Scientists Discuss Forensic Process Used To Track Down Anthrax Strain In 2001 Letter Attacks

It took nearly a decade before University of Maryland researchers were allowed to talk about their work identifying the anthrax strain used in the 2001 deadly letter attacks. But now, they and the other key members of the high-powered science team have published the first account of the pioneering work, which launched the new field of “microbial forensics” and gave bioterrorism investigators a way to “fingerprint” bacteria.

The current online Early Edition of the Proceedings of National Academy of Sciences (PNAS) details the multi-institutional research that the FBI ultimately used to track anthrax-laden letters back to test tube number RMR-1029 at a lab in Fort Detrick, Maryland.

University of Maryland bioinformatics experts co-authored the article and conducted the computational analysis that detected four genetic mutations that together comprised a unique signature of a particular colony of anthrax bacteria. The FBI subsequently determined this colony was found only in that Ft. Detrick test tube.

The Maryland researchers have since developed their work into a genetic ‘fingerprinting’ tool that is available online to law enforcement seeking to track down other microbial suspects.

“We found unique bio-markers to help investigators track down the source of the anthrax,” said Steven Salzberg, director of the University of Maryland Center for Bioinformatics and Computational Biology (CBCB). “At first the tiny mutations were elusive. We thought we’d pieced together the ‘jigsaw puzzle’ of data very neatly, until we ended up with a few oddball bits left over. When we looked more closely, we found an extra copy of a critical gene.”

“Fortunately, anthrax bacteria mutate relatively slowly, so the material in this colony developed these small distinctive mutations that resulted in physically distinct characteristics,” said Mihai Pop, Salzberg’s CBCB colleague and article co-author. “If you isolate a colony of bacteria in a test tube, they’ll slowly accumulate random mutations that make them distinct from any other samples of the same type of bacteria.”

“Our colleagues at the University of Maryland School of Medicine’s Institute for Genome Sciences sequenced the DNA of the bacterial samples provided by the FBI. Then, using computational analysis, we identified four tiny changes in the DNA structure that the FBI could use as a fingerprint in their investigation.”

Working on a sensitive, high-profile project involving national security turned out to be nothing like Salzberg expected. It was 2001, several letters with anthrax powder had been sent to Capitol Hill and various media outlets. Five people had died and 19 more were sickened. The FBI asked Salzberg, Pop and their colleagues to analyze samples of the powdered anthrax in the letters.

“We mainly got blind samples -- most of the time we had no idea of the material’s origin,” Salzberg said. “Our job was to comb through the DNA sequence data and puzzle out the genetic structure. When we’d done it, we handed our report to the FBI, and they simply said, ‘Thank you. You’ve been a great help.’ We heard almost nothing for five years, which was frustrating at times. We wanted to ask, ‘How did this help?’”

Subsequently, the FBI concluded that only anthrax samples from test tube RMR-1029 at Ft. Detrick had the identical genetic structure with the anthrax powder sent through the U.S. mail. These samples shared the four quirks identified by the University of Maryland computational biology team.

Last month, a team of top scientists assembled by the National Research Council reviewed the FBI’s investigation -- at the FBI’s request. The report found no fault with the science. However, it did challenge the FBI’s interpretation and use of it, concluding, “The scientific link between the letter material and flask RMR-1029 is not as conclusive as stated in the Department of Justice Investigative summary.”

The researchers’ 2001 work, in effect, launched a new field of microbial forensics, the study reports.

“Before the anthrax letter attacks of 2001, the developing field of microbial forensics relied on microbial genotyping schemes based on a small portion of a genome sequence. Amerithrax, the investigation into the anthrax letter attacks, applied high-resolution whole-genome sequencing and comparative genomics….This study demonstrates the forensic value of systematic microbiological analysis combined with whole-genome sequencing and comparative genomics,” according to the PNAS article.

“Ten years ago, the team broke new ground, and in the intervening years we’ve developed this into a standard tool that law enforcement and anti-terror agencies can use on their own,” Salzberg said. “We recently finished a project for the U.S. Department of Homeland Security, producing an online, open-source tool that agencies can download and use to fingerprint microbes used in attacks.”

The tool Salzberg’s team created is called Insignia and is located on the CBCB site to give agencies easy access: http://insignia.cbcb.umd.edu/

The University of Maryland Center for Bioinformatics and Computational Biology is a multidisciplinary center dedicated to research on questions arising from the genome revolution. CBCB brings together scientists and engineers from many fields, including computer science, molecular biology, genomics, genetics, mathematics, statistics, and physics -- and works with many other institutions, including the National Institutes of Health, the University of Maryland Medical School and John's Hopkins University, all sharing a common interest in gaining a better understanding of how life works.

The Center for Bioinformatics and Computational Biology is organized as a center within the University of Maryland Institute for Advanced Computer Studies (UMIACS), an interdisciplinary research institute supporting high-performance computing research across the College Park campus.

Featured

  • Improve Incident Response With Intelligent Cloud Video Surveillance

    Video surveillance is a vital part of business security, helping institutions protect against everyday threats for increased employee, customer, and student safety. However, many outdated surveillance solutions lack the ability to offer immediate insights into critical incidents. This slows down investigations and limits how effectively teams can respond to situations, creating greater risks for the organization. Read Now

  • Security Today Announces 2025 CyberSecured Award Winners

    Security Today is pleased to announce the 2025 CyberSecured Awards winners. Sixteen companies are being recognized this year for their network products and other cybersecurity initiatives that secure our world today. Read Now

  • Empowering and Securing a Mobile Workforce

    What happens when technology lets you work anywhere – but exposes you to security threats everywhere? This is the reality of modern work. No longer tethered to desks, work happens everywhere – in the office, from home, on the road, and in countless locations in between. Read Now

  • TSA Introduces New $45 Fee Option for Travelers Without REAL ID Starting February 1

    The Transportation Security Administration (TSA) announced today that it will refer all passengers who do not present an acceptable form of ID and still want to fly an option to pay a $45 fee to use a modernized alternative identity verification system, TSA Confirm.ID, to establish identity at security checkpoints beginning on February 1, 2026. Read Now

  • The Evolution of IP Camera Intelligence

    As the 30th anniversary of the IP camera approaches in 2026, it is worth reflecting on how far we have come. The first network camera, launched in 1996, delivered one frame every 17 seconds—not impressive by today’s standards, but groundbreaking at the time. It did something that no analog system could: transmit video over a standard IP network. Read Now

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”