Ebola, smallpox, anthrax and many others: the most dangerous microorganisms are strictly regulated<\/a> in the United States. The federal government oversees use of 65 so-called select agents<\/a> with \u201cthe potential to pose a severe threat to public, animal or plant health, or to animal or plant products.\u201d Before scientists can work with them to learn more, find cures or create vaccines, they must meet a long list of conditions. The goal is to keep deadly infectious agents safely under lock and key, where they can\u2019t threaten the general population or fall into the wrong hands.<\/p>\n But even the most physically secure research lab could be the site of a devastating data security breach. As they stand now, information security guidelines<\/a> published by science regulators with regard to select agents lack the critical level of detail needed to protect data effectively.<\/p>\n There has never been as much research<\/a> performed with these pathogens as in the past decade. The sprawl of high containment laboratories has led to a parallel increase in individuals with access to these agents. As of January 2015, approximately 11,000 individuals<\/a> were on the list.<\/p>\n As the amount of research done on these deadly microorganisms continues to grow, the scientific community needs to wise up about information security threats and toughen up its defenses. The stakes are high. The goal is to avoid a data security breach that could, for instance, provide bioterrorists with information they could use to make already dangerous agents even more so.<\/p>\n The government has mandated strong security measures for people working with deadly microorganisms since 2001, subsequent to the anthrax events that followed 9\/11<\/a>.<\/p>\n Today, research has to be reviewed internally by a scientist\u2019s institution to assess whether safety precautions are adequate. In some cases, it\u2019s reviewed externally as well by the National Institutes of Health (NIH<\/a>) (one of the major federal sources of funding for researchers). The NIH takes particular note if potential results could be used for nefarious purposes or if recombined genetic materials<\/a> are to be administered to human beings.<\/p>\n Personnel must pass stringent background checks. Facilities must be inspected for proper containment and physical security. Standard operating procedures must be in place to ensure protection of the agents, scientists, community and environment. All of these precautions are meant to ensure that dangerous pathogens don\u2019t infect anyone and stay safely in the lab.<\/p>\n There are also policies<\/a> in place that curtail how freely researchers can intentionally share information about their work on these dangerous microorganisms.<\/p>\n Since the implementation of the federal government\u2019s first Dual Use Research Policy in 2012<\/a>, the notion that some nonclassified research information may need to be withheld has marked a big change from science\u2019s typical culture of openness. Researchers are used to running studies and experiments, then publishing details and results in freely available peer-reviewed journals.<\/p>\n Never before has the US scientific enterprise been as constrained as it currently is. There is even an ongoing moratorium on so-called gain-of-function experiments<\/a> that involve certain agents potentially capable of causing a pandemic.<\/p>\n Recent safety lapses by government laboratories<\/a> involving anthrax and H5N1 flu prove that despite all precautions, the system is far from perfect. And the bad news is there might be more to worry about \u2013 even if the microbes remain under lock and key and the researchers aren\u2019t deliberately sharing sensitive findings.<\/p>\n Vulnerabilities in information security can directly affect the physical security of dangerous pathogens. For instance, someone gaining access to a computerized key card system could use that information to enter a restricted area.<\/p>\n So-called \u201cdual-use<\/a>\u201d knowledge, which could be used to weaponize some of these agents, is also at risk. In theory, a hacker could gain access to a researcher\u2019s data on how a particular microbe could become more pathogenic: for instance, by increasing its resistance to available therapeutic or prophylactic drugs.<\/p>\n My colleagues and I recently published an article<\/a> in the journal Health Security describing these kinds of vulnerabilities. It was the result of a unique collaboration. I am an associate professor of environmental and occupational health who specializes in biosecurity<\/a>. Nick Lewis came from an information security perspective. And Mark Campbell is a biosafety officer and select agent responsible official at Saint Louis University.<\/p>\n We found that current information security guidelines are inadequate. For instance, government agencies must abide by the Federal Information Security Management Act (FISMA<\/a>), which is considered the gold standard for a risk-based approach. Unfortunately, current government-mandated information security around dangerous pathogens does not meet even the lowest standard of the act. One example: FISMA specifies how to configure a firewall in great detail<\/a>; on the other hand, select agent information security guidelines mention firewalls, but don\u2019t specify how to configure or manage the firewall securely.<\/p>\n Understanding of the threats unique to the academic and research environment is still evolving. There\u2019s very poor communication between the scientific community, the security community and the information technology community.<\/p>\n Scientists themselves are largely uneducated in matters of information security. For instance, many remain unaware that they might be targeted to divulge sensitive information through a variety of stealth tactics. Since advances in science often depend on open communication and sharing data, scientists aren\u2019t trained to be wary of inquiries about their work.<\/p>\n Many also don\u2019t recognize that shared computer systems and laboratory equipment capable of storing or transmitting data \u2013 from microscopes with digital photography capability to freezers that send emails when temperatures are too high \u2013 are sources of vulnerabilities. After all, everything connected to a computer network is at risk, even if it doesn\u2019t look like a computer.<\/p>\n First (and obviously), the standards required for government agencies by FISMA should be implemented for information related to research with dangerous pathogens. This is a matter of carrying out what the law already calls for.<\/p>\n Secondly, there should be a secure way for research institutions to exchange information about current information security threats, as well as effective strategies to protect scientific data that could be misused. While implementing these measures now is not without monetary and time costs, they would prevent the big security and research expenses that would be incurred after a major security breach and implementation of reactive measures.<\/p>\n Finally, there should be more concrete efforts at effective communication between science, information technology, and security experts, so they may understand each other\u2019s disciplines better. An effective approach could include educational opportunities for individuals who are interested in working at the interface of these very different communities.<\/p>\n My colleagues and I found writing our research paper to be difficult because we were all outside of our comfort zones. Professionals, whether they are life scientists or computer people, do not like to admit that they don\u2019t know or understand something. When we had to ask each other for explanations regarding simple concepts in the others\u2019 fields, it was humbling.<\/p>\n But we have proved it can be done. The cross-disciplinary conversations must continue. Information security concerns are not going away, so we need to awaken to this reality before a major disaster happens.<\/p>\n Carole Baskin<\/a> is Associate Professor of Environmental & Occupational Health at Saint Louis University<\/a><\/em><\/span><\/p>\n This article was originally published on The Conversation<\/a>. Read the original article<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" Researchers carefully protect dangerous pathogens \u2013 but how secure are all their data? Carole Baskin, Saint Louis University Ebola, smallpox, anthrax and many others: the most dangerous microorganisms are strictly regulated in the United States. The federal government oversees use of 65 so-called select agents with \u201cthe potential to pose a severe threat to public, […]<\/p>\n","protected":false},"author":40,"featured_media":4235,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[8],"tags":[150,209,193,240],"_links":{"self":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/4234"}],"collection":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/users\/40"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/comments?post=4234"}],"version-history":[{"count":1,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/4234\/revisions"}],"predecessor-version":[{"id":4236,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/4234\/revisions\/4236"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media\/4235"}],"wp:attachment":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media?parent=4234"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/categories?post=4234"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/tags?post=4234"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"\"](\"https:\/\/62e528761d0685343e1c-f3d1b99a743ffa4142d9d7f1978d9686.ssl.cf2.rackcdn.com\/files\/91823\/width668\/image-20150813-21425-1u1z7lg.jpg\")
<\/a>
\n UNMEER<\/a>, CC BY-ND<\/a><\/span>
\n <\/figcaption><\/figure>\n<\/p>\nPhysically securing dangerous pathogens<\/h2>\n
![\"\"](\"https:\/\/62e528761d0685343e1c-f3d1b99a743ffa4142d9d7f1978d9686.ssl.cf2.rackcdn.com\/files\/91825\/width668\/image-20150813-21425-1l2wgkn.jpg\")
<\/a>
\n tales of a wandering youkai<\/a>, CC BY<\/a><\/span>
\n <\/figcaption><\/figure>\n<\/p>\nLimiting open discussion<\/h2>\n
Information security at least as vulnerable<\/h2>\n
Why isn\u2019t research\u2019s data security cutting-edge?<\/h2>\n
![\"\"](\"https:\/\/62e528761d0685343e1c-f3d1b99a743ffa4142d9d7f1978d9686.ssl.cf2.rackcdn.com\/files\/91824\/width668\/image-20150813-21432-1g81ntr.jpg\")
<\/a>
\n Jim Urquhart\/Reuters<\/span><\/span>
\n <\/figcaption><\/figure>\n<\/p>\nHow to lock down the information, too<\/h2>\n
![\"The](\"https:\/\/counter.theconversation.edu.au\/content\/44391\/count.gif\")
<\/p>\n