In 1920, the Irish Republican Army reportedly considered a terrifying new weapon: typhoid-contaminated milk. Reading from an IRA memo he claimed had been captured in a recent raid, Sir Hamar Greenwood described to Parliament the ease with which "fresh and virulent cultures" could be obtained and introduced into milk served to British soldiers. Although the plot would only target the military, the memo expressed concern that the disease might spread to the general population.

Although the IRA never used this weapon, the incident illustrates that poisoning a nation's milk supply with biological agents hardly ranks as a new concept. Yet just two weeks ago, the National Academy of Sciences' journal suspended publication of an article analyzing the vulnerability of the U.S. milk supply to botulinum toxin, because the Department of Health and Human Services warned that information in the article provided a "road map for terrorists."

That approach may sound reasonable, but the effort to suppress scientific information reflects a dangerously outdated attitude. Today, information relating to microbiology is widely and instantly available, from the Internet to high school textbooks to doctoral theses. Our best defense against those who would use it as a weapon is to ensure that our own scientists have better information. That means encouraging publication.

The article in question, written by Stanford University professor Lawrence Wein and graduate student Yifan Liu, describes a theoretical terrorist who obtains a few grams of botulinum toxin on the black market and pours it into an unlocked milk tank. Transferred to giant dairy silos, the toxin contaminates a much larger supply. Because even a millionth of a gram may be enough to kill an adult, hundreds of thousands of people die. (Wein summarized the article in an op-ed he wrote for the New York Times.) The scenario is frightening, and it is meant to be -- the authors want the dairy industry and its federal regulators to take defensive action.

The national academy's suspension of the article reflects an increasing concern that publication of sensitive data can provide terrorists with a how-to manual, but it also brings to the fore an increasing anxiety in the scientific community that curbing the dissemination of research may impair our ability to counter biological threats. This dilemma reached national prominence in fall 2001, when 9/11 and the anthrax mailings drew attention to another controversial article. This one came from a team of Australian scientists.

Approximately every four years, Australia suffers a mouse infestation. In 1998, scientists in Canberra began examining the feasibility of using a highly contagious disease, mousepox, to alter the rodents' ability to reproduce. Their experiments yielded surprising results. Researchers working with mice naturally resistant to the disease found that combining a gene from the rodent's immune system (interleukin-4) with the pox virus and inserting the pathogen into the animals killed them -- all of them. Plus 60 percent of the mice not naturally resistant who had been vaccinated against mousepox.

In February 2001 the American SocietyforMicrobiologists' (ASM) Journal of Virology reported the findings. Alarm ensued. The mousepox virus is closely related to smallpox -- one of the most dangerous pathogens known to humans. And the rudimentary nature of the experiment demonstrated how even basic, inexpensive microbiology can yield devastating results.

When the anthrax attacks burst into the news seven months later, the mousepox case became a lightning rod for deep-seated fears about biological weapons. The Economist reported rumors about the White House pressuring American microbiology journals to restrict publication of similar pieces. Samuel Kaplan, chair of the ASM publications board, convened a meeting of the editors in chief of the ASM's nine primary journals and two review journals. Hoping to head off government censorship, the organization -- while affirming its earlier decision -- ordered its peer reviewers to take national security and the society's code of ethics into account.

Not only publications came under pressure, but research itself. In spring 2002 the newly formed Department of Homeland Security developed an information-security policy to prevent certain foreign nationals from gaining access to a range of experimental data. New federal regulations required that particular universities and laboratories submit to unannounced inspections, register their supplies and obtain security clearances. Legislation required that all genetic engineering experiments be cleared by the government.

On the mousepox front, however, important developments were transpiring. Because the Australian research had entered the public domain, scientists around the world began working on the problem. In November 2003, St. Louis University announced an effective medical defense against a pathogen similar to -- but even more deadly than -- the one created in Australia. This result would undoubtedly not have been achieved, or at least not as quickly, without the attention drawn by the ASM article.

The dissemination of nuclear technology presents an obvious comparison. The 1946 Atomic Energy Act classifies nuclear information "from birth." Strong arguments can be made in favor of such restrictions: The science involved in the construction of the bomb was complex and its application primarily limited to weapons. A short-term monopoly was possible. Secrecy bought the United States time to establish an international nonproliferation regime. And little public good would have been achieved by making the information widely available.

Biological information and the issues surrounding it are different. It is not possible to establish even a limited monopoly over microbiology. The field is too fundamental to the improvement of global public health, and too central to the development of important industries such as pharmaceuticals and plastics, to be isolated. Moreover, the list of diseases that pose a threat ranges from high-end bugs, like smallpox, to common viruses, such as influenza. Where does one draw the line for national security?

Experience suggests that the government errs on the side of caution. In 1951, the Invention Secrecy Act gave the government the authority to suppress any design it deemed detrimental to national defense. Certain areas of research-- atomic energy and cryptography -- consistently fell within its purview. But the state also placed secrecy orders on aspects of cold fusion, space technology, radar missile systems, citizens band radio voice scramblers, optical engineering and vacuum technology. Such caution, in the microbiology realm, may yield devastating results. It is not in the national interest to stunt research into biological threats.

In fact, the more likely menace comes from naturally occurring diseases. In 1918 a natural outbreak of the flu infected one-fifth of the world's population and 25 percent of the United States'. Within two years it killed more than 650,000 Americans, resulting in a 10-year drop in average lifespan. Despite constant research into emerging strains, the American Lung Association estimates that the flu and related complications kill 36,000 Americans each year. Another 5,000 die annually from food-borne pathogens -- an extraordinarily large number of which have no known cure. The science involved in responding to these diseases is incremental, meaning that small steps taken by individual laboratories around the world need to be shared for larger progress to be made.

The idea that scientific freedom strengthens national security is not new. In the early 1980s, a joint Panel on Scientific Communication and National Security concluded security by secrecywasuntenable. Its report called instead for security by accomplishment -- ensuring strength through advancing research. Ironically, one of the three major institutions participating was the National Academy of Sciences -- the body that suspended publication of the milk article earlier this month.

The government has a vested interest in creating a public conversation about ways in which our society is vulnerable to attack. Citizens are entitled to know when their milk, their water, their bridges, their hospitals lack security precautions. If discussion of these issues is censored, the state and private industry come under less pressure to alter behavior; indeed, powerful private interests may actively lobby against having to install expensive protections. And failure to act may be deadly.

Terrorists will obtain knowledge. Our best option is to blunt their efforts to exploit it. That means developing, producing and stockpiling effective vaccines. It means funding research into biosensors -- devices that detect the presence of toxic substances in the environment -- and creating more effective reporting requirements for early identification of disease outbreaks. And it means strengthening our public health system.

For better or worse, the cat is out of the bag -- something brought home to me last weekend when I visited the Tech Museum of Innovation in San Jose. One hands-on exhibit allowed children to transfer genetic material from one species to another. I watched a 4-year-old girl take a red test tube whose contents included a gene that makes certain jellyfish glow green. Using a pipette, she transferred the material to a blue test tube containing bacteria. She cooled the solution, then heated it, allowing the gene to enter the bacteria. Following instructions on a touch-screen computer, she transferred the contents to a petri dish, wrote her name on the bottom, and placed the dish in an incubator. The next day, she could log on to a Web site to view her experiment, and see her bacteria glowing a genetically modified green.

In other words, the pre-kindergartener (with a great deal of help from the museum) had conducted an experiment that echoed the Australian mousepox study. Obviously, this is not something the child could do in her basement. But just as obviously, the state of public knowledge is long past anyone's ability to censor it.

Allowing potentially harmful information to enter the public domain flies in the face of our traditional way of thinking about national security threats. But we have entered a new world. Keeping scientists from sharing information damages our ability to respond to terrorism and to natural disease, which is more likely and just as devastating. Our best hope to head off both threats may well be to stay one step ahead.

While the anthrax scare at Washington Post offices this year proved to be a false alarm, it was a reminder of how vulnerable Americans are to biological terrorism. In general, two threats are viewed as the most dangerous: anthrax, which is as durable as it is deadly, and smallpox, which is transmitted very easily and kills 30 percent of its victims.

But there is a third possibility that, while it seems far more mundane, could be just as deadly: terrorists spreading a toxin that causes botulism throughout the nation's milk supply.

Why milk? In addition to its symbolic value as a target--a glass of milk is an icon of purity and healthfulness--Americans drink more than 6 billion gallons of it a year. And because it is stored in large quantities at centralized processing plants and then shipped across country for rapid consumption, it is a uniquely valuable medium for a bioterrorist.

For the last year, a graduate student, Yifan Liu, and I have been studying how such an attack might play out, and here is the situation we consider most likely: a terrorist, using a 28-page manual called "Preparation of Botulism Toxin" that has been published on several jihadist Web sites and buying toxin from an overseas black-market laboratory, fills a one-gallon jug with a sludgy substance containing a few grams of botulin. He then sneaks onto a dairy farm and pours its contents into an unlocked milk tank, or he dumps it into the tank on a milk truck while the driver is eating breakfast at a truck stop.

This tainted milk is eventually piped into a raw-milk silo at a dairy-processing factory, where it is thoroughly mixed with other milk. Because milk continually flows in and out of silos, approximately 100,000 gallons of contaminated milk go through the silo before it is emptied and cleaned (the factories are required to do this only every 72 hours). While the majority of the toxin is rendered harmless by heat pasteurization, some will survive. These 100,000 gallons of milk are put in cartons and trucked to distributors and retailers, and they eventually wind up in refrigerators across the country, where they are consumed by hundreds of thousands of unsuspecting people.

It might seem hard to believe that just a few grams of toxin, much of it inactivated by pasteurization, could harm so many people. But that, in the eye of the terrorists, is the beauty of botulism: just one one-millionth of a gram may be enough to poison and eventually kill an adult. It is likely that more than half the people who drink the contaminated milk would succumb.

The other worrisome factor is that it takes a while for botulism to take effect: usually there are no symptoms for 48 hours. So, based on studies of consumption, even if such an attack were promptly detected and the government warned us to stop drinking milk within 24 hours of the first reports of poisonings, it is likely that a third of the tainted milk would have been consumed. Worse, children would be hit hardest: they drink significantly more milk on average than adults, less of the toxin would be needed to poison them and they drink milk sooner after its release from dairy processors because it is shipped directly to schools.

And what will happen to the victims? First they will experience gastrointestinal pain, which is followed by neurological symptoms. They will have difficulty seeing, speaking and walking as paralysis sets in. Most of those who reach a hospital and get antitoxins and ventilators to aid breathing would recover, albeit after months of intensive and expensive treatment. But our hospitals simply don't have enough antitoxins and ventilators to deal with such a widespread attack, and it seems likely that up to half of those poisoned would die.

As scary as this possibility is, we have actually been conservative in some of our assumptions. The concentration of toxin in the terrorists' initial gallon is based on 1980's technology and it's possible they could mix up a more potent brew; there are silos up to four times as large as the one we based our model on, and some feed into several different processing lines that would contaminate more milk; and the assumption that the nationwide alarm could go out within 24 hours of the first reported symptoms is very optimistic (two major salmonella outbreaks in the dairy industry, in 1985 and 1994, went undetected for weeks and sickened 200,000 people).

What can we do to avoid such a horror? First, we must invest in prevention. The Food and Drug Administration has some guidelines - tanks and trucks holding milk are supposed to have locks, two people are supposed to be present when milk is transferred - but they are voluntary. Let's face it: in the hands of a terrorist, a dairy is just as dangerous as a chemical factory or nuclear plant, and voluntary guidelines are not commensurate with the severity of the threat. We need strict laws - or at least more stringent rules similar to those set by the International Organization for Standardization in Geneva and used in many countries - to ensure that our milk supply is vigilantly guarded, from cow to consumer.

Second, the dairy industry should improve pasteurization so that it is far more potent at eliminating toxins. Finally, and most important, tanks should be tested for toxins as milk trucks line up to unload into the silo. The trucks have to stop to be tested for antibiotic residue at this point anyway, and there is a test that can detect all four types of toxin associated with human botulism that takes less than 15 minutes. Yes, to perform the test four times, once for each toxin, on each truck would cost several cents per gallon. But in the end it comes down to a simple question: isn't the elimination of this terrifying threat worth a 1 percent increase in the cost of a carton of milk?

One other concern: although milk may be the obvious target, it is by no means the only food product capable of generating tens of thousands of deaths. The government needs to persuade other food-processing industries - soft drinks, fruit juices, vegetable juices, processed-tomato products - to study the potential impact of a deliberate botulin release in their supply chains and take steps to prevent and mitigate such an event.

Americans are blessed with perhaps the most efficient food distribution network in history, but we must ensure that the system that makes it so easy to cook a good dinner doesn't also make it easy for terrorists to kill us in our homes.

By Dawn Levy

Responding to a terrorist attack employing biological or chemical agents requires knowledge spanning many disciplines. Three Stanford researchers were among nearly 135 leading scientists and technical experts from industry, academia and government invited to participate in the Gordon Research Conference on Chemical and Biological Terrorism Jan. 30-Feb. 4 in Buellton, Calif. The conference brought together public and private sectors to discuss what has worked, where problems are now and may appear in the future, and what needs more attention in responding to and preventing terrorism. The goal was to move toward a better "systems approach" to defense.

The Stanford participants were Margaret E. Kosal, a science fellow at the Center for International Security and Cooperation (CISAC) with a doctorate in chemistry; Steven M. Block, a professor of applied physics and of biological sciences and senior fellow, by courtesy, at the Stanford Institute for International Studies; and Mark A. Musen, a professor of medicine (medical informatics) and, by courtesy, of computer science.

The conference included discussions of public health surveillance and response, food supply vulnerabilities and agricultural security, forensics of biological and chemical evidence, and the changing nature of the threat environment.

Both biological and chemical terrorist attacks have the potential to cause a large number of causalities and overwhelm medical capabilities, or "surge capacity." The nation's terrorism defense plans focus on mass-effect bioterrorism--events with the potential to infect tens of thousands and kill more than a thousand. But those plans may not effectively counter small-scale biological or chemical attacks, much less nuclear or radiological attacks, Kosal asserted.

Musen spoke about the computational problems of automating surveillance for possible bioterrorism using "prediagnostic" indicators that become available even before health-care workers can identify a specific epidemic.

"There is enormous enthusiasm--and enormous spending--for combining databases of over-the-counter drug sales, absenteeism records, 911 calls and admitting diagnoses to emergency rooms and clinics," he said. "There has been virtually no empirical evaluation of any of these efforts, despite all the excitement."

Musen discussed difficulties computers have making sense of high-volume, low-signal data streams, including basic problems with the way that the data typically are represented, difficulties of integrating disparate data sources and uncertainty in how to present the results of computational analyses to public-health officials in an optimal way.

"Although there is enormous political pressure to be 'doing something' to monitor for bioterrorism, it's also important to take a step back and to engage in the research needed to determine what we really should be doing," Musen said.

Chemical threats are underestimated

The focus on bioterror threats may miss a more frequent occurrence--chemical attacks. In a presentation titled "The Shifting Face of Chemical Terrorism: Assessing an Emerging Threat," Kosal examined the growing trend of non-state actors to use improvised chemical devices (ICDs) that may include choking and blistering agents.

"The path from the 'street chemistry' of improvised explosive devices [IEDs] to ICDs incorporating commercial chemicals is very short, whereas the path from IEDs to transgenic biological agents effectively weaponized is a substantial leap for states and even more so for terrorists," Kosal said. "While U.S. policy is focused on defending against a mass-effect bioterrorism attack, we may be missing a lower-tech threat of much higher probability."

Half of the U.S. fatalities in Iraq have been due to IEDs, typically roadside bombs, Kosal said. "This strongly suggests there is a substantial tacit knowledge base and readily available materials for constructing these types of weapons--one guy has not been making them all in a Mosul garage." While incorporating chemicals into roadside bombs would not dramatically increase military casualties, incorporating them in devices employed in enclosed spaces could, Kosal said.

An analysis of terrorism between 1910 and 2003 from open-source information shows the lion's share of 265 terrorist attacks--76 percent--were chemical. Only 17 percent were biological, 0 percent nuclear (involving fissile material, such as that powering an atomic bomb) and 7 percent radiological (involving radioactive elements that cannot be used for fission or that contain less than a critical mass of fissionable material, such as those employed in "dirty bombs").

It used to be that the major threat of chemical weapons came from state-based programs. Chlorine and mustard gases were used extensively in World War I, for example. The United States and the former Soviet Union amassed stockpiles exceeding 40,000 tons, which are still being destroyed. International efforts to control the exchange of certain chemicals, such as precursors for nerve and blister agents, have been effective. Kosal cited the refusal in the 1980s during the Iran-Iraq war of the world community to sell Iraq the key precursor to mustard gas.

Nowadays, terrorists both foreign and domestic may disperse traditional chemical warfare agents using improvised methods. In 1995, for example, the Aum Shinrikyo group crudely dispersed a nerve agent in a Tokyo subway--killing 12 and panicking thousands--using umbrellas to puncture 11 garbage bags, each filled with a common solvent and about a pound of sarin. Today's chemical weapons may just as likely come from common commercial sources, such as agrochemicals. Radical Islamists have even attempted to weaponize a research chemical, osmium tetroxide, used to prepare biological specimens for electron microscopy.

In contrast with nuclear or mass-effect biological weapons, chemical weapons may not require sophisticated knowledge to produce. In 2003 at a rented storage space in Tyler, Texas, government agents seized half a million rounds of ammunition, more than 60 pipe bombs, remote-controlled bombs disguised as briefcases, pamphlets on how to make chemical weapons and improvised hydrogen cyanide dispersal devices hypothetically capable of killing thousands in a minute. The stockpiler, William J. Krar, described as a white supremacist and anti-government extremist, was sentenced to 11 years in federal prison. His specific objectives remain unknown to authorities.

Kosal said terrorists do not appear to be concocting new chemicals; they're co-opting existing ones. "Chemical terrorism is likely to be a crime of opportunity and familiarity with chemicals and chemistry," Kosal said. "Perhaps the basic knowledge and materials--commercial dual-use chemicals in this instance--are too globally widespread to justify efforts to control the capability of terrorists to co-opt them for malfeasant uses. . . . The best threat-reduction policy may be to reduce the motivation.

"Much of the academic and policy dialogue segregates the folks discussing motivation from the folks discussing capacity and vulnerability. The former tend to be historians and social scientists and the latter, biologists, chemists and physicists. It may prove that decreasing terrorist motivation is unfeasible in the near term, but here is an example where those with the technical knowledge and those with the social science knowledge need to be working cooperatively, the type of interaction that the CISAC Science Fellows program fosters," Kosal said.

Ten thousand fingers on the bioterror "button"

Block's talk focused on the growing threat of bioterror. While chemicals have killed more people to date than have biological weapons, future biological attacks using infectious, untreatable pathogens have the potential to kill more people than chemicals. Block wryly called such biological attacks "the gift that keeps on giving."

Block said post-9/11 restrictions aimed at keeping pathogens out of the wrong hands have backfired. One is the Department of Health and Human Services' "Select Agent Rule," which establishes requirements regarding possession and use in the United States, receipt from outside the United States and transfer within the United States of a particular list of agents and toxins.

"We're shooting ourselves in the foot," Block said. "We've made it so hard to work on these pathogens that even our so-called 'A-Team' can't do research with them." World-renowned plague researcher Stanley Falkow of Stanford and famed anthrax expert John Collier of Harvard have stopped working on live pathogens because of restrictive effects of recent legislation, according to Block. They now confine their research to a handful of cloned genes. "It's almost impossible to hire grad students or postdocs to work on Select Agents. Such research has been driven underground or into our national labs, which historically have not had the biological expertise found in the top academic labs and biotech companies."

Much of our response to bioterror threats is based on how we've historically responded to nuclear terror threats, Block said. "With nuclear weapons, only two things can be made to go 'boom'--plutonium and highly enriched uranium," he said. That made it comparatively easy to track and control materials, and to get a handle on the problem. "We tried to keep nuclear secrets secret. Not everyone knows how to make an atomic bomb."

In contrast, the genie has long been out of the bottle when it comes to biological agents. Virtually all research is reported in the open literature. "Even if we were to stop publishing everything now, there'd be enough public information to keep bioterrorists busy for at least another 50 years," he said.

"Back in the nuclear age, only a few countries were nuclear powers, and only a few people were authorized to have their 'fingers on the button,'" Block said. "Like them or not, they were responsible people. Contrast that with a world where genetically engineered weapons can be produced by, say, 10,000 people. Someone is guaranteed to press that button. We can't stop [bioterror acts] at the source any more than we can stop a computer virus at the source."

Rather than futilely attempting to thwart biological threats at their sources, which are ubiquitous, Block advocated shoring up the public health system so it can respond nimbly once threat turns to reality. A new generation of antitoxin, antiviral and antibacterial agents may mitigate ill effects, and improved vaccines may prevent damage altogether. "We need to work the problem from the other direction," he said. "To confine our attention to Select Agents alone is essentially putting on blinders. The future threats we may face may bear little relation to the organisms on the current list."