Scientists Discuss Forensic Process Used To Track Down Anthrax Strain In 2001 Letter Attacks

It took nearly a decade before University of Maryland researchers were allowed to talk about their work identifying the anthrax strain used in the 2001 deadly letter attacks. But now, they and the other key members of the high-powered science team have published the first account of the pioneering work, which launched the new field of “microbial forensics” and gave bioterrorism investigators a way to “fingerprint” bacteria.

The current online Early Edition of the Proceedings of National Academy of Sciences (PNAS) details the multi-institutional research that the FBI ultimately used to track anthrax-laden letters back to test tube number RMR-1029 at a lab in Fort Detrick, Maryland.

University of Maryland bioinformatics experts co-authored the article and conducted the computational analysis that detected four genetic mutations that together comprised a unique signature of a particular colony of anthrax bacteria. The FBI subsequently determined this colony was found only in that Ft. Detrick test tube.

The Maryland researchers have since developed their work into a genetic ‘fingerprinting’ tool that is available online to law enforcement seeking to track down other microbial suspects.

“We found unique bio-markers to help investigators track down the source of the anthrax,” said Steven Salzberg, director of the University of Maryland Center for Bioinformatics and Computational Biology (CBCB). “At first the tiny mutations were elusive. We thought we’d pieced together the ‘jigsaw puzzle’ of data very neatly, until we ended up with a few oddball bits left over. When we looked more closely, we found an extra copy of a critical gene.”

“Fortunately, anthrax bacteria mutate relatively slowly, so the material in this colony developed these small distinctive mutations that resulted in physically distinct characteristics,” said Mihai Pop, Salzberg’s CBCB colleague and article co-author. “If you isolate a colony of bacteria in a test tube, they’ll slowly accumulate random mutations that make them distinct from any other samples of the same type of bacteria.”

“Our colleagues at the University of Maryland School of Medicine’s Institute for Genome Sciences sequenced the DNA of the bacterial samples provided by the FBI. Then, using computational analysis, we identified four tiny changes in the DNA structure that the FBI could use as a fingerprint in their investigation.”

Working on a sensitive, high-profile project involving national security turned out to be nothing like Salzberg expected. It was 2001, several letters with anthrax powder had been sent to Capitol Hill and various media outlets. Five people had died and 19 more were sickened. The FBI asked Salzberg, Pop and their colleagues to analyze samples of the powdered anthrax in the letters.

“We mainly got blind samples -- most of the time we had no idea of the material’s origin,” Salzberg said. “Our job was to comb through the DNA sequence data and puzzle out the genetic structure. When we’d done it, we handed our report to the FBI, and they simply said, ‘Thank you. You’ve been a great help.’ We heard almost nothing for five years, which was frustrating at times. We wanted to ask, ‘How did this help?’”

Subsequently, the FBI concluded that only anthrax samples from test tube RMR-1029 at Ft. Detrick had the identical genetic structure with the anthrax powder sent through the U.S. mail. These samples shared the four quirks identified by the University of Maryland computational biology team.

Last month, a team of top scientists assembled by the National Research Council reviewed the FBI’s investigation -- at the FBI’s request. The report found no fault with the science. However, it did challenge the FBI’s interpretation and use of it, concluding, “The scientific link between the letter material and flask RMR-1029 is not as conclusive as stated in the Department of Justice Investigative summary.”

The researchers’ 2001 work, in effect, launched a new field of microbial forensics, the study reports.

“Before the anthrax letter attacks of 2001, the developing field of microbial forensics relied on microbial genotyping schemes based on a small portion of a genome sequence. Amerithrax, the investigation into the anthrax letter attacks, applied high-resolution whole-genome sequencing and comparative genomics….This study demonstrates the forensic value of systematic microbiological analysis combined with whole-genome sequencing and comparative genomics,” according to the PNAS article.

“Ten years ago, the team broke new ground, and in the intervening years we’ve developed this into a standard tool that law enforcement and anti-terror agencies can use on their own,” Salzberg said. “We recently finished a project for the U.S. Department of Homeland Security, producing an online, open-source tool that agencies can download and use to fingerprint microbes used in attacks.”

The tool Salzberg’s team created is called Insignia and is located on the CBCB site to give agencies easy access: http://insignia.cbcb.umd.edu/

The University of Maryland Center for Bioinformatics and Computational Biology is a multidisciplinary center dedicated to research on questions arising from the genome revolution. CBCB brings together scientists and engineers from many fields, including computer science, molecular biology, genomics, genetics, mathematics, statistics, and physics -- and works with many other institutions, including the National Institutes of Health, the University of Maryland Medical School and John's Hopkins University, all sharing a common interest in gaining a better understanding of how life works.

The Center for Bioinformatics and Computational Biology is organized as a center within the University of Maryland Institute for Advanced Computer Studies (UMIACS), an interdisciplinary research institute supporting high-performance computing research across the College Park campus.

Featured

  • AI Is Now the Leading Cybersecurity Concern for Security, IT Leaders

    Arctic Wolf recently published findings from its State of Cybersecurity: 2025 Trends Report, offering insights from a global survey of more than 1,200 senior IT and cybersecurity decision-makers across 15 countries. Conducted by Sapio Research, the report captures the realities, risks, and readiness strategies shaping the modern security landscape. Read Now

  • Analysis of AI Tools Shows 85 Percent Have Been Breached

    AI tools are becoming essential to modern work, but their fast, unmonitored adoption is creating a new kind of security risk. Recent surveys reveal a clear trend – employees are rapidly adopting consumer-facing AI tools without employer approval, IT oversight, or any clear security policies. According to Cybernews Business Digital Index, nearly 90% of analyzed AI tools have been exposed to data breaches, putting businesses at severe risk. Read Now

  • Software Vulnerabilities Surged 61 Percent in 2024, According to New Report

    Action1, a provider of autonomous endpoint management (AEM) solutions, today released its 2025 Software Vulnerability Ratings Report, revealing a 61% year-over-year surge in discovered software vulnerabilities and a 96% spike in exploited vulnerabilities throughout 2024, amid an increasingly aggressive threat landscape. Read Now

  • Motorola Solutions Named Official Safety Technology Supplier of the Ryder Cup through 2027

    Motorola Solutions has today been named the Official Safety Technology Supplier of the 2025 and 2027 Ryder Cup, professional golf’s renowned biennial team competition between the United States and Europe. Read Now

  • Evolving Cybersecurity Strategies

    Organizations are increasingly turning their attention to human-focused security approaches, as two out of three (68%) cybersecurity incidents involve people. Threat actors are shifting from targeting networks and systems to hacking humans via social engineering methods, living off human errors as their most prevalent attack vector. Whether manipulated or not, human cyber behavior is leveraged to gain backdoor access into systems. This mainly results from a lack of employee training and awareness about evolving attack techniques employed by malign actors. Read Now

New Products

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge.

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.