Preventing 'Insider Threats' at Biodefense Labs a Matter of Culture not Rules: NRC Report

E-mail Print


Would recommended lab procedures have prevented the 2001 anthrax killings traced to a researcher at the US Army Medical Research Institute of Infectious Diseases?

By This e-mail address is being protected from spambots. You need JavaScript enabled to view it HSO Editor

In 2008, seven years after five people died and dozens were injured from anonymous mailings of anthrax, the FBI said it had identified the perpetrator as Bruce Edward Ivins, a senior biodefense researcher at the US Army Medical Research Institute of Infectious Diseases at Fort Detrick, Maryland. After Ivins apparently committed suicide by overdosing on Tylenol PM, the incident launched strong debates within the biological select agents and toxins (BSAT) laboratory community about how to hire and monitor personnel.


If Ivins could presumably cause mayhem despite mandatory background checks and security measures, should labs change their personnel procedures?


According to a recent report by the National Research Council of the National Academies of Science, Responsible Research with Biological Select Agents and Toxins, current hiring and monitoring procedures of lab personnel are adequate but could benefit from some changes.


First, the report found that the current way of checking job candidates against databases is adequate. The Security Risk Assessment (SRA) relies on the standard criminal, immigration, and terrorist databases maintained by the Federal Bureau of Investigation (FBI) and Department of Homeland Security (DHS) for these purposes and are used to conduct routine suitability or security screening for other federal agencies, the report stated. The committee concluded that the databases being used in the SRA are consistent with current US government practices in determining the eligibility of persons to have access to classified and proprietary information and sensitive sites and are adequate for assessing whether applicants possess disqualifying background/activities.


The report calls into question the traditional practice of drug testing to weed out insider threats. The committee concluded that there was insufficient information to say that routine or random drug testing would significantly reduce the risk of an insider threat. The committee noted, however, that use of illegal drugs provides insight into a person's judgment and reliability, which are critical attributes for those with access to highly pathogenic infectious agents.


The report also noted current procedures may dismiss skilled candidates. While the number of job candidates who represent a security risk is unknown, the number is likely to be very small. As a result, the more measures employed to disqualify a potential candidate, the more often qualified candidates are turned away. Again, while drug use may be an indication of an applicant's unsuitability for a laboratory position, checking his or her financial situation -- a standard check in many employment screening processes -- is difficult to administer and may yield false reports on otherwise qualified applicants. The committee concluded that the difficulties in establishing a meaningful baseline make adding credit or financial history to the SRA screening process too challenging. In any event, signs of sudden, unexplained affluence or evidence of irresponsible financial behavior would be appropriate to consider as part of the process of monitoring employees' behavior.


Another change suggested by the report is that a more robust appeal process be established. Currently, the only grounds for appeal hinge on challenging incorrect facts about a person's background. The current appeal criteria does not take into account how long ago an offense occurred, its severity or extenuating circumstances. This, again, could turn away many qualified candidates. The committee concluded that the questions raised about the current automatic and permanent disqualifications were sufficiently serious that it would be worthwhile to change the system to incorporate a broader appeal process more aligned with personnel security practices already in place across the government.


In the end, the report concluded, there is no 'silver bullet ' when it comes to hiring and monitoring lab personnel who work with toxins. Even the use of lie detectors or polygraphs does not promise strong outcomes.


What may yield the best results is for laboratories to foster an environment where individuals watch out for each other and take responsibility for both their own performance and that of others. When this works well, the environment and culture reinforce a positive and inclusive ethic that promotes excellent performance. Security then becomes an additional goal, although many of the components of a safety-oriented culture serve security goals as well.


A vital component is a culture of trust and responsibility on the part of all workers. Management plays an essential role and has important responsibilities, not the least of which is to provide mechanisms for people to self-report problems and relay concerns about others via a safe mechanism (e.g., ombuds offices, hotlines, confidential reporting systems) and to enable individuals to obtain help in dealing with concerns proactively (e.g., employee assistance programs). Although often focused on safety concerns, these processes can serve security as well.

The full report, which included other findings and recommendations, can be accessed here.


Share

Comments (0)Add Comment

Write comment
smaller | bigger

security code
Write the displayed characters


busy
 
Banner

Upcoming Training and Events

Banner

Banner
AddThis Social Bookmark Button

Become a Fan on Facebook