Standards in biosafety & biosecurity  

Rose Hadshar,

Arb Research,

July 2023

This report represents ~40 hours of work by Rose Hadshar in summer 2023 for Arb Research, in turn for Holden Karnofsky in response to this call for proposals on standards. It’s based on a mixture of background reading, research into individual standards, and interviews with experts.

I didn’t ask for permission to cite the expert interviews publicly, so I’ve anonymised them.

I suggest reading the scope and summary and skimming the overview, then only looking at sections which seem particularly relevant to you.

Scope

Summary of most interesting findings

Overview of standards in biosafety and biorisk

Background

Main standards in biosafety and biorisk

International standards

US standards

Notable standards in other countries

The origins of biosafety and biosecurity standards

Compliance

Problems with biosafety and biosecurity standards

Questions this report doesn’t address

Further resources

Recommended reading

Interview notes

Scope

This report covers:

• Both biosecurity and biosafety:^[1]

• Biosecurity: “the protection, control and accountability for valuable biological materials (including information) in laboratories in order to prevent their unauthorized access, loss, theft, misuse, diversion or intentional release.”
• Biosafety:  “the containment principles, technologies and practices that are implemented to prevent unintentional exposure to pathogens and toxins or their accidental release”
  

• Biosecurity and biosafety standards internationally, but with much more emphasis on the US
  
• Regulations and guidance as well as standards proper. I am using these terms as follows:

• Regulations: rules on how to comply with a particular law or laws. Legally binding
• Guidance: rules on how to comply with particular regulations. Not legally binding, but risky to ignore
• Standards: rules which do not relate to compliance with a particular law or laws. Not legally binding.

• Note that I also sometimes use ‘standards’ as an umbrella term for regulations, guidance and standards.

Summary of most interesting findings

For each point:

• I’ve included my confidence in the claim (operationalised as the probability that I would still believe the claim after 40 hours’ more work).
• I link to a subsection with more details (though in some cases I don’t have much more to say).

The origins of bio standards

• (80%) There were many different motivations behind bio standards (e.g. plant health, animal health, worker protection, bioterrorism, fair sharing of genetic resources…)
• (70%) Standards were significantly reactive to rather than proactive about incidents (e.g. lab accidents, terrorist attacks, and epidemics), though:

• There are exceptions (e.g. the NIH guidelines on recombinant DNA)
• Guidance is often more proactive than standards (e.g. gene drives)

• (80%) International standards weren’t always later or less influential than national ones
• (70%) Voluntary standards seem to have prevented regulation in at least one case (e.g. the NIH guidelines)
• (65%) In the US, it may be more likely that mandatory standards are passed on matters of national security (e.g. FSAP)

Compliance

• (60%) Voluntary compliance may sometimes be higher than mandated compliance (e.g. NIH guidelines)
• (70%) Motives for voluntarily following standards include responsibility, market access, and the spread of norms via international training
• (80%) Voluntary standards may be easier to internationalise than regulation
• (90%) Deliberate efforts were made to increase compliance internationally (e.g. via funding biosafety associations, offering training and other assistance)

Problems with these standards

• (90%) Bio standards are often list-based. This means that they are not comprehensive, do not reflect new threats, prevent innovation in risk management, and fail to recognise the importance of context for risk

• There’s been a partial move away from prescriptive, list-based standards towards holistic, risk-based standards (e.g. ISO 35001)

• (85%) Bio standards tend to lack reporting standards, so it’s very hard to tell how effective they are
• (60%) Standards may have impeded safety work in some areas (e.g. select agent designation as a barrier to developing mitigation measures)
• (75%) Those implementing standards aren’t always sufficiently high powered
• (75%) Researchers view standards as a barrier to research
• (90%) The evidence base for bio standards is poor
• (95%) In the US, there is no single body or legislation responsible for bio standards in general

• Some countries have moved towards a centralised approach (e.g. Canada, China)

• (95%) Many standards are voluntary rather than legally mandated (e.g. BMBL)

• In the US, legal requirements to meet certain standards are a first amendment issue

• (75%) There is sometimes a conflict of interest where the same body is responsible for funding research and for assessing its safety

Overview of standards in biosafety and biorisk

Background

There are a lot of different biosafety and biorisk standards, but at a very high level:

• What bad things are these standards trying to prevent?

• Biosafety standards are generally trying to protect the safety of lab staff and prevent accidental release.
• Biosecurity standards are generally trying to prevent state or non-state development of bioweapons.
• Other motivations also come up (e.g. plant health, animal health, fair sharing of genetic resources…)
  

• What activities do these standards cover?

• Who conducts biological research in labs, on what, and how
• The storage, ownership, sale and transportation of biological agents
  

• Do these standards cover all actors undertaking those activities?

• Laws generally cover all actors undertaking the activities
• Standards are generally voluntary, though some funding bodies make compliance with standards a mandatory condition of funding

The main standards in biosafety and biorisk

Internationally:

• The Biological Weapons Convention (BWC, 1972) prohibits the development of bioweapons

• The Australia Group (1985) sets standards for the international sale of dual use equipment and transport of pathogens.

• The WHO Laboratory Safety Manual (LBM, 1983) is a voluntary biosafety standard (there is also more recent WHO guidance on biosecurity).
• The ISO 35001 (2019) is a voluntary standard for biosafety and biosecurity (though it’s not clear that there’s much adoption according to a biorisk expert involved in setting this standard up, and the standard is expensive to access).

In the US:

• The main things are:

• The Biosafety in Microbiological and Biomedical Laboratories (BMBL, 1984), which is a voluntary standard for laboratory biosafety.
• The select agent regulations, which are mandatory regulations with a statutory basis, and govern who can use particularly dangerous agents and how.

• The NIH Guidelines for Research Involving Recombinant DNA Molecules (1976) are noteworthy for being among the first voluntary standards, though they aren’t very significant today.
• There is also more recent voluntary guidance on:

• DNA synthesis screening (Screening Framework Guidance for Providers of Synthetic Double-Stranded DNA, 2010)
• Dual Use Research of Concern (Policy for Oversight of Life Sciences Dual Use Research of Concern, 2012 and Policy for Institutional Oversight of Dual Use Research of Concern, 2014)
• GoF research (P3CO, 2017)

• Also note that there are two bills currently under consideration (see here for a brief introduction):

• Securing Gene Synthesis Act
• Artificial Intelligence and Biosecurity Risk Assessment Act

Other countries

• China and Russia were both quite slow to develop biosafety standards.

• The first biosafety regulations in Russia were in 1993.
• China’s first regulations on biosafety in particular were in the early 2000s.

• There’s been a move towards overarching biosafety and biosecurity acts which give legislative footing to standards.

• Canada (2009) and China (2020) both have this.

• Canada has one of the best systems in the world, according to a biorisk expert I spoke with.

The tables below go into more detail. For a full timeline of biosafety and biosecurity standards, see here.

International standards

US standards

Notable standards in other countries

The origins of biosafety and biosecurity standards

Questions from Holden’s call this section relates to:

• What’s the history of the standard? How did it get started?
• How did we get from the beginnings to where we are today?
• If a standard aims to reduce risks, to what extent did the standard get out ahead of/prevent risks, as opposed to being developed after relevant problems had already happened?
• Was there any influence of early voluntary standards on later government regulation?

There were many different motivations behind bio standards

At a high level:

• Biosafety standards are generally trying to protect the safety of lab staff and prevent accidental release.
• Biosecurity standards are generally trying to prevent state or non-state development of bioweapons.

But other motivations have also led to standards with a bearing on biological research. For example:

• Worker safety: in the US, the Occupational Safety and Health Act (OSHA) of 1970 was motivated by worker safety in general, but some of its provisions were relevant to biological research.
• Plant protection: one of the earliest relevant standard-setting organisations was the International Plant Protection Convention (IPPC), founded in 1951. Some of their standards impact biological research involving plants.^[2]
• Animal health: the World Organization for Animal Health (OIE) sets standards relating to animal health and zoonoses as well as animal welfare, animal production, and food safety.^[3]
• Fair sharing of genetic resources: the Nagoya Protocol on Access to Genetic Resources and the Fair and Equitable Sharing of Benefits Arising from their Utilization to the Convention on Biological Diversity of 2011 was not motivated by concerns about biosafety or biosecurity, but its provisions imply full traceability on the access and use of some biological materials (genetic resources).^[4]

Standards were significantly reactive rather than proactive

Standards have been significantly reactive to:

• Lab accidents

• I haven’t found evidence of lab accidents being a direct cause of particular biosafety standards, but it is the case that both harm to workers and accidental release from labs were happening before standards were introduced, so the standards were not pre-emptive.
  

• Terrorist attacks, in the case of biosecurity

• In the US, the select agent regulations were first established via the Antiterrorism and Effective Death Penalty Act (1996). The act overall was in significant part a reaction to the Oklahoma City bombing of 1995.^[5] The select agent provisions in particular were in part a response to another incident in 1995, where white supremicist Larry Wayne Harris successfully ordered Yersinia pestis by mail.^[6]
• 9/11 and Amerithrax prompted the PATRIOT Act (2001) and the Bioterrorism Act (2002), which led to the establishment of FSAP in its current form in 2003.^[7]
  

• Epidemics

• The SARS outbreak 2002-2005 and the perceived inadequacy of the WHO response may have sped up the revision of the IHR in 2005 and influenced the revisions themselves.^[8]
• SARS is cited as an important motivation for Chinese biosafety regulations.^[9]

However:

• There are exceptions, where standards were developed in anticipation of potential risks.

• The most notable example is the NIH Guidelines for Research Involving Recombinant DNA Molecules, which were developed in anticipation of low probability extreme risks.^[10]
  

• Guidance is often more proactive than standards.

• For example, there was guidance on gene drives before they were successfully built, but there still aren’t standards, according to one biorisk expert.

International standards weren’t always later or less influential than national ones

• The WHO LBM (1983) was published a year before the US BMBL (1984).
• There are examples of international standards prompting/informing national ones:

• The US select agent list was based on the Australia group list.^[11]
• One motivation behind China’s biosafety legislation has been compliance with the international treaties it is member to.^[12]
  

• There is competition between the WHO LBM and the BMBL.

• According to one biorisk expert I spoke with, this increases the risk of confusion and gaps, and happened because the US rushed ahead of the rest of the world, who weren’t willing/able to follow.
• According to two biorisk experts I spoke with, it’s useful to have international standards as some countries will never adopt US standards on principle.
  

Voluntary standards seem to have prevented regulation in at least one case

The NIH guidelines were widely seen by critics and proponents as preventing future regulation, and this was one of the key motivations of the scientists who organised the research pause and Asilomar.^[13] 

In the US, it may be more likely that mandatory standards are passed on matters of national security

Most bio related standards are voluntary in the US, with the exception of FSAP. According to an expert in standards I spoke with, one of the reasons this was practicable was that there’s federal authority over national security.

Compliance

Question from Holden’s call this section relates to: “What sorts of companies (and how many/what percentage of relevant companies) comply with what standards, and what are the major reasons they do so?”

Voluntary compliance may sometimes be higher than mandated compliance

In the case of the NIH guidelines, compliance may have been higher among commercial companies (who complied voluntarily) than among NIH-funded bodies (who were mandated to comply as a condition of their funding):^[14]

• Paul Berg, one of the organisers of Asilomar, believed this was the case.
• Commercial companies likely had access to more resources and were more concerned by liability than academic counterparts.
  

Motives for voluntarily following standards include responsibility, market access, and the spread of norms via international training

I formed this impression from talking with a biorisk expert, and a biologist involved in setting up the Asilomar conference.

Voluntary standards may be easier to internationalise than regulation

Countries’ legal systems differ, and law is often slow and costly to enact. But voluntary standards can be adopted more quickly.

Examples of voluntary standards being adopted internationally:

• The WHO LBM is used internationally. To my knowledge, there are no equivalent internationally adopted laws on lab biosafety.
• The US BMBL, Canadian Biosafety Standard (CBS) and AU/NZ standards are also all used internationally.^[15]
• Recombinant DNA:

• The 1974 voluntary pause on recombinant DNA research pause was observed internationally.^[16]
• Scientists from all over the world were invited to Asilomar in 1975. According to one of the conference organisers, those people went back to their countries and helped set up regulatory regimes which were consistent with the Asilomar recommendations. The conference organiser believes that no countries deviated from these recommendations apart from Russia as part of their bioweapons programme.

Deliberate efforts were made to increase compliance internationally

According to a biorisk expert I spoke with, part of why biosafety compliance is high internationally is that a lot of funding was put into building regional and national biosafety associations. This expert says that the motivation for this was non-proliferation of dangerous biological agents.

Examples of deliberate efforts to increase compliance:

• According to the same expert, Trevor Smith at Global Affairs Canada and the US DoD and State Department have provided a lot of funding for regional biosafety associations.
• The Canadian Association for Biological Safety assisted Russia to train instructors for biosafety programmes in 2008. Canada has also been involved in other assistance with improving Russian standards, and in translating US and WHO biosafety guidelines into Russian.^[17]

Problems with biosafety and biosecurity standards

Question from Holden’s call for proposals which this section relates to: Does the standard currently seem to achieve its intended purpose? To the extent it seeks to reduce risks, is there a case that it’s done so?

Bio standards are often list-based

Many bio standards are based on lists of agents to which different standards of safety and security apply. There are a number of possible problems with this approach:

• Lists aren’t comprehensive.
• Lists don’t automatically cover emerging threats.

• According to a biorisk expert I spoke with, the ability to make new structures (especially in future with AI) makes list-based approaches particularly inappropriate for biological research.

• List-based approaches tend towards tick-box exercises and may mitigate against careful thinking and innovation in risk management.^[18]
• According to a biorisk expert I spoke with, list-based approaches often impose standards independently of context, when scientists know that there’s a big difference in risk depending on where and how the research is conducted.

There’s been a partial move away from prescriptive, list-based standards towards holistic, risk-based standards. The ISO 35001 is an example of this.

Bio standards tend to lack reporting standards, so it’s very hard to tell how effective they are

• Biorisk expert: “My main hot take is a lot of this field is flying ~blind due to the absence of any outcome data (e.g. how many incidents per X lab year or equivalent). The main push I advocate for is reporting standards rather than guessing what may or may not help (then having little steer post implementation whether you've moved the needle).”
• Palmer et al, 2015: criticises underdeveloped metrics^[19]
• Farquhar et al: calls for centrally commission absolute risk assessments^[20]

Standards may have impeded safety work in some areas

For example, some scientists have argued that in the US, select agent designation creates a barrier to developing mitigation measures.^[21]

Those implementing standards aren’t always sufficiently high powered

• According to a biorisk expert, biosafety isn’t sufficiently integrated with senior management .

• This expert was involved in setting up the ISO standard, and says that one of the aims of the ISO standard is to address this.

• According to a biorisk expert I spoke with, biosafety compliance in the US defaults to something list-based even though the standards themselves are risk-based, because the inspection workforce isn’t sophisticated enough for a more consultative approach as in the UK^[22] or Canada.

Researchers view standards as a barrier to research

• According to a biorisk expert
• They also note that currently biosafety isn’t a technical field in its own right where you can publish papers and make spin-off companies

The evidence base for bio standards is poor

According to a biorisk expert, there often isn’t good evidence that a particular standard is risk reducing. This seems like a somewhat structural problem, related to:

• The fact that standards tend to lack reporting standards
• It being hard to test low probability extreme risks experimentally.

In the US, there is no single body or legislation responsible for bio standards in general

According to a US biorisk expert I spoke with, this leads to gaps in what’s regulated and a lack of leadership.

Some countries have moved towards a centralised approach, for example Canada (Human Pathogen and Toxins Act 2009) and China (Biosafety/Biosecurity Law 2020).

Many standards are voluntary rather than legally mandated

Examples:

• Internationally: the WHO LBM, the Australia Group export controls, ISO 35001
• In the US: the NIH guidelines on recombinant DNA, the BMBL, PC30

The upshot of this is that it’s perfectly legal for example for a rich person in the US to build pathogenic flu in their basement, as long as it’s for peaceful purposes.

There is sometimes a conflict of interest where the same body is responsible for funding research and for assessing its safety

Examples:

• The NIH guidelines on Recombinant DNA 1976 (issued by NIH and applied to NIH fundees)^[23]
• Policy for Oversight of Life Sciences Dual Use Research of Concern 2012 (issued by HHS and applied to HHS fundees)
• Policy for Institutional Oversight of Dual Use Research of Concern 2014 (issued by HHS and applied to HHS fundees)
• Framework for Guiding Funding Decisions about Proposed Research Involving Enhanced Potential Pandemic Pathogens (P3CO) 2017 (issued by HHS and applied to HHS fundees)

Questions this report doesn’t address

Holden’s call for proposal lists a series of questions which he’s interested in answers to. This report gives partial answers to some of those questions above, and doesn’t address the following questions at all:

• How is the standard implemented today? Who writes it and revises it, and what does that process look like?
• How involved are/were activists/advocates/people who are explicitly focused on public benefit rather than profits in setting standards? How involved are companies? How involved are people with reputations for neutrality?
• Are there audits required to meet a standard?

• If so, who does the audits, and how do they avoid being gamed?
• How much access do they get to the companies they’re auditing?
• How good are the audits? How do we know?
• What other measures are taken to avoid standards being “gamed” and ensure that whatever risks they’re meant to protect against are in fact protected against?

• How costly and difficult is it to comply with the standards?
• What happens if a company stops complying?

(Very) select bibliography

I haven’t made a proper bibliography.

Biosafety standards timeline contains information on all of the standards mentioned in this report, with quotes and links. I’d recommend it as a reference.

Some useful background articles:

• Connell, ‘Biologic agents in the laboratory—the regulatory issues’, Federation of American Scientists, 2011.
• Salerno and Gaudioso, ‘Introduction: The Case for Biorisk Management’, in Salerno and Gaudioso (eds), Laboratory biorisk management: biosafety and biosecurity, 2015.
• Beeckman and Rüdelsheim, ‘Biosafety and Biosecurity in Containment: A Regulatory Overview’, Frontiers in Bioengineering and Biotechnology, 2020.