captures it would be both unenforceable and destructive.
The category that warrants oversight is far narrower. It is research reasonably anticipated to enhance the transmissibility or virulence of a pathogen that could pose a serious threat to public health, which United States policy has designated research involving pathogens with enhanced pandemic potential. The 2014 funding pause applied to a specified set of influenza, SARS, and MERS work. The 2017 framework created a departmental review process for funding decisions concerning enhanced potential pandemic pathogens (Department of Health and Human Services, 2017). The May 2024 consolidated policy governs both dual use research of concern and this narrower enhanced-pathogen category, with distinct review obligations for each (Office of Science and Technology Policy, 2024).
Where the boundary falls is the substance of the entire dispute rather than a preliminary to it. Define the category broadly and the regime sweeps in ordinary virology, generates review volume no committee can absorb, and loses legitimacy with the researchers it depends upon. Define it narrowly and the decision about whether a given experiment qualifies falls to a judgment call made by people with a professional interest in the answer. No definition yet drafted has escaped this trade-off, and the reader should be skeptical of any account of the controversy that presents the boundary as obvious.
The case for permitting enhancement research is serious, is made by serious people, and is stated here at its strongest because an assessment that caricatures it will misjudge the cost of restriction.
The primary argument is interpretive. Surveillance systems now generate genetic sequence data at a volume no previous era approached, but a sequence is only actionable if someone can say what its features mean. Establishing which changes confer mammalian transmissibility is what converts a sequence database from a list of strings into a warning system. That is not an abstract benefit for the subject of this paper: Section 2 assesses H5N1 as being afforded an unusually large number of independent attempts at adaptation, and the practical question facing surveillance officials is whether any particular circulating variant has taken steps that matter. Answering it requires knowing in advance which steps matter.
Three further benefits follow. Candidate vaccine strain selection and antiviral resistance profiling depend on characterizing pathogens under conditions that sometimes require modified strains. Understanding which host-adaptation barriers are difficult to cross is as informative as understanding which are easy, and findings in this literature have on occasion been reassuring rather than alarming. And a domestic research community working openly on these questions is the same community that supplies expertise to the biodefense enterprise, reviews adversary publications, and staffs the institutions described in Section 11.
Two structural arguments against prohibition also deserve statement. Restriction reaches only the jurisdiction imposing it, so work forbidden in the United States may relocate rather than cease, with the effect of moving it to jurisdictions with weaker biosafety oversight and no American visibility. And prohibition forfeits the warning capability described above permanently, while the risk it avoids is probabilistic. A policy that trades a certain loss for an uncertain gain is not obviously correct merely because the uncertain harm is severe.
The risks are equally serious and are of four distinct kinds. They are frequently discussed as though they were one, which is why the debate so often fails to progress.
The first is accident. Laboratory-acquired infections and containment breaches are documented regularly in the aggregate record, including at facilities operating to the highest standards, and a compiled survey of high-consequence exposure events across four decades establishes that the base rate is not negligible (Manheim & Lewis, 2021). What distinguishes this category is not the probability of a breach but the consequence profile of one. An agent selected for efficient mammalian transmission does not remain a laboratory problem once it leaves the laboratory, which is the argument developed at length in the escape literature (Klotz & Sylvester, 2014). The 1979 Sverdlovsk release described in Section 5, the 1978 smallpox death following a laboratory-associated infection in the United Kingdom, and the multiple laboratory-associated SARS infections in 2003 and 2004 are the empirical anchors.
The 1977 reemergence of H1N1 illustrates both the force of this argument and the care required in making it. The reemergent strain was genetically near-identical to strains circulating decades earlier, which effectively excludes natural reemergence. It does not follow that a gain-of-function accident is the explanation. Rozo and Gronvall assessed a vaccine trial or vaccine development mishap as more plausible than a simple laboratory escape, and argued on that basis that the episode’s relevance to the enhancement debate is limited; Furmanski replied that separating vaccine development risk from enhancement research risk is not tenable, because the two enterprises hand material to one another (Rozo & Gronvall, 2015; Furmanski, 2015). The exchange is worth reading in full, and it is a reminder that the most-cited historical example in this debate is itself contested.
The second risk is informational. Publication of a method creates a permanent, globally available artifact that no subsequent decision can withdraw. Section 6 identifies tacit knowledge as the principal barrier that has historically separated intent from capability among non-state actors, and detailed published protocols are precisely the instrument that erodes it. The National Science Advisory Board for Biosecurity’s recommendation to redact the 2011 manuscripts, and its subsequent reversal, is the governing precedent, and its lesson is discouraging in both directions: the concern was judged real enough to warrant an unprecedented intervention, and the intervention proved unworkable.
The third risk is normative and strategic, and it is the one most often omitted. The Biological Weapons Convention prohibits development for hostile purposes and permits work for prophylactic and protective purposes, a line drawn on intent rather than on activity. Enhancement research sits directly on that line, and a permissive American posture weakens the ability to characterize adversary work as prohibited. Section 5 documents a sustained Russian Information Warfare campaign attributing an offensive program to Western-supported public health laboratories. Such operations are more effective when the activity they describe is legally ambiguous or can not be easily explained to the public.
The fourth risk is attributional and follows from the third. The more laboratories legitimately produce enhanced strains, the larger the set of plausible origins for any pathogen that appears in circulation, and the harder the determination becomes. The contested origin of SARS-CoV-2 in the early years of the 2020s is the demonstration rather than an aside. Intelligence Community elements reached differing conclusions at differing confidence levels, while assessing that the virus was not developed as a biological weapon (Office of the Director of National Intelligence, 2023). This paper does not adjudicate that question and takes no position on it. The relevant observation is narrower and holds regardless of the answer: a dispute over whether a major outbreak had a laboratory-associated origin persisted for years without resolution under conditions less demanding than a deliberate event utilizing a well-design pathogen would impose.
Three asymmetries explain why fifteen years of argument following the 2011 incident have not produced a settlement, and recognizing them is more useful than expecting one:
The benefit is diffuse, incremental, and partially verifiable; the harm is concentrated, rare, and not quantifiable even in principle. There is no common unit in which the two can be compared, so the disagreement is not resolvable by evidence alone. It turns on how a decision maker weighs incommensurable quantities, which is a value judgment presented in technical language.
The party bearing the risk is not the party receiving the benefit. An institution weighing a research proposal internalizes the scientific return and externalizes the tail risk onto a global population that has no representation in the decision.
The policy lever reaches only federally funded work. This is the same defect regarding synthesis screening, and it produces the same result: privately funded and foreign work sits outside the existing regulatory regime, and the least cautious or most frivolous institution sets the effective standard.
There is also a rhetorical hazard on both sides worth naming, since it degrades the quality of the argument. Advocates of restriction have at times relied on catastrophic framing in place of demonstrated pathways, a tendency criticized from within the field (Casadevall et al., 2014). Advocates of permission have at times treated the risk as fully managed by existing biosafety practice, which the accident record does not support. Neither posture is analytically defensible, and a policy audience should discount both.
Following the 2011 to 2012 controversy, the United States government imposed a funding pause on certain gain-of-function research in 2014, replaced it with a departmental review framework in 2017, and issued a consolidated policy in May 2024 governing dual use research of concern and research involving pathogens with enhanced pandemic potential. That policy represented the most coherent federal position achieved to date, establishing categories of covered research, institutional review responsibilities, and agency-level oversight.
Executive Order 14292, issued 5 May 2025 and titled , directed the Office of Science and Technology Policy to revise or replace the 2024 policy within 120 days (Congressional Research Service, 2026). As of the most recent congressional review, the Congressional Research Service was unable to determine whether the replacement had been issued. The practical consequence is that the governing federal policy on enhanced-pathogen research is formally slated for replacement, with no replacement available, leaving institutional review boards operating against a framework the executive branch has declared inadequate.
The difficulty underlying that stalled revision deserves acknowledgment rather than dismissal. Dual-use governance is genuinely hard, and the same experiment that identifies a mutation conferring mammalian transmissibility also tells surveillance officials what to watch for in circulating strains. Prohibiting the work forfeits that warning capability; permitting it creates both accident risk and information risk. Reasonable scientists disagree, and the disagreement is not resolvable by appeal to evidence alone because it turns on how one weighs a diffuse, quantifiable benefit against a concentrated, unquantifiable harm.
What is not defensible is the current state: a policy under formal revision, a revision past deadline, and institutional review committees left to improvise. This paper does not conclude that enhancement research should be prohibited, and the case set out in 3.2 is sufficient to make blanket prohibition an unattractive instrument. It concludes that the work requires a settled, published, enforceable framework with a definition stated in advance, a review that reaches privately funded work, a named accountable decision authority rather than diffuse institutional discretion, and attention to publication as well as to funding. Governance vacuums do not produce neutrality. They produce heterogeneity, in which the least cautious institution sets the effective national standard, and they produce it while conferring none of the benefits that a permissive settled policy would at least deliver openly.
Accidental Release and the Unregulated Laboratory
Two enforcement actions between 2022 and 2026 provide the clearest available evidence of how the American biosecurity regime performs against an undeclared actor. Neither reflects well on it.
In December 2022, a code enforcement officer in Reedley, Fresno County, California, noticed a garden hose protruding from a wall of a warehouse at 850 I Street that municipal records showed as vacant. The resulting investigation uncovered an unlicensed laboratory operated under the corporate identities Universal Meditech and Prestige Biotech, controlled by Jia Bei Zhu, who also used the names Jesse Zhu, David He, and Qiang He. Investigators documented approximately 1,000 laboratory mice, of which 175 were found dead and 773 were subsequently euthanized, alongside refrigeration units, centrifuges, and thousands of vials of biological material. Many vials were unlabeled; others were labeled in Mandarin or in what investigators described as an internal code (Select Committee on the Chinese Communist Party, 2023).
The location of the facility warrants specific attention because it bears directly on the consequence estimate. The warehouse, a decades-old cold storage building, sat across the street from a residential neighborhood, adjacent to an active railway line, and within a short walk of Reedley High School, the city hall, and the municipal water supply (Select Committee on the Chinese Communist Party, 2023). No element of that location reflected an attempt at concealment. Universal Meditech’s own subsequent legal filings state that a landlord dispute forced the company out of a Fresno industrial building before its intended replacement facility near Fresno Yosemite International Airport was ready, and that 850 I Street was rented as temporary space after an urgent search. The operation was located where it was because the building was available, and it remained undetected for reasons that had nothing to do with tradecraft.
Recovered containers were labeled as holding agents including human immunodeficiency virus, hepatitis, dengue, malaria, tuberculosis, and coronavirus material, together with human blood and unidentified biological fluids. Classified under the risk group framework of the National Institutes of Health Guidelines, that inventory spans Risk Group 2, which comprises agents associated with human disease that is rarely serious and for which interventions are often available, and Risk Group 3, which comprises agents associated with serious or lethal human disease and for which interventions may be available. Tuberculosis and human immunodeficiency virus are Risk Group 3 agents; hepatitis, dengue, and malaria are Risk Group 2.
Not one of these agents appears on the Federal Select Agent Program list. This is the mechanical explanation for the regulatory outcome described below, and it is frequently misunderstood. The risk group framework and the select agent list are distinct instruments serving distinct purposes. Risk group assignment is a laboratory safety classification generated by the research community; it governs containment practice at institutions that have elected to comply with it and carries no registration, inspection, or reporting consequence of its own. The select agent list is a security classification generated by statute, and it is the instrument that creates federal authority. A facility may therefore hold Risk Group 3 material lawfully and without any obligation to inform the federal government of its existence, which is precisely what occurred at 850 I Street over a period of roughly ten months.
Federal and state authorities publicly concluded that the materials were associated with a failed effort to manufacture COVID-19 diagnostic tests rather than with weapons development. Zhu was convicted on twelve state counts in May 2026. Critically, none of those counts related to the storage or possession of biological materials. The charges concerned fraud and violations of Food and Drug Administration requirements, because no federal statute cleanly criminalized what had actually occurred.
The second case is the more instructive of the two, and it has been widely reported as though it were a separate incident. It was not. The Las Vegas facility was controlled by the same operator as Reedley, through the same technique of layered corporate identity, and it was discovered by the same mechanism of accident.
On 31 January 2026, a Las Vegas Metropolitan Police Department tactical element and the Federal Bureau of Investigation served a search warrant on a single-family residence on Sugar Springs Drive in northeast Las Vegas. The garage contained refrigeration units, a freezer, a centrifuge, and more than one thousand labeled vials of unidentified liquids, which responding authorities characterized as potential biological and hazardous material. The Joint Terrorism Task Force assumed control of the investigation. Investigators ultimately collected more than one thousand samples, held them temporarily at the Southern Nevada Health District, and transported them by aircraft to the National Bioforensic Analysis Center in Maryland (Lawfare, 2026).
The discovery sequence deserves emphasis because it is identical in character to Reedley. The investigation did not originate in any biosecurity authority. It began with a municipal code enforcement matter, was reinforced by a tip from a person who had worked at the property, and was given urgency by reports that people who had been inside the garage became seriously ill. The property has been reported to have been operated as a short-term rental. In neither case did any element of the federal biosecurity architecture generate the lead.
The location is worse than Reedley’s in the respect that matters most. The Reedley operation occupied a commercial warehouse in a mixed-use area, which is where one would expect to find an unlicensed laboratory and which at least carried the incidental protections of an industrial structure. The Las Vegas materials were in the attached garage of an occupied single-family home on a residential street in a working neighborhood, near the intersection of East Washington Avenue and North Hollywood Boulevard, with paying short-term occupants sleeping on the other side of the wall. Residents subsequently asked publicly how the operation had gone unnoticed in an active neighborhood watch community. The answer is that nothing about an unlicensed laboratory is visible from the street, which is the general condition this paper describes rather than a local failure.
The connection to Reedley is fact and above dispute. The residence is owned by a Nevada limited liability company, David Destiny Discovery LLC, registered through the Nevada Secretary of State. The principal and registered agent of that company is David He, one of the aliases used by Jia Bei Zhu, the operator convicted in the Reedley matter; Zhaoyan Wang, Zhu’s business partner and a co-defendant in the federal fraud case, is listed as an officer. The company purchased the house in 2022 (Las Vegas Review-Journal, 2026). Open reporting indicates the same corporate structure is associated with a warehouse location in Las Vegas and with a business address in Spring Valley, and that a second location searched on the same day contained no laboratory. Investigators have assessed that the materials in the garage may have been residue from the Reedley operation, relocated rather than newly acquired (KTNV-TV, 2026).
The 2022 purchase means the Nevada property was acquired in the same period the Reedley laboratory was operating and being discovered, and it remained in the operator’s control, holding biological material, for roughly three years after Reedley was raided, after Zhu was arrested, after a congressional investigation had published a detailed report on his activities, and while he was in federal custody awaiting trial. The enforcement action against the first facility did not reach the second, because no authority existed to ask what else the same person controlled.
The mechanism that made this possible is the corporate identity layer, and it is the specific defect that registration proposals must be designed against. Zhu operated through Universal Meditech, through its successor Prestige Biotech, and through a Nevada holding company, under at least four personal names, and he told federal investigators in 2023 that he was a different person entirely. None of those entities was a laboratory in any registrable sense; the Nevada entity was a property holding company that happened to own a house with a freezer in it. A registration regime keyed to declared laboratory entities would have captured none of this. The national inventory recommended in 15.2 is therefore only useful if it keys on beneficial ownership and on the material itself rather than on entity type or stated business purpose.
The evidentiary outcome is the final parallel and the most damaging one. In March 2026 the Federal Bureau of Investigation reported that the recovered materials had degraded significantly as a result of improper storage, limiting the ability to determine conclusively which agents had been present (Lawfare, 2026). At Reedley, a substantial quantity of material had similarly been destroyed without testing, and the CDC did not test the majority of the samples it encountered. The resulting epistemic position is uncomfortable: the reassuring official conclusion in both cases rests partly on evidence that no longer exists, and the reassurance is therefore not falsifiable. This is a chain-of-custody failure with intelligence consequences, and it also creates conditions in which conspiracy narratives flourish because the official account cannot be independently checked.
The prosecutorial outcome follows the pattern set out in Section 6. The property manager was charged under state law with felony hazardous waste disposal. A federal complaint alleging unlawful firearms possession was subsequently dismissed. Zhu was convicted in May 2026 on twelve counts arising from the California conduct, none of which concerned the possession or storage of biological material at either site. In simple terms: two facilities, four years, one operator, and no biosecurity charge.
The structural finding is the important one. The Federal Select Agent Program, administered jointly by the CDC and the Animal and Plant Health Inspection Service, regulates the possession, use, and transfer of a defined list of agents and toxins by registered entities. It is a declaration-and-inspection regime; it does not discover undeclared activity, and it does not reach agents absent from the list. The Clinical Laboratory Improvement Amendments govern laboratories performing human diagnostic testing. A privately funded, non-clinical laboratory holding unlisted material sits outside both.
Legislative response has stalled. The Preventing Illegal Laboratories and Protecting Public Health Act, introduced by Representative Jim Costa, failed to advance in 2024 and again following reintroduction with Representative David Valadao in October 2025. Fresno County responded by adopting a local ordinance establishing annual inspection authority over non-CLIA private laboratories, an appropriate but jurisdictionally trivial remedy to a national gap.
The resulting judgment follows directly from that gap. Accidental release from an under-regulated facility is assessed as moderate likelihood and moderate consequence. The consequence estimate is bounded because such operations are typically working with material of limited transmissibility. The likelihood estimate is elevated specifically because there is no detection mechanism: both known cases were discovered by chance, over a combined operational period of several years, which implies that the observed rate is a lower bound on the true rate by an unknown factor. That inference is strengthened rather than weakened by the common operator. The two discoveries are not two independent observations of the problem; they are two accidental observations of a single actor, which means the federal government has never detected an unregistered laboratory operator it was not already looking at.
State Biological Weapon Programs
The Department of State’s annual report on adherence to arms control, nonproliferation, and disarmament agreements provides the authoritative unclassified baseline for state-level assessment.
Russia and the Democratic People’s Republic of Korea are assessed to maintain offensive biological weapons programs in direct violation of their obligations under the Biological Weapons Convention. Iran’s dual-use activities continue to raise compliance concerns. With respect to China, the reporting reiterates concerns regarding Article I of the Convention, citing Chinese military medical institutions conducting toxin and biotechnology research and development with potential biological weapons applications (Council on Strategic Risks, 2025a).
The DPRK assessment is the most specific. The United States assesses that North Korea maintains a dedicated, national-level offensive biological weapons program, possesses the technical capability to produce bacterial, viral, and toxin agents suitable for weapons use, and is capable of genetically engineering biological materials. Additional concern attaches to the possibility of unconventional delivery (Radio Free Asia, 2025).
Two developments in the most recent reporting cycle warrant specific attention beyond these standing findings. First, the compliance report warned for the first time that China is probably capable of using publicly available artificial intelligence and machine learning tools to advance efforts related to biological weapons applications (Council on Strategic Risks, 2025a). This is the first formal acknowledgment in compliance reporting that general-purpose commercial technology may materially affect state-level biological capability.
Second, the 2026 Annual Threat Assessment states that the threats of nuclear proliferation and chemical and biological warfare capabilities continue to grow, language absent from the 2025 edition, and notes that Russian scientists continue developing new chemical and biological warfare capabilities while Russian forces have used chemicals in large numbers of attacks against Ukrainian forces since 2022 (Mauroni, 2026). The normalization of chemical weapons use in an active theater is directly relevant to biological risk assessment, because it evidences a lowered threshold for employing prohibited unconventional weapons where the actor judges attribution costs to be manageable.
The Russian finding is the most specific of the three examined here and rests on the deepest evidentiary base. The United States assesses that Russia maintains an offensive biological weapons program in violation of its obligations under Articles I and II of the Convention, that the program continued and evolved from the Soviet effort rather than being reconstituted from nothing, and that Russia is extensively modernizing Soviet-era biological warfare infrastructure capable of supporting a present-day offensive program (Council on Strategic Risks, 2025a).
The agent set of concern is inherited rather than novel. The Soviet program, run jointly by the Ministry of Defense and the nominally civilian Biopreparat complex, employed tens of thousands of personnel across dozens of facilities and carried a defined list of agents through to validated military use. The scholarly reconstruction of that program documents work on Bacillus anthracis, Yersinia pestis, Francisella tularensis, Burkholderia mallei, Coxiella burnetii, variola virus, Venezuelan equine encephalitis virus, and Marburg virus, among others (Leitenberg & Zilinskas, 2012). That inventory is not a claim about present holdings, and it should not be read as one. It is a statement about which agents a specific institutional lineage has already solved the applied problems for. Applied knowledge of that kind resides in people, procedures, and strain collections rather than in stockpiles, which is precisely why the tacit knowledge barrier described in Section 6 does not constrain a state program in the way it constrains a non-state one.
The institutional locus of present concern is the 48th Central Scientific Research Institute of the Ministry of Defense, which comprises three sites: Sergiev Posad-6 in Moscow Oblast, known in the Soviet period as Zagorsk-6; Kirov; and Yekaterinburg, the successor to the military microbiological compound at Sverdlovsk. Compliance reporting has named the 48th Central Scientific Research Institute specifically as an example of the modernization of Soviet-era infrastructure (Radio Free Europe/Radio Liberty, 2024). The open historical literature associates the Sergiev Posad site with orthopoxvirus and hemorrhagic fever work, the Kirov site with bacterial agents, and the Sverdlovsk lineage with anthrax.
None of the three has ever been inspected by an outside party. The trilateral arrangement negotiated with the United States and the United Kingdom in the early 1990s produced visits to several Biopreparat facilities but never reached the Ministry of Defense sites, which have remained closed for the entire post-Soviet period (Radio Free Europe/Radio Liberty, 2024). This is the single most important fact in the Russian assessment, and it is a structural fact rather than an intelligence failure. There is no mechanism by which access could be compelled, because the Convention provides none.
What is observable is indirect and consistent with more than one explanation. Open-source analysis of commercial satellite imagery from 2022 onward documents substantial new high-containment construction at Sergiev Posad-6 (Nuclear Threat Initiative, 2024; Global Partnership Against the Spread of Weapons of Mass Destruction, 2026). Russian government procurement records show a sharp increase in laboratory equipment spending by the institute beginning in late 2021, after which military procurement data was classified. Open patent filings and publications from the Sergiev Posad and Kirov branches concern the preparation and behavior of aerosolized pathogens (Radio Free Europe/Radio Liberty, 2024). None of this is dispositive. High-containment capacity and aerobiology are equally necessary for legitimate biodefense, which is the Convention’s foundational problem rather than an artifact of this particular case.
Two further elements belong in the assessment. The first is Sverdlovsk. The 1979 release of anthrax from the military compound in that city produced 77 documented cases and 66 deaths and remains the largest accidental release of a biological agent on record (Meselson et al., 1994). It occurred within the same institutional lineage described above, and it is the empirical basis for treating accident risk at state facilities as a category distinct from the unregulated-laboratory risk examined in Section 4. The second is the State Research Center of Virology and Biotechnology at Koltsovo, near Novosibirsk, a civilian facility under Rospotrebnadzor that is one of the two internationally sanctioned repositories of variola virus. Custody of variola is a strategic asset irrespective of intent, and the center’s 2019 explosion is a reminder that the safety record of the holder is a matter of international concern.
A behavioral indicator completes the picture. Since 2022 Russia has conducted a sustained campaign attributing an offensive biological weapons program to Ukrainian public health laboratories and to United States cooperative threat reduction engagement, including through formal Convention mechanisms (Global Partnership Against the Spread of Weapons of Mass Destruction, 2026). Whatever else that campaign is, it demonstrates a willingness to contest attribution in the information domain in advance of any event. Section 10 treats attribution as a technical problem. Russian practice indicates it is also a contested political one, and that the United States should expect the forensic question and the narrative question to be fought simultaneously.
The DPRK assessment presents the opposite structure to the Russian one. Its declarative language is the most specific of any in compliance reporting, and its evidentiary base is the thinnest. Both propositions are true simultaneously, and an assessment that reports the first without the second is not usable for planning.
The United States assesses that North Korea maintains a dedicated, national-level offensive biological weapons program, possesses the technical capability to produce bacterial, viral, and toxin agents suitable for weapons use, and is capable of genetically engineering biological materials (Radio Free Asia, 2025). The agents recurrently identified in the open literature are Bacillus anthracis, Yersinia pestis, Vibrio cholerae, Francisella tularensis, variola virus, botulinum toxin, yellow fever virus, and viral hemorrhagic fever agents; a Belfer Center survey compiled thirteen agents from the available reporting (Kim et al., 2017). South Korean intelligence has reported that the program originated in the 1960s and that strains of the causative agents of anthrax, plague, and cholera were acquired from a source in Japan in 1968 (Bulletin of the Atomic Scientists, 2017).
Facility reporting is correspondingly imprecise. The South Korean government has estimated that roughly ten facilities may be involved, of which seven are research centers and three are production sites, without identifying them. The entities named repeatedly in the open literature are the Pyongyang Bio-technical Institute; the February 25 Factory at Chongju in North Pyongan Province, also rendered as the No. 25 Factory; a Central Biological Research Institute in Pyongyang; a Germ Research Institute dating to the 1970s; the bacteriological research element of the Second Academy of Natural Sciences; and the Institute of Microbiology of the Academy of Sciences, whose researchers have trained and published abroad, including in China (Bulletin of the Atomic Scientists, 2017).
The Pyongyang Bio-technical Institute is the clearest available illustration of why this category resists resolution. In 2015 North Korean state media published images of a leadership visit to the facility, presented as a pesticide plant. Analysts assessed that the fermenters, bioreactors, and associated equipment visible in those images were of a scale and type sufficient to produce military-sized batches of anthrax, and that the equipment set indicated procurement in circumvention of dual-use export controls (James Martin Center for Nonproliferation Studies, 2016). North Korea responded by publicly inviting the United States Congress to inspect the site. Both readings survive the evidence, because industrial fermentation equipment for biopesticide production and for bacterial agent production is substantially the same equipment. A subsequent analysis noted that the imagery did not display the security and biosafety features that would be expected at a facility handling agents of this class (Parachini, 2019).
The evidentiary caution should be stated plainly. United States intelligence has not published in depth on the DPRK biological program since approximately 2012, and the most recent unclassified military assessment reaches only the judgment that biological weapons research is highly likely and that anthrax or smallpox munitions have possibly been produced (Stimson Center, 2020). The gap between the confident language of compliance reporting and the underlying open-source base is wider here than for any other actor in this paper, and confidence in the DPRK judgment should be set accordingly.
That caution does not reduce the planning significance of the case, for two reasons that are independent of how advanced the program actually is. First, the DPRK is the actor for whom the state-adjacent transfer pathway identified in Section 6 is most technically available, and its risk tolerance is evidenced by the extraterritorial use of a chemical warfare agent in an assassination conducted on the soil of a third state. Second, the procurement pattern is itself the finding. A state under comprehensive sanctions assembled a modern fermentation suite through illicit acquisition of controlled dual-use equipment. That is the empirical case for the equipment licensing and ownership tracking measures recommended in 15.5 and 15.6, and it is an argument that does not depend on resolving what the equipment was ultimately used for.
China is analytically distinct from Russia and the DPRK and should not be grouped with them. The United States does not assess China as maintaining a declared offensive program. The concern is the scale and growth rate of its dual-use biotechnology base, which could compress the interval between civilian capability and military application under changed strategic conditions (Foreign Affairs Forum, 2026). This is a capability-latency concern rather than an intent concern, and it calls for different policy instruments: research security, supply chain visibility, and export control rather than deterrence signaling.
The baseline matters for reading the current finding correctly. The United States assesses that China maintained an offensive biological weapons program from the early 1950s until at least the late 1980s, and that it has not documented the destruction or diversion of the associated materials and facilities. The present compliance concern is therefore a concern about undisclosed history and about current dual-use activity under Article I, not a finding that an offensive program exists (Council on Strategic Risks, 2025a).
The current concern rests on a narrower and more specific set of activity than public commentary usually conveys. Compliance reporting and successive Department of Defense reports to Congress cite military medical institutions conducting toxin and biotechnology research and development with potential biological weapons applications, and specifically identify concern regarding pharmaceutical-based agents and toxins (United States Department of Defense, 2024; War on the Rocks, 2025). Publicly reported work at military-affiliated institutions has included the identification, testing, and characterization of families of potent marine and animal toxins; a government-funded Chinese study in 2014 identified anatoxins, saxitoxin, and tetrodotoxin as having military potential. Characterizing toxins is ordinary pharmacology and is conducted worldwide for legitimate reasons. The concern arises from the conjunction of military affiliation, absence of transparency, and doctrinal writing that treats biology as a domain of contest, not from the research subject itself.
The institutional focus is the Academy of Military Medical Sciences in Beijing and its subordinate institutes, including those concerned with microbiology and epidemiology and with pharmacology and toxicology. The Department of Commerce added the Academy and a set of its subordinate research institutes to the Entity List in December 2021, on grounds concerning biotechnology applications to military end uses (United States Department of Commerce, 2021). Separately, China has expanded its high-containment laboratory capacity substantially, including maximum-containment facilities at the Wuhan Institute of Virology and the Harbin Veterinary Research Institute, with further construction planned. Containment capacity is an unambiguous public health good and is not evidence of a weapons program. What is analytically relevant is that oversight of that capacity is not externally visible, which means growth in capacity translates directly into growth in latency.
Doctrine is the third element and the one most often overstated. The authoritative PLA volume Science of Military Strategy identifies biology as a domain of military struggle, and senior figures at the Academy of Military Medical Sciences have publicly described biotechnology as a strategic commanding height of national defense (War on the Rocks, 2025). Doctrinal writing is evidence of institutional attention rather than of a program, and the United States produces comparable literature about domains it does not weaponize. It belongs in the assessment as context and not as a finding.
Two developments sharpen the picture in opposite directions. The compliance report warned for the first time in the most recent cycle that China is probably capable of using publicly available artificial intelligence and machine learning tools to advance efforts related to biological weapons applications, which is the state-level instance of the mechanism described in Section 8. The same reporting assessed that China probably remains unable to produce the most complex scientific equipment without Western innovation (Council on Strategic Risks, 2025a). That second judgment is the actionable one. It identifies a dependency that export control and equipment licensing can act upon, and it is the state-level argument for the Bureau of Industry and Security measures recommended in 15.5.
A final caution applies specifically to this country and follows directly from Section 7. The Fusarium prosecution demonstrated how readily a research security and import control failure is narrated as an agroterrorism plot, and how much institutional credibility that mischaracterization consumes. The assessment above is a capability-latency judgment supported by compliance reporting. It is not a finding of hostile intent, it does not support one, and the enforcement posture that follows from it is the nationality-neutral standard set out in Section 10.
Set against one another, the three cases are not three degrees of the same problem. They are three different problems, and the instruments that address one are largely inapplicable to the others. Russia is a continuity problem: an inherited program, an inherited agent set, and an inaccessible institutional core. The DPRK is an evidence problem: a confidently worded assessment resting on defector reporting and imagery interpretation, where the policy-relevant question is transfer rather than employment. China is a latency problem: a large and rapidly improving dual-use base whose military applications are governed by decisions not yet taken.
Two limitations govern everything in this section. The first is stated in Section 1 and applies with particular force here: the most consequential intelligence on state programs is classified, and the reporting relied upon above is the declassified residue of a much larger body of assessment. The agents and institutions named are named because official unclassified reporting, peer-reviewed scholarship, or established open-source analysis has already identified them. No technical information concerning production, enhancement, formulation, or dissemination appears here, and none is necessary to the policy argument.
The second is structural. State-level biological risk is uniquely difficult to manage because the Biological Weapons Convention has no verification protocol, no inspectorate, and an Implementation Support Unit staffed by a handful of personnel. The practical consequence is that assessments of state programs rest on national technical means and human intelligence rather than on inspection, and that confidence in any given judgment is therefore lower than the declarative language of compliance reporting suggests. Section 13 sets out why intelligence collection is not a substitute for verification and why the substitution fails in both directions, understating a real program and overstating an absent one. The three tables above should be read in that light. They record what is publicly asserted and by whom, which is a different thing from what is established.
Against that background of durable capability and weak verification, the assessment is nonetheless bounded. Deliberate employment of a biological weapon against the United States homeland by a state actor is assessed as low likelihood and very high consequence. The likelihood estimate reflects the durable logic of deterrence: a state employing such a weapon against the American homeland invites a response that no plausible objective would justify. The consequence estimate reflects that state programs are the only actors with both the resources and the institutional continuity to develop an agent of genuinely strategic effect. The transfer pathway described in Section 6 is not bounded by the same logic, which is why it receives separate collection priority in Section 15.
Non-State Actors
The empirical record of biological attack against the United States is thin, and it is skewed decisively toward low-capability actors. That record is the single most useful corrective to alarmism in this field. It is also the element of the assessment most likely to become obsolete, and it should therefore be examined in detail rather than invoked as a summary judgment. This section accordingly treats the two most consequential non-state biological weapons programs in the historical record at length, extracts their doctrinal significance, and assesses their value as a template for successor organizations.
Section 1 established the fortress premise: the United States homeland is, against conventional attack, effectively unassailable. That premise requires refinement before the non-state threat can be assessed properly. A fortress is not defined solely by its walls. It is defined by the relationship between its walls, its gates, and its garrison. Walls deny approach. Gates admit what the fortress requires in order to remain a going concern, which in the American case means trade, travel, capital, students, scientific collaboration, and the free movement of people and materials. The garrison detects, characterizes, and responds to whatever passes the gate.
Framed in the terms of joint planning doctrine, the American center of gravity against conventional attack is military power, and its critical capabilities are force projection, alliance structure, and assured retaliation. Against biological attack, the center of gravity is entirely different. It is the national capacity to detect an anomalous biological event, characterize the agent, attribute the act, and mount a medical and civil response at scale. The critical requirements supporting that capability are surveillance networks, laboratory capacity, forensic and intelligence attribution, and a countermeasure industrial base. The critical vulnerability is that every one of those requirements is presently being reduced, as documented in Section 11.
The analytic consequence is that a competent adversary does not assault the wall. It enters through the gate, because the gate must remain open for the fortress to function, and because nothing in the wall’s design is relevant to what passes through it. Both organizations examined below understood this, and neither was defeated by the wall.
Aum Shinrikyo remains the most instructive non-state case because it is the only organization in the historical record to have pursued, in parallel and at scale, both a biological and a chemical weapons program, and to have employed the latter against a civilian population. Founded by Shoko Asahara in the mid-1980s, the organization claimed approximately ten thousand adherents in Japan and a substantially larger following in Russia, and controlled financial assets that open-source estimates place in the hundreds of millions of dollars. It operated a manufacturing complex at Kamikuishiki near Mount Fuji, held front companies, and recruited systematically from graduate programs at leading Japanese universities.
Aum therefore possessed, in combination, the four resources conventionally assumed to be prohibitive for a non-state actor: substantial money, credentialed scientific personnel, dedicated physical infrastructure, and freedom from meaningful law enforcement attention over a multi-year period. Its senior scientific personnel included graduates in molecular biology, physics, and applied chemistry occupying formal positions within an internal ministry structure that mirrored a government.
It used those advantages. Between 1990 and 1993 the organization mounted a sustained biological weapons effort under its Ministry of Health and Welfare, directed by Seiichi Endo, and made repeated attempts at employment. Documented target sets included the Japanese legislature, central Tokyo, and United States naval facilities in Japan. The organization also dispatched a delegation of roughly forty members to Zaire in 1992 under the cover of a medical relief mission, an effort assessed to have been directed at acquiring a viral agent from a natural outbreak zone.
Every one of these attempts failed to produce a single casualty. The most extensively documented attempt, conducted from a facility in the Kameido district of Tokyo in mid-1993, generated odor complaints from neighbors and was investigated at the time as an environmental nuisance. Its true nature was established only retrospectively, after the 1995 sarin attack, when investigators returned to archived environmental samples.
The subsequent forensic and interview-based reconstruction, most authoritatively the multi-year study conducted by Danzig and colleagues on the basis of direct correspondence and interviews with former Aum leadership, established that the failure was attributable to a combination of material selection and process control problems rather than to any external barrier (Danzig et al., 2011). The organization was not stopped by law enforcement, by supplier controls, by export regulations, or by any element of the Japanese or American security architecture. It stopped because its own technical execution was inadequate, and because its internal culture, in which scientific findings were subordinated to the leader’s expectations, prevented the organization from recognizing and correcting that inadequacy.
This finding is routinely cited as reassuring. It should not be. The correct inference is narrower and considerably more uncomfortable. Aum’s failure demonstrates that resources are not sufficient for capability. It does not demonstrate that capability is unattainable, and it establishes nothing whatever about the effectiveness of the defensive systems that are supposed to prevent such programs, because those systems were never engaged. The organization ran a multi-year biological weapons program to completion and then abandoned it as a matter of internal preference. Detection played no role in that outcome.
The organization’s response to that failure is as significant as the failure itself. Having judged its biological effort unproductive, Aum reallocated personnel and resources to chemical agents, achieving results that its biological program never approached: the Matsumoto attack of June 1994, which killed eight, and the Tokyo subway attack of March 1995, which killed thirteen and injured thousands. The pivot is doctrinally significant. It establishes that a determined organization treats agent class as a variable to be optimized rather than as a fixed commitment, and that failure in one line of effort produces reallocation rather than abandonment of the objective.
The most transferable lesson from Aum, however, is not scientific but institutional. Japanese authorities possessed, before March 1995, an indicator set that in retrospect was close to comprehensive, and the significance of the case lies in how ordinary each indicator appeared in isolation.
The Matsumoto release of June 1994 killed eight civilians and injured hundreds in a residential district, and was a confirmed chemical attack on Japanese soil eight months before the subway operation. Investigative attention initially settled on a local resident who had himself been poisoned. Environmental sampling conducted near the group’s Mount Fuji complex in late 1994 detected chemical residues consistent with nerve agent production, and the finding was reported in the national press. Neighbors of the Kameido facility had complained of foul odors in 1993, which was investigated as an environmental nuisance and closed. The organization had attempted to purchase a Russian military helicopter, had acquired a sheep station in Western Australia where residues were later found, and had recruited openly from graduate science programs. A lawyer representing families seeking to recover members had disappeared with his wife and infant son in 1989, and other critics and defectors had disappeared subsequently. Civil litigation by former members was open and public. Members had been detained on unrelated charges.
Each of those was individually explicable. A poisoning with an unidentified perpetrator, an odor complaint, a missing lawyer, an unusual aircraft purchase, and a foreign land holding do not assemble themselves into a weapons program without an analyst who is looking for one and who has authority to fuse them. Action was not taken. The principal reason was that Aum was a legally registered religious corporation, a status that in the Japanese constitutional environment of the period imposed substantial practical constraints on police investigation of its internal activities. The indicators were not missing. They were distributed across agencies that had no requirement to combine them and no framework that would have told them what the combination meant, which is the specific failure the indicator set recommended in 15.3 is intended to prevent.
That is the fortress lesson in its clearest form. The organization was shielded not by any technical countermeasure to state power but by a legal and social structure that the state had created for legitimate reasons and was unwilling to breach. The gate was open, and it was held open by the fortress’s own values.
Where Aum’s biological effort was one line of activity among many within an organization pursuing diffuse and apocalyptic objectives, al-Qaeda’s was a deliberate, compartmented program initiated at the direction of the organization’s second-ranking figure and pursued in parallel with the September 11 operation. It is the closest approximation in the historical record to a non-state actor applying state-style program management to a biological weapons effort, and for that reason it is the more instructive of the two cases for contemporary planning.
Ayman al-Zawahiri initiated the effort, referred to in the documentary record by the cover designation al-Zabadi, in approximately 1999. The 9/11 Commission and the subsequent Commission on the Intelligence Capabilities of the United States Regarding Weapons of Mass Destruction both concluded that the program was real, was resourced, and was materially more advanced than had been assessed prior to the fall of Afghanistan (National Commission on Terrorist Attacks Upon the United States, 2004; Commission on the Intelligence Capabilities of the United States, 2005). Mowatt-Larssen’s subsequent reconstruction, drawing on his tenure directing intelligence at the Department of Energy and prior service in the Central Intelligence Agency’s counterterrorism component, assessed that al-Qaeda’s biological effort was the most advanced of its unconventional weapons lines and was closer to operational capability than its nuclear or radiological efforts (Mowatt-Larssen, 2010).
Three features of that command intent distinguish this program from ordinary terrorist aspiration. First, it was directed personally by the deputy leader of the organization rather than delegated to a peripheral cell, which placed it under the same operational security regime applied to al-Qaeda’s most sensitive planning. Second, contemporaneous internal correspondence framed the effort in explicitly cost-benefit terms, weighing resources required against strategic effect sought. That is the reasoning of a general staff rather than of a millenarian sect, and it implies a rational actor calculating return on investment. Third, the effort proceeded concurrently with, rather than as an alternative to, the aircraft operation, indicating that al-Qaeda’s leadership conceived of unconventional weapons as an additional line of effort rather than as a substitute for conventional terrorism.
Religious authorization followed rather than preceded the technical effort, which is itself analytically significant.
The jurisprudential ruling issued in 2003 permitting the use of weapons capable of indiscriminate mass casualties against the United States postdates the program’s initiation by roughly four years. Doctrinal permission was constructed to accommodate a capability the organization was already pursuing, not the reverse. Assessments that treat the absence of explicit religious sanction as a constraint on a given group’s unconventional weapons ambitions should account for this sequencing.
If command intent explains why the program existed, its architecture explains how it was pursued, and that architecture is the element most relevant to contemporary assessment. Al-Qaeda did not attempt to build indigenous scientific capacity from nothing, which was Aum’s approach and which failed. It sought instead to acquire capability through legitimate institutional channels, using three mechanisms in combination.
Patronage of credentialed outside specialists. Rauf Ahmad, a Pakistani microbiologist, corresponded directly with al-Zawahiri, attended scientific conferences in the United Kingdom between 1999 and 2001, and pursued equipment and material acquisition through ordinary commercial and academic channels. Correspondence later recovered indicates he reported to al-Zawahiri on progress and on procurement. He was detained for questioning in Pakistan in late 2001; American investigators were subsequently unable to bring charges, and the Federal Bureau of Investigation placed the case in inactive status (Warrick, 2006).
Recruitment of Western-trained diaspora scientists. Yazid Sufaat, a Malaysian national and former army captain, held a 1987 biochemistry degree from California State University, Sacramento. He operated a registered pathology laboratory in Malaysia as commercial cover, hosted two of the eventual September 11 hijackers in Kuala Lumpur in January 2000, and was tasked with cultivating a biological agent. The 9/11 Commission established that he spent several months on that effort at a facility near Kandahar airport. He was detained in Malaysia in December 2001, released in 2008, and re-detained in 2013 (National Commission on Terrorist Attacks Upon the United States, 2004).
Use of territorial sanctuary for infrastructure. The Kandahar facility existed because al-Qaeda enjoyed the protection of a state sponsor over defined terrain, which supplied what no clandestine urban operation can easily obtain: physical space, freedom from inspection, and time. Coalition forces overrunning Kandahar in December 2001 recovered program documentation from a residence together with rudimentary laboratory facilities; open reporting indicates that no evidence of completed production was found (Warrick, 2006).
That model of acquiring capability through legitimate channels was substantially more efficient than Aum’s, but the historical record indicates it suffered from a specific and instructive defect: the organization appears to have recruited on the basis of credential rather than on the basis of relevant specialization.
Sufaat held a bachelor’s degree in biochemistry with a minor in laboratory science, awarded fourteen years before he was tasked. Biochemistry is not microbiology, and an undergraduate degree awarded in 1987 does not confer the applied culturing and process expertise the assignment required. Rauf Ahmad was a genuinely relevant specialist, and he was the exception rather than the pattern. The organization’s difficulty was not identifying willing scientists; it was identifying willing scientists whose specific training matched the requirement.
This is the same finding that emerged from Aum, arrived at from the opposite direction. Aum possessed relevant specialists and failed on process control and organizational culture. Al-Qaeda possessed superior program management and failed to assemble the right specialists. Neither organization was defeated by an external control. Both were defeated by the difficulty of converting resources and intent into applied technical competence, which is the substance of the tacit knowledge barrier described in Section 6.
A further feature of the case recurs with sufficient consistency across this paper to constitute a finding in its own right. Rauf Ahmad, the only genuinely relevant specialist identified in the program, was detained for questioning and never charged with any offense; American investigators could not construct a chargeable case and the matter was placed in inactive status. Yazid Sufaat was held under Malaysian security detention rather than prosecuted for the conduct that concerned investigators.
The same pattern governs the domestic cases examined in Section 4. Jia Bei Zhu was convicted on twelve counts of fraud and misbranding, none of which concerned the pathogens at 850 I Street. The federal complaint against the Las Vegas property manager alleged unlawful firearms possession and was subsequently dismissed, leaving only a state hazardous waste charge. In each instance the conduct that generated the biosecurity concern was not the conduct that was prosecutable, and the government reached the individual through a collateral offense, through a security authority outside the criminal law, or not at all.
The implication is that conviction rates in this domain are a poor proxy for the effectiveness of biosecurity authorities. A regime that reliably convicts the right people for the wrong offenses is producing an accurate record of law enforcement competence and a misleading record of biosecurity coverage. Section 15 accordingly recommends a criminal provision that does not require proof of hostile intent, on the assessment that the intent element is what forces prosecutors onto collateral charges.
How the program actually ended is the finding that should govern American planning, and it is uncomfortable for the same reason the Aum finding is. Al-Qaeda’s biological weapons program was not defeated by biosecurity controls. It was not detected by supplier screening, by export control, by academic research security, or by any element of the international nonproliferation architecture. Rauf Ahmad attended conferences in a Western democracy and pursued procurement openly. Sufaat held an American degree, operated a licensed laboratory, and moved internationally without impediment.
The program ended because the United States invaded Afghanistan and destroyed the sanctuary in which its physical infrastructure sat. The disruption was kinetic and territorial, achieved by the wall rather than at the gate, and it was incidental to a campaign undertaken for other reasons. Al-Qaeda’s biological program was, in the language of targeting, a beneficiary of collateral effect rather than the object of a deliberate defensive success. Had the September 11 attacks not occurred, there is no identified mechanism by which the program would have been interdicted.
That disruption removed the infrastructure but not the ambition. Intent within the broader Salafi-jihadist movement did not terminate with the loss of Afghan sanctuary. The 2003 jurisprudential ruling authorizing indiscriminate mass casualty weapons against the United States has circulated within the movement since. Al-Qaeda in the Arabian Peninsula subsequently demonstrated interest in unconventional agents, and the Islamic State conducted chemical weapons employment in Iraq and Syria between 2014 and 2017, establishing that the movement retains both the doctrinal permission and, under conditions of territorial control, the organizational capacity to pursue unconventional weapons.
Set side by side, the two programs differ in nearly every organizational dimension and converge on the two that matter. The binding constraint on both has been territorial sanctuary rather than intent or doctrinal permission. That makes the relationship between American counterterrorism posture and biological risk direct rather than incidental: conditions that restore durable safe haven over defined terrain also restore the specific enabler that made the Kandahar effort possible, and no element of the biosecurity architecture examined in this paper substitutes for its denial.
Taken together, these two cases constitute something the counterterrorism literature has been reluctant to state plainly: a documented, publicly available operational template. The template does not consist of technical methods, which remain the binding constraint and are not addressed in this paper. It consists of organizational doctrine, and organizational doctrine transfers far more readily than laboratory skill.
Five elements of that doctrine are directly transferable to a successor organization.
Legitimate institutional cover is the decisive enabler. Aum used a religious corporation; al-Qaeda used a licensed pathology laboratory and academic conference attendance. In both cases the cover was not merely concealment but active legal protection, and in both cases it worked. Section 4 established that the American regulatory architecture presently affords equivalent cover to any privately funded non-clinical laboratory holding unlisted material.
Capability is purchased, not developed. Al-Qaeda’s model of contracting credentialed outside specialists is substantially more efficient than Aum’s model of internal cultivation, and it is the model a rational successor organization would adopt. The relevant defensive control is therefore personnel and research security, not material control.
The defensive systems were never the binding constraint. In neither case did screening, licensing, export control, or inspection contribute to the outcome. Any organization studying this record will conclude, correctly on the evidence, that these controls are evadable by an actor that does not present itself for regulation.
Failure produces reallocation rather than abandonment. Aum’s pivot to chemical agents demonstrates that agent class is treated as an optimization variable. Assessments that measure the threat by counting biological attempts systematically undercount the underlying intent.
Time favors the adversary. Aum operated its program for roughly three years and al-Qaeda for roughly two, in both cases without effective interdiction. An organization prepared to operate on a decadal timeline against a defensive architecture that is not detecting it faces no meaningful attrition.
Applying that template to the present threat picture identifies four categories of actor warranting sustained collection and analytic priority.
Salafi-jihadist organizations retaining doctrinal authorization. Al-Qaeda core and al-Qaeda in the Arabian Peninsula retain the jurisprudential permission established in the early 2000s and institutional memory of the al-Zabadi effort. Islamic State remnants in Iraq, Syria, and the Sahel retain demonstrated willingness to employ unconventional agents. The binding constraint on both is territorial sanctuary, which makes the relationship between counterterrorism posture and biological risk direct rather than incidental.
Apocalyptic and accelerationist movements. The Aum profile, characterized by an eschatological worldview, an internal scientific cadre, and legal cover, is not confined to any religious tradition. Contemporary neo-Nazi accelerationist networks in the United States and Europe, including the successors to Atomwaffen Division and the Base and the online ecosystems that supplanted them, have produced repeated toxin cases and articulate an explicit doctrine of societal collapse. Their technical ceiling has to date been low, but their doctrinal ceiling is unlimited.
The state-adjacent actor. The scenario least addressed by current American posture is a non-state group receiving material or expert assistance from a state program seeking deniability. Given the compliance findings in Section 5, Russia and the Democratic People’s Republic of Korea are the actors for whom this pathway is technically available, and the DPRK’s documented use of unconventional agents in extraterritorial operations is directly relevant to its risk tolerance.
The insider. Amerithrax remains the only mass-casualty biological attack on American soil, and it was executed by a cleared scientist employed within the federal biodefense enterprise. Insider access remains the highest-probability pathway to a consequential deliberate event, and it is the pathway least affected by supplier screening, export control, or border enforcement.
Across five decades the pattern has been consistent: intent has been reasonably common, capability has been rare, and the distance between them has functioned as the primary safeguard. That distance has been maintained by two things. The first is tacit knowledge, the accumulated practical judgment that determines whether biological work succeeds and which does not transfer through written protocols. The second is physical access to materials and equipment. Section 8 assesses whether both are eroding; the honest answer is that they are, that the rate is unknown, and that no public demonstration has established that the gap is closed.
Because the gap cannot be measured directly, the appropriate planning posture is defense in depth across the full adversary pathway rather than reliance on any single control. The sequence below is generic to all four actor categories identified above, and each stage presents a distinct intervention opportunity for a distinct set of federal authorities.
The utility of this framing is diagnostic. In the Aum case, no intervention point functioned. In the al-Qaeda case, no intervention point functioned, and termination occurred outside the model through unrelated military action. A defensive architecture in which the historical record contains zero successful interdictions at stages three through five is not a validated architecture. It is an untested one, and its apparent success to date is more plausibly explained by the scarcity of serious attempts than by its own effectiveness.
The resulting assessment divides non-state deliberate use into two distinct risk profiles that should not be aggregated. Low-capability toxin incidents, the recurring ricin pattern documented in the historical record, are assessed as high likelihood and low consequence, and constitute a standing feature of the environment rather than a strategic threat. Successful non-state employment of an agent capable of mass casualties is assessed as low likelihood and very high consequence, with the likelihood estimate carrying substantially greater uncertainty than any other judgment in this paper.
That uncertainty should be stated precisely rather than smoothed over. The low likelihood estimate rests on the historical base rate. The historical base rate rests on two cases in which the defensive architecture demonstrably contributed nothing to the outcome. An estimate resting on a record of untested defenses is a weak estimate, and it will degrade further as the technological conditions described in Section 8 continue to change.
The claim that the architecture is untested rather than effective should itself be held to the standard this paper applies elsewhere, and it is worth stating what would refute it. The competing explanation, that the controls deter attempts which are therefore never mounted, predicts a specific and observable record: procurement approaches refused and referred, screening declinations investigated, expertise solicitations detected through research security, and cases closed at stages three through five before any production attempt. That record would be dispositive, and the government does not presently produce it. Refusals by synthesis providers are resolved privately and are not reported. No count exists of unregistered laboratories or of inspections performed. No disposition rate is published for referrals arising from either. The deterrence reading is therefore not disproved by the evidence; it is unmeasured, and so is the reading offered here. That is a defect in the instrumentation rather than in either argument, and it is the reason the measures of effectiveness in Section 15 are specified as they are. Four of the seven cannot currently be computed, and computing them is what would convert this judgment from a contest between two unfalsifiable readings into a question the record could settle.
Agricultural and Economic Biosecurity
Agricultural biosecurity is systematically underweighted relative to human pathogens in both funding and public attention, despite presenting a larger and less defended attack surface. American agriculture is monocultural, geographically concentrated, and vertically integrated. These are efficiency features that function as vulnerabilities under attack conditions. A foot-and-mouth disease or African swine fever introduction would cause no direct human mortality but would trigger immediate export market closure, mass culling, and cascading supply chain effects measurable in tens of billions of dollars. Detection depends substantially on producer self-reporting and on Animal and Plant Health Inspection Service surveillance, both of which are designed against accidental introduction rather than deliberate action. This category has a longer record of actual employment than any other examined in this paper, and the record is instructive precisely because it is unglamorous. Attacks on plants and animals have been attempted more often than attacks on people, they have been easier to execute, and they have been almost impossible to prove.
The most fully documented case was conducted on American soil against American livestock by a foreign national operating from a private residence. In 1915, with the United States still neutral, the sabotage section of German military intelligence dispatched Anton Dilger, a German-American physician holding a United States passport, to disrupt the flow of draft animals to the Allied armies. Dilger carried cultures of Bacillus anthracis and Burkholderia mallei, the agent of glanders, and established a laboratory in a rented house in Chevy Chase, Maryland, within a few miles of the White House. Cultures produced there were passed to agents and to recruited stevedores who inoculated horses and mules held in dockside corrals and remount depots at Baltimore, Newport News, Norfolk, and New York while the animals awaited shipment to France and Britain. The program was one element of a coordinated campaign that also targeted livestock consignments in Romania, Norway, Spain, and Argentina (Wheelis, 1999; Koenig, 2006).
Three features of that case transfer directly to the present. The operation used a legitimate professional identity and a private residential structure as cover, which is the configuration Section 4 documents in Reedley and Las Vegas a century later. It targeted logistics rather than population, seeking military effect without producing casualties that would compel a response. And its actual effect has never been established. Contemporary reporting noted outbreaks among horses and mules in transit, but existing diagnostic tests for glanders blunted the impact, the viability of the cultures is unknown, and estimates of animals lost are set against roughly three quarters of a million shipped. A documented program executed over three years produced no measurable, and therefore no attributable, result.
The second case illustrates the attribution problem from the opposite direction. In 1985 the Department of Agriculture asserted that contract workers in Mexico had deliberately spread New World screwworm, Cochliomyia hominivorax, among livestock, an allegation made against the background of the joint United States-Mexico eradication campaign then approaching its most expensive phase (Biosecurity and Bioterrorism, 2013). The Food and Agriculture Organization’s subsequent account of the same period attributes the 130 cases detected in northeastern Mexico that year, predominantly in cattle, to the movement of a single infested sheep out of an enzootic zone in Yucatán (Food and Agriculture Organization of the United Nations, 1993).
Both explanations remain in the literature. Neither has been eliminated. That is the entire difficulty of the category stated in a single episode: an economically consequential outbreak, a plausible deliberate hypothesis, a plausible accidental hypothesis, and no forensic method available at the time capable of distinguishing them. An adversary contemplating this pathway does not need to achieve deniability, because the epidemiology supplies it.
One recent case illustrates both that vulnerability and the analytic difficulty of assessing it. In June 2025 the Department of Justice charged two Chinese nationals, Yunqing Jian and Zunyong Liu, with conspiracy, smuggling, false statements, and visa fraud in connection with bringing Fusarium graminearum into the United States for research at a University of Michigan laboratory. The Department characterized the fungus as a potential agroterrorism weapon and noted that Jian had received Chinese government funding for research on the pathogen and that documentation of Chinese Communist Party affiliation was recovered from her devices (United States Department of Justice, 2025; Cable News Network, 2025).
The case merits careful reading because it demonstrates a recurring analytic failure. The 25-page criminal complaint did not allege that the defendants planned to release the fungus outside a laboratory. Fusarium graminearum is not listed under the Federal Select Agent Program, and it is already endemic in American wheat and corn, where it causes Fusarium head blight and Gibberella ear and stalk rots. Several plant pathologists publicly disputed the agroterrorism characterization (Chemistry World, 2025).
What the case actually establishes is a research security and import control failure: undeclared foreign funding, undisclosed affiliation, and unauthorized transfer of biological material through a port of entry. That is a real and addressable problem. It was, however, narrated as an agroterrorism plot and arrived alongside a broader policy push to revoke Chinese student visas. The mismatch between what the evidence supported and how the case was framed is itself a threat to sound policy, because it misallocates attention and expends institutional credibility that will be needed when an unambiguous event occurs.
Read against the two historical cases, the Fusarium prosecution completes an uncomfortable pattern. In 1915 a genuine agricultural attack ran for years and was never measured. In 1985 an ambiguous outbreak generated a deliberate-action allegation that was never resolved. In 2025 an unambiguous research security violation was characterized as an attack it was not. The category has produced a documented attack that went unquantified, a contested event that went unattributed, and an attributed case that was mischaracterized. Each failure is a different one, and each is a failure of the same underlying capability.
Setting aside how the Fusarium case was characterized, the underlying category assessment is clear. Foreign animal or plant disease incursion is assessed as moderate to high likelihood and moderate to high consequence. Deterrence is effectively absent in this category. Attribution of a plant or animal pathogen introduction to a deliberate act is extraordinarily difficult, and such an act may not clearly satisfy the intent element of 18 U.S.C. § 175.
Two structural features compound that assessment and distinguish agriculture from the human health case. Detection is reporting-dependent: the sensor is a producer with a direct financial interest in the finding, operating in an industry where a confirmed foreign animal disease closes export markets within days. And the consequence is realized through markets rather than through mortality, which means the damage is largely complete before any attribution question can be answered. The scenario in Section 14 assumes this sequence. The historical record in 7.1 indicates it is the normal one.
Technological Change
Nucleic acid synthesis screening is the highest-leverage intervention available in biosecurity, because it constitutes a genuine physical chokepoint. Regardless of what an actor knows or intends, obtaining synthetic genetic material generally requires transacting with a commercial provider, and that transaction is observable.
The 2023 Department of Health and Human Services framework and the 2024 Office of Science and Technology Policy framework substantially improved the regime. Coverage was extended beyond select agents to a broader category of sequences of concern; screening was encouraged at 50 base pairs rather than 200; oligonucleotide pools and benchtop synthesizers were addressed; and compliance became mandatory for federally funded research purchases made on or after 26 April 2025 (Biosecurity Handbook, 2026).
Three gaps remain. Screening is still voluntary for research that is not federally funded. Enforcement mechanisms against private-sector non-compliance are limited. International harmonization is incomplete, so an unscreened provider in another jurisdiction remains reachable. A fourth technical gap is that short oligonucleotides, typically under 200 base pairs, are often unscreened or minimally screened, and standard laboratory methods permit their assembly into longer sequences.
The Center for Security and Emerging Technology stated the core limitation directly when the framework was first announced: using federal research funding as the policy lever captures most legitimate biological research activity but does not reach an actor who neither receives nor uses federal funding, and closing that gap requires legislation mandating universal screening (Center for Security and Emerging Technology, 2025).
Executive Order 14292 directed the Office of Science and Technology Policy to revise or replace the 2024 Framework for Nucleic Acid Synthesis Screening within 90 days of 5 May 2025. As of July 2026, the Congressional Research Service reported that it had not been able to determine whether the framework had been revised or replaced, and that the 2024 framework remained in place past the deadline (Congressional Research Service, 2026; Legis1, 2026). The Administration for Strategic Preparedness and Response stated as of August 2026 that a replacement remained forthcoming.
Against that federal inertia, an unusual and politically perishable condition currently obtains: the regulated parties are asking to be regulated. In June 2026, a coalition of life sciences researchers, artificial intelligence companies, biotechnology developers including members of the International Gene Synthesis Consortium, and other experts wrote to Congress calling for mandatory screening of synthetic nucleic acid orders and of the equipment used to produce them. The obligations proposed in that letter would fall on synthesis providers rather than on biological design tools or the artificial intelligence models supporting them (Congressional Research Service, 2026).
Pending legislation includes S. 3741, the Biosecurity Modernization and Innovation Act of 2026, introduced in January 2026 and referred to the Senate Committee on Commerce, Science, and Transportation, which would address nucleic acid synthesis security and biosecurity authorities across the federal government; S. 4363, the Engineering Biology Readiness Act, which would require the next biennial biodefense threat assessment to analyze engineering biology risks; and S. 3952, the Future of Artificial Intelligence Innovation Act of 2026, which would require examination of safeguards against unintended use of artificial intelligence in developing chemical, biological, radiological, nuclear, and explosive threats (Legis1, 2026).
The mechanism of concern regarding artificial intelligence has two components, and until recently only one of them was taken seriously. The first is that models may compress tacit knowledge, the troubleshooting judgment that has historically separated intent from capability, and thereby narrow the gap described in Section 6. The second is generative design itself, the direct production of novel functional biological sequences, which was long treated as a distant prospect and is no longer one.
Until recently the standard counterweights to that concern were that computationally generated biological designs frequently do not function, and that no public demonstration had shown a model producing an artifact of real consequence (Congressional Research Service, 2026). Both propositions have now been overtaken by published, peer-reviewed results, and any assessment still resting on them is out of date.
The viability objection did not survive 2026. A Stanford and Arc Institute team reported in Science the first generative design of complete genomes, using genome language models to produce whole bacteriophage sequences that were then chemically synthesized and introduced into host bacteria. Of roughly three hundred designs, sixteen yielded functional phages carrying substantial evolutionary novelty relative to any natural template. Several outperformed the natural reference phage in growth competition and lysis kinetics, one was shown by cryo-electron microscopy to employ an evolutionarily distant capsid packaging protein, and a cocktail of the generated phages defeated resistance in three bacterial strains (King et al., 2026). A model was given a design objective and returned novel, viable, self-replicating biological agents.
Four qualifications bound what that result demonstrates, and they matter. The phages target bacteria, not humans, and host tropism was deliberately constrained to the intended host. The work was performed by a leading laboratory that had to build custom annotation, prompting, and screening pipelines before any design succeeded. The yield was roughly sixteen functional constructs from several hundred attempts, which is a research success rate rather than a production one. And the design template was among the smallest genomes in biology, orders of magnitude below a mammalian virus. The correct reading is not that a pandemic pathogen can now be generated on request. It is that the specific claim on which the reassuring assessment rested, that these designs do not work, is no longer available.
The second development strikes the chokepoint directly. A Microsoft-led team reported in Science that open-source protein design tools could generate large numbers of variants of proteins of concern, including ricin and botulinum neurotoxin, that preserved predicted structure while evading the biosecurity screening software used by synthesis providers. Roughly seventy-six thousand variants of seventy-two proteins were assessed; most were not flagged. Following a coordinated disclosure process modeled on cybersecurity practice, patches were developed and distributed to providers before publication, after which approximately three percent of the highest-risk variants still evaded detection (Wittmann et al., 2025). That study was computational, and the function of the redesigned proteins was predicted rather than demonstrated, which is a real limitation. It is not a reassuring one. Section 8 identifies synthesis screening as the highest-leverage control in the system because it is a physical chokepoint. The screening it describes operates by matching orders against known sequences, and a generative model’s basic capability is producing sequences that are functionally similar and textually dissimilar.
Three consequences follow for this paper’s assessment. The intent-capability gap described in Section 6 is narrowing measurably rather than speculatively, and the trajectory is one-way: model capability accumulates, published results do not expire, and no mechanism exists by which this class of capability is withdrawn. The historical base rate in Section 6 is accordingly a weaker guide to the coming decade than to the past one, and the low-likelihood estimate for non-state engineered agents should be understood as resting on conditions that are actively changing. And the screening framework in Section 8, already past its replacement deadline, is now overdue against a technical environment that has moved since it was written. A control designed around sequence matching requires periodic revision to remain effective against generative design, which is an argument for the standing auditing and standards functions recommended in 15.5 rather than for a single corrective action.
Frontier developers have moved to self-governance ahead of regulation. OpenAI published a governance framework in May 2026 describing risk assessment and mitigation for cyber offense, chemical, biological, radiological and nuclear risks, harmful manipulation, and loss of control, and has run competitions offering up to $50,000 for identifying circumventions of its biosafety safeguards. Anthropic released a proposed policy framework in June 2026 recommending that frontier developers test models for catastrophic capabilities (Legis1, 2026). Voluntary industry governance without a statutory floor is a fragile equilibrium, because it depends on continued competitive alignment among firms whose incentives may diverge.
Two developments in laboratory hardware extend the problem in a different direction. Benchtop synthesizers relocate production from a screened commercial provider to a device on a bench, shifting the control point from the transaction to the machine. Cloud laboratories, which permit remote design and execution of experiments in automated facilities, decouple physical access from experimental capability. Oversight of the cloud laboratory sector remains largely unexamined; the Council on Strategic Risks has recommended that the National Academies conduct an exploratory study of its biosafety and biosecurity implications (Council on Strategic Risks, 2025c).
Taken together, technological change is the variable most likely to invalidate the historical base rate. No single development closes the intent-capability gap. All of them move in the same direction simultaneously, while the principal mitigating control remains substantially voluntary, and while a mandatory screening bill sits in committee and an executive order deadline has passed unmet.
Legal and Regulatory Architecture
Four federal regimes govern biological risk in the United States, supplemented by one informal institutional layer. None was designed to function as a general-purpose safety net, and the composite leaves a specific and identifiable hole.
The composite picture is a regime constructed for accountable institutions handling known dangerous agents. It provides close to zero coverage against an unaccountable actor handling an unlisted agent, which is the configuration present in both the Reedley and Las Vegas cases and in most plausible future scenarios. The Zhu prosecution is the demonstration: twelve convictions, none of which concerned the pathogens.
Detection, Attribution, and Response
BioWatch, the aerosol collection system deployed across more than thirty metropolitan jurisdictions, has been criticized for years for false alarms and for an operational timeline in which filter retrieval and laboratory verification require approximately twelve hours, producing a detect-to-warn interval of roughly twelve to thirty-six hours from release to confirmation (Department of Homeland Security, 2020).
The intended successor, Biological Detection for the 21st Century, was designed to shift to continuous anomaly detection with notification within minutes. The Government Accountability Office reported in 2021 that the program remained early in the acquisition lifecycle with technologies not yet selected and feasibility of core components still under analysis (Government Accountability Office, 2021). The Department of Homeland Security placed the program on hold in 2022 pending a capabilities assessment. The Bipartisan Commission on Biodefense had recommended replacing both legacy BioWatch and piloted BD21 equipment within eighteen months. That replacement has not occurred. The United States therefore continues to rely on a system its own oversight bodies have assessed as inadequate, approximately two decades after fielding it.
Environmental detection is not, however, where detection actually occurs. In practice, a biological event in the United States would most likely be detected by an alert clinician recognizing an anomalous presentation, and characterized downstream through genomic sequencing and wastewater surveillance. This reframes the public health workforce reductions described in Section 11 as a detection problem rather than solely a response problem. The loss of approximately one quarter of the CDC civilian workforce between fiscal years 2024 and 2026 degrades the sensor, not merely the responder (Trust for America’s Health, 2026).
Attribution is the weakest element of the American posture and the foundation of any deterrent claim. Microbial forensics, the determination of whether a sample was engineered and by whom, is the technical basis on which retaliation could be threatened credibly.
The National Defense Authorization Act for Fiscal Year 2026, signed 18 December 2025, contained at least twenty-four provisions affecting biodefense. Several are constructive, including limits on adversarial access to sensitive technologies and multiomic datasets, strengthened Department of Defense preparedness for biological events, and support for a resilient biomanufacturing base. On the negative side, the Act codified the dissolution of the National Counterproliferation and Biosecurity Center within the Office of the Director of National Intelligence and repeated prior language restricting the National Nuclear Security Administration from exercising its biodefense and biosecurity capabilities (Council on Strategic Risks, 2025d). Deterrence without attribution is a bluff, and adversary analysts read appropriations and authorization documents.
The Amerithrax precedent implies that personnel access, not material acquisition, is the highest-probability pathway to a consequential deliberate event. Personnel reliability programs exist at registered select agent facilities, but the more common contemporary failure mode is research security drift: undeclared foreign funding, undisclosed affiliations, and unauthorized material transfer, as in the Fusarium case.
Calibration here is genuinely difficult and currently contested. Research security enforcement that is perceived as ethnically targeted degrades the willingness of foreign-born scientists, who constitute a substantial share of American life sciences capacity, to report anomalies, and imposes long-term costs on the talent base. Enforcement that is too lax permits precisely the transfers that generate the cases. The correct posture is rigorous, uniform, and nationality-neutral enforcement of disclosure and material transfer rules, decoupled from immigration policy objectives.
The United States Defensive Posture
Nearly every measurable indicator of American biodefense capacity is moving in the same direction.
The fiscal year 2026 budget requested $5.12 billion for biodefense, a decline of approximately $3 billion from the $8.16 billion enacted in fiscal year 2025, with the majority of the reduction attributable to the National Institute of Allergy and Infectious Diseases (Council on Strategic Risks, 2025b). The Council on Strategic Risks assessment of the fiscal year 2027 request concluded that although biodefense continues to be articulated as an administration priority, general programmatic cuts and agency reorganizations have restricted and eliminated key programs, clouding budgetary transparency and weakening deterrence (Council on Strategic Risks, 2026).
The proposed fiscal year 2026 budget for the CDC represented a 53 percent reduction relative to fiscal year 2024 when combined with the Agency for Toxic Substances and Disease Registry, with the Public Health Emergency Preparedness cooperative agreement, the primary federal funding source for state and local emergency preparedness, facing a 52 percent reduction. More than one hundred public health programs and funding lines would be eliminated, including 61 at CDC (Trust for America’s Health, 2026; Association of Schools and Programs of Public Health, 2025).
Congress partially resisted. The fiscal year 2026 Labor-HHS appropriations bill provided approximately $9.2 billion for CDC at relatively level funding, held the Public Health Emergency Preparedness cooperative agreement level at $735 million, provided $307.1 million for the Hospital Preparedness Program, and increased public health data modernization funding by $10 million (Association of State and Territorial Health Officials, 2026). The fiscal year 2027 request would nonetheless eliminate the Hospital Preparedness Program entirely.
Two further factors compound the fiscal picture. Approximately 80 percent of the CDC domestic budget flows to states, localities, tribes, health systems, and community partners, and federal funding constitutes roughly half of state and local health department budgets, so federal reductions transmit directly to local capacity. Separately, the March 2025 termination of more than $12 billion in COVID-era grants, funding that had been broadened to support infectious disease monitoring, laboratory capacity, and emergency preparedness, was blocked by court order for plaintiff states and the District of Columbia but remained in unresolved litigation through year end, creating planning uncertainty that exceeds the accounting effect (Trust for America’s Health, 2026).
Medical countermeasures constitute the final line of defense and the most fragile element of the posture. The development of authorized COVID-19 vaccines within approximately eleven months of sequence publication was the most consequential biodefense demonstration of the century, and it depended on a platform technology combined with pre-positioned manufacturing capacity.
The cancellation of nearly $500 million in contracts funding mRNA vaccine research and development in August 2025 is therefore the single most consequential decision surveyed in this paper. It targets precisely the capability that converts an unknown novel pathogen into a tractable one. Trust for America’s Health characterized the action as a potential disruption to the research, development, and deployment of countermeasures needed for the next public health emergency (Trust for America’s Health, 2026).
The same contraction extends beyond American borders. The United States formally completed withdrawal from the World Health Organization in January 2026, reducing access to global data sources supporting outbreak tracking and response. The dissolution of the United States Agency for International Development and reductions to CDC global health programs further curtailed forward-deployed detection (Trust for America’s Health, 2026). Because pathogens of concern to the United States generally emerge outside it, reductions in overseas surveillance translate into reduced domestic warning time.
Integrated Risk Assessment
The following positioning represents the author’s structured judgment on the basis of the evidence surveyed above. It is offered to make the reasoning explicit and contestable rather than to convey quantitative precision.
Two entries in that table deserve a caution the ranking itself cannot carry. The non-state engineered agent judgment is the least stable in the assessment. Its low likelihood estimate rests on the historical base rate, and Section 8 establishes that the technological conditions supporting that base rate have measurably changed. If this table is revisited in three years, that is the row most likely to move, and it will move in one direction. The insider entry is newly ranked here on the strength of Section 10, and its likelihood estimate rests on a single case, which is a thin basis for any judgment; it is included because a pathway that no other measure in this paper reaches should not be absent from the assessment merely because its base rate is hard to estimate.
International Governance
The Biological Weapons Convention entered into force in 1975 without a verification protocol, and it still lacks one. It has no inspectorate and an Implementation Support Unit staffed by a handful of personnel. This is the weakest verification regime governing any category of weapon of mass destruction.
The Ninth Review Conference established a Working Group for the 2023 to 2026 review cycle with a mandate to identify and develop concrete measures to strengthen the Convention across seven areas, including compliance and verification measures potentially of a legally binding nature, a subject absent from Convention discussions for more than twenty years (Permanent Mission of Italy to the Conference on Disarmament, 2026).
Progress has been procedural and slow. The sixth session in August 2025 examined compliance and verification measures in depth. The seventh session, concluding in December 2025, did not complete examination of the draft final report. An extraordinary eighth session convened 9 to 13 February 2026 in Geneva to continue that work, with text approved piecemeal through informal consultations held in December 2025 and January and February 2026. A ninth session convened 17 to 21 August 2026 (United Nations Office for Disarmament Affairs, 2026a, 2026b).
What fills the verification vacuum is intelligence, and it is worth stating plainly why that is not a substitute. Every judgment in Section 5, including each entry in the three country tables, rests on this basis rather than on inspection. Intelligence is collected against an actor working to defeat collection, which means it yields probabilistic judgments rather than the auditable findings a compliance regime requires. It rarely resolves intent, because the activity in question is dual-use at the point of observation: containment construction, aerobiology, and vaccine development look substantially the same whether the program they support is prohibited or permitted, which is the difficulty documented at Sergiev Posad-6 in Section 5 and at the Pyongyang Bio-technical Institute in Section 5. The most probative material cannot be tabled, since disclosure in a multilateral forum would expose sources and methods, so the evidence that would most support a compliance finding is the evidence least available to make one. And the error record runs in both directions. The Soviet program operated at scale for two decades while it was assessed as terminated, and the 2002 Iraq assessment overstated a capability that did not exist. A regime that relies on national means for verification inherits both failure modes, and it inherits them without any mechanism for correcting a mistaken judgment through inspection.
Two structural features limit expectations. The Convention operates by consensus, so any state under compliance suspicion can slow or block progress, and the states the United States assesses as non-compliant are parties to the negotiation. Meanwhile, American withdrawal from the World Health Organization and the dissolution of USAID reduce the informal international detection architecture at the same time that the formal treaty architecture remains unverifiable.
Scenarios for Planning
Three scenarios follow from the preceding assessment and should govern planning assumptions.
The first is an ambiguous outbreak. A cluster of unusual respiratory illness appears in a mid-sized American city. The immediate and decisive question is whether the cause is natural, accidental, or deliberate. With current attribution capability, the honest answer for a period of weeks would be that it is unknown. Every subsequent decision, including movement restriction, diplomatic signaling, retaliation, and market stabilization, would be taken under that ambiguity. This is simultaneously the most likely serious scenario and the one for which the United States is least prepared, because the deficit is analytic rather than material and therefore cannot be remedied at the moment of need. The hypothesis-free diagnostic capability that would shorten the characterization half of that interval is the subject of the metagenomic sequencing recommendation at 15.2; the analytic half is the subject of the joint biological warning cell at 15.3.
The second is an agricultural incursion. Foot-and-mouth disease or African swine fever establishes in American livestock. Human mortality is zero. Export markets close within days, culling extends into the millions of animals, and direct and indirect losses reach tens of billions of dollars. Detection depends on producer reporting. Deterrence is essentially absent because attribution is nearly impossible and the act may not clearly trigger the intent element of 18 U.S.C. § 175.
The third is a low-capability, high-salience attack. A toxin incident targets a public figure or a federal facility. Casualties are in the single digits. Federal response consumes enormous attention, drives legislation, and addresses none of the pathways capable of producing catastrophic outcomes. Historically this is what biological attack against the United States has meant in practice, and the principal planning risk is that policy continues to optimize against it.
Three Year Program of Action
The recommendations below are structured as a phased program of action across fiscal years 2027 through 2029, organized by executing department. They are stated at a level of specificity sufficient to be actionable, assigned to identifiable offices, and sequenced so that Year One actions establish the authorities and baselines on which Years Two and Three depend. They are ordered within each department by estimated risk reduction per dollar.
The program is organized around three lines of effort corresponding to the critical requirements identified in Section 1. Line of Effort One, Deny, comprises measures that raise the cost and difficulty of the adversary pathway at stages three through five: research security, synthesis screening, laboratory registration, and material control. Line of Effort Two, Detect and Attribute, comprises measures that restore the capacity to notice an event and determine its origin: clinical and genomic surveillance, environmental detection, and microbial forensics. Line of Effort Three, Absorb, comprises measures that limit consequence once an event occurs: countermeasure platforms, stockpile posture, hospital surge, and continuity of government.
The decisive point across all three lines is the transition from Year One to Year Two. Year One consists almost entirely of authorities, baselines, and organizational decisions that cost comparatively little and gate everything that follows. If Year One is not executed, Years Two and Three cannot be executed, and the program reduces to unfunded aspiration.
Year One is not, however, a single track, and presenting it as one would understate the risk to the program. Six of its items require statute. This paper’s own evidence indicates that such legislation is difficult to move: the Preventing Illegal Laboratories and Protecting Public Health Act failed in 2024 and again on reintroduction in 2025, and a mandatory synthesis screening bill has sat in committee since January 2026. A reader is entitled to know which recommendations survive a Congress that acts on none of them.
The executive track proceeds on existing authority and is unconditional. It comprises publishing the two outstanding biosafety frameworks, constructing the non-clinical laboratory inventory, reconstituting the attribution analytic function, issuing the National Intelligence Estimate, designating the recipient for screening and evaluation referrals, publishing the frontier model evaluation standards, re-baselining the biological defense force protection requirement, resolving the biological detection executive agency question, and reinstating the platform countermeasure portfolio. None of these requires new law. Several require nothing beyond a decision and a signature, and the frameworks in particular are past due rather than unfunded.
The legislative track comprises universal synthesis screening, extension of enhanced-pathogen oversight beyond federally funded research, laboratory registration and inspection authority with a criminal provision not requiring hostile intent, the auditor accreditation regime, domestic equipment licensing, and the appropriations decisions treated in 15.6. Absent these, the program still executes at reduced effect: screening remains voluntary for the actor who declines federal funding, the laboratory gap identified in Section 4 stays open, and the Commerce measures in 15.5 stop at standards without accreditation or licensing. The honest statement is that the executive track buys detection and preparation, and the legislative track buys denial. The paper recommends both, and specifies them separately so that the loss from obtaining only one is visible in advance.
Three categories of recommendation added to this program in the sections below sit inside that same structure rather than alongside it. Assurance of frontier artificial intelligence models, control of synthesis orders and laboratory equipment, and internationalization of both are Deny measures acting at stages three and four of the adversary pathway. Integrated epidemic intelligence, expanded environmental monitoring, and metagenomic diagnostics are Detect and Attribute measures. Secured countermeasure manufacturing is an Absorb measure. What they do require is a fourth executing department. The Department of Commerce holds the standards and licensing instruments on which the artificial intelligence and equipment measures depend, and it appears nowhere in the original program. Its actions are set out in 15.5 below.
Department of Health and Human Services
HHS holds the largest share of the detection and consequence-management mission and is presently the component under the greatest resource pressure. Its actions are accordingly the most consequential in the program.
Year One: restore the platform countermeasure base. The Biomedical Advanced Research and Development Authority should reinstate a rapid-response vaccine platform portfolio at not less than the funding level obtaining prior to the August 2025 contract cancellations, structured explicitly as prototype-and-warm-base rather than as product development. The objective is a maintained capability to move from pathogen sequence to clinical candidate on a compressed timeline for a pathogen not yet identified. Platform neutrality should be preserved across mRNA, viral vector, and recombinant protein approaches so that the portfolio is not vulnerable to a single technical or political reversal. The portfolio should be structured around government-backed partnerships with commercial manufacturers that maintain warm-base capacity rather than around procurement of finished product, and the associated fill-finish and sterile injectable capacity should be established under the Defense Production Act authorities identified in 15.4 so that the research portfolio and the manufacturing base are funded as a single capability rather than as two programs that assume each other’s existence.
Year One: publish the replacement synthesis screening framework, with a defined screening floor. The Office of the Assistant Secretary for Preparedness and Response and the Office of Science and Technology Policy should issue the replacement directed by Executive Order 14292, or formally reaffirm the 2024 instrument. The replacement framework should set the screening floor at 50 base pairs rather than 200, require verification of customer identity and institutional legitimacy, and require that failed legitimacy checks be reported to a designated federal recipient rather than resolved privately by the provider. Section 8 establishes that short oligonucleotides are the specific technical gap in the present regime and that unreported refusals are invisible to the government.
Year One: publish the replacement enhanced-pathogen oversight policy, with a stated scope and a named decision authority. The same offices should issue the replacement dual-use research and enhanced pandemic potential pathogen policy directed by Executive Order 14292, or formally reaffirm the May 2024 instrument. Section 3 assesses that prohibition is the wrong instrument and that the governing problem is the vacuum rather than the permission, and the replacement should accordingly be built to four requirements drawn from that assessment. It should state the covered category in advance and in published terms, so that whether a given experiment qualifies is not decided case by case by the party proposing it. It should vest the approval decision in a named accountable official at agency level rather than in diffuse institutional discretion. It should treat publication as a reviewable stage rather than reviewing only at the point of funding, since Section 3 establishes that the information hazard is created at publication and cannot be withdrawn afterward. And it should be written so that its obligations can be extended to research that federal funding does not reach, which requires the legislation recommended in 15.6. The present condition, in which both instruments are declared inadequate and neither is replaced, devolves the effective national standard to the least cautious institution and should be terminated within the fiscal year. Publishing an imperfect framework is preferable to maintaining a vacuum, and either instrument may be revised once it exists.
Year One: establish a national inventory of non-clinical laboratory capacity. The CDC, in coordination with state health departments, should construct a baseline registry of privately funded, non-CLIA laboratories handling biological materials, using state business licensing, hazardous materials, and utility data. Registration should precede regulation; the Reedley and Las Vegas cases establish that the federal government does not currently know how many such facilities exist or where they are.
Year Two: rebuild the detection workforce. Restore CDC civilian staffing in the outbreak investigation, laboratory, and global health functions toward the fiscal year 2024 baseline, prioritizing the Epidemic Intelligence Service, the Laboratory Response Network, and advanced molecular detection. Section 10 establishes that this is a detection investment, not a general public health investment, and it should be justified to Congress on that basis.
Year Two: place genomic, wastewater, and bioaerosol surveillance on a permanent statutory footing. Convert the current patchwork of pilot and cooperative agreement funding into a permanent national program with defined geographic coverage, standardized sequencing depth, and mandatory data sharing to a federal repository within defined timelines. Coverage should be specified in population terms and should include rural and tribal jurisdictions, which are presently the least monitored and the most dependent on federal funding. Wastewater surveillance is the single most cost-effective early warning modality currently available and it is presently funded as though it were experimental. Bioaerosol coverage should be expanded only after the executive agency question in 15.4 is resolved; funding a nationwide bioaerosol build before an owner and a technology are selected would repeat the BioWatch and BD21 sequence described in Section 10.
Year Two: build the epidemic intelligence integration layer. The CDC Office of Public Health Data, Surveillance, and Technology should be resourced and directed to fuse the National Syndromic Surveillance Program, the One CDC Data Platform, wastewater and bioaerosol streams, genomic sequencing, and clinician reporting into a single anomaly detection and alerting capability, with machine learning applied to cross-stream correlation rather than to any single feed. Section 10 establishes that detection in practice occurs through clinical recognition and downstream characterization, not through environmental collection; the value of this layer is that it shortens the interval between a clinician’s observation and a national signal. This capability supplies the epidemiological input to the joint biological warning cell established in 15.3, and the two should be specified together. The warning cell owns the determination of whether an event is natural, accidental, or deliberate. The integration layer owns the data on which that determination rests.
Year Two: establish a centralized synthesis order screening clearinghouse. Mandatory screening at the provider level does not detect an order deliberately fragmented across multiple providers, because no provider sees the whole. The Assistant Secretary for Preparedness and Response should establish a clearinghouse function, operating against technical standards issued by the National Institute of Standards and Technology, that receives screening records from covered providers, performs cross-provider correlation against sequences of concern, and refers anomalies to the Federal Bureau of Investigation Weapons of Mass Destruction Directorate. Predictive assessment of the biological function of an ordered sequence, as distinct from matching it against a list, is a research problem rather than a fielded control, and Section 8.3 establishes both why it is needed, because generatively designed sequences can be functionally similar while textually dissimilar, and why it cannot yet be relied upon. That capability should be pursued as a Year Three research line through the National Institute of Allergy and Infectious Diseases, the Biomedical Advanced Research and Development Authority, and the Department of Energy national laboratories, and should not be assumed available for screening decisions before it is validated.
Year Two: expand the Strategic National Stockpile beyond anticipated agents. The Stockpile is the national repository of medicines, vaccines, antitoxins, and medical supplies maintained by HHS for deployment to states when local supplies are exhausted, and it is the materiel component of the federal response to any large biological event. Reorient a defined share of stockpile investment from agent-specific holdings toward broad-spectrum therapeutics, medical consumables, and personal protective equipment with domestic manufacturing surge agreements, on the assessment that the highest-probability event involves a pathogen not on any current list.
Year Three: standardize and authorize metagenomic diagnostics. Clinical metagenomic next-generation sequencing identifies a pathogen without a prior hypothesis about what it is, which is the specific requirement generated by the ambiguous outbreak scenario in Section 14. The Food and Drug Administration Center for Devices and Radiological Health should establish a clear authorization pathway for these assays; the CDC Laboratory Response Network should validate and deploy them across the public health laboratory system; and the National Institute of Standards and Technology Material Measurement Laboratory should supply the reference materials against which performance is measured. Absent a standard, each laboratory produces results that cannot be compared to any other laboratory’s, which is a detection capability that does not aggregate.
Year Three: restore hospital surge capacity as a funded requirement. Reverse the proposed elimination of the Hospital Preparedness Program and establish regional surge compacts with pre-negotiated cross-state licensure, staffing, and materiel-sharing arrangements. The fiscal year 2027 request would eliminate this capability entirely; its absence is the binding constraint on consequence management in every scenario in Section 14.
Year Three: restore forward-deployed surveillance. Reestablish bilateral and regional disease surveillance partnerships sufficient to replace the warning function lost through World Health Organization withdrawal and the dissolution of the United States Agency for International Development, whether through direct CDC country office presence, bilateral agreements, or participation in regional networks. Pathogens of concern to the United States generally emerge outside it, and warning time purchased abroad is the cheapest warning time available.
The Intelligence Community
The Intelligence Community holds the attribution mission, and attribution is the foundation of deterrence. Section 10 assesses this as the weakest element of the American posture following the statutory dissolution of the National Counterproliferation and Biosecurity Center.
Year One: reconstitute the biological attribution and counterproliferation analytic function. The Office of the Director of National Intelligence should establish a successor entity to the National Counterproliferation and Biosecurity Center, or formally assign its functions to a named component with commensurate resources and reporting authority. Congress should be asked to reverse the restriction on National Nuclear Security Administration biodefense and biosecurity activities imposed in the fiscal year 2026 National Defense Authorization Act. An attribution capability dispersed without an owner is not a capability.
Year One: issue a National Intelligence Estimate on non-state biological capability. The Estimate should address, at minimum, the four actor categories identified in Section 6, and should specifically assess the extent to which artificial intelligence and biological design tools have altered the tacit knowledge barrier since 2023. The Community has not produced a public or congressionally briefed judgment on this question at the requisite level, and policy is presently being made in its absence.
Year Two: institutionalize the Aum and al-Qaeda indicator sets. Both historical programs generated observable indicators that were available and unacted upon or recognized only retrospectively. The Community, in coordination with the Federal Bureau of Investigation Weapons of Mass Destruction Directorate, should derive from those cases a validated indicator set covering procurement patterns, conference and academic access, front-entity formation, and personnel recruitment, and should embed it in field office and fusion center reporting requirements. Section 6.5 establishes that the transferable element of these cases is organizational, which means the indicators are organizational and therefore collectible.
Year Two: fund microbial forensics as an enduring program. Attribution requires a maintained reference collection, validated analytic methods, and practiced analysts. This capability atrophies silently and cannot be surged. It should be funded as an enduring program of record with a named executive agent rather than as a project.
Year Two: designate the recipient for screening and evaluation referrals. The reporting obligations created in 15.2 and 15.5 generate two new streams of investigative lead: failed customer legitimacy checks from synthesis providers and equipment vendors, and biosecurity-relevant findings from frontier model evaluations. The Federal Bureau of Investigation Weapons of Mass Destruction Directorate should be designated as the recipient for both, with a defined referral standard and a requirement to report annually on volume, disposition, and time to disposition. A reporting requirement without a named recipient and a published disposition rate produces compliance paperwork rather than intelligence. The Community should additionally establish the classified channel through which national security relevant model evaluation findings reach analysts, since the Center for AI Standards and Innovation conducts a portion of this work in classified environments and those results presently have no routine path into biological threat analysis.
Year Three: establish a joint biological warning cell. A standing analytic cell drawing from ODNI, CDC, the Defense Intelligence Agency, the National Center for Medical Intelligence, and the Federal Bureau of Investigation should hold responsibility for fusing epidemiological, environmental, and intelligence reporting and for issuing a single national assessment of whether an ambiguous event is natural, accidental, or deliberate. Section 14 identifies this determination as the most likely serious scenario and the one for which the United States is least prepared; no entity currently owns it.
Department of Defense
DOD holds force protection, deterrence, and the largest share of the research and development base. Its principal contribution over the program period is to restore capabilities that atrophied during the period of counterinsurgency focus and to underwrite the industrial base that HHS depends upon.
Year One: restore biological defense to the force protection baseline. The Chemical and Biological Defense Program and the Joint Program Executive Office for Chemical, Biological, Radiological and Nuclear Defense should re-baseline requirements against a peer adversary employing biological agents against deploying forces, ports of embarkation, and installations, rather than against the legacy counterinsurgency threat model. The 2026 Annual Threat Assessment finding that chemical and biological warfare capabilities continue to grow, together with the normalization of chemical weapons employment in Ukraine, supplies the justification.
Year One: designate a single executive agent for biological detection acquisition. Two decades and two acquisition programs have not produced a fielded replacement for BioWatch. The Department, in coordination with the Department of Homeland Security, should either assume executive agency for the capability using the Defense Threat Reduction Agency and existing service acquisition authorities, or the capability should be formally terminated and its funding redirected to clinical and genomic surveillance. Continued funding of an inadequate system substitutes the appearance of detection for detection. This decision is a precondition for the environmental monitoring expansion in 15.2 and should be sequenced ahead of it. No additional bioaerosol collection should be fielded until an executive agent, a technology, and a detect-to-warn performance requirement are selected, and if no combination of the three can be demonstrated within the fiscal year, the honest course is termination and reallocation to the clinical and genomic modalities that are already producing detections.
Year Two: expand the Cooperative Threat Reduction Program’s biological mission. Cooperative Threat Reduction remains the most cost-effective instrument available for securing pathogen collections, retaining former weapons scientists in civilian employment, and building partner surveillance capacity. Its biological line should be expanded, with priority to partner nations bordering states of proliferation concern and to regions where sanctuary conditions for the actor categories in Section 6 could recur.
Year Two: harden the medical countermeasure industrial base. Using Defense Production Act Title III authorities and the resilient biomanufacturing provisions of the fiscal year 2026 National Defense Authorization Act, establish and maintain domestic surge manufacturing for fill-finish, sterile injectables, and platform vaccine production. This capacity is the physical substrate of the HHS Line of Effort Three and it does not currently exist at the required scale.
Year Two: restore and protect the biodefense research base. Sustain the United States Army Medical Research Institute of Infectious Diseases and associated laboratory capacity, with particular attention to personnel reliability programs. Amerithrax establishes that this enterprise is simultaneously a defensive asset and an insider risk surface, and both propositions must be managed together rather than traded off.
Year Three: exercise the ambiguous attribution problem at the joint level. Conduct a series of national-level exercises, with interagency and combatant command participation, in which the scenario is deliberately ambiguous as to origin and no attribution is available for a period of weeks. The purpose is to develop decision procedures for acting under sustained attribution uncertainty rather than to rehearse response to a known agent. Existing exercises overwhelmingly assume a characterized threat, which is the condition least likely to obtain.
Department of Commerce
Commerce holds two instruments the rest of this program depends on and cannot supply for itself: the standards apparatus through which technical requirements become measurable, and the licensing apparatus through which controlled items become traceable. Section 8 establishes that frontier developer governance is presently voluntary and that voluntary governance without a statutory floor is a fragile equilibrium, because it depends on continued competitive alignment among firms whose incentives may diverge. The measures below are intended to supply that floor without displacing the technical work the private sector is better positioned to perform.
One constraint should be stated at the outset because it determines the sequencing. The National Institute of Standards and Technology is a non-regulatory agency, and its Center for AI Standards and Innovation operates through voluntary agreements with developers and conducts evaluations rather than enforcing requirements. The standards work recommended below is within existing authority. The auditing and licensing regimes are not, and cannot be created by directive. Congress must act first, which is why the corresponding legislative items appear in 15.6.
Year One: publish biosecurity evaluation standards for frontier models. The Center for AI Standards and Innovation, working with the National Institute of Standards and Technology laboratories, should publish measurable technical standards for evaluating whether a frontier model provides meaningful uplift toward the acquisition, production, or employment of biological agents. The Assistant Secretary for Preparedness and Response should define the biological outcome set the standards are written against, because the question of what constitutes uplift is a biosecurity judgment rather than a measurement judgment. Standards should specify evaluation methodology, evidentiary sufficiency, and reporting format, so that an audit conducted by one party is comparable to an audit conducted by another. This work is achievable within current authority and does not wait on legislation.
Year Two: accredit private technical auditors. Upon receipt of the authority sought in 15.6, Commerce should establish an accreditation program for private technical auditors qualified to assess frontier models against the published standards, on the model of the National Voluntary Laboratory Accreditation Program. The government defines the outcomes and accredits the assessors; the assessors perform the work at a scale no federal office could staff. Accreditation should carry conflict-of-interest requirements, a defined revocation process, and mandatory reporting of biosecurity-relevant findings to the recipient designated in 15.3. The failure mode to design against is an audit market in which developers select their assessors and assessors compete on leniency, which is the pattern established in adjacent assurance industries.
Year Two: license sensitive laboratory equipment. The Bureau of Industry and Security should administer a licensing regime for benchtop nucleic acid synthesizers and other equipment designated as sensitive, requiring verification of the purchaser, pre-purchase approval, registration of ownership, and tracking of subsequent transfer. Section 8 establishes that benchtop synthesis relocates the control point from an observable commercial transaction to a device on a bench, which defeats order screening entirely for anyone who owns one. The Bureau’s existing authorities govern export rather than domestic sale, so this requires the new authority sought in 15.6; the argument for placing it at the Bureau notwithstanding is that the verification, approval, and tracking functions already exist there and would otherwise be built twice. Ownership registration should be interoperable with the non-clinical laboratory inventory established in 15.2, since the two describe overlapping populations.
Year Three: complete the first audit cycle and report. Every covered frontier model should complete an independent accredited audit against the published standards within the fiscal year, with results reported to Congress in aggregate and biosecurity-relevant findings referred individually. The first cycle is also the first opportunity to test whether the standards are measuring anything, and the report should state candidly where they were found not to.
Year Three: internationalize the standards. Commerce should pursue harmonization of both the model evaluation standards and the synthesis screening standards through the relevant international standards bodies, in coordination with the Department of State line of effort in 15.7. Section 8 establishes that an unscreened provider in another jurisdiction remains reachable regardless of domestic coverage, which makes a purely national screening regime a control on the compliant and an inconvenience to everyone else. Technical harmonization is the faster of the two paths and should not wait on the treaty track.
Congress
Six measures in this program cannot be executed by any department acting alone. Section 8 establishes that the federal funding lever reaches most legitimate research and no actor who declines federal funding, and Section 9 establishes that no existing statute reaches an unaccountable holder of an unlisted agent. Both defects are statutory and only Congress can close them. The items below are ordered by the cost of continued inaction rather than by legislative difficulty.
Enact mandatory nucleic acid synthesis screening. Legislation should cover sequence orders of 50 base pairs and above and the equipment used to produce them, apply to all orders rather than only to federally funded purchases, place the compliance obligation on providers, require verification of customer identity and institutional legitimacy, require reporting of failed legitimacy checks to a designated federal recipient, and include an enforcement mechanism with meaningful penalties. S. 3741 provides a vehicle. The June 2026 industry open letter indicates that the regulated parties presently support such a mandate, which is a politically perishable condition and should be used before it dissipates.
Extend enhanced-pathogen oversight beyond federally funded research. The oversight policy described in 15.2 binds only what federal funding reaches, which is the same structural defect identified in Section 8 for synthesis screening and produces the same result: privately funded and philanthropically funded work sits outside the regime, and the least cautious institution sets the effective national standard. Legislation should apply the covered-category definition, review requirement, and approval authority to research involving pathogens with enhanced pandemic potential without regard to funding source, and should pair that requirement with a route to international harmonization, since Section 3 establishes that unilateral restriction may relocate the work to jurisdictions with weaker biosafety oversight and no American visibility rather than reduce the aggregate risk.
Close the unregulated laboratory gap. Establish federal registration and inspection authority for non-CLIA private laboratories handling biological materials, and create a criminal provision addressing grossly unsafe pathogen storage that does not require proof of hostile intent. This is the substance of the stalled Preventing Illegal Laboratories and Protecting Public Health Act, and it addresses the specific defect that produced twelve fraud convictions and no biosecurity convictions in the Reedley matter.
Authorize a licensed technical auditor regime for frontier models. Legislation should empower the Department of Commerce to accredit private auditors, require covered developers to obtain independent audit against federally published standards prior to deployment, and require reporting of biosecurity-relevant findings. The regime should regulate the assurance function rather than model architecture or training, and the obligation should fall on developers of models above a defined capability threshold rather than on the sector generally. S. 3952 addresses the adjacent question of safeguards against unintended use and may provide a vehicle for the reporting elements.
Establish domestic licensing authority for sensitive laboratory equipment. Existing authority reaches the export of controlled biological equipment and not its domestic sale. Legislation should extend verification, pre-purchase approval, ownership registration, and transfer tracking to domestic transactions in a designated equipment list, with the list maintained by the Department of Commerce in consultation with the Department of Health and Human Services and subject to periodic revision as the technology moves.
Preserve state and local public health capacity as national detection infrastructure. Roughly half of state and local health department funding is federal, and those departments constitute the primary detection layer. Federal appropriations decisions in this area are detection policy and should be scored as such in budget justifications.
Department of State
State holds the only instrument that reaches activity outside American jurisdiction, and Section 8 establishes that a purely national screening regime is a control on the compliant and an inconvenience to everyone else.
Extend the framework internationally. The Department of State, through the Bureau of Arms Control, Deterrence, and Stability, should pursue adoption of equivalent synthesis screening and model evaluation obligations by partner states, using the Working Group process described in Section 13 where the subject matter is treaty-adjacent and bilateral or plurilateral instruments where it is not. Section 13 establishes that the Convention operates by consensus and that states under compliance suspicion are parties to the negotiation, so the treaty track should be pursued without being depended upon. A coalition of the states that host the great majority of commercial synthesis capacity is achievable on a shorter timeline than a Convention protocol and would capture most of the volume.
Cross-Cutting Executive Action
One measure falls to no single department and is executed through enforcement posture rather than through program or statute.
Decouple research security enforcement from immigration policy. Disclosure and material transfer requirements should be enforced rigorously and uniformly without regard to nationality. Section 6 establishes that expertise acquisition is the decisive stage in the adversary pathway and that personnel controls are therefore the highest-value denial measure; those controls depend on the cooperation of a scientific workforce that uniform enforcement retains and selective enforcement forfeits.
A program of this kind fails most often not through rejection but through partial implementation followed by declared success. Seven measures should be reported to Congress annually and should be capable of falsifying the claim that the program is working.
The proportion of commercial synthesis orders of 50 base pairs or more subject to mandatory, audited screening with verified customer identity, which is presently unknown and should approach unity.
The number of failed customer legitimacy checks reported by providers and vendors, the proportion referred, and the median time to disposition. A reported figure of zero should be treated as a screening failure rather than as an absence of attempts.
The number of registered non-clinical laboratories and the proportion inspected within the preceding twenty-four months, which is presently zero.
The number of licensed sensitive equipment units and the proportion with current and verified ownership registration, which is presently zero because no registry exists.
The proportion of covered frontier models that completed an independent accredited audit against published standards prior to deployment, and the proportion of audits that produced a biosecurity-relevant finding. A finding rate at or near zero across all auditors indicates a standards failure, not a clean industry.
Median time from specimen collection to genomic characterization and to national notification, which should decline year over year, reported separately for metropolitan and rural jurisdictions.
Demonstrated attribution performance in exercise conditions against a deliberately ambiguous scenario, reported as time to a defensible national assessment.
Four of these seven cannot currently be computed at all. That fact is itself the most compact statement of the problem this paper describes.
Cost
A program stated without cost is a wish, and a reader in an appropriations role is entitled to a figure. This paper does not offer a budget, because the data required to construct a defensible one is not available in open sources and a false precision here would undermine the argument it is meant to support. What follows is an order-of-magnitude banding of the recommendations, with the basis for each band stated, offered so that the shape of the request is contestable even where the amount is not.
The first band comprises measures whose principal cost is decision and staff time rather than program dollars, and which should be achievable within existing appropriations at under fifty million dollars annually in aggregate. Publishing the two outstanding frameworks. Constructing the non-clinical laboratory inventory from data states already hold. Designating the referral recipient. Issuing the National Intelligence Estimate. Publishing the model evaluation standards. Re-baselining the force protection requirement. Resolving the detection executive agency question, which is a decision that may reduce spending rather than increase it. Nearly the whole of Year One sits in this band, which is the strongest argument for executing Year One irrespective of the budgetary environment.
The second band comprises new capabilities of moderate scale, plausibly in the low hundreds of millions of dollars annually once established. The synthesis screening clearinghouse. Microbial forensics as an enduring program of record. The auditor accreditation program and the equipment licensing regime, both of which are administrative functions attached to existing bureaus rather than new agencies. Metagenomic diagnostic standardization and Laboratory Response Network deployment. The joint biological warning cell and the epidemic intelligence integration layer.
The third band comprises the measures that carry real money, in the billions of dollars annually. The platform countermeasure portfolio at pre-2025 levels. Restoration of Centers for Disease Control and Prevention detection staffing toward the fiscal year 2024 baseline. Permanent genomic and wastewater surveillance at defined national coverage. Defense Production Act Title III surge manufacturing. Stockpile reorientation. The Hospital Preparedness Program and regional surge compacts.
The relationship of that third band to the fiscal record is the point. Section 11 documents a decline in federal biodefense funding of approximately three billion dollars between fiscal years 2025 and 2026, a proposed 52 percent reduction to the cooperative agreement that funds state and local preparedness, cancellation of approximately 500 million dollars in countermeasure contracts, and a proposal to eliminate the Hospital Preparedness Program entirely. The substantial majority of this program is therefore a restoration question rather than a new-money question. It asks Congress to decline reductions already proposed and to reinstate capabilities recently cancelled, and the incremental cost of the genuinely new measures in the first two bands is small against that baseline.
If the full program cannot be funded, the sequence in which it should be reduced follows from its own logic and should be stated rather than left to circumstance. Year One is preserved at any funding level, because it is authorities and because it gates everything else. Detect and Attribute is preserved next, on the assessment in Section 2 that detection investment purchases capability against all four threat vectors simultaneously while agent-specific investment does not. Absorb is reduced first, and the cost of doing so should be stated plainly: consequence management is what converts a detected event into a survivable one, and reducing it accepts a larger casualty figure in exchange for a lower probability of being surprised.
Conclusion
The premise with which this paper opened is correct. The United States is, against conventional attack, effectively invulnerable. No adversary can plausibly project ground forces into the American homeland, and the deterrent architecture that guarantees this is the most formidable in history. The inference commonly drawn from that premise, that the United States is therefore secure, does not follow.
Nothing in the open record indicates an imminent engineered attack, and the assessment offered here should not be read as forecasting one. The state programs of concern are longstanding and largely static, and the deterrent logic that restrains their employment against the American homeland remains robust. The non-state historical record is one of intent unaccompanied by capability. Highly pathogenic avian influenza is concerning on an evolutionary timescale rather than a news cycle. Each of these judgments counsels against alarm, and each is stated here deliberately so that the argument that follows cannot be mistaken for one.
What the evidence does not support is confidence, and the reason lies in the structure of the historical record rather than in its content. Section 6 established that in the two most serious non-state biological weapons programs ever documented, the American and allied defensive architecture contributed nothing whatever to the outcome. Aum Shinrikyo abandoned its program because its own technical execution was inadequate and its internal culture prevented correction. Al-Qaeda’s program ended because the United States destroyed the territory on which it sat, in a campaign undertaken for unrelated reasons. In neither case did screening, licensing, inspection, export control, or research security perform a function. Both organizations reached the production stage unmolested, and both did so behind legitimate institutional cover that the state had created for legitimate reasons and was unwilling to breach.
The reassurance conventionally drawn from these cases is therefore misplaced. A record of zero successful interdictions at the decisive stages of the adversary pathway is not evidence that the defenses work. It is evidence that they have not been tested, and the most parsimonious explanation for the absence of catastrophic non-state biological attack is the scarcity of serious attempts rather than the effectiveness of the response to them. That explanation is stable only for as long as attempts remain scarce and difficult.
Two independent trends now intersect, and their intersection is the finding of this paper. The barriers that historically made biological weapons difficult, tacit knowledge and physical access to materials, are eroding as synthesis, laboratory automation, and computational design tools advance. Simultaneously, the United States is reducing the capacity to detect, characterize, attribute, and absorb a biological event: federal biodefense funding down by roughly $3 billion between fiscal years 2025 and 2026, approximately a quarter of the CDC civilian workforce lost, the National Counterproliferation and Biosecurity Center dissolved by statute, mRNA countermeasure contracts cancelled, the Hospital Preparedness Program proposed for elimination, and the World Health Organization relationship terminated.
Neither trend alone would warrant serious concern. The first is gradual and unquantified; the second would be manageable in a static threat environment. The margin between an event the United States would detect and characterize and one it would not is narrowing annually, and it is narrowing primarily by domestic choice rather than by adversary action. That is an unusual property for a national security problem, and it carries an unusual implication: the principal variable is under American control.
The fortress metaphor with which this paper opened can now be stated in its final form. The wall is sound. The gate is open, and it must remain open, because a fortress that seals its gate against trade, travel, students, and open science has defeated itself more thoroughly than any adversary could. That leaves the garrison, and the garrison is the whole of the defense against this category of threat.
Reedley and Las Vegas are the small, legible demonstration of what a reduced garrison looks like. Two facilities, one operator, four years of operation, discovered twice by accident. The convictions were obtained under fraud and food-and-drug statutes because no biosecurity statute reached the conduct. The materials were never conclusively identified because the evidence degraded in improper storage. The legislation that would have made the underlying conduct unlawful remains in committee, having failed twice. Every element of that sequence is a garrison failure, and none of it had anything to do with the wall.
Donald Kennedy’s observation, made in the shadow of the anthrax letters and quoted in the introduction to this paper, holds with greater force in 2026 than when he made it. The threats most capable of disrupting American national stability no longer arrive as armies or missiles. They emerge from laboratories, from supply chains, from open scientific literature, and from the accumulated consequences of decisions that individually appeared reasonable. Defending against them requires institutions capable of noticing, characterizing, and attributing an event that produces no explosion, generates no radar return, and crosses no defended border.
Those institutions are being reduced. The program set out is an attempt to specify what reversing that reduction would require over three fiscal years, at what appears to be an affordable cost relative to the exposure. Whether it is undertaken is a matter of choice rather than of capability, which is precisely what makes the present trajectory difficult to defend. The United States is not being outmatched in this domain. It is disarming, deliberately and incrementally, against the one category of threat its walls were never designed to stop.
Comments