Two of Five BSL-4 Labs Flunk Security Test
by Mickey McCarter   
Friday, 17 October 2008

GAO reviews perimeter security at biolabs

Three out of five of the nation's top biosafety laboratories have poor perimeter security measures, prompting congressional investigators to recommend that the Centers for Disease Control and Prevention (CDC) review their security and consider upgrades.

The Government Accountability Office (GAO) examined the physical security of the five labs from September 2007 to December 2008 and published the results Thursday in a report titled "Biosafety Laboratories: Perimeter Security Assessment of the Nation's Five BSL-4 Laboratories." GAO conducted the review for the House Committee on Energy and Commerce.

CDC regulates all five of the operational US biosafety level (BSL) 4 labs, which handle the deadly contaminants in the world. The BSL 4 labs, operating at high levels of security, are the only ones authorized by the federal government to work with biological agents--such as the Ebola virus, hemorrhagic fevers, and smallpox--that could kill people but have no cure or treatment.

GAO explored the perimeter security of the five national BSL-4 labs, examining 15 physical security controls. Three labs had all or nearly all of the key security controls, which include features like perimeter barriers, roving armed guards, and active intrusion detection systems. Two of the labs, however, "demonstrated a significant lack of these controls," possessing only three or four of the prescribed 15 security measures.

"Although the presence of the security controls GAO assessed does not automatically ensure a secure perimeter, having most controls provides increased assurance that a strong perimeter security system is in place and reduces the likelihood of unauthorized intrusion," the GAO report read. "For example, the two labs with fewer security controls lacked both visible deterrents and a means to respond to intrusion. One lab even had a window that looked directly into the room where BSL-4 agents were handled."

GAO recommended that CDC work with the US Department of Agriculture (USDA) to review perimeter security at the labs and make upgrades to security as necessary. Federal law authorizes USDA to regulate the biosafety labs as well as CDC, but all five labs currently report only to CDC.

CDC responded that it would do so, but the agency explained that it does not set requirements for specific security measures at the labs but rather bases any security on risk assessments of likely threats. CDC further noted components of biosecurity include physical security, personnel security, information security, transport security, and material control and accountability.

Storage of biological agents falls under the domain of the Department of Health and Human Services (HHS) and USDA under the Public Health Security and Bioterrorism Preparedness and Response Act of 2002. HHS, the parent agency of CDC, regulates labs that study agents that could threaten human life, while USDA regulates those with agents that could threaten animals and plants. In cases where agents could pose a threat to humans and animals, labs could register with either agency but all have chosen to register with CDC.

Each lab receives a site-specific risk assessment to determine the establishment of specific security features. Each lab should develop a specific security plan based on the assessment to prevent the loss, theft or release of agents, according to federal law.

The nation's five operational BSL-4 laboratories are located at the US Army Research Institute of Infectious Diseases in Fort Detrick, Md.; CDC facilities in Atlanta, Ga.; the Southwest Foundation for Biomedical Research in San Antonio, Texas; the University of Texas at Galveston; and the Virginia Division of Consolidated Laboratory Services in Richmond, Va. The GAO report does not specify which labs met perimeter security requirements and which did not.


Mickey McCarter
About the author:
eNewsletter Editor/Senior Washington Correspondent, is a journalist with more than a decade of experience in reporting on military affairs and information technology.
Read More >>