GAO says tighter security needed at two BSL-4 labs

Lisa Schnirring

Oct 22, 2008 (CIDRAP News) – Two of the nation's five biosafety level 4 (BSL-4) labs lack outer-ring security controls to protect against a terrorist attack or theft of some of the world's most dangerous pathogens, such as the Ebola and smallpox viruses, according to a new report from the Governmental Accountability Office (GAO).

The GAO released its findings on Oct 16 in a 20-page report posted on its Web site. The agency prepared the report at the request of House of Representatives committees that have been probing safety problems at the nation's biodefense labs.

In the report, the GAO recommended that the US Centers for Disease Control and Prevention (CDC) implement specific perimeter security controls for all of the country's BSL-4 labs. Currently, the CDC's Select Agent regulations don't specify the perimeter controls that should be in place at the labs, which has resulted in varying security levels among the BSL-4 labs, the report said.

GAO investigators conducted site visits at the labs using a survey that focused on 15 perimeter controls that they said represent a baseline for security at BSL-4 labs. Examples of the controls included barriers to prevent vehicles from approaching the lab, closed-circuit television monitoring, and armed guards at entrances.

Three labs had nearly all of the security controls in place, but one had only four and another had three the controls. Investigators noted that the three labs with the tightest security were subject to additional federal security measures required by other agencies that own or control the labs.

Rep. John Dingell, D-Mich., said in an Oct 16 press release from the House Committee on Energy and Commerce that the GAO report confirms that legislators have reason to be concerned about the security of the labs that handle some of the world's most lethal pathogens.

"I urge the CDC to quickly identify all security shortcomings at these facilities and determine how to best rectify the problems," said Dingell, who chairs the House committee. "Six more of these high-containment labs are currently under construction. Once again, I urge the President to suspend the design and construction of these labs until we solve the security problems at the labs we already have."

The GAO did not name the labs because of security concerns. However, the Associated Press (AP) in an Oct 16 report said the two labs that scored low on the GAO's security assessment are at the Southwest Foundation for Biomedical Research, a private facility in San Antonio, Tex., and at Georgia State University (GSU) in Atlanta.

Researchers at the BSL-4 lab at Georgia State University are investigating B virus, a benign herpesvirus in macaque monkeys that can cause an occupationally acquired human disease that can be fatal without prompt diagnosis and treatment, according to an Oct 18 statement from the school.

Though the CDC's Select Agent regulations don't specify the perimeter controls needed for BSL-4 labs, the school said it has added numerous additional security controls since the GAO's assessment and that it is aggressively addressing the remaining issues.

"Even though the GAO report addresses perimeter security, GSU has had multiple layers of interior security actively implemented since the inception of the laboratory," the school said in its statement.

Meanwhile, Kenneth Trevett, president of the lab in San Antonio, said the facility has already launched an initiative to study perimeter security, according to the AP report. "We're waiting for additional input, but we're not waiting too long. The GAO would like us to do some fairly significant things," he said. "They would like us to do it sooner rather than later."

In a response that accompanies the GAO report, the US Department of Health and Human Services (HHS) wrote that security measures at the labs have been based on risk assessments for each facility and are structured more as performance objectives than as compliance rules.

HHS asked the GAO to address if the 15 security controls it used were research-based. The GAO responded that it has used the security survey in the past and that though the list doesn't represent the only measures that provide perimeter security, it does reflect "common-sense security measures."

HHS said the CDC, along with the US Department of Agriculture, will consult with security experts and the research community to determine what perimeter enhancements are needed at the BSL-4 labs. "The CDC is committed to enhancing security at our nation's BSL-4 laboratories based on risk and sound science, while balancing security enhancements against any impact on the important research being conducted by these laboratories," HHS wrote in its response.