Evasion scenarios based on molecular biology will be the major focus of this paper; however, some of what is said about the capabilities and limitations of various molecular-biology-based analysis methods also has relevance to evasion scenarios based on cleanup. Finally, detection and identification of chemical BW agents such as toxins has been well studied for the Chemical Weapons Convention and outlined elsewhere⁽¹⁾, so will not be discussed here.

Evasion scenarios during visits or inspections will not be further discussed because of space limitations. The Federation of American Scientists has published a sampling procedure⁽²⁾ that can protect valuable proprietary commercial microorganisms and, at the same time, serve as a countermeasure against willful destruction of analysis targets in a sample. While this procedure needs elaboration to satisfy industry concerns, it demonstrates that the risk of evasion during sampling can be significantly reduced.

Summary of detection methods

For microorganisms, there are a number of sophisticated identification methods¹. Most were developed for and are routinely used for diagnosing infectious diseases, so they would need to be adapted for the detection of BW microorganisms that include viruses, bacteria and higher organisms. Most methods for identification of microorganisms target easily-recognizable species-specific molecules or features. The targets or features (in italics) and methods that recognize them include:

Specificity and sensitivity

To understand the capabilities and limitations of various detection methods, the concepts of specificity and sensitivity are useful. An analysis method for a species of microorganism is said to be specific if it usually identifies only that species. If an analysis has accurately identified the species in question, the result is said to be a true positive. If an analysis has falsely identified the species--indicated the species is present when it was not--the result is said to be a false positive. If the analysis fails to identify the species when it is not present, the result is said to be a true negative. If the analysis fails to identify the species when it is indeed present, the result is said to be a false negative. DNA probes, for example, can be developed to have very high specificity, so false positives due to limitations in the method itself are rare ("analytic" specificity).

In a BWC setting, however, the real question is "What is the meaning of the presence of an organism?" Is the organism there because of some illegal activity, or is it there "by accident?" A positive that results from accidental contamination of a facility is not a true positive, so the specificity of an analysis in a BWC setting will be equal to or less than the analytic specificity. We call this true specificity, the "actual" specificity. Analytic specificity must be determined during test development on a case-by-case basis for each BW microorganism. Estimates of what actual specificity might be in different settings can only come from long experience. In this regard, as methodologies for analysis are developed and approved, each facility may wish to test themselves to determine (and report) the presence of accidental contamination.

Since false positives and false negatives are possible outcomes, one consequence in a BW compliance regime, is that a single or a few positive results from a single analysis method must be treated with caution, since they could be false positives. That is, a positive result in an analysis for the presence of a BW microorganism should be corroborated with other data and information.

Sensitivity is a relative concept. For our purposes, high sensitivity is defined as the capability of an analysis method to detect as few microorganisms as is necessary for the purpose at hand. If the analysis method is incapable of detecting sufficiently low numbers of microorganisms, it is described as having low sensitivity.

Some modern analysis methods, such as DNA probes employing PCR or other amplification procedures, have such high sensitivity that they are capable in theory of detecting a single microorganism. In a compliance regime, such sensitive analyses could inadvertently lead to false positives by identifying trace amounts of BW microorganisms that are naturally or accidentally present at the site. On the other hand, methods of low sensitivity might fail to detect traces of BW microorganisms in a facility that is in violation of the BWC.

Analysis methods likely to be used only rarely

While the methods below may well find utility in particular situations, or may be improved in the future to the point where they could become standard BWC methods, at present they are unlikely to be used often.

Spectroscopic methods such as nuclear magnetic resonance and Fourier-transform infrared may be eliminated from further consideration here, because they are not yet sufficiently developed for detection or identification purposes.

Because animal virulence testing also utilizes live microorganisms, it should not be employed for analysis unless it is essential. Animal virulence testing, which determines morbidity and mortality in live animals, is the most direct test of the potential pathogenicity of a suspected BW agent; however, it presents potential safety problems from working with live potential BW agents. It could be employed in special circumstances, for example, to differentiate between a BW agent and an attenuated vaccine strain.

Targets and methods likely to be employed most frequently

Microscopy allows the visualization of whole viruses, cells and cell features, but is usually incapable of making positive identifications at the species level--that is, it has low specificity. Light microscopy, however, which is simple and rapid, could eliminate certain microorganisms from suspicion; for that reason, it would likely be utilized on site.

DNA probes and immunoassays are the leading candidates for use in sampling and analysis in a BWC compliance regime. DNA probes are capable of high specificity and high sensitivity when the sample is amplified by PCR. They also can utilize dead microorganisms, which is one way to protect proprietary commercial microorganisms. Furthermore, residues from dead microorganisms might be detected after sterilization procedures used in a cleanup. New versions of DNA probe methods are rapid (less than one hour to complete an identification) and are portable⁽⁴⁾, both important features for on-site analyses.

Immunoassays that employ monoclonal antibodies to detect the surface characteristics (shapes) of proteins and nonprotein molecules are capable of high specificity and sensitivity sufficient for some BWC purposes. In addition, they can recognize dead microorganisms, can be performed rapidly, and are portable.

Standard chemical analysis methods, which can be used to determine the amounts of each member of chemically-similar families of nonprotein molecules (such as long-chain fatty acids in cell membranes), are of interest because ratios of the target molecules are difficult or impossible to disguise to evade detection. Furthermore, the methods are in standard use in the chemical industry, and experience with them in CWC inspections should make them easily adaptable to the BWC. Many standard chemical analysis methods are rapid and portable, and most can utilize dead microorganisms.

Culture methods for bacteria and other free-living organisms and plaque assays for viruses are highly reliable and have been around a long time; they are the "gold standard" of medical diagnostics. For this reason, they might be used frequently when it is deemed appropriate to conduct sampling and analysis. Culture methods, because they utilize live microorganisms, do present the problem of potential loss of valuable proprietary property (live commercial microorganisms). Protocols for protecting confidential property will have to be worked out for culture methods, which will usually be performed on site under the observation of a facility employee. Furthermore, both culture methods and plaque assays present potential safety problems from working with live potential BW agents.

These four methods are "orthogonal"; that is, they identify different targets utilizing different methodologies. Even though false positives from more than one orthogonal method are unlikely, a BWC response to any positive result must be carefully considered, supported by other information and data, and must allow ample opportunity for the facility to respond--because a false accusation would have many injurious consequences. For non-environmental samples (e.g., samples from a fermenter or stock cultures), positive results obtained by more than one orthogonal method would be much more suspicious than for environmental samples.

Adaptation of these existing methods to detect BW microorganisms, involves the specification of target molecules or sequences within them that are unique to the BW microorganisms, and the production of appropriate probes, antibodies and standards for those targets. While sampling and analysis is treated here only casually, the amount of effort to develop reliable and acceptable sampling and analysis methodologies for the BWC should not be underestimated, for it may take several years of intensive effort. As one industry representative remarked, "In order for testing of samples to become acceptable to industry as part of BWC compliance monitoring, a means will be needed to design, execute, and publish ...validation experiments with academic, industrial, and government participation." Of particular importance, means for rapidly validating tests at each site at the time of use must be developed. Furthermore, technical and political implications arising from reduced specificity from conditions at the site (actual specificity) must be understood and carefully planned for in advance of implementing sampling and analysis protocols.

DNA probe methods and genomic DNA or RNA

The instructions for reproducing an identical copy of every living organism resides in the so-called A, T, C, and G base sequence of the organism's DNA. Since every species of microorganism is unique, it must contain segments of its base sequence that are also unique. Once unique DNA sequences are identified, they can be "read" by specific short DNA molecules called DNA probes, which can be synthesized to be complementary to the unique genome segments and, thus, to pair with them.

The identification of several DNA probes unique to each BW agent can provide the basis for DNA probe analysis methods that are highly specific for each agent. Each species of BW microorganism will have several DNA sequences unique to it. The genomic DNA of a typical bacterium, for example, is 4x10⁶ bases long, and viral genomes are typically 100-fold smaller. Since DNA probes are usually 15 to 150 bases long, depending on the DNA probe detection method employed, there are then hundreds to thousands of probes that could be utilized for identification of a particular BW agent.

High analytic specificity is achieved by testing the large number of candidate probes against a very large number of other species. In practice, as many probes as is necessary to achieve very high analytic specificity may be employed. It should be possible to find dozens of probes to "read" the sequences unique to each BW species. It is envisioned that the BWC Inspectorate would have available for analysis many different, approved probes for each BW microorganism, even though only a few probes for each species would be used for analysis at any one site. One reason to have many available probes is that it will increase the difficulty of disguising BW microorganisms by engineering them to evade detection by all the available probes (see below).

DNA probe analysis can be developed to achieve very high analytic sensitivity. This is presently accomplished through the use of target-DNA amplification technologies such as PCR. In principle, a single microorganism can be detected, and in practice as few as 100 microorganisms are routinely detected. Therefore, false negatives are unlikely in most samples, and evasion would have to rely on thorough and diligent cleaning of the facility before inspection.

In several studies, PCR has been used to detect BW microorganisms. For example, for Yersinia pestis, the cause of bubonic plague, as few as 10-50 cfu (a measure of live microorganisms) were detected in crude cell lysates, and 100-400 cfu were detected in blood ⁽⁵⁾. In another study, 10 microorganisms were detected in flea tissue⁽⁶⁾. For Bacillus anthracis (the cause of anthrax) in environmental soil samples, 10 spores per 100 grams of original soil sample were detected⁽⁷⁾. In another, B. Anthracis study, 100 spores were detected when no attempt was made to free the DNA from the spores, but as little as two spores were detected when the DNA was released from the spores through mechanical disruption prior to analysis⁽⁸⁾.

While these few, nondefinitive studies tend to confirm the high sensitivity of PCR-amplified DNA-probe analysis, they also point to the influence of sample source and sample preparation. The BWC Inspectorate should develop optimal sampling and sample preparation procedures, and must understand their capabilities and limitations. Developing good sampling and sample preparation procedures is likely to be more difficult than developing highly specific and sensitive DNA probe analyses.

Another kind of DNA probe analysis called restriction-fragment length polymorphism (RFLP) analysis identifies species-specific lengths of fragments of DNA that are obtained by cutting the DNA at specific sequence sites using restriction enzymes. RFLP analysis requires considerable quantities of DNA and identification of BW agents can be evaded easily (see below), so it should not often be used to identify agents. RFLP analysis, however, could be used to verify the accuracy of declarations, and may find use for that purpose.

DNA probe methods have the additional advantage that the target genomic DNA is more difficult to destroy that many other cellular components, so there is a greater probability that the targets would remain intact after autoclaving and after a cleanup of a facility. The stability of DNA and the ability of PCR to identify DNA residues from suboptimal samples has been reviewed by Morse, a part of which is reproduced in Annex I.

The conclusion from the Morse analysis is that a number of harsh chemical and physical treatments can be used to destroy DNA, but most of these treatments involve chemical and physical treatments that are unsafe (e.g., radiation) or expensive (nucleases), and therefore are difficult to apply over large areas of a facility. In addition, evidence of the presence of these treatment capabilities might serve to increase suspicions of noncompliance in some situations. These problems will help to deter potential violators.

Of special interest is the observation that autoclaving, a primary sterilization procedure, may not destroy DNA. In fact, as one commercial PCR utilizer said, "One of the biggest nightmares for a PCR lab is the autoclave, because of aerosols and spills of amplified DNA."⁽⁹⁾

Immunoassay (antibody) methods targeted to surface and internal proteins unique to BW species

In medical diagnostics, immunoassays that employ antibodies to detect the shape of species-specific proteins and nonprotein molecules are routinely used. Immunoassays can also be developed to detect denatured proteins, which may be found after autoclaving and other treatments.

Immunoassays have been used to detect BW microorganisms. For example, Yersinia pestis has been detected at concentrations of 5x10⁴ microorganisms per milliliter⁽¹⁰⁾. This sensitivity is low compared to DNA probes, where 100 microorganisms are routinely detected; and in some instances, where a single microorganism can be detected. Such low sensitivity may not be useful for analysis of environmental samples, but would be useful in analyzing cultures such as bacterial stocks or samples from fermenters. With high affinity antibodies, perhaps fewer than 500 microorganisms may be detected (See Annex II).

Like DNA probes, a number of different antibodies directed to different protein and nonprotein targets can be utilized by the BWC Inspectorate both to attain high specificity and to make difficult evasion of detection by disguising the microorganism (see below). To achieve high specificity, the protein parts (epitopes) that antibodies recognize must not be common to similar but nonpathogenic microorganisms.

Proteins are easily denatured and may be partially degraded during autoclaving and mild chemical treatments, which may present more targets for antibodies targeted to denatured proteins, if the proteins are not highly degraded. Because of the wide range of stabilities of protein molecules and the high stabilities of many nonprotein molecules, Morse (reference in Annex I) concludes, "For identification based on proteins or other antigens, using immunoassay or immuno-PCR⁽¹¹⁾, it is much harder to make generalizations; immuno-PCR is quite sensitive and might give useful results even when the DNA of a sample has been destroyed."

Standard chemical methods for quantifying species-specific families of chemically-similar molecules

Microorganisms possess several different families of molecules, where each family member is chemically similar in some way (e.g., families of fatty acids, oligosaccharides, etc.), but different in some respect (e.g., molecular weight). The members of each family exist in different ratios in each species. These families are interesting targets for microorganism detection and identification, because the similarities indicate that a single chemical analysis method can be used, and the differences mean that different species can be identified with high specificity. Many such families are expected to be stable to autoclaving and other common sterilization procedures.

Gas-liquid capillary chromatography (GLC) profiles of long-chain fatty acids from cell membranes are being used successfully in clinical microbiology laboratories and should fit the needs of the BWC. Species and even strains can be differentiated and identified from fatty-acid GLC profiles. Isolation of fatty acids from dead microorganisms is straightforward, a typical analysis takes only two hours, and the equipment can be made portable. The number of cells required for an analysis is larger than required for immunoassays, so GLC may not be useful for analysis of environmental samples, but would be useful in analyzing cultures such as bacterial stocks or samples from fermenters⁽¹²⁾.

Evasion scenarios and countermeasures based on molecular biology

To understand how genomic DNA could be altered to evade detection of the microorganism, we take a closer look at the flow of information from DNA to the synthesis of other components of the microorganism. In the representation below, the translation from the four-letter DNA code to the twenty amino-acid code of proteins is illustrated.

DNA ---->	mRNA ---->	protein--->	non-protein components
AAG GCT TTC CGA TTC CGA AAG GCT--->	UUC CGA --->	phe-arg --->	non-protein components
(DNA probes)	(DNA probes)	(immunoassay)	(fatty-acid profiles, immunoassay or chemical assay)

The second line of arrows shows that the mRNA copy of a section of genomic DNA has a similar four-letter code except the base T is replaced by the base U, so that DNA and mRNA are identical in information terms--that is, one is just a transcript of the other.

Also in the second line, are shown two examples of the "genetic code" that translates from DNA language to amino-acid language. Specifically the three-letter UUC "codon" translates to the amino acid phenylalanine and the CGA codon translates to the amino acid arginine. Since there are four DNA or mRNA bases, there are 4x4x4=64 potential three-letter codons, more than sufficient to translate to the twenty amino acids. In fact, more than one codon is utilized for each amino acid except methionine, so the genetic code is said to be degenerate. For example, the two codons CGA, AGG both translate to the amino-acid arginine. As many as six codons are available to translate to some particular amino acids. A typical protein has 300-400 amino acids, so the sequence of DNA that directs the synthesis of a typical protein is about 1000 bases in length, and is called a gene.

The non-protein components of a microorganism are synthesized by enzymes (also proteins), so they too are dependent on the information in the sequence of the genomic DNA.

The third line indicates analysis methods that can detect the molecules in the information stream. Thus,

Thus, all inheritable alterations of microorganisms to evade detection must be made at the DNA level. How can molecular biologists make alterations while retaining a viable and virulent BW microorganism? There are four obvious kinds of DNA-level alterations that can be made for evasion purposes.

1. Remove or inactivate the gene for a non-essential target protein, so that the entire protein is eliminated;

2. Alter the DNA sequence of a gene to produce the same protein;

3. Add a single new gene for a protein toxin to an exempt microorganism to make it a BW agent; and

4. Add several new enzyme genes to create a BW microorganism that makes a nonprotein BW agent, or to create a new BW microorganism

How each of these strategies may be carried out and countermeasures to each strategy are discussed below.

(1) A strategy based on removal of a gene for a protein will evade detection by antibodies targeted to that protein and by DNA probes for the gene. This strategy is clearly restricted to proteins nonessential to the survival or pathogenicity of the microorganism. DNA probe detection of the gene is evaded, only if the sequence within the gene to which the DNA probe is targeted is actually eliminated from the microorganism. This is a severe restriction. The countermeasure is simple: employ immunoassays directed to species-specific proteins essential to the survival or pathogenicity of the BW microorganism, of which there are many. This would make this evasion strategy useless.

(2) Altering the DNA sequence of a gene to produce the same or a slightly altered protein that still retains its activity can be accomplished by changing the codons in the gene to other codons for the same amino acid in the protein, or to codons for certain other amino acids in regions of the protein that are not critical for function. This strategy would employ homologous recombination, as described below.

For example, if a DNA probe reads the sequence GGATTGCCGTTCGTTAATC, so the mRNA copy contains the UUC codon (TTC equivalent is in boldface) that codes for the amino acid phenylalanine, the DNA sequence could be changed at the phenylalanine codon site to TTT, whose mRNA copy also codes for phenylalanine. Thus, the DNA sequence has been altered, but the protein remains the same. Several codons in a DNA-probe target sequence would have to be changed in this manner to make the DNA sequence unrecognizable to the DNA probe.

Detection by immunoassay would not be prevented by codon changes that leave the target protein unchanged. Alteration of the protein is necessary to evade immunoassay. A considerable amount of experimentation would be necessary to determine what amino acid changes are permissible for the retention of protein activity, and these changes would often not coincide with the amino acids targeted by the immunoassay. However, since immunoassays are much less sensitive than DNA probe assays, detection of BW microorganisms in the environment might be successfully evaded by a strategy that addresses only DNA targets.

Implementing such a strategy would be difficult for a number of reasons. For a single DNA probe not to recognize its target sequence, at least one-in-ten to one-in-fifteen bases have to be altered, which, for example, amounts to two to three base and codon alterations to evade identification by a short probe of length 30 bases.

Furthermore, different organisms are adapted to use some codons efficiently and others inefficiently. In fact, if a codon that is rarely used in a species is inadvertently substituted, the protein may not be synthesized at all, or synthesized only at low levels⁽¹³⁾ It is unclear whether codon changes to less-used, but not rare, codons would have an observable effect on protein synthesis. However, changing several codons in several genes by homologous recombination (see below), besides being a difficult task, may severely affect the viability and pathogenicity of a BW microorganism.

Potential countermeasures are to have available a number of DNA probes for a number of gene targets, preferably genes involved in pathogenicity, and to make sure that the target sequences contain codons that are frequently used, so that codon alterations will frequently have to substitute less- or rarely-used codons, thereby potentially decreasing the viability and the usefulness of the BW agent. Another countermeasure is to utilize the probes under lower stringency conditions, where they can read target sequences with slightly more than one-in-ten base changes. Lower stringency increases the potential for false positives, which may make this countermeasure unacceptable, except as an indicator of the need for further evidence. However, since stringency is a "continuous variable," it may be possible to find analysis conditions where false positives are minimized, and detection of codon alterations is possible.

A strategy to evade detection using RFLP analysis is to change the length of the species-specific DNA fragments identified in the analysis. Using transposable elements, fragment lengths might be readily changed; for that reason, RFLP analysis is probably not acceptable for BW agent identification.

Utilizing the native homologous recombination process in bacteria is the strategy of choice for eliminating, altering or replacing a gene with another gene. It is worthwhile to examine this procedure in order to estimate the work involved in disguising a BW microorganism⁽¹⁴⁾. In homologous recombination, a large genomic DNA segment (e.g., a gene) is replaced by a similar DNA segment, which for evasion purposes might contain a "nonsense" piece of DNA or a codon-altered gene to replace the genomic DNA segment. For homologous recombination to take place, the replacement DNA must contain DNA sequences identical to those flanking the genomic DNA segment to be replaced. We call this replacement DNA the "donor" DNA. For a well-studied microorganism such as E. coli, starting with only 10 ml of E. coli cells, several bacterial colonies with incorporated donor DNA can be produced in a day.

While the recombination event itself can be accomplished with relative ease, preparation of the donor DNA is time consuming. Homologous recombination is a rare event, so some selection criteria must be built into the donor DNA. The usual selection is to include a gene for antibiotic resistance to antibiotics such as ampicillin or tetracycline in the donor DNA, so that only cells that have incorporated the donor DNA will grow in the presence of the antibiotic. (A similar and slightly simpler procedure can employ antibiotic sensitivity for selection.)

The donor DNA is, therefore, a complicated construct. On both ends, it has flanking sequences identical to the flanking sequences present in the gene to be replaced, it has between these flanking sequences an antibiotic resistance gene and a DNA segment (altered gene or "nonsense" DNA). The potential violator must first locate, and then sequence, a region around and including the target for the DNA probe to obtain the required flanking and gene sequences for the donor DNA construct. This is a time consuming task.

For each donor DNA incorporated, either a different antibiotic resistance gene must be used, or the antibiotic resistance gene must be eliminated before selecting for incorporation of another donor DNA. To replace twenty genes to evade batteries of immunoassays or DNA probes would be perhaps a two-year task for experts in E. coli, where these procedures are well worked out. It is unclear how long it would take to accomplish this task, or even if the task could be accomplished, in the much less studied BW microorganisms. At best, it is bound to be an expensive and lengthy proposition.

Whether substitutions of alternative codons would result in reduced viability that would affect the delivery and pathogenicity of a BW agent is likely to be dependent on all the specifics of the situation. It is therefore difficult to generalize on this subject; only studies designed for each BW microorganism and its weaponization can begin to address the utility of this means of evasion. Since it seems that evasion of detection by changing codons is a tenuous strategy at best, and difficult to implement, it is unclear whether studies to determine the utility of this evasion strategy should even be contemplated, at present.

(3) Adding a single new gene to a nonpathogenic microorganism to make it a BW agent is probably the strategy easiest to implement and the one with the most potential for evasion. For example, a gene for a protein toxin could be inserted into a nonpathogenic microorganism or a weak pathogen that was not on the list of agents for which identification methods had been developed. The recombinant microorganism would not be identified as a BW agent even by batteries of DNA probes, immunoassays, or standard chemical analyses targeted to BW molecules that are not the protein toxin. Furthermore, the inserted toxin gene would not be identified if codons in the gene were changed to evade DNA probes directed to the toxin gene.

To insert the gene for a protein toxin is standard fare for recombinant DNA technology. Inefficient homologous recombination is not required. To change codons in one gene would not be prohibitively difficult. Immunoassays directed to the toxin protein, however, would not be evaded.

As a countermeasure against insertion of simple protein toxins, besides developing sensitive immunoassays (see Annex II), the Inspectorate could develop a battery of probes against each known toxin gene, including probes that target genes with altered codons. Testing for all substituted codons should be possible using the new DNA microchip technologies that can employ short DNA probes of fifteen bases in length (that is, only five codons). For appropriately chosen codon sets, typically only 100 different DNA probes would cover all possible codon substitutions. Of course, the utilization of new methodologies brings about new issues, evasion scenarios and countermeasures that will need to be thought through.

(4) Adding several new genes to a non-pathogenic organism is a considerably more difficult task than adding a single protein toxin gene. To insert genes for enzymes that are capable of carrying out the many chemical steps usually required for the synthesis of small molecules (e.g., non-protein toxins) requires a good understanding of the biochemical pathways involved, and how those pathways can be integrated into and not interfere with existing pathways in the microorganism. This information is not presently available in most cases of interest. In addition, to regulate the amounts of enzyme synthesized from each inserted gene requires very sophisticated genetic engineering. This capability is at the cutting-edge of genetic engineering; it would require a great deal of original work, with no guarantee of success. Furthermore, development of safety measures and weaponization of such an organism would require extensive study and field testing. In any case, immunoassays and/or chemical analyses for nonprotein toxins and other relevant small molecules will likely be developed and will serve as countermeasures. DNA probes and immunoassays could also be developed for critical enzymes in the synthesis pathways.

To make an entirely new BW agent by converting a nonpathogenic organism into a pathogen is considerably more problematic. The physiology of pathogenesis is complex and not well understood. It is highly unlikely that making an entirely new agent can be accomplished. Moreover, a newly-created pathogen would require basic study from the ground up; its properties and biological effects could not be predicted.

The evasion strategies, problems in their implementation, and countermeasures are summarized in Table I.

Evasion Strategy	Development Problems	Possible Countermeasures
Knock out a nonessential gene to evade detection with DNA probes or immunoassay for the corresponding protein	Only feasible for nonessential genes; requires advanced genetic engineering; long and tedious	Utilize assays for essential genes and their products, or conduct fatty-acid profiles
Substitute codons, or alter ribosomal RNA	A genetically modified pathogen would have uncertain viability and pathogenicity; requires advanced genetic engineering methods; long and tedious	Develop several DNA probes and antibodies for multiple genes and their products; perform lower stringency testing with DNA probes; do fatty-acid profiles
Insert gene for a protein toxin into the genome of a non-pathogenic microorganism	A genetically modified microorganism would have uncertain virulence; possible difficulties in weaponization	Utilize DNA probes to toxin genes and codon-substituted genes plus immunoassays for toxins;
Insert multiple genes for synthesis of non-protein toxin into the genome of a nonpathogenic microorganism	Requires advanced genetic engineering and extensive basic research	Utilize DNA probes to genes for enzymes in biosynthetic pathway; do immunoassays and chemical analysis for nonprotein toxins

Table I. Summary of evasion strategies, development problems, and countermeasures based on molecular biology.

Evasion Scenarios Based on Cleanup

Can a violator evade detection through sampling and analysis by cleaning up a facility on short notice? There are two components to this question: What is the time required to clean up a facility between notification of an inspection and the inspection? Would BW agents or identifiable residues remain after clean-up?

While these questions probably have not been put to a test in controlled experiments designed specifically to address BWC issues, current industry practice can provide partial answers. The questions are not independent; and here, they will be dealt with together.

There are a number of parameters that can influence the answers to the questions:

Type of BW agent

Nature of the target for the analysis method

Degree of containment

Particulars of the facility

These are discussed briefly below:

Type of BW agent. For BW microorganisms that are human pathogens, care will usually be taken to keep the microorganism contained to prevent contamination of the facility. For plant and animal pathogens less care might be taken to keep the facility uncontaminated, since these agents pose no threat to the humans working in the facility. Even with human pathogens, immunization of workers makes it possible to work with minimal containment, as practiced in Iraq and other places in the past.

Nature of the target for the analysis method. If the target for analysis is DNA or non-protein molecules, they may survive standard sterilization procedures such as autoclaving. Thus, if containment is routinely "broken" after sterilization, because there is no threat from the killed BW agent, evidence of its presence in the form of DNA or non-protein molecules may be easy to find in the facility. Although breaking containment after sterilization may not be routine for commercial microorganisms in a state-of-the-art pharmaceutical facility, it could be routine in less well-equipped facilities in a developing country.

Degree of containment (contamination of the environment). While modern GMP facilities strive for perfect containment, older facilities--especially those designed for purposes that required little containment--may become contaminated more easily. In the rush to clean up such a facility in anticipation of an inspection, it is possible to overlook contaminated areas. The inspectors, however, would have to be lucky enough to sample the contaminated, uncleaned area. If special chemicals and enzymes are used to destroy DNA, discovery of quantities of these in a facility might create suspicion of a violation, depending on the declared use of the facility. This is an example of a situation where the possibility of analysis might cause a violator to take an action that in itself creates suspicion.

Even in modern pharmaceutical facilities containment can be imperfect. For example, in a trial inspection in the UK, DNA probes detected DNA from a microorganism outside a state-of-the art fermenter, although no live microorganisms were found (comment in Workshop). It was speculated that the detected DNA came from leaks in the steam-condensate system. We can therefore assume that on occasion evidence of BW microorganisms may be found due to imperfections in the equipment. Furthermore, there is always a reasonable probability of finding residues of past production operations in pipe joinings, and these could be investigated if there were strong collateral evidence of violation. In addition, inspectors will look for evidence of a fresh cleanup, such as: new HEPA filters throughout, synchrony of operations (all started about the same time, after notification), absence of some materials (e.g., empty seed stock storage facilities), contents of the waste stream (disinfectant load, absence of microorganism residues), etc.

If inspectors were to find a modern, high-containment facility where the declared use did not indicate the need, that in itself would be cause for suspicion. This is another example where the possibility of analysis might cause a violator to take an action that in itself creates suspicion.

Particulars of the facility. There are a number of particulars that might influence the likelihood of contamination, the ability to clean up a facility, and the time required. Among them are: size of the facility, whether its location is isolated or in a populated area, whether the nation can afford or has the technical expertise to maintain and manage properly a high-containment facility, whether the nation is able to obtain appropriate replacement equipment, and the intended use for which the facility was constructed.

Conclusions

Modern molecular biology provides a number of strategies for evasion of detection by DNA-probe and immunoassay methods. Most evasion strategies require considerable effort, and countermeasures are available. Batteries of tests directed to different targets for each analysis method is a good generic countermeasure to make evasion more difficult. Even though only a few tests from a battery might be used at a particular site, a potential violator would need to have disguised most of the targets to ensure successful evasion--a daunting task. It would seem easier to attempt to avoid detection by cleaning a facility in anticipation of an inspection.

The one exception is the engineering of a single protein toxin into an exempt microorganism. The required genetic engineering is standard, and the inserted gene can be extensively modified to avoid detection from the most sensitive method, DNA probes--unless extensive countermeasures are undertaken. The protein, however, may be detected by immunoassay. This is an example of the value of orthogonal analysis methods: while one type of test is evaded, another type is not. Toxins are, however, different from infectious agents in one major respect: the amounts of toxin required for military purposes are orders of magnitude greater than the amounts of infectious agents. This difference in scale makes production, storage and weaponization much more vulnerable to detection; and in particular, less sensitive analysis methodologies might be acceptable. In this regard, toxins are more like other chemical warfare agents than infectious agents, and are covered by the Chemical Weapons Convention.

The alteration of families of non-protein molecules, such as fatty acids, would require considerable genetic engineering, and the significant alteration needed to avoid identification of the BW microorganisms by standard chemical methods would likely be lethal to the cell. Families of non-protein molecules, therefore, are appealing targets. The one drawback of standard chemical methods is that they do not approach the sensitivity of DNA probe analysis, or even the sensitivity of immunoassay.

Devising evasion scenarios and countermeasures based on molecular biology is a game that probably will not be played in the near future. The specific targets for analysis methods have not yet been identified, for instance; so real evasion strategies cannot be implemented. Evasion scenarios, other than the obvious ones discussed here, can probably be devised. And if the present discussion can serve as an example, countermeasures can probably be devised. In any event, no matter what evasion strategy is implemented, virulence testing in animals and plants is a powerful last resort.

Modern high-containment facilities can usually be thoroughly cleaned up in only a few hours, less than the time between notification of an inspection and the arrival of the inspection team. It is likely that most other facilities can be cleaned up in a few days. It is anticipated, however, that in the rush to clean up before an inspection, mistakes may be made that will leave identifiable residues of BW microorganisms (the "smoking gun"). The probability will be much higher that such residues can actually be identified if there is some idea of the organisms to look for. Just the possibility of sampling and analysis could lead to the employment of enzymes (e.g., nucleases and proteases) and chemicals that, if discovered, might provide evidence of a cleanup that is inconsistent with the declared use of the facility. Such suspicious evidence would "cast a spotlight" on that nation and facility, making continued violation of the BWC even more difficult.

End Notes

1. See Annex on Sample Analysis in "Beyond Verex: A Legally-Binding Compliance Regime for the Biological Weapons Convention," Report of the Federation of American Scientists Working Group on BW Verification, July 1994.

2. "Sampling and Analysis of Proprietary Microorganisms while Protecting Confidential Proprietary Information," Federation of American Scientists Working Group on BW Verification, Pugwash Workshop on Strengthening the BWC, December 1995

3. See "New Approaches to Microorganism Identification," Federation of American Scientists, November 1995.

4. Stephen S. Morse, Workshop presentation.

5. OV Norkina, et al. (1994), J Appl Bacteriol (UK), 76, p240-245. J Hinnebusch and TG Schwan (1993), J Clin Microbiol, 31, p1551-14.

6. W Beyer et al.(1995) Microbiol Res (GERMANY), 150, p179-86.

7. W Beyer et al (1995), Microbiol Res (GERMANY), 150, p179-86.

8. TC Reif, et al.(1994), Appl Environ Microbiol (US), 60, p1622-5.

9. Dr. David Bing, Vice President, Center for Blood Research, Inc., personal communication.

10. IM Klimova, (1989), Zh Mikrobiol Epidemiol Immunobiol (USSR), Jul 1989, p62-66.

11. T Sano, C Smith and C Cantor (1993), Science 258, p120-122.

12. A recent review can be found in AB Onderdonk and M Sasser (1995), In "Manual of Clinical Microbiology", Sixth Edition, Editors: PR Murray, EJ Baron, MA Phaller, FC Tenover, RH Yolken, ASM Press, Washington DC.

13. M Seidman, Chief Scientist, Codon, Inc., personal communication; and BJ Del Tito BJ Jr., et al. (1995), J. Bacteriol (US), 177, p7086-91.

14. The following general procedure derives from Dr. Peter Glazer (Yale University Medical School), an expert on this technique.

***************

ANNEX I

The following is an excerpt from the monograph written by Stephen S. Morse that appears as the Annex to "New Approaches to Microorganism Identification," Federation of American Scientists, November 1995.

"There is a considerable literature on use of PCR with suboptimal samples, including archeological or paleontological material of great age (reviewed in Paabo, 1990; see also his monograph Ancient DNA, Springer-Verlag, 1994), and samples that have been subjected to autoclaving (Barry and Gannon, 1991), or treated with formalin, paraformaldehyde, glutaraldehyde, or solvents (reviewed in Greer et al., 1995; Jackson et al., 1991).

"Under most conditions, DNA is not destroyed by autoclaving, so conventionally heat-sterilized samples are often likely to be usable for analysis (Barry and Gannon, 1991). A number of solvents, alcohols and phenolic compounds, detergents, or chaotropic agents, in various combinations, are frequently used for chemical sterilization or decontamination. Since a number of these compounds are used to purify nucleic acids from tissues, many of the widely used solvents (for example, ethanol, acetone, chloroform, phenolics, etc.) would not prevent nucleic acid amplification and identification, although they may inhibit the reactions if not removed during sample preparation. Finally, samples treated with active aldehydes (e.g., formalin, paraformaldehyde, gluteraldehyde, etc.), a class of agents frequently, and effectively, used for chemical sterilization, are also often usable for DNA amplification and identification, as suggested by extensive experience with archived pathological specimens and slides (Greer et al., 1995; Jackson et al., 1991). Some studies have suggested that mercurials also may not necessarily render the DNA of a sample unusable (Jackson, 1991). On the other hand, it is likely that certain inactivating treatments (agents known to damage nucleic acids drastically, such as harsh oxidizing agents, incineration, some treatments under highly acidic conditions, nucleases, intense ionizing radiation or short-wave ultraviolet light, and, for RNA, highly alkaline conditions) will probably make nucleic acid analysis impossible."

References

T Barry and F Gannon (1991), PCR Meth Applic, 1, p75.

C Greer, C Wheeler, and M Manos (1995), In: PCR Primer. A Laboratory Manual, ed. C Dieffenbach and G Dveksler, Cold Spring Harbor, NY: Cold Spring Harbor Laboratory Press, p99-112.

D Jackson, J Hayden, and P Quirke (1991), In: PCR. A Practical Approach, ed. M McPherson, P Quirke and F Taylor, Oxford: IRL Press at Oxford University Press, p29-50.

S Paabo (1990), In: PCR Protocols, ed. M Innis, D Gelfand, J Sninsky and T White, San Diego: Academic Press, p159-166.

**********

ANNEX II

INCREASING THE SENSITIVITY OF IMMUNOASSAYS

Calculation of Expected Detection Limit for High-Affinity Monoclonal Antibodies

from the Dissociation Constant

Monoclonal antibodies can have very high affinity, with dissociation constants as small as K_d~10^-11molar. This high affinity translates to 50% of the protein or nonprotein target bound, and therefore detectable, when target is present at a concentration of