(5) Amerithrax

1

Microbial Forensics

200 nm

WMD Incident Threat Spectrum

Overall Threat is Low

NuclearWeapons

Radio-isotopes

BiologicalToxins

Chemicals Weapons

High

Low

Industrial Chemicals

Biological Pathogens

Biological terrorist threats

Pathogenic viruses, bacteria, fungi and toxins:

–Anthrax

–Smallpox–Plague–Toxins–Tularemia–Foot & Mouth Disease–Enterics

Pre-Event Planning

2

Anthrax infection can occur in three forms:Cutaneous (skin) – 95% of infection casesInhalation – symptoms resemble common cold, often fatalGastrointestinal – consumption of contaminated meat, often fatal

Bacillus anthracis spores can live in soil for many years. Humans can become infected with anthrax by handling products from infected animals or by inhaling anthrax spores from contaminated animal products.

Anthrax

Amerithrax

Five distinct anthrax attacks, Fall 2001Four letters mailed from postal collection box,

Princeton, NJ• Editor, NY Post (9/18/01)

• Tom Brokaw, NBC (9/18/01)

• Senator Tom Daschle (10/09/01)

• Senator Patrick Leahy (10/09/01)

AMI Building contamination, Boca Raton, FL

Bob Stevens died 10/05/01, no envelope/letter

Anthrax victims

Joseph Curseen Jr. and Thomas Morris Jr., both postal workers in Washington; Ottilie Lundgren of Oxford, Conn., the last person to die of anthrax in 2001; Robert Stevens, a photo editor at a supermarket tabloid based in Florida; and Kathy Nguyen, a New York hospital worker.

3

killed five people, sickened 17 others

AMI Building, Boca Raton, Florida

FBI Hazardous Materials Response Teams, AMI Building, Florida 2001

4

Post Event Investigation

“Pre-Event”Event!

Post-Event

What kind of pie?

Who made the pie, where was it made?

Is there a stockpile of pies? WHERE are they?How did they make it, what’s in it andWhat was the equipment they used?The Pie Terrorist

Bioforensic Investigative Challenges in 2001

• No dedicated biocontainment labs, staff or equipment to conduct bioforensic analysis

• No methods to enable handling of biothreat agent powders

• No methods to support traditional forensic analyses of evidence contaminated with a biothreat agent

• No place to receive large quantities or large pieces of evidence contaminated with a biothreat agent

• No established evidence handling, analytical methodologies, quality guidelines, peer review of methodologies or central coordination for bioforensic analyses

Amerithrax

• Investigation focus– Knowledge

– Access

– Laboratory experience

– Motive

16 US Labs – 1,200 employees

5

Inside the warehouse

Interior of Mail Sorting Facility

Large-Scale Mail SearchSpringfield, Virginia

Task: Search for “Daschle-like” letter among 1 million quarantined letters packed in 642 plastic bags in 230 drums (55 gal)

Initial plan: Sort all letters by hand

Estimated time; 1.5 to 2 months

Employed a microbiological sampling approach

First Use of Spore Concentration to Locate Evidence

6

Airflow Air sampler Air handler (HEPA filter) Safety cabinet

Staging

Decon

50 ft

Containment Facility Constructed

Sorting room:83 x 73 x 16 ft6060 ft2

96945 ft3

26 x 22 x 5 m572 m2

2860 m3

15.2 m

Mailbag Sampling Summary

Total bags 642

≥1 cfu 62

≥10 cfu 20

>100 cfu 7

All bags 10 cfu sorted by hand

642 results in 3 days

2.0

4.0

6.0

8.0

10.0

Col

ony

form

ing

units

S4S3S2S1

4:00 5:00 600

Time (PM)

Detection of Airborne Spores Coincident With Finding of Leahy Letter

All four air samplers detect spores

Sealed envelope

Most “pristine” source of spore powder

7

Anthrax Letter

LEAHY LETTER

LEAHY LETTER

8

Letters to “Tom Brokaw NBC TV” and “Editor New York Post”

09-11-01 THIS IS NEXT TAKE PENACILIN NOW DEATH TO AMERICA DEATH TO ISRAEL ALLAH IS GREAT

Photocopying Machine Comparisons with Trash Marks

All four of the recovered anthrax envelopes contained a white, photocopied letter on paper cut to irregular size by trimming one to three edges of the page. The letters to the New York Post and Brokaw contain identical handwritten text, and the letters to Senators Daschle and Leahy likewise contain the same handprinted text. Three “trash marks,” or copy imperfections, of forensic value were found on the letters to Senators Daschle and Leahy, but not on the letters to the New York Post and Brokaw. These trash markings were compared to letters maintained in the FBI Anonymous Threat Letter File and to 1,014 photocopier exemplar sets collected from copy machines located inside or near the vicinity of every known biological laboratory that possessed virulent Ames anthrax in 2001. No matches were found.

1. The author uses dashes ("‐") in the writing of the date "09‐11‐01." Many people use the slash ("/") to separate the day/month/year. 

2. In writing the number one, the author chooses to use a formalized, more detailed version. He writes it as "1" instead of the simple vertical line.

3. The author uses the words "can not," when many people prefer to spell it as one word, "cannot." 

4. The author writes in all upper case block‐style letters. However, the first letter of the first word of each sentence is written in slightly larger upper case lettering. Also, the first letter of all proper nouns (like names) is slightly larger. This is apparently the author's way of indicating a word should be capitalized in upper case lettering. For whatever reason, he may not be comfortable or practiced in writing in lower case lettering.

5. The names and address on each envelope are noticeably tilted on a downward slant from left to right. This may be a characteristic seen on other envelopes he has sent. 

6. The envelopes are of the pre‐stamped variety, the stamps denoting 34 cents, which  are normally available directly from the post office. They are not the 

traditional business size envelopes, but the smaller size measuring approximately 6 1/4" x 3 ½".

Handprinting characteristics

9

Protocol Requirements

Sample Analyses Flow Chart

PowderIssues:Control chargeControl HumidityMaximize yield

OpenLetter

Bacteria IDClassic bacteriology

Strain IDGenetic Engineering

Spore densityCfu/ml

Percentage viabilityDead vs live spores

Particle sizing

Analytical chemistry

InorganicSilica / SilicatesCations and anionsElemental AnalysisIsotope Analyses

OrganicCarbohydratesAgar (Agarobiose)HemeHeadspace

Electron Microscopy (EM)

Scanning EMEDX Analysis

Transmission EM

Twenty Letters With Trenton Postmarks

17050914061103120215100420070816DaschleLeahy1819

Letter07:5507:5607:5608:0908:1108:1408:1408:2308:2408:2808:3010:3510:4010:4110:4110:4110:4110:4110:5411:15

Time (DC)165,000

1,2004,2008,200

3006,1008,3002,3006,4001,400

29,300117,000382,300328,100

1,731,0007,026,300

DaschleLeahy

197,100115,800

cfu (6 x) Letter

1301

200800

cfu

D.C. Sorting machine 1

07 336,20008 1,787,70016 7,937,300

18 429,60019 175,900

cfu after 11 swabbings

D.C. Sorting machine 2

10

ID & Analysis of Contaminated Collection Box

628 sampled: 1 contaminated

All sampling at night

Princeton, NJ

Contact Sampling:Different Surfaces

Floor High in spores & competitors

Walls Low in spores & competitors

11

Data Recording

B. anthracis B. cereus

Top lightingcaptures texture

Data RecordingBottom lightingcaptures hemolysis

B. anthracis B. cereus

Amerithrax

Exosporium

12

Amerithrax

• Scientific support

– USAMRIID – repository for Ames strain

– Los Alamos National Lab – genetic engineering, vaccine resistance

– NSF – funded genetic sequencing

– Woods Hole Oceanographic Institute – radiocarbon dating

– Lawrence Livermore National Lab – radiocarbon dating

– CDC – protective antigens in blood samples

– Sandia National Lab – EM, elemental mapping

– Dugway Proving Ground – production methods

– Northern Arizona University – anthrax isolates

– University of Maryland – agar vs broth

– University of Utah – oxygen/hydrogen isotope ratios in growth media

– The Institute for Genomic Research – DNA sequencing

– Commonwealth Biotechnologies – genetic assays

– Battelle Memorial Institute – particle size

– AFTAC – trace analysis

NBFAC Hub Laboratories at USAMRIID

• BSL-3 Suite USAMRIID

• Virulent Bacillus anthracis (Ames strain)

• Antibiotic and vaccine sensitive

• No known genetic engineering or modifications

• Concentrations and purity known

• Age known

• Manufacturing process known

WHAT DO WE KNOW?

13

WHAT DO WE KNOW?• Manufacturing process known

Agar grown (traces found in particulate)

Water washed (no solvents)

Freeze dried (not spray dried) – low moisture content, absence of additives

Low energy milled – absence of sheared or masticated spores

No additives to enhance aerosolizability (fumed silica or bentonite)

Elemental profile of rehydrated spore

Red = SporeC, Ca, P …Green = Si,

O, Fe …Blue = Carbon

support

Automated X-ray spectral image analysis

• Forensic evidence - tape, ink, fibers, copying process

• Isolate collection from all known labs – 16 US Labs, multiple other countries

• DNA sequencing (5.8 million base pairs)

• Morphological polymorphism effort

• Isotope ratio – inconclusive?

• Handprinting - copy

WHAT DO WE KNOW?

14

2H and 18O Isotopic Distribution

Whole Genome Sequencing

• Sequenced the “wild type” as well as the Morphological variants

– Over 5 million DNA base pairs.

• Identified DNA-based signatures for the variants.

• Developed strain-specific markers.

• Most important evidence linking anthrax to lab

1. Grow spores

2. Isolate colonies

3. Find rare mutants (4)

4. Sequence DNA

5. Develop tests

6. Screen 1013 samples

7. Find samples with same 4

mutants

8. Identify flask

15

Physical / Chemical Signatures

Dr. Stephen J. Hatfill, was the focus of intensive FBI and news media attention in the case beginning in mid-2002, declared his innocence at a news conference outside of his lawyer's office in Virginia. Last June, the Justice Department agreed to pay $4.6 million to settle a lawsuit.

16

Dr. Bruce E. Ivins“Dr. Ivins, who had helped develop an anthrax vaccine to protect American troops, had spent his career waiting for a biological attack. Suddenly, at 55, he was advising the FBI and regaling friends with scary descriptions of the deadly powder, his expertise in demand.” Scott Shane, NY Times, January 3, 2009

BEHAVIORAL ASSESSMENT

Based on the selection of Anthrax as the "weapon" of choice by this individual, the offender:•is likely an adult male•if employed, is likely to be in a position requiring little contact with the public, or other employees. He may work in a laboratory. He is apparently comfortable working with an extremely hazardous material•has likely taken appropriate protective steps to ensure his own safety•has access to a source of Anthrax and possesses knowledge and expertise to refine it. •possesses or has access to some laboratory equipment•has exhibited an organized, rational thought process in furtherance of his criminal behavior•has a familiarity, direct or indirect, with the Trenton, NJ, metropolitan area•did not select victims randomly. He made an effort to identify the correct address, including zip code, of each victim and used sufficient postage to ensure proper delivery of the letters. The offender deliberately "selected" NBC News, the New York Post, and the office of Senator Tom Daschle as the targeted victims (and possibly AMI in Florida). These targets are probably very important to the offender. They may have been the focus of previous expressions of contempt which may have been communicated to others, or observed by others. •is a non‐confrontational person, at least in his public life. He lacks the personal skills necessary to confront others. He chooses to confront his problems "long distance" and not face‐to‐face.  He may hold grudges for a long time

Dr. Ivins still carried resentment from four decades earlier at Lebanon High School in Ohio, where he had been a nerdy, awkward teenager devoted to photography and, even then, to the study of bacteria.In recent years, said Rick Sams, a pharmacologist who had been among Bruce Ivins’s few school friends, Dr. Ivins “shared with me feelings about how he’d been treated in high school. He was bitter about being excluded.”

17

Summary of investigative evidenceimplicating Dr. Ivins

• Opportunity (RMR1029; alone in lab)• Motive (failing vaccine program)• Mental health struggle (“homicidal””sociopath”)• Proximity to source of envelopes (local batch)• Language used in the letters (emails)• Guilty conscious (emails, trash, shifting blame)• History of disguising identity (pseudonyms)• Obsessive behavior (KKG sorority)• Inability to describe/explain his own behavior

By late 2006, investigators had conducted 9,100 interviews, sent out 6,000 grand jury subpoenas and conducted 67 searches.

7 years• 600,000 person hours• 10,000 witness interviews• 6,000 items of potential evidence• 5,750 grand jury subpoenas• 5,730 environmental samples from 60 sites• More than 1,040 individuals scrutinized, 400in-depth• Cooperation of 29 labs (gov’t, academic andcommercial)