Scientists Discuss Forensic Process Used To Track Down Anthrax Strain In 2001 Letter Attacks

It took nearly a decade before University of Maryland researchers were allowed to talk about their work identifying the anthrax strain used in the 2001 deadly letter attacks. But now, they and the other key members of the high-powered science team have published the first account of the pioneering work, which launched the new field of “microbial forensics” and gave bioterrorism investigators a way to “fingerprint” bacteria.

The current online Early Edition of the Proceedings of National Academy of Sciences (PNAS) details the multi-institutional research that the FBI ultimately used to track anthrax-laden letters back to test tube number RMR-1029 at a lab in Fort Detrick, Maryland.

University of Maryland bioinformatics experts co-authored the article and conducted the computational analysis that detected four genetic mutations that together comprised a unique signature of a particular colony of anthrax bacteria. The FBI subsequently determined this colony was found only in that Ft. Detrick test tube.

The Maryland researchers have since developed their work into a genetic ‘fingerprinting’ tool that is available online to law enforcement seeking to track down other microbial suspects.

“We found unique bio-markers to help investigators track down the source of the anthrax,” said Steven Salzberg, director of the University of Maryland Center for Bioinformatics and Computational Biology (CBCB). “At first the tiny mutations were elusive. We thought we’d pieced together the ‘jigsaw puzzle’ of data very neatly, until we ended up with a few oddball bits left over. When we looked more closely, we found an extra copy of a critical gene.”

“Fortunately, anthrax bacteria mutate relatively slowly, so the material in this colony developed these small distinctive mutations that resulted in physically distinct characteristics,” said Mihai Pop, Salzberg’s CBCB colleague and article co-author. “If you isolate a colony of bacteria in a test tube, they’ll slowly accumulate random mutations that make them distinct from any other samples of the same type of bacteria.”

“Our colleagues at the University of Maryland School of Medicine’s Institute for Genome Sciences sequenced the DNA of the bacterial samples provided by the FBI. Then, using computational analysis, we identified four tiny changes in the DNA structure that the FBI could use as a fingerprint in their investigation.”

Working on a sensitive, high-profile project involving national security turned out to be nothing like Salzberg expected. It was 2001, several letters with anthrax powder had been sent to Capitol Hill and various media outlets. Five people had died and 19 more were sickened. The FBI asked Salzberg, Pop and their colleagues to analyze samples of the powdered anthrax in the letters.

“We mainly got blind samples -- most of the time we had no idea of the material’s origin,” Salzberg said. “Our job was to comb through the DNA sequence data and puzzle out the genetic structure. When we’d done it, we handed our report to the FBI, and they simply said, ‘Thank you. You’ve been a great help.’ We heard almost nothing for five years, which was frustrating at times. We wanted to ask, ‘How did this help?’”

Subsequently, the FBI concluded that only anthrax samples from test tube RMR-1029 at Ft. Detrick had the identical genetic structure with the anthrax powder sent through the U.S. mail. These samples shared the four quirks identified by the University of Maryland computational biology team.

Last month, a team of top scientists assembled by the National Research Council reviewed the FBI’s investigation -- at the FBI’s request. The report found no fault with the science. However, it did challenge the FBI’s interpretation and use of it, concluding, “The scientific link between the letter material and flask RMR-1029 is not as conclusive as stated in the Department of Justice Investigative summary.”

The researchers’ 2001 work, in effect, launched a new field of microbial forensics, the study reports.

“Before the anthrax letter attacks of 2001, the developing field of microbial forensics relied on microbial genotyping schemes based on a small portion of a genome sequence. Amerithrax, the investigation into the anthrax letter attacks, applied high-resolution whole-genome sequencing and comparative genomics….This study demonstrates the forensic value of systematic microbiological analysis combined with whole-genome sequencing and comparative genomics,” according to the PNAS article.

“Ten years ago, the team broke new ground, and in the intervening years we’ve developed this into a standard tool that law enforcement and anti-terror agencies can use on their own,” Salzberg said. “We recently finished a project for the U.S. Department of Homeland Security, producing an online, open-source tool that agencies can download and use to fingerprint microbes used in attacks.”

The tool Salzberg’s team created is called Insignia and is located on the CBCB site to give agencies easy access: http://insignia.cbcb.umd.edu/

The University of Maryland Center for Bioinformatics and Computational Biology is a multidisciplinary center dedicated to research on questions arising from the genome revolution. CBCB brings together scientists and engineers from many fields, including computer science, molecular biology, genomics, genetics, mathematics, statistics, and physics -- and works with many other institutions, including the National Institutes of Health, the University of Maryland Medical School and John's Hopkins University, all sharing a common interest in gaining a better understanding of how life works.

The Center for Bioinformatics and Computational Biology is organized as a center within the University of Maryland Institute for Advanced Computer Studies (UMIACS), an interdisciplinary research institute supporting high-performance computing research across the College Park campus.

Featured

  • Maximizing Your Security Budget This Year

    Perimeter Security Standards for Multi-Site Businesses

    When you run or own a business that has multiple locations, it is important to set clear perimeter security standards. By doing this, it allows you to assess and mitigate any potential threats or risks at each site or location efficiently and effectively. Read Now

  • New Research Shows a Continuing Increase in Ransomware Victims

    GuidePoint Security recently announced the release of GuidePoint Research and Intelligence Team’s (GRIT) Q1 2024 Ransomware Report. In addition to revealing a nearly 20% year-over-year increase in the number of ransomware victims, the GRIT Q1 2024 Ransomware Report observes major shifts in the behavioral patterns of ransomware groups following law enforcement activity – including the continued targeting of previously “off-limits” organizations and industries, such as emergency hospitals. Read Now

  • OpenAI's GPT-4 Is Capable of Autonomously Exploiting Zero-Day Vulnerabilities

    According to a new study from four computer scientists at the University of Illinois Urbana-Champaign, OpenAI’s paid chatbot, GPT-4, is capable of autonomously exploiting zero-day vulnerabilities without any human assistance. Read Now

  • Getting in Someone’s Face

    There was a time, not so long ago, when the tradeshow industry must have thought COVID-19 might wipe out face-to-face meetings. It sure seemed that way about three years ago. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity

Webinars

New Products

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3