2. Chemical and Biological Investigation, Evidence and Countermeasures Training
In line with BEP’s mission, the “chemical and biological investigation, evidence and countermeasures” training was organized by the U.S. Civilian Research and Development Foundation (CRDF Global, USA) in collaboration with Thin Blue Line (TBL), a not-for-profit international association based in Geneva. The main goal of this training was to bring together biological scientists, law enforcement investigators, and public health response laboratory representatives from the East Asia Pacific (EAP) region for training on how to recognize indicators of low-effort toxins and respond or disrupt effectively, identify, and collect evidence in a hazardous environment, and support and strengthen partner operations and countermeasures using a multi-agency approach. Fifteen participants from Indonesia, the Philippines and Malaysia were trained through this training program. The eight-day training was conducted at Radisson Blu Hotel on Cebu Island of the Philippines from February 21 to March 2, 2023. Subject matter experts (SME) Medley J. (TBL), Wood R. (TBL), Morris D. (TBL), and Rohonczy E. (TBL) served as instructors for the training program. During the opening session, on behalf of CRDF Global, Rowe, A. (Senior Project Lead) delivered welcoming remarks and highlighted that CRDF Global is fully committed to meeting specific regional needs in over 100 countries across the globe. He also highlighted that CRDF Global has opened a new office in Manila to facilitate the implementation of projects in the Philippines and Southeast Asia. In the opening remarks, Wahyuni K. (BEP, Embassy of the USA, Indonesia) highlighted the importance of equipping regional stakeholders to mitigate biosecurity risks. She also underlined the significance of coordinated multi-agency efforts and the vital role played by biological scientists, law enforcement investigators, and public health response laboratories in the respective countries.
2.1. Identification of the ‘Gaps’ in the system
To begin with, SMEs outlined the objectives of the training and made it clear to the participants that the program contains tabletop exercises, round table discussions, lectures, practical exercises, immersion scenarios, practical assessment, and a written assessment. To initiate discussions amongst the participants' groups and to increase awareness about threats from low-effort toxins and homemade explosives (HME) such as Triacetone Triperoxide (TATP), a case scenario (tabletop exercise) was presented by SMEs. For discussion purposes, various questions were posed as follows:
-
i.
Should police share some of this telephone intercept information with other agencies?
-
ii.
Who could benefit from the provided information?
-
iii.
Does your country have a list of chemicals of security concern? (For example, chemicals used for weapons)
-
iv.
Do laws exist to secure the storage and transportation of those chemicals?
-
v.
Are compulsory checks done on staff transporting chemicals or biological materials of security concern?
-
vi.
Does your country have a process by which suspicions about chemical sales of movements be reported by industry and the public?
-
vii.
Do your law enforcement officers have any specialist equipment or training to operate in hazardous environments?
-
viii.
Do your officers have training or equipment to identify chemicals?
-
ix
If officers required specialist equipment to identify chemicals or examine the vessel – whom could they call?
-
x.
What would raise suspicion about chemicals in cargo?
The SME highlighted that abrin is a natural poison which could be extracted from the seeds of the Rosary Pea plant (Scientific name: Abrus precatorius L.). The SME also highlighted that abrin is one of the most toxic poisons known to man and doesn’t have an antidote. Abrin can be absorbed through the skin, inhaled, or ingested, and it is of interest to nefarious actors and terrorist groups. To find the gaps and for discussion purposes, various questions were posed, such as:
-
i.
Have general law enforcement, emergency services, or health officers received any training on chemical, biological, and explosive threats?
-
ii.
If hospital staff are suspicious, who do they raise suspicions with?
-
iii.
Would anything about this incident trigger an investigation from any agency?
-
iv.
Would any sample of the Rosary Pea plant or the power be preserved at the hospital?
-
v.
How would a sample be taken, and who would do that?
The SME elaborated on the hypothetical scenario highlighting that police surveillance has identified the address of a suspect and wants to execute a search warrant at 06.00 am the next day – to search the premises and vessel. The SME asked the participants (law enforcement investigators) for feedback on the following issues:
What considerations would you have when planning a search operation?
Whom would you involve in planning for the search?
Would you seek information from any other agencies or sources before proceeding with the operation?
What other support could assist in the planning and execution of the operation?
During the search operations, police found a clandestine laboratory located in a building, found many containers containing chemicals, and noticed powders and crystals drying in trays, filter papers and cooking containers. The gaps and challenges were discussed in line with the following questions:
Would any sampling be done at the scene?
Who would do sampling?
How will any highly dangerous exhibits be handled from the point of discovery to the laboratory for testing?
Are there any standard operating procedures (SOP) which ensure dangerous samples taken at the scene arrive at the labs in the best conditions for analysis?
How will investigations across national borders be coordinated?
Through the tabletop exercise, participants learned the importance of filling the potential gaps for safety and security purposes.
2.2. Biological and Chemical Terrorism
While discussing the threats, the SME highlighted that terrorism is just a tactic, and fighting a tactic cannot define a strategy. Jihadi groups exploit wars and state collapse to consolidate power, and they thrive on chaos. Different forms of deprivation can result in terrorism; in particular, poverty, lack of education, or lack of political freedom could motivate terrorism. Cultural and ideological change, access to people and materials, HMEs, dual-use equipment, and firearms influences the evolution of terrorism, participants learned. The SME highlighted that bad actors and groups could use plant-based toxins (e.g., ricin), microbial toxins (e.g., Anthrax, mycotoxins etc.), aerosol dissemination, food, or water contamination (e.g., water contamination fears in Paris, 2015) as the biological threats. The SME highlighted that Chlorine and Sulfur Mustard are commonly used as chemical weapons.
The SME underlined that the behaviours and modus operandi of terrorist groups are shifting, and any terrorist acts may involve conventional weapons, guns, and explosives. We also need to bear in mind that there is an increased threat of the growing manufacture and use of chemical and biological weapons. However, the use of biological agents would have a devastating effect on global health – participants learned.
2.3. Early Warning Indicators - Scene Appraisal Notes
A practical was conducted to familiarize participants with the importance of early warning indicators and scene appraisal notes. During the practical, participants were asked to enter a location that contained various biological and chemical items. Participants used a specially designed form to record the biological and chemical items in the context of this training. As a part of the practical, participants recorded their observations by answering the questions stated below:
2.4. Biological Agents
Infectious biological agents and toxins they produce could be misused as a bioweapon. While discussing biological agents, an SME highlighted that a microbiological entity, cellular or non-cellular, which is capable of replication or transferring genetic material or is a byproduct of a biological entity, could be misused by bad actors. For instance, bacteria, biological toxins, fungi, and viruses could be used to harm an individual or specific community. Because of easy accessibility, dissemination, or delivery, limited or no medical treatment options, delayed effects following exposure, and high mortality or morbidity, biological agents are becoming popular among bad actors – participants learned.
The SME deliberated the categories (A, B and C) of biological agents and highlighted Smallpox (Variola major), Plague (Yersinia pestis), Anthrax (Bacillus anthracis), Ebola Virus Disease (EVD), Botulinum toxin (Clostridium botulinum), Q Fever (Coxiella burneti), Tularemia (Francisella tularensis), Glanders (Burkholderia mallei) and common food poisoning agents such as Salmonella spp, Escherichia coli O157, and Listeria monocytogenes as bioagents of concern.
2.5. Crime Scene Investigation
Systematic and careful investigation of a crime scene involving low-effort toxins is essential to provide convincing evidence during legal proceedings. To deliberate the crime scene investigation, an SME stated the Locard Principle that, tell that when someone commits a crime, they will leave something of themselves at the scene and take something away from the scene. The SME highlighted that all possible documentary, testimonial, and real or physical evidence should be collected from the crime scene. The crime scene may or may not be the location where a crime was committed – participants learned.
While deliberating the importance of evidence, an SME highlighted the importance of identifying each piece of evidence, describing where the evidence was found, describing any changes to the evidence, and proving the continuity of the evidence. The SME also underlined the importance of trace evidence types such as hairs, deoxyribonucleic acid (DNA), fibers, glass, plant material, paint chips or transfers, soil, fingerprints, footprints, and tire tracks. The participants learned that trace evidence-firearms, physical matching, bloodstain pattern analysis, continuity of evidence and taking notes are equally important.
The SME also highlighted that notes (or statements) taken during an investigation contribute to the development of the investigation, reconstructing events long after they occur to refresh your memory for a trial or other legal proceeding and serve as a record of your conduct should questions arise. Therefore, as a permanent, ongoing record of events, notes or writing out a detailed statement is vital for all persons involved in a crime as victims, witnesses, or investigators.
2.6. Biological Agent Acquisition and Production
Acquisition, production, and dissemination are the three main steps involved in biological weapons development and use. While discussing the acquisition of biological agents, an SME highlighted that biological agents could be acquired from natural origin (e.g., outbreaks or environmental samples, including the soil), theft from the laboratory, purchase from the supplier (culture collections) as well as from infected animals, humans, plants or from vectors. To mitigate the biosecurity risks, we must ensure that all government, private commercial, university, hospital, and veterinary laboratories follow best practices in line with international standards and national regulations/legislation – participants learned. The SME highlighted that enhanced security for storing Security Sensitive Biological Agents (SSBA) is essential.
Stating the rapid development of digital technologies, online markets, increase in cybercrime, illegal and ‘dark’ marketplaces for trade in drugs, firearms, and chemicals, the biotech industry and growing use of artificial intelligence (A.I.) to create and predict biological and chemical weapons, an SME highlighted the challenges posed by access to biosecurity sensitive information, equipment and materials via dark net and black markets. An SME also highlighted that with limited technical skills, biological agents could be produced on a small-scale using common household items, dual-use equipment, and other resources.
To deal with challenges associated with biological agent acquisition and production, countermeasures such as measures to reduce the risks of unauthorized access, theft from facilities and during transport; systems to improve detection of biological contraband at borders; increasing awareness of the type of intelligence that can be obtained from the production process were suggested by the SME.
2.7. Low-effort Toxins Threat
Nefarious actors could misuse toxins extracted from plants, animals, insects, or microbes. For instance, ricin is a toxic protein produced by the castor plant (Scientific name: Ricinus communis L.). Castor beans are processed to make castor oil, and ricin is part of the waste produced in this process. Ricin can be deadly depending on the dose and route of entry. The SME highlighted that ricin is 6000 times more deadly than cyanide and much easier to produce than other weapons of mass destruction (WMD). Hence, it could be misused by nefarious actors or terror groups. After inhalation, injection or ingestion, ricin enters cells and interferes with protein biosynthesis. As a result, cells die due to a lack of proteins, organs get damaged, and the exposed person’s death occurs in 3-5 days – participants learned.
To provide another example, an SME highlighted that abrin could be misused as a low-effort toxin. Abrin is a natural poison found in the seeds of rosary pea, aka jequirity pea (Scientific name: Abrus precatorius L.). The seeds of this plant are red with a black spot covering one end and reported as 75 times more toxic than ricin in tests with mice – participants learned from the SME.
To highlight the low-effort toxins threats, the SME deliberated a case study on ricin and one case study on abrin. Ricin and abrin are just two examples of low-effort toxins. Therefore, we need to remember that nefarious actors or terror groups could use any toxins accessible to them.
2.8. Improvised Explosive Devices
Nefarious actors could use improvised explosive devices (IEDs) to disseminate or deliver toxins, biological agents, or noxious chemicals intended to cause harm. To ensure that participants know the IEDs, an SME deliberated on the essential components of the IED. How to determine if something is an IED? What should we do if we discover an IED? How to defeat an IED? And what should responders do? IEDs are used extensively throughout the world by criminals, terrorists, and states to achieve their goals. An SME highlighted that IEDs are essential tools for nefarious actors.
IEDs generally consist of a switch, power supply, initiator, and explosive packed in a container (or packaging). Participants learned that IEDs could be packed in a shoe, pressure cookers, bags, cars, or printer cartridges. Stating that electrostatic discharge (ED), friction, heat, impact, radio frequencies, and shock could be used as explosive stimuli, an SME highlighted that understanding the initiation methods will always help during the proper threat assessment. Suppose you see any unattended item with suspicious labelling, fuel oil leakage, unusual smells, bulges or protruding wires, power source (e.g., batteries), LED lights, and pieces of metal or glass. In that case, it gives a reason to take extra caution – participants learned. An SME highlighted that if one comes across an IED, 5 C’s [confirm, clear, cordon, control, and check] and 5 W’s [what, where, when, why, and who] techniques could be used to mitigate the risk.
2.9. Clandestine Laboratories
The do-it-yourself (DIY) concept is becoming popular. Nevertheless, the misuse of DIY laboratories cannot be ruled out. Clandestine laboratories are illegal operations where dual-use material, equipment, and knowledge are used to manufacture a controlled substance. Clandestine laboratories can manufacture drugs, biological agents, explosives, chemical weapons, and low-effort toxins. An SME highlighted that a team effort is necessary for identifying, investigating, and prosecuting a clandestine laboratory; hence, in every country, law enforcement, forensic experts, scientists, and criminal prosecutors need to work together to ensure the safety of the people. The SME also highlighted that presenting a case that definitively demonstrates how a group of items with legitimate uses is being used to manufacture an illegal controlled substance as one of the significant challenges.
Clandestine laboratories always harbour hazardous materials; hence stakeholders and agencies such as fire departments, emergency medical personnel, local health professionals, and environmental quality personnel should be well equipped – participants learned. Stating that extensive personal protective equipment (PPE) are required because of the potential risk of exposure to harmful substances, an SME highlighted that the first priority at the scene of a clandestine lab is to prevent and limit exposure to yourself.
An SME also critically elaborated on various risks posed by clandestine laboratories. For better understanding, examples such as a flammable or explosive atmosphere, an oxygen-deficient or toxic atmosphere, leaking or damaged compressed gas cylinders, clan labs in confined spaces, water-reactive and pyrophoric chemicals’ presence, damaged and leaking chemical containers, electrical hazards and sources of ignition, reactions in progress, which can include containers under high heat and high pressure, incompatible chemical reactions, and bombs and booby traps were discussed. According to an SME, biological and chemical warfare agent laboratories (clandestine laboratories) are least prevalent; however, such laboratories pose the potential for mass casualties and panic.
Depending on the type and scale, nefarious actors and terror groups could use barns, buildings, campsites, cars, garages, hotel rooms, houses, and trailers or equivalents for their clandestine activities. The SME highlighted various clandestine drug laboratory indicators and reminded participants to take necessary precautions while dealing with such kinds of labs, as hazards include antipersonnel devices or “booby traps.”
2.10. Homemade Explosives
The HMEs, also known as acid bombs and bottle bombs, are low-effort explosive devices that can be prepared easily from commonly available chemicals (for instance, drain, toilet bowl, and driveway cleaners) for purchase at various local grocery or hardware stores. An SME gave an excellent overview of the HMEs and chemical precursors and highlighted that 70% of all terrorist incidents involve explosives. Investigations suggest that terrorists use the most available explosives, an SME highlighted. The HMEs, such as TATP, hexamethylene triperoxide diamine (HMTD), ammonium nitrate, and pentaerythritol tetranitrate (PETN) are highly dangerous and unpredictable – participants learned.
The HMEs are made by combining fuel and oxidizer. An SME elegantly highlighted that fuels such as alcohol, antimony trisulfide, aluminium, carbon black, copper, charcoal, dextrin, diesel, ethelene glycol, gasoline, parrafin, shellac, magnesium, magnalium, nitromethane (drag racing fuel), phosphorous, petrol, sugar, sulfur, wax, and zirconium could be used in HMEs, as they react with oxygen to produce heat. Whereas ammonium nitrate, ammonium perchlorate, sodium chlorate, calcium hyperchlorate, perchloric acid, potassium chlorate, potassium nitrate (saltpeter), potassium permanganate, sodium azide, sodium perchlorate, sodium nitrate are commonly used as oxidisers in HMEs – participants learned. The SME also highlighted the common precursor chemicals used in making HMEs and suggested that bad actors and terrorists prefer whatever is the most easily available to make explosives. Hence, making access difficult to chemical precursors used in making HMEs could be one of the approaches of countermeasures.
2.11. Crime Scene Sampling
Systematic sampling of toxins, biological agents or other items from the crime scene is essential for evidence. Emphasizing the importance of the roles of each evidence sampling team member and the methods of the safe and effective collection of different samples, the SME highlighted that personnel expected to operate in CBRNE-contaminated environments must have appropriate training and PPE to meet safety requirements. During the evidence collection, it is essential to reduce the risk to personal and public safety, rapid evidence collection (it can help to determine if a threat is credible or feasible), determine criminal intent (or otherwise), stop an incident from occurring, and counteract further incidents occurring – participants learned.
Underlining that collecting intelligence or information, accurate documentation, and chain of custody of collected evidence, collected samples preservation, and integrity is vital for the law enforcement department, the SME emphasized that contamination and cross contamination should be avoided during crime scene sampling. While discussing the team requirements before entry at the CBRNE crime scene, the SME highlighted the importance of having a competent reconnaissance team, evidence collection team, and evidence decontamination team. While elaborating on evidence collection teams, an SME highlighted that in line with the best practices, an evidence collection team should contain four people, namely an assistant (person who assists the collector), a collector aka sampler (a person who collects samples), a scribe (photographer), and safety officer (not necessarily police). Alternatively, where possible, the evidence collection team should contain a minimum of 3 people, viz., collector, assistant, and scribe/safety professional – participants learned.
Explaining the nitty-gritty of evidence or sampling plan, basic techniques of sample collection, sample-specific precautions (e.g., liquids, powders, trace collection, plant material or seeds, culture plates, slides, and radiological samples etc.), triple packaging for sample transportation, and over-packaging, the SME highlighted that items such as hard drives of laptop or desktop computers, mobile phones, cloths, wallet, weapon/s, and documents are essential for intelligence gathering, which could help in reducing the biosecurity risk and during legal proceedings.
Before closing the session on crime scene sampling, all participants did sampling from simulated low-effort toxin crime scenes without contamination or cross-contamination by following the best practices of crime scene sampling.
2.12. Understanding the Mindset of Nefarious Actors
For stakeholders such as biological scientists, law enforcement investigators, and public health response laboratory representatives, it is crucial to understand the psychology or thinking patterns of bad actors and or individuals involved in terror activities. Apparent injustice, need for belonging, and or need for identity could stimulate the behaviours of individuals that result in retribution or terrorist act. In order to understand the thinking process of the bad actors or terror groups, participants’ groups completed simulated exercises. In the process, participants learned – how well-established, funded, bad regional actors or their groups connected with international terror groups can execute their plans.
Frustration at the ‘establishment’ and new political policies that affect future prosperity for the country, or deprivation of farming land through mandatory government acquisition for development and limited financial resources available, could become a root cause that makes some individuals or groups resort to for terror activities, where low-effort toxins could be used – participants learned through imitation exercises. Through fictitious scenarios, participants also learned: How chemical/biological (CB) agent is selected? How is the target selected? How is the CB agent collected? How are chemical precursors obtained? How are biological agents acquired? How biological agent or material is propagated? How is hazardous material transported? How are dissemination devices assembled? Furthermore, how do nefarious actors protect themself from exposure to hazardous materials?
2.13. PPC and PPE for Contaminated Crime Scenes
Personal protective clothing (PPC) and PPE are essential in creating a barrier against hazards to provide respiratory, skin and eye protection. Accentuating the importance of the decision process in selecting the appropriate PPC and PPE, and the risks associated with personnel operating in specialized protective clothing, the SME highlighted that standard police uniform and even tactical kit offers little or no protection against toxins or chemical hazards. Inhalation, ingestion, absorption, and injection are the entry routes for toxins or biological agents; hence, respiratory protection to provide protection against inhalation and ingestion and PPC to protect against skin contact is essential – participants learned.
Underlining the advantages and limitations of level A, B and C suits (PPC), air purifying respirators (APR), powered air-purifying respirators (PAPR), supplied-air respirator (SAR), self-contained breathing apparatus (SCBA), the SME highlighted that if you are caught without PPE, you should get out and get away as fast as possible, use double layer material over nose and mouth, and take off clothing and wash when clear. The SME also highlighted that if your extended thumb is too small to block your view of the hazardous material (HAZMAT) incident, you are not far enough away, as a rule of thumb for safety. During a practical session, all participants completed donning and doffing of Level C suite and other PPE such as respiratory masks, safety glasses, hand gloves and shoe covers. Level C suite could be used when collecting forensic evidence, samples, fingerprints, and most powders and liquids. However, Level C suite and PPE do not provide protection where there is fire or smoke (cannot protect against toxic gases) and should not be used in low oxygen environments – participants learned.
From a biorisk management perspective, decontamination is critical, as it neutralizes or removes dangerous substances, radioactivity, or germs from an area, object, or person. Stating the importance of the decontamination process and choosing the appropriate decontamination method, the SME highlighted that everything leaving the hot zone must be decontaminated, a single victim slipping through can contaminate others, and failure to properly decontaminate equipment can lead to cross-contamination and equipment failure. Therefore, planning, reviewing, modifying, and training together is essential – participants learned.
From a law enforcement perspective, the SME highlighted that we need to consider every possible aspect of risks and considerations, such as how to control crime scenes. How toxic is the material? Where will we get trained resources from? How to manage evidence? What happens to weapons? Besides, how much time is available?
2.14. Improvised Dispersal Devices
Using homemade and/or commercial components, a device incorporating destructive, lethal, noxious, pyrotechnic, or incendiary chemicals could be designed by nefarious actors and terrorists to destroy, disfigure, distract, or harass target individuals or a specific community. To develop a basic understanding among participants about improvised dispersal devices (IDD), the SME provided a comprehensive overview of various aspects of IDD and highlighted that bad actors and terrorists could use IDDs for the effective dispersal of the biological and chemical agents, as they aim to accomplish their goal at any cost. Mechanical, binary chemical, mechanical action, pneumatic (compressed air: low or high pressure), dirty bombs or bulk containers could be used as dispersal methods by bad actors – participants learned. The SME pointed out that sealed bags or glass bottles with biological or chemical agents could be used for the dispersal (mechanical) of harmful toxins or infectious agents.
Discussing the case studies on the assassination of Kim Jong-Nam, the Skripal poisoning, and the poisoning in Salisbury, the SME highlighted various elements of investigation, evidence collection and countermeasures.
2.15. Multi-Agency Biological and Chemical Investigation Coordination
Various government agencies work together to investigate crimes involving toxins, infectious biological agents and or chemical agents for the identification, evidence collection and countermeasures. The SME presented an in-depth overview of the multi-agency biological and chemical investigation coordination approach and highlighted that the multi-agency working principles for joint working should be used during all phases of an incident, whether pre-planned or spontaneous and regardless of scale. The principles guide the development of multi-agency coordination and provide structure during all phases of incidents investigation – participants learned.
The SME also accentuated that each agency has a particular CBRN role determined by its capacity (combat role or advice or support). For instance, fire, emergency, and military units will have the most CBRN capability. Underlining the importance of safety and self-protection training and joint exercising by multi agencies for coordination refinement, the SME highlighted the consideration of plume modelling, dangerous substances or HAZMAT control zones (hot, warm and cold zones), decontamination corridor, equipment drop area, forensic investigation, physical evidence, CBRN evidence, crime scene considerations, PPE limitations, managing casualties, securing people, and casualty behavior for efficient and effective coordination among multi agencies for biological and chemical investigation, evidence collection and to counter a danger or threat.
2.16. Instant Chemical Identification
The safety and security of first responders are vital while investigating crime scenes involving low-effort toxins or chemicals. From this context, first responders’ key questions will be: what chemical is this? Is it dangerous? Is it illegal? How should I react? Rodney Trickett, an invited speaker (from Rigaku, APAC Regional Office), gave an excellent overview of the instant chemical identification using Rigaku CQL handheld Raman analyzer (HRA) and highlighted that HRA could be used for reliable chemical identification of over 12,000 chemicals, including narcotics and precursors, chemicals used in HMEs, chemical weapons explosives, and industrial and household chemicals. Handheld Raman Spectroscopy is considered robust and reliable for scanning bulk chemicals through the glass and plastic containers, is easy to use, and works fast to provide precise results for immediate action and reduces delays waiting for forensic lab test results.
While talking about the laser safety and ignition hazard while using handheld Raman Spectroscopy, Rodney highlighted that some materials might be sensitive to shock, static electrical charges, friction, and heat; hence, avoid scanning dark or black solid materials (chemicals), as dark solids are very likely to absorb laser energy, heat-up and ignite. Sometimes, even light-coloured samples can still heat up and ignite – participants learned. Underlining the basic instrument (handheld Raman Spectroscopy) operation, Rodney also highlighted the equipment’s ability to identify individual chemicals from a mixture of up to 5 chemicals.
In a practical session, all participants were able to identify the unknown chemical samples collected from the hypothetical crime scenes. The practical session helped participants understand the right approach to chemical sampling at crime scenes and the instant identification of collected chemical samples.
2.17. Biological Field-Testing and Microbial Forensics
Biological or microbial forensics is very helpful in crime scene investigation, as it provides science-based evidence that brings to criminals or terrorists who use toxins or infectious biological materials to cause harm. The SME discussed various techniques of biological field-testing and microbial forensics, including molecular techniques, and highlighted that forensics helps investigation agencies to answer various questions such as what kind of biological agents are used? Who did it? Did it come from a program or laboratory we know? Will there be more attacks? What are we or nations involved in doing about it? What can we know, by when, and with what confidence?
The SME also highlighted those forensics aids in answering legal questions. For instance, did a crime occur? What happened? How, where, when, and why did it occur? Who was involved and responsible? What evidence exists? What does it indicate? How strong are the links? How reliable and credible is the evidence? What alternative explanations are there for the evidence? And can it help in defending investigation conclusions?
2.18. CBRNE Crime Scene Processing
CBRNE materials or weapons are commonly used by culprits to cause significant harm or disruption. An intentional CBRNE incident is treated as a crime. Stressing the importance of meticulousness in CBRNE crime scene processing, the SME highlighted that contaminated scenes affect the order in which the investigation is processed. During CBRNE incident response, priority should be given to the safety of the team members, the public's safety, the protection of critical infrastructure, and the recovery of evidence – participants learned.
Discussing the critical elements in minimizing contamination, the path of contamination, processing CBRN-contaminated crime scenes, evidence preservation, and proficiency of evidence collection sampling team members, the SME elegantly highlighted that during CBRNE crime scene processing, efficient and effective communication is essential. The SME also highlighted that communication in PPE is more difficult than in a regular crime scene; everyone in the scene needs to know what everyone else is doing in a CBRNE scene before you do it and get an agreement before commencing a task and if there is a disagreement, discuss the rationale as a group and explore options.
Liquid or powder samples always serve as evidence in a CBRNE scene. To meet the legal and scientific requirements, we must be able to identify each piece of evidence, describe exactly where it was found, prove continuity, and describe any changes in the evidence – participants learned. Using new tools or changing gloves while collecting each new sample, establishing a contamination control zone, using clean sheets for setting out equipment, use of kill buckets (filled with bleach dilution), isolation of exhibits or samples in the scene, and proper packaging and transport of exhibits or samples in leak-proof containers were highlighted as sampling best practices to avoid cross or secondary contamination. The SME underlined that concurrent documentation of actions in scene notes and accurate completion of the required information onto evidence bags/labels as the two most essential aspects of seizing evidence during CBRNE crime scene processing.
2.19. Drones Weaponization
An unmanned aircraft system (UAS), aka unmanned aerial vehicle (UAV), commonly named a drone, is an aircraft or flying equipment without any crew, passengers, or human pilot on board. The SME presented an in-depth overview of the UAS/UAV and highlighted that UAS is valuable and could be used as a courier to deliver materials, provide combat service support (CSS) or logistics for surveillance, reconnaissance, research and development, vectoring, and training purpose; however, it could be misused as a weapon to cause damage or loss or harm that results in the destruction of property or material, harassment, smuggling to import or export something in violation of the customs laws, to cause the death of, to mutilate, disfigure, or to cause severe damage.
Underlining UAS’s capabilities, including payload carrying capacity, range, navigation, auto take-off, handoff, map integration and other elements, the SME highlighted that UASs/UAVs are posing new threats and challenges from a biosecurity or safety and security perspective, as they are inexpensive and easy to acquire, hard to detect or destroy, evade minimal pre-event signature, automated, able to take advantage of global positioning system(GPS), and could be modified to fulfil specific needs.
The SME also underlined that UAS capabilities are increasing and piloting is getting simpler and automated; even sites with thorough ground-threat mitigation measures may be vulnerable to UAS threats; we need to put in efforts for the development of enhanced and new capabilities to defeat threats from UAS; and all relevant agencies of government and stakeholders should take note of threats and challenges to put in the mitigation measures for the safety and security of the people and strategic interests.
2.20. Laboratory Interface
Laboratories play a vital role in the chemical and biological investigation of samples collected from crime scenes and provide science-based evidence helpful during legal proceedings. The input from the laboratory also aids in taking the appropriate countermeasures to mitigate the risks. The SME gave an excellent overview of the documents that must accompany any sample while submission to a laboratory, the types of pre-screening required for samples, the types of samples that laboratories typically handle, the approximate size limitation for samples identification, the steps in packaging a sample for submission, and importance of control samples, and highlighted that most mobile biology laboratories, and public, private, or academic laboratories or reference laboratories could handle swabs, powders, liquids, filters, and contact plates.
Pre-screening of samples is done as part of the hazard assessment process, where available detection and monitoring equipment are utilized to assess explosive, radiological, and chemical hazards -participants learned. Each sample submission requires two forms, namely, the chain of custody form and a sample data sheet, the SME emphasized. While discussing the common mistakes made during the CBRNE crime scene sampling, the SME highlighted that instead of sending a desk chair to a lab, it is appropriate to send a swab of the chair surface, focusing on horizontal surfaces or other areas of suspected contamination; instead of sending full-sized speakers (sound amplifier devices) to a laboratory, it is better to send swabs, wipes, or contact agar plates; and instead of sending HAZMAT drum or container to a lab for analysis, investigation team must send sampling wipes, swabs, or liquid samples. It also underlines the need for proper training for CBRNE crime scene investigation team members.
The proper transportation of CBRNE crime scene samples is essential. If the transport of the samples is done in a vehicle, it is necessary to ensure a rigid outer container such as a box or cooler is used; absorbent materials around the samples inside the outer box to fully absorb any spills (paper towels) is placed; enough packaging to keep samples upright is used; and arrangements are made to keep samples cool – participants learned.
2.21. Laboratory Results for Biological Samples
Unknown Biological Samples from the crime scenes could be subjected to immunoassay, Cell culture techniques, DNA extraction for polymerase chain reaction (PCR), and microscopic examination. Sharing an overview on the importance of laboratory results in solving the crime mysteries involving low toxin effort toxins or infectious biological agents, the SME highlighted that there is always demand for results from various stakeholders such as law enforcement departments, public health administration, media, communities, individuals, government officials and politicians. Therefore, clear communication is also vital during crisis management – participants learned.
While discussing the suitability of field-testing results, the SME highlighted that field testing of biological agents is not currently deemed reliable for decision-making, though it is acceptable for screening, as confirmatory tests may be needed. False positives (biological agent is incorrectly identified) and false negatives (biological agent is present but not identified) results may hinder future prosecution efforts. Hence, both (false positives and false negatives) results can be dangerous to responders if assumed to be accurate – participants learned.
Stating the usefulness of various PCR techniques such as RT-PCR (reverse transcription PCR), qPCR (quantitative real-time PCR), multiplex PCR (can amplify more than one target DNA at a time), and standard PCR, the SME highlighted that PCR technique is so sensitive and it is prone to errors, especially when the targeted DNA samples are contaminated – participants learned.
The SME also highlighted that preliminary results could be available within hours, often PCR based, and may be incorrect; to substantiate crime evidence, the confirmatory results can be fully trusted for decision-making efforts but requires multiple days; and the definitive results always help to further identify the type, processing, and origin of the toxins or infectious biological agents. Therefore, despite the high demand for urgent results, we need to convince the stakeholder that scientific testing in laboratories takes time to complete the tests and to verify the results – the SME convinced the participants.
2.22. Challenges of Bioterrorism
Despite advances in innovative applications of science and technologies in CBRNE crime scene investigation, there could be many challenges in investigating bioterrorism. The SME underlined the key differences between chemical and biological attacks and challenges for the investigators and precisely highlighted some challenges of biological attack (bioterrorism) as follows:
Usually, biological attacks will be covert.
There will be no immediate signs and symptoms of biological agents’ action.
Biological agents’ detection or identification takes time.
It is difficult to demarcate areas, and there will be no obvious hot zone.
Evidence could be biologically contaminated.
To confirm the identity of biological agents needs verification tests, which are time-consuming.
Dual-use biological materials, equipment, and knowledge are easily available.
It is easy to access and manufacture crude material needed for biological attacks.
Bioterrorism could pose one health risk.
Bioterrorism Could result in disease outbreaks and, if not controlled in time, may lead to a global pandemic.
The SME highlighted that churches, temples, pedestrians, cafes, concerts, transport hubs, food or agriculture systems, and attacks on resources and food supply chains could be soft targets of bad actors, adversaries, or terrorist groups. Underlining that bad actors could get hold of deadly toxins or infectious biological agents available at universities, hospitals, veterinary facilities, biological waste, and or from environmental (e.g., soil, water) samples, the SME highlighted that life sciences research or diagnostic institutions should boost biosecurity by implementing: strict laboratory access restrictions to nonauthorized persons, effective management of biological waste, security measures to protect dual-use sensitive biosecurity samples, sample transport security, and personnel reliability programs.
We must remember that bioterrorism could kill more people than nuclear war, and prevention is always better than cure from a sustainability perspective. Hence, to prevent, identify, and contain biological threats or risks, health surveillance and analysis, investigation, and forensic analysis is essential – participants learned. Asking questions such as what biological threats we should focus on? Is there enough awareness about the challenges of biosecurity (bioterrorism) among security, health, law enforcement, and other stakeholders? The SME highlighted that prevention starts with surveillance, notification and reporting to security agencies, and stakeholder engagement.
2.23. Disease Outbreaks Investigation
Disease outbreaks can occur anywhere, and their control at the earliest is essential. The occurrence of more illness cases than expected over a period of time or during a season in a given area or amongst a specific group of people (old or young) is termed a disease outbreak. If an epidemic disease is not controlled in time, it could result in a pandemic. For instance, Coronavirus disease (COVID-19) is caused by the severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2). Discussing the process of an epidemiological investigation, the type of information the investigation discovers, and how disease outbreaks investigation is an essential tool in a suspected bioterrorism event, the SME highlighted that the new and emerging diseases might be the result of adaptation or mutations in pathogens (e.g., COVID-19, SARS, Bird flu, H5N1, MERS, Ebola) genetic material over the time or change in their hosts or ways of their transmission.
The SME highlighted that the main aim of disease outbreaks investigation is to identify the disease-causing agent, identify where it came from (the source), determine how it spread, determine when people were first exposed to it (index case), identify the people who may have been connected to the index case or infected persons (contact tracing), and put in place effective control measure to stop the disease spread.
Emphasizing the importance of international engagement for biosecurity through international health regulations (IHR-2005) intended to protect countries from health threats that have the potential to spread globally and to better prevent, detect and respond to public health threats, the SME underlined that effective coordination and cooperation among epidemiologists, diagnostics labs, law enforcement, veterinarians, health care workers (doctors and nurses), and food authorities is essential for public health. Though the goals of law enforcement and public health departments are different, they need to work together for disease outbreaks investigation – the SME underlined.
The SME highlighted that multi-agency partnering is essential during suspected deliberate outbreak investigations, disease surveillance (including border posts), maintaining the chain of custody of specimens submitted for microbiologic testing, for the security of health officials during outbreak investigation and response, implementing and enforcing quarantine and isolation, tracking escapee and difficult contacts, and for communication to the public. However, building relationships prior to an incident is important – participants learned.
2.24. Case Studies
With the help of discussion on the Ebola outbreak and US Anthrax attacks 2001 (aka Amerithrax) case studies, the SME helped participants to generate an in-depth, multi-faceted understanding of complex issues associated with the biological and chemical investigation, evidence, and countermeasures, which would help in real-world work life scenarios to deal with low-effort toxins and infectious biological agents.
Emphasizing the importance of understanding the method of transmission, the processes involved in contact tracing, risk mitigation measures that reduce the spread of an infectious disease (Ebola), and identifying areas where law enforcement plays a role, the SME highlighted that contact tracing is vital as it helps in finding everyone who comes in direct contact with a sick patient; and the process involves interviewing, medical checkups, monitoring and solation if symptoms begin. A missed contact will keep the outbreak going – participants learned. The SME also highlighted that changes to burial practices, best biosecurity practices land and air borders, prudent use of mobile diagnostic labs, the establishment of temporary medical centers, effective isolation and quarantine, increased levels of PPE (countermeasures), efficient crisis communication significantly contributed in controlling the spread of Ebola. In the process, the role of partner agencies was vital for the security of burial sites, burial team transport security, sample transport security, quarantine, restricted movement, crowd control, and the overall law and order – participants learned from the case study.
While discussing the Amerithrax case, SME highlighted that five people were killed and 17 additional people were infected during the incident. The SME underlined that the search investigation was spanned six continents, and in the process, 9000 people were interviewed; 67 searches were conducted; 6000 summonses were issued, and 100s of Federal Bureau of Investigation (abbreviated as FBI) (Law Enforcement Agency of the United States) personnel were involved. The FBI used all approaches, including behavioral analysis and motives.
The Amerithrax case study highlighted the hazards of handling spores, the importance of using biosafety cabinets, and air and personnel monitoring to prevent exposure to HAZMAT.
With the help of the case, the SME facilitated participants in understanding the practical considerations of the scale of the evidence identification, sampling method, air sampling if the need arises, prevention of primary or cross-contamination, microbiological sampling (swabs) and importance of containment facility. The Amerithrax, the most extensive and most complex case study, also helped participants in understanding the implications of the bioterrorism act, considering that spore preparation is well within the skill set of many biological scientists and how a low-effort weapon (sealed envelope with Anthrax spores) could create such havoc, which sucked billions of United States Dollar (USD) in costs.
2.25. The Chemical Detection Dilemma
We need to remember that terrorists have access to a range of materials and technology to undertake attacks, and their preference could be for using chemicals which minimize the opportunity for detection. The SME gave an excellent overview of terrorism and the chemical detection dilemma and illustrated examples where chemical detection efforts alone during the attack phase are inadequate.
Discussing various elements of HMEs, such as TATP (triacetone triperoxide) used in London bombings, HMTD used in transatlantic airline plot, and HPOM (hydrogen peroxide organic materials), a liquid threat to aircraft, the SME highlighted the case of Shoe Bomber, who used PETN (Pentaerythritol tetranitrate) as explosive material and underlined the case as an example of the chemical detection dilemma.
The SME also highlighted the underwear bomber’s case, printer cartridge bomb, and PETN – meat grinder plot as examples and elaborated that PETN is mighty and easy to manufacture, and the effort on detection and response was not enough.
Considering the three stages of a terrorist attack (acquisition, development, and execution), at the end of the discussion session, the SME recommended that multi-agency professionals and stakeholders need to target the acquisition stage, as attackers are most vulnerable during this stage.
2.26. Outreach Triggers and Tripwires
Triggers (suspicious behaviours) and tripwires are indicators that provide early warning of a potential threat. Focusing on the acquisition stage of terrorist attacks, the SME discussed the case of the Zazi Subway Bomb Plot and highlighted that the potential result of retail outreach and sensible triggers could play an important role in thwarting various terror attacks.
Underlining the usefulness of various triggers such as attempted acquisition, communication, industry, personnel, process, sales, theft, transportation, and unauthorized access, the SME emphasized that something “abnormal or odd” should serve as a trigger and that should prompt notification to law enforcement within a reasonable time (
Table 1). Events such as out-of-hours visits to self-storage facilities, complaints of odours, dumped waste containers, suspicious deliveries, illness of animals or humans, unexplained medical conditions, fires in vehicles or buildings, fire/gas detector alarms, and attempts to block emergency responders are indicators of suspicious activities – participants learned.
The SME underlined that lack of outreach program, trigger and tripwire training, stock accountability, staff background checks, staff awareness and vigilance, knowledge of procedures (e.g., whom to notify?), and freedom to raise concerns leads to the common trigger failures.
2.27. Investigative Leads and Countermeasures for Biological Incidents
As a part of a deterrent strategy, it is essential to identify potential points of prevention and countermeasures within the typical development process for a biological weapon. Also, determining investigative leads that might become available before or after a biological incident is important. Discussing the three stages (acquisition, production dissemination) of biological weapon development, the SME highlighted that the scientific knowledge and understanding about the usefulness of information regarding acquisition (e.g., source of pathogens, stock culture, production process, equipment acquisition, security questions), of dissemination (e.g., aerosolization, food contamination, water contamination, animal vectors, and person-to-person) of the pathogen would serve as detection point. Most of the equipment used in the biotech industry and at life sciences research institutions are of “dual use” in nature, and because of rapid growth in the biotechnology industry in all countries, purchasing equipment has become relatively easy – participants learned.
The SME highlighted that reaching out to the Science Community and promoting awareness about the inherent vulnerabilities and toxin production from Bacteria, Plants, Insects, or snakes, could provide detection points.
Delivery systems such as the agricultural sprayer mounted on a truck, crop dusting plane or drone, spray bottle, suspicious envelopes, or information about self-infection (biological equivalent of suicide bombers) of a pathogen for person-to-person dissemination could serve as leads for the investigation – participants learned. If all involved agencies and stakeholders work together, a biological plot could be detected prior to the incident – the SME underlined.
2.28. Emerging Trends in Bioscience
The advancements in biological sciences and innovations in the biotechnology domain always bring new biosecurity challenges, which must be considered while refining multi-agency coordination. In this line, the SME shared information about the latest trends in biosciences and highlighted that the rise of non-state actors (groups and individuals), an offensive weapon for civilian targets, generation of economic instability and disruption of services, potential for complex genetic modifications (GM) resulting significantly different properties than found in nature, technical capability and knowledge is widespread.
Underlining the latest advances in computational biology, systems biology, nanotechnology, and synthetic biology, the SME highlighted collected different strains of SARS-type viruses from bats, genetic modifications of the genes for the spike proteins, and the creation of new virus strains not found in nature as some examples of dual-use research. Innovative research-based technologies that are developed with good intentions but could be misused to cause public harm are called dual-use technologies – participants learned.
The SME also highlighted that biological science is getting faster, easier, and less expensive, and this advancement benefits law enforcement and potential terrorists. Cultivating new technology for attribution and detection, cultivating relationships with scientists, and being aware of the technology available in your area is essential to remaining competitive in addressing the threats posed by emerging trends – participants learned.
2.29. Biosecurity
Interest in biological capability by terrorist groups, individuals with extremist ideology or personal plight, availability to biological material (e.g., outbreaks, hospitals, universities, industry), access to knowledge, access to equipment, and access to biological material contributes to increasing biosecurity risks. In this line, the SME highlighted that to mitigate the biosecurity risks, our focus should be on the high-risk pathogens; hence, hospitals (research and diagnostic laboratories), research facilities (independent organizations), academia (both within the university and start-up companies that are possibly off-site), food and water testing laboratories (they keep stocks of pathogens and toxins as confirmation), and pharmaceutical companies (research into new drugs) should implement the biosecurity best practices.
Underlining the importance of physical security, alerts and notifications, outreach programs for community engagement and increased awareness of biosecurity risks, the SME highlighted the need to boost biosecurity risk management at all life sciences research institutions and biotech companies.
Emphasizing that biosecurity engagement with laboratories and in the field (e.g., ensuring faculties security arrangements, coordinating information sharing, collecting samples and their proper packaging, ensuring chain of custody, securely transporting samples to the nominated laboratory, assisting with border biosecurity checks) is essential, the SME highlighted various challenges in mitigating the biosecurity risks.
Using a hypothetical case study on the outbreak of a novel virus, participants learned: Risks associated with an unidentified viral outbreak and the implications to national infrastructure, economy, and health; what actions could be taken to reduce these risks? Which risk reduction activities are related to the roles and responsibilities of law enforcement? And which controls could be used as biosecurity countermeasures?
Ricin extracted from caster bean seeds is a highly potent toxin but does have potential applications in medicine, for instance, ricin as a possible treatment for cancer. Using a case study on ricin, the SME facilitated the participants learning on: what biosecurity risks are associated with receiving, holding, producing, and using a biological toxin in laboratories; What regulations are in place for research facilities to have or use ricin? If not, where would participants get this information in their respective countries? Why is personnel reliability important for biosecurity? Moreover, what countermeasures could be put in place?
We need to remember that biosecurity risks will never be zero; however, we can reduce the risks by implementing effective risk-mitigation measures – participants learned.
2.30. CBRNE Tabletop Exercise
On the last day of the eight-day training, a tabletop exercise (TTX) was conducted by SMEs to ensure that all participants were able to put the gained knowledge into practice. All participants actively participated in the TTX and completed all the steps involved in low-effort toxin-associated hypothetical crime scenes. TTX was a role-playing activity which allowed participants to respond to imaginary crime scenarios equivalent to real-world low-effort toxin-related offence scenarios.