Suspected Intentional Use Of Biologic And Toxic Agents

Stephen Papagiotas and Kelly Shannon

At a glance

Chapter 24 of The CDC Field Epidemiology Manual

Introduction

Most of the chapters in this manual focus on the epidemiologic investigation of exposures, illnesses, or outbreaks that have an unintentional or naturally occurring cause. For these events, epidemiologists and public health, in general, work with traditional health-sector partners who have similar professional cultures and expertise, familiarity with relevant laws, and use of investigative methods. In contrast, events involving the suspected intentional use of a biological or toxic agent require epidemiologists to work with nontraditional partners, specifically law enforcement. Cross-sector collaboration is necessary to prevent loss of life, protect public safety, and minimize adverse outcomes for both public health (e.g., increased morbidity and mortality) and law enforcement (e.g., inability to apprehend and/or convict the perpetrator).

Because most epidemiologic field investigations do not involve collaboration with law enforcement, interactions among the sectors during an investigation involving the malicious use of a biological or toxic agent can be challenging. To ensure successful outcomes of such investigations, public health and law enforcement can develop and implement processes to improve coordination and collaboration. This chapter provides a general guide for building relationships between public health and law enforcement that will facilitate timely identification, assessment, and investigation during outbreaks suspected of being intentionally caused.

Events Involving Intentional Release of Biological or Toxic Agents

The deliberate or intentional use of biological and toxic agents to harm populations is not new. Throughout history, governments, organizations, and individuals have used biological and toxic agents for malicious purposes, including as weapons of war (biowarfare), a form of terrorism (bioterrorism), or criminal acts (biocrime) (See Table 24.1 below).

Because of the potential for many countries and nongovernment actors to be well funded and have the scientific and technical expertise to develop and intentionally use a biological or toxic agent, intentional events by these actors present substantial risks for public health and national security; however, the likelihood of occurrence is low 1. In an intentional situation, an epidemiologist is most likely to encounter an exposure or illness associated with a criminal act (i.e., biocrime) rather than an act of bioterrorism or biowarfare.

A biocrime involves the threatened or actual use of a biological or toxic agent for the sole intent of causing harm to another individual or group of individuals; in contrast, bioterrorism includes motivation to achieve a political or social objective. Because biocrimes usually target an individual or a group of people, public health consequences typically are limited. Although biocrimes can involve sophisticated production and use of biological or toxic agents commonly associated with bioterrorism, most events involve crude production or dissemination techniques and use biological or toxic agents that might not be commonly associated with bioterrorism 2. Additionally, a biocrime can occur even without the use of a biological agent. Many biocrimes result from the threatened use of a biological agent, which can involve the use of a suspicious or unknown substance (e.g., "white powder letter"). Although these "hoax" incidents do not involve the actual use of a biological agent, the threatened use is unlawful and is considered a crime 3. In the United States, most biocrimes are hoaxes or involve the production, acquisition, or use of a toxin, and the Federal Bureau of Investigation (FBI) responds to such incidents almost daily (John Woodill and Kelly Shannon, personal communication, January 27, 2017).

Although intentional events involving the actual use of biological or toxic material—compared with hoaxes—have occurred rarely in the United States, the accelerated pace of scientific advancement, availability of materials, and accessibility of information through the Internet have increased risks and vulnerabilities 4. Therefore, the potential use of biological and toxic agents by individuals and groups is likely to pose a long-term threat.

Table 24.1

Selected examples of biological or toxic agents used for intentional purposes

Agent

Perpetrator / Location

Year / Category

Pancuronium bromide[1]

Individual / Michigan

1975 / Criminal

Salmonella typhimurium [2–4]

Organization / Oregon

1984 / Terrorism

Bacillus anthracis [5]

Organization / Japan

1993 / Terrorism

Shigella dysenteriae type 2 [6]

Individual / Texas

1997 / Criminal

Bacillus anthracis [7]

Individual / Multiple US locations

2001 / Terrorism

Nicotine [8]

Individual / Michigan

2003 / Criminal

Tetrodotoxin [9]

Individual / Illinois

2008 / Criminal

Ricin [10]

Individual / Texas

2013 / Criminal

Ricin [11]

Individual / Mississippi

2013 / Criminal

References: 5671891011121314

Building Relationships

Because the response to an intentional event requires combined epidemiologic and law enforcement subject matter expertise, epidemiologists need to be versed in how to work with law enforcement. The first step is to identify the appropriate point of contact in law enforcement and establish a working relationship. An ongoing relationship will improve understanding of respective roles and responsibilities, informational needs, and investigational sensitivities during responses to biological and toxic events, whether intentional or unintentional. Improved understanding also fosters development of strong personal ties and trust that in turn facilitates information sharing and collaboration. Because roles and responsibilities differ among federal, state, and local law enforcement, contacts should be identified and relationships established at all jurisdictional levels.

In the United States, organizational structure and responsibilities for law enforcement differ across jurisdictional levels. For example, certain crimes are subject only or principally to federal jurisdiction; others are addressed primarily at the state or local level. As indicated by law 15, Homeland Security Presidential Directive 5 16, and the National Response Framework 17, the FBI is the lead agency for criminal investigations of terrorist acts or terrorist threats, which includes weapons of mass destruction (WMD) incidents. As defined by law 18, a WMD is

  • Any explosive or incendiary device: bomb, grenade, rocket, missile, mine, or other device with a charge of more than 4 ounces;
  • Any weapon designed or intended to cause death or serious bodily injury through the release, dissemination, or impact of toxic or poisonous chemicals or their precursors;
  • Any weapon involving a disease organism; or
  • Any weapon designed to release radiation or radioactivity at a level dangerous to human life.

In addition to responsibilities specified by federal statutes or other legal authorities, an intentional biological incident might be investigated by state and/or local law enforcement and prosecuted under state criminal codes.

Because most intentional events involving biological or toxic agents are subject to federal statutes or other legal authorities, within a given jurisdiction the primary contact for public health will be the FBI WMD Coordinator at the local FBI field office. The WMD Coordinator, a designated Special Agent at each of the 56 FBI Field Offices, is responsible for federal-level prevention, response, and investigations related to WMD, including biological or toxic events. In addition to investigating WMD-related crimes and acts of terrorism, the WMD Coordinators conduct outreach with federal, state, and local stakeholders; industry; academia; and the scientific community. Through this outreach, the WMD Coordinator builds relationships and trust with partners, which facilitates the timely notification of incidents.

In addition, each FBI Field Office maintains a Joint Terrorism Task Force (JTTF) comprising Special Agents and Task Force Officers who represent a multitude of federal, state, and local law enforcement agencies that might have jurisdiction over other criminal activities identified and/or initially investigated by the FBI. The Field Office WMD Coordinator can be a conduit for communications with the JTTF in the event that public health needs an appropriate point of contact with a state or county police department.

Because of the benefits of established, ongoing relationships between public health and law enforcement entities, some jurisdictions have implemented official protocols or Memoranda of Understanding that outline practices for collaboration before and during events. The purpose for creating a formal document is that it extends the collaboration beyond a personal relationship and instills it as part of the agency culture and operations. Although these agreements are recommended and highly beneficial, the steps outlined within this chapter are relevant regardless of whether a Memorandum of Understanding is in place.

Notification

Because most epidemiologic investigations do not involve a criminal act or malicious intent, determining when law enforcement should be notified can be difficult. Public health might be reluctant to share information with law enforcement before an outbreak has been confirmed and intentional exposure is suspected, but delaying notification while awaiting confirmation can hamper the timely exchange of information necessary to contain the outbreak, preserve evidence, conduct an investigation, and apprehend the perpetrators.

"A covered entity may, consistent with applicable law and standards of ethical conduct, use or disclose protected health information, if the covered entity, in good faith, believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and the disclosure is made to a person reasonably able to prevent or lessen the threat." See 45 CFR 164.512 (j)(1)(i)).

Establishing public health triggers for notifying law enforcement contacts can facilitate information sharing. The public health triggers (See section on Selected Public Health Triggers for Notifying Law Enforcement) are not intended as definitive criteria for notification but rather as a starting point to improve information sharing 19. Public health, with input from law enforcement, bases the triggers on the specific needs and circumstances of each sector and jurisdiction. A communications protocol that identifies an intended recipient, timeline (e.g., 30 minutes, 60 minutes), and a means (e.g., email, phone) for notification should be linked to the triggers. As public health becomes familiar with the process for sharing information with law enforcement, notifications are anticipated to occur in a timely manner for events of mutual interest, even if they are not specifically identified by a trigger.

Selected Public Health Triggers for Notifying Law Enforcement‎

A specimen (clinical) or samples (environmental) submitted to public health for analysis that tests positive for a biological or toxic agent.


Large number of unexplained symptoms, illnesses, or deaths.


Unusual disease presentation (e.g., inhalation vs. cutaneous anthrax).


Endemic disease with unexplained increase in incidence (e.g., tularemia, plague).


Higher than expected morbidity and mortality associated with a common disease and/or failure of patients to respond to traditional therapy.


Death or illness in humans preceded or accompanied by death or illness in animals that is unexplained or attributed to a zoonotic biological agent.

Legal Restrictions on Information Sharing

Barriers to sharing information between public health and law enforcement can remain, despite the establishment of relationships and public health triggers. One barrier to sharing information with law enforcement is the legal restriction placed on public health about information disclosure. At both federal and state levels, privacy statutes prevent the release of individually identifiable health information. Public health and other healthcare entities (e.g., healthcare providers, health maintenance organizations, healthcare clearinghouses) can use these statutes as justification for not providing information to law enforcement. However, exceptions exist that allow law enforcement access to protected health information provided certain requirements are met. For example, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) 20and corresponding HIPAA Privacy Rule 21allow for disclosure of individually identifiable health information, without an individual's authorization or permission for national priority purposes. During a suspicious biological or toxic event, a likely exemption that law enforcement can use to request patient information from a healthcare entity is the "imminent threat exemption" (See section on HIPPA/Imminent Threat Exemption) 19.

States' laws governing privacy and information disclosure vary among states. Some states have stringent rules; others have higher standards or elaborate processes regulating information disclosure, such that invoking an exception to the HIPAA Privacy Rule might not be sufficient. Thus, public health should first review federal and state privacy laws to clarify the rules and regulations governing disclosure of protected patient information and then develop approaches with law enforcement to facilitate information sharing in accordance with those regulations. Awareness of all laws governing information sharing will facilitate timely identification and investigation of a suspected or actual intentional event.

HIPPA/Imminent Threat Exemption‎

"A covered entity may, consistent with applicable law and standards of ethical conduct, use or disclose protected health information, if the covered entity, in good faith, believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and the disclosure is made to a person reasonably able to prevent or lessen the threat." See 45 CFR 164.512 (j)(1)(i)).

Breach of the Public's Trust

Perceptions grounded in ethics and trust also can constrain information sharing and notification. Patients routinely provide personal information to physicians and public health with the understanding that their information will not be disclosed. The perception that public health is "informing" on individuals to law enforcement is an important concern, especially when the information might be associated with evidence of a crime (e.g., illicit drug use, prostitution). Infringements on the bond of trust might constrain a patient's willingness to provide information that could be critical to identifying an outbreak source or implementing effective control measures 22. Fortunately, such concerns can be addressed to enable the exchange of information between public health and law enforcement. Public health and medical providers routinely work with law enforcement to share patient information that might be associated with a criminal investigation (i.e., abuse/neglect) or public health intervention (i.e., quarantine), so this process is not uncommon. For a suspected or confirmed intentional event, a primary focus of the investigation is stopping the outbreak. To preserve the trust between public health and the individual, information related to minor or petty crimes, which is not associated with the investigation, is typically not prioritized by law enforcement. However, law enforcement may use this information to seek prosecution at a later date 19.

Assessment

Because many microbial pathogens are endemic or occur naturally in the environment, the intentional use of a biological agent initially might be difficult to discern from an unintentional outbreak 23. Public health generally considers that the source of a case or an outbreak is an unintentional exposure until proven otherwise. Even when the nature of an exposure has not yet been defined, many public health officials will indicate the illness is "not the result of bioterrorism" or "not bioterrorism." However, determining whether an exposure or illness is intentional is the responsibility of law enforcement (i.e., the FBI), not public health, because the scope of an epidemiologic investigation does not fully encompass determination of intent. The ability to determine intentionality relies on attribution of the act to a specific person or group of persons. The data sources and investigational methods used by law enforcement have been developed and implemented for this specific purpose. Conversely, the purview of law enforcement does not encompass a determination of whether an exposure is "not a health risk" because that determination is a public health responsibility. Therefore, any assessment needs to be conducted jointly, involving both law enforcement and public health 19.

The goal of a joint threat assessment is to determine the nature of the threat (i.e., credible or not credible) and identify potential health risk associated with the event. It can be initiated when either public health or law enforcement identifies a defined trigger for information sharing.

Typically, law enforcement and public health will participate in the joint threat assessment of a suspicious exposure, illness, or outbreak involving a biological or toxic agent; other federal, state, and local partners and subject matter experts also might be included, depending on event-specific circumstances. As part of the threat assessment, public health shares any critical or relevant information so that participants can make an informed decision about the nature (i.e., intentional or unintentional) of the event and appropriate follow-up activities. Specifically, public health should be ready to provide or discuss information related to case reports, laboratory results, exposure source, interventions, and overall health risk to the community and responders. Similarly, law enforcement will provide information relevant to assessing the threat, such as intelligence, criminal records checks, national-level trends, and other investigative data, as appropriate.

Once all available information has been shared, the event is classified into one of three risk categories 19:

  • No Threat: No indication of a criminal act
  • Possible Threat: Information suggests the event might be a result of a criminal act.
  • Likely Threat: There is a reasonable belief the event was caused by a criminal act.

If "No Threat" exists, public health can manage the response. If a "Possible Threat" or "Likely Threat" exists, public health should implement a joint investigation with law enforcement.

Joint Investigations

The scope of an epidemiologic investigation is similar for unintentional and intentional events—for both situations, epidemiologists will apply the traditional steps for an epidemiologic investigation 24. The distinction is that during a potential intentional event, epidemiologists will investigate jointly with law enforcement, referred to as a criminal– epidemiologic (crim–epi) investigation. The goals of crim–epi investigations are to

  • Identify the disease-or illness-causing agent;
  • Identify the source and location of the exposure;
  • Determine the mode(s) of spread or transmission of the biological or toxic agent;
  • Identify who might have been exposed;
  • Direct interventions to reduce morbidity and mortality;
  • Identify possible perpetrators; and
  • Collect evidence for prosecution 19.

For public health, the crim–epi investigation does not replace the traditional epidemiologic investigation. Instead, it complements both the epidemiologic and law enforcement investigative processes by increasing the efficiency of the investigation through the exchange of real-time information. When implementing a crim–epi investigation, public health should consider several factors.

Information Sharing and Dissemination

A crim–epi investigation does not allow public health and law enforcement full access to each other's information and data sources. When conducting a crim–epi investigation, both public health and law enforcement will still abide by all applicable laws and regulations that govern their routine activities. For example, patient medical information that is not relevant to the investigation is not shared with law enforcement. Similarly, public health does not have access to law enforcement– sensitive information (e.g., informants, intelligence, and undercover operations) that is not relevant to the epidemiologic investigation.

Public health should continually review pertinent investigative information with law enforcement to ensure the accuracy of the information and avoid inconsistencies in reporting. The investigative information should be maintained in a manner consistent with established requirements to prevent unauthorized release 25. In the event that information is requested by entities other than the principal public health and law enforcement agencies—for example, another investigative party, media, or the public—the originating agency should be contacted and consulted before any information is released 25.

Evidence

The goal of a law enforcement investigation is identification, apprehension, and prosecution of the person(s) who committed the crime. Therefore, any information or materials collected by law enforcement during a criminal investigation is handled as potential evidence. For an intentional event involving a biological or toxic agent, evidence might include dissemination devices, clothing of victims or suspects, clinical specimens (e.g., blood, other body fluids or secretions), environmental samples, documents, photographs, and witness statements 19. Evidence must be collected, maintained through chain-of-custody (i.e., the documented accountability at each stage of collecting, handling, testing, storing, and transporting evidence), and analyzed in a manner consistent with evidentiary standards and that will withstand the challenges expected in a legal proceeding 26. Because a suspected or confirmed intentional biological or toxic event is considered a possible criminal or terrorist act until proven otherwise, information and materials collected by public health need to be preserved according to proper evidence collection procedures. Items that are not of central importance from an epidemiologic perspective might have value for the criminal investigation and should not be unilaterally discarded. In addition, public health participants involved in evidence collection or other aspects of the crim–epi investigation might be called as witnesses during the trial of a suspected perpetrator.

Crime Scene Access

A crime scene might not be readily apparent for an intentional biological or toxic exposure. Without the identification of a dissemination device or confession by a perpetrator, the specific location of the intentional exposure might be identified only through the epidemiologic investigation. Because of evidentiary needs of the criminal investigation, law enforcement will consider any location identified by an epidemiologic association as a potential crime scene, until determined otherwise, so public health access to the crime scene location might be limited and delayed because of the need to preserve evidence. If it is a concern that a time-sensitive health investigation could be negatively impacted by the limited and delayed access, then public health can work with law enforcement to address this issue by ensuring that samples or other evidence collected from the location fulfill both epidemiologic and criminal investigative needs.

Joint Interviews

To collect information from case-patients and potential contacts, a crim–epi investigation uses a joint interview by public health and law enforcement, rather than conducting separate public health and law enforcement interviews. Although the presence of law enforcement during a joint interview can provoke anxiety in the patient and public health, one interview with both agencies might be less disruptive to the patient and the investigation than two or more separate interviews. Additionally, separate questioning by law enforcement and public health can produce conflicting statements, which can jeopardize the outcome of the criminal investigation and public health interventions.

Conclusion

After the anthrax attack in 2001, it was indicated that public health and law enforcement need to develop working relationships for the response to biological and toxic agents 26. Although public health generally has made progress in developing partnerships with law enforcement, additional work remains. As part of the normal turnover in positions and key contacts, new relationships need to be constantly built and trust established. Additionally, it is essential that the information sharing, threat assessment, and joint investigation processes be constantly practiced and refined. Finally, as scientific knowledge increases and technology advances, the nature of biological and toxic threats will evolve. The mitigation of dynamic biological and toxic threats requires robust relationships between public health and law enforcement partners, as well as with other sectors (e.g., agriculture, veterinary medicine, food safety). Only through productive partnerships can public health and law enforcement be ready to respond to intentional biological or toxic events.

Acknowledgments

The authors thank Dr. Toby Merlin and Dr. Satish Pillai for their guidance and contributions to the development of this chapter.

Print
Content Source:
Public Health Infrastructure Center
  1. Kortepeter, MG, Parker GW. Potential biological weapons threats. Emerg Infect Dis. 1999;5:523–7.
  2. Budowle B, Murch R, Chakraborty R. Microbial forensics: the next forensic challenge. Int J Legal Med. 2005;119:317–30.
  3. Title 18 U.S.C. §1038.
  4. Berger KM, Wolinetz C, McCarron K, You E, So KW, Hunt S. Bridging science and security for biological research: international science and security. Proceedings from the meeting, 2013 Feb 4–5; Washington, DC. https://mcmprodaaas.s3.amazonaws.com/s3fs-public/reports/International%20Science%20and%20Security%20AAAS-AAU-APLU-FBI%20%282013%29%20v%202.pdf
  5. Stross JK, Shasby DM, Harlan WR. An epidemic of mysterious cardiopulmonary arrests. N Engl J Med. 1976;295:1107–10.
  6. Torok TJ, Tauxe RV, Wise RP, et al. A large community outbreak of salmonellosis caused by intentional contamination of restaurant salad bars. JAMA. 1997;278:389–95.
  7. US v Sheela et al., CR 86-53, Indictment (D Ore 1986), based on 18 USC §1365(a) and 1365(e).
  8. Takahashi H, Keim P, Kaufmann AF, et al. Bacillus anthracis incident, Kameido Tokyo. Emerg Infect Dis. 2004;10:117–20. Erratum in: Emerg Infect Dis. 2004;10:385.
  9. Kolavic SA, Kimura A, Simons SL, Slutsker L, Barth S, Haley CE. An outbreak of Shigella dysenteriae type 2 among laboratory workers due to intentional food contamination. JAMA. 1997;278:396–8.
  10. Jernigan DB, Raghunathan PL, Bell BP, et al. Investigation of bioterrorism-related anthrax, United States, 2001: epidemiologic findings. Emerg Infect Dis. 2002;8:1019–28.
  11. Centers for Disease Control and Prevention. Nicotine poisoning after ingestion of contaminated ground beef—Michigan. MMWR. 2003;52:413–6.
  12. US Department of Justice. Lake in the Hills man sentenced to federal prison for acquiring and possessing deadly neurotoxin [press release]. https://www.justice.gov/archive/usao/iln/rockford/2012/pr0924_02.pdf
  13. US Department of Justice. New Boston, Texas woman sentenced for ricin letters [press release]. https://www.justice.gov/usao-edtx/pr/new-boston-texas-woman-sentenced-ricin-letters
  14. Federal Bureau of Investigation. Mississippi man Sentenced in ricin letter investigation [press release]. https://www.fbi.gov/jackson/press-releases/2014/mississippi-man-sentenced-in-ricin-letter-investigation-1
  15. Title 18 U.S.C. §2332(f).
  16. Homeland Security Presidential Directive 5. https://www.dhs.gov/sites/default/files/publications/Homeland%20Security%20Presidential%20Directive%205.pdf
  17. Federal Emergency Management Agency. National Response Framework. https://www.fema.gov/national-response-framework
  18. Title 18, U.S.C. §2332(a).
  19. Centers for Disease Control and Prevention. Joint criminal and epidemiological investigations handbook. https://www.cdc.gov/phlp/docs/crimepihandbook2015.pdf
  20. Pub L No 104-191, 110 Stat. 1936 (1996).
  21. 45 CFR §§160, 164.
  22. Quinlisk P, Hutin Y, Carter K, Carney T, Teale K. A community outbreak of hepatitis A involving cooperation between public health, the media, and law enforcement, Iowa 1997. In: Vogelstein B, Kinzler KW, editors. The Genetic Basis of Human Cancer. New York: McGraw-Hill; 2002:93–113.
  23. Treadwell TA, Koo, D, Kuker K, Khan A. Epidemiologic clues to bioterrorism. Public Health Rep. 2003;118:92–118.
  24. Pavlin JA. Epidemiology of bioterrorism. Emerg Infect Dis. 1999;5:528–30.
  25. National Association of State EMS Officials. Joint public health–law enforcement investigations: model memorandum of understanding (MOU). http://www.nasemso.org/Projects/DomesticPreparedness/documents/JIMOUFinal.pdf
  26. Bulter JC, Cohen ML, Friedman CR, Scripp RM, Watz CG. Collaboration between public health and law enforcement: new paradigms and partnerships for bioterrorism planning and response. Emerg Infect Dis. 2002;8:1152–6.