Meet the Scientists on the Frontlines of Protecting Humanity from a Man-Made Pathogen
Jean Peccoud wasn't expecting an email from the FBI. He definitely wasn't expecting the agency to invite him to a meeting. "My reaction was, 'What did I do wrong to be on the FBI watch list?'" he recalls.
You use those blueprints for white-hat research—which is, indeed, why the open blueprints exist—or you can do the same for a black-hat attack.
He didn't know what the feds could possibly want from him. "I was mostly scared at this point," he says. "I was deeply disturbed by the whole thing."
But he decided to go anyway, and when he traveled to San Francisco for the 2008 gathering, the reason for the e-vite became clear: The FBI was reaching out to researchers like him—scientists interested in synthetic biology—in anticipation of the potential nefarious uses of this technology. "The whole purpose of the meeting was, 'Let's start talking to each other before we actually need to talk to each other,'" says Peccoud, now a professor of chemical and biological engineering at Colorado State University. "'And let's make sure next time you get an email from the FBI, you don't freak out."
Synthetic biology—which Peccoud defines as "the application of engineering methods to biological systems"—holds great power, and with that (as always) comes great responsibility. When you can synthesize genetic material in a lab, you can create new ways of diagnosing and treating people, and even new food ingredients. But you can also "print" the genetic sequence of a virus or virulent bacterium.
And while it's not easy, it's also not as hard as it could be, in part because dangerous sequences have publicly available blueprints. You use those blueprints for white-hat research—which is, indeed, why the open blueprints exist—or you can do the same for a black-hat attack. You could synthesize a dangerous pathogen's code on purpose, or you could unwittingly do so because someone tampered with your digital instructions. Ordering synthetic genes for viral sequences, says Peccoud, would likely be more difficult today than it was a decade ago.
"There is more awareness of the industry, and they are taking this more seriously," he says. "There is no specific regulation, though."
Trying to lock down the interconnected machines that enable synthetic biology, secure its lab processes, and keep dangerous pathogens out of the hands of bad actors is part of a relatively new field: cyberbiosecurity, whose name Peccoud and colleagues introduced in a 2018 paper.
Biological threats feel especially acute right now, during the ongoing pandemic. COVID-19 is a natural pathogen -- not one engineered in a lab. But future outbreaks could start from a bug nature didn't build, if the wrong people get ahold of the right genetic sequences, and put them in the right sequence. Securing the equipment and processes that make synthetic biology possible -- so that doesn't happen -- is part of why the field of cyberbiosecurity was born.
The Origin Story
It is perhaps no coincidence that the FBI pinged Peccoud when it did: soon after a journalist ordered a sequence of smallpox DNA and wrote, for The Guardian, about how easy it was. "That was not good press for anybody," says Peccoud. Previously, in 2002, the Pentagon had funded SUNY Stonybrook researchers to try something similar: They ordered bits of polio DNA piecemeal and, over the course of three years, strung them together.
Although many years have passed since those early gotchas, the current patchwork of regulations still wouldn't necessarily prevent someone from pulling similar tricks now, and the technological systems that synthetic biology runs on are more intertwined — and so perhaps more hackable — than ever. Researchers like Peccoud are working to bring awareness to those potential problems, to promote accountability, and to provide early-detection tools that would catch the whiff of a rotten act before it became one.
Peccoud notes that if someone wants to get access to a specific pathogen, it is probably easier to collect it from the environment or take it from a biodefense lab than to whip it up synthetically. "However, people could use genetic databases to design a system that combines different genes in a way that would make them dangerous together without each of the components being dangerous on its own," he says. "This would be much more difficult to detect."
After his meeting with the FBI, Peccoud grew more interested in these sorts of security questions. So he was paying attention when, in 2010, the Department of Health and Human Services — now helping manage the response to COVID-19 — created guidance for how to screen synthetic biology orders, to make sure suppliers didn't accidentally send bad actors the sequences that make up bad genomes.
Guidance is nice, Peccoud thought, but it's just words. He wanted to turn those words into action: into a computer program. "I didn't know if it was something you can run on a desktop or if you need a supercomputer to run it," he says. So, one summer, he tasked a team of student researchers with poring over the sentences and turning them into scripts. "I let the FBI know," he says, having both learned his lesson and wanting to get in on the game.
Peccoud later joined forces with Randall Murch, a former FBI agent and current Virginia Tech professor, and a team of colleagues from both Virginia Tech and the University of Nebraska-Lincoln, on a prototype project for the Department of Defense. They went into a lab at the University of Nebraska at Lincoln and assessed all its cyberbio-vulnerabilities. The lab develops and produces prototype vaccines, therapeutics, and prophylactic components — exactly the kind of place that you always, and especially right now, want to keep secure.
"We were creating wiki of all these nasty things."
The team found dozens of Achilles' heels, and put them in a private report. Not long after that project, the two and their colleagues wrote the paper that first used the term "cyberbiosecurity." A second paper, led by Murch, came out five months later and provided a proposed definition and more comprehensive perspective on cyberbiosecurity. But although it's now a buzzword, it's the definition, not the jargon, that matters. "Frankly, I don't really care if they call it cyberbiosecurity," says Murch. Call it what you want: Just pay attention to its tenets.
A Database of Scary Sequences
Peccoud and Murch, of course, aren't the only ones working to screen sequences and secure devices. At the nonprofit Battelle Memorial Institute in Columbus, Ohio, for instance, scientists are working on solutions that balance the openness inherent to science and the closure that can stop bad stuff. "There's a challenge there that you want to enable research but you want to make sure that what people are ordering is safe," says the organization's Neeraj Rao.
Rao can't talk about the work Battelle does for the spy agency IARPA, the Intelligence Advanced Research Projects Activity, on a project called Fun GCAT, which aims to use computational tools to deep-screen gene-sequence orders to see if they pose a threat. It can, though, talk about a twin-type internal project: ThreatSEQ (pronounced, of course, "threat seek").
The project started when "a government customer" (as usual, no one will say which) asked Battelle to curate a list of dangerous toxins and pathogens, and their genetic sequences. The researchers even started tagging sequences according to their function — like whether a particular sequence is involved in a germ's virulence or toxicity. That helps if someone is trying to use synthetic biology not to gin up a yawn-inducing old bug but to engineer a totally new one. "How do you essentially predict what the function of a novel sequence is?" says Rao. You look at what other, similar bits of code do.
"We were creating wiki of all these nasty things," says Rao. As they were working, they realized that DNA manufacturers could potentially scan in sequences that people ordered, run them against the database, and see if anything scary matched up. Kind of like that plagiarism software your college professors used.
Battelle began offering their screening capability, as ThreatSEQ. When customers -- like, currently, Twist Bioscience -- throw their sequences in, and get a report back, the manufacturers make the final decision about whether to fulfill a flagged order — whether, in the analogy, to give an F for plagiarism. After all, legitimate researchers do legitimately need to have DNA from legitimately bad organisms.
"Maybe it's the CDC," says Rao. "If things check out, oftentimes [the manufacturers] will fulfill the order." If it's your aggrieved uncle seeking the virulent pathogen, maybe not. But ultimately, no one is stopping the manufacturers from doing so.
Beyond that kind of tampering, though, cyberbiosecurity also includes keeping a lockdown on the machines that make the genetic sequences. "Somebody now doesn't need physical access to infrastructure to tamper with it," says Rao. So it needs the same cyber protections as other internet-connected devices.
Scientists are also now using DNA to store data — encoding information in its bases, rather than into a hard drive. To download the data, you sequence the DNA and read it back into a computer. But if you think like a bad guy, you'd realize that a bad guy could then, for instance, insert a computer virus into the genetic code, and when the researcher went to nab her data, her desktop would crash or infect the others on the network.
Something like that actually happened in 2017 at the USENIX security symposium, an annual programming conference: Researchers from the University of Washington encoded malware into DNA, and when the gene sequencer assembled the DNA, it corrupted the sequencer's software, then the computer that controlled it.
"This vulnerability could be just the opening an adversary needs to compromise an organization's systems," Inspirion Biosciences' J. Craig Reed and Nicolas Dunaway wrote in a paper for Frontiers in Bioengineering and Biotechnology, included in an e-book that Murch edited called Mapping the Cyberbiosecurity Enterprise.
Where We Go From Here
So what to do about all this? That's hard to say, in part because we don't know how big a current problem any of it poses. As noted in Mapping the Cyberbiosecurity Enterprise, "Information about private sector infrastructure vulnerabilities or data breaches is protected from public release by the Protected Critical Infrastructure Information (PCII) Program," if the privateers share the information with the government. "Government sector vulnerabilities or data breaches," meanwhile, "are rarely shared with the public."
"What I think is encouraging right now is the fact that we're even having this discussion."
The regulations that could rein in problems aren't as robust as many would like them to be, and much good behavior is technically voluntary — although guidelines and best practices do exist from organizations like the International Gene Synthesis Consortium and the National Institute of Standards and Technology.
Rao thinks it would be smart if grant-giving agencies like the National Institutes of Health and the National Science Foundation required any scientists who took their money to work with manufacturing companies that screen sequences. But he also still thinks we're on our way to being ahead of the curve, in terms of preventing print-your-own bioproblems: "What I think is encouraging right now is the fact that we're even having this discussion," says Rao.
Peccoud, for his part, has worked to keep such conversations going, including by doing training for the FBI and planning a workshop for students in which they imagine and work to guard against the malicious use of their research. But actually, Peccoud believes that human error, flawed lab processes, and mislabeled samples might be bigger threats than the outside ones. "Way too often, I think that people think of security as, 'Oh, there is a bad guy going after me,' and the main thing you should be worried about is yourself and errors," he says.
Murch thinks we're only at the beginning of understanding where our weak points are, and how many times they've been bruised. Decreasing those contusions, though, won't just take more secure systems. "The answer won't be technical only," he says. It'll be social, political, policy-related, and economic — a cultural revolution all its own.
Niklas Anzinger is the founder of Infinita VC based in the charter city of Prospera in Honduras. Infinita focuses on a new trend of charter cities and other forms of alternative jurisdictions. Healso hosts a podcast about how to accelerate the future by unblocking “stranded technologies”.This spring he was a part of the network city experiment Zuzalu spearheaded by Ethereum founder Vitalik Buterin where a few hundred invited guests from the spheres of longevity, biotechnology, crypto, artificial intelligence and investment came together to form a two-monthlong community. It has been described as the world’s first pop-up city. Every morning Vitalians would descend on a long breakfast—the menu had been carefully designed by famed radical longevity self-experimenter Bryan Johnson—and there is where I first met Anzinger who told me about Prospera. Intrigued to say the least, I caught up with him later the same week and the following is a record of our conversation.
Q. We are sitting here in the so-called pop-up network state Zuzalu temporarily realized in the village of Lusticia Bay by the beautiful Mediterranean Sea. To me this is an entirely new concept: What is a network state?
A. A network state is a highly aligned online community that has a level of in-person civility; it crowd-funds territory, and it eventually seeks diplomatic recognition. In a way it's about starting a new country. The term was coined by the crypto influencer and former CTO of Coinbase Balaji Srinivasan in a book by the same title last year [2022]. What many people don't know is that it is a more recent addition or innovation in a space called competitive governance. The idea is that you have multiple jurisdictions competing to provide you services as a customer. When you have competition among governments or government service providers, these entities are forced to provide you with a better service instead of the often worse service at higher prices or higher taxes that we're currently getting. The idea went from seasteading, which was hardly feasible because of costs, to charter cities getting public/private partnerships with existing governments and a level of legal autonomy, to special economic zones, to now network states.
Q. How do network states compare to charter cities and similar jurisdictions?
A. Charter cities and special economic zones were legal forks from other existing states. Dubai, Shenzhen in China, to some degree Hong Kong, to some degree Singapore are some examples. There's a host of other charter cities, one of which I'm based in myself, which is Prospera located in Honduras on the island Roatán. Charter cities provide the full stack of governance; they provide new laws and regulations, business registration, tax codes and governance services, Estonia style: you log on to the government platform and you get services as a citizen.
When conceptualizing network states, Balagi Srinivasan turns the idea of a charter city a bit on its head: he doesn't want to start with this full stack because it's still very hard to get these kinds of partnerships with government. It's very expensive and requires lots of experience and lots of social capital. He is saying that network states could instead start as an online community. They could have a level of alignment where they trade with each other; they have their own economy; they meet in person in regular gatherings like we're doing here in Zuzulu for two months, and then they negotiate with existing governments or host cities to get a certain degree of legal autonomy that is centered around a moral innovation. So, his idea is: don't focus on building a completely new country or city; focus on a moral innovation.
Q. What would be an example of such a moral innovation?
A. An example would be longevity—life is good; death is bad—let's see what we can do to foster progress around that moral innovation and see how we can get legal forks from the existing system that allow us to accelerate progress in that area. There is an increasing realization in the science that there are hallmarks of aging and that aging is a cause of other diseases like cancer, ALS or Alzheimer's. But aging is not recognized as a disease by the FDA in the United States and in most countries around the world, so it's very hard to get scientific funding for biotechnology that would attack the hallmarks of aging and allow us potentially to reverse aging and extend life. This is a significant shortcoming of existing government systems that groups such as the ones that have come together here in Montenegro are now seeking alternatives too. Charter cities and now network states are such alternatives.
Q. Would it not be better to work within the current systems, and try to improve them, rather than abandon them for new experimental jurisdictions?
A. There are numerous failures of public policies. These failures are hard, if not impossible, to reverse, because as soon as you have these policies, you have entrenched interests who benefit from the regulations. The only way to disrupt incumbent industries is with start-ups, but the way the system is set up makes it excessively hard for such start-ups to become big companies. In fact, larger companies are weaponizing the legal system against small companies, because they can afford the lawyers and the fixed cost of compliance.
I don't believe that our institutions in many developed countries are beyond hope. I just think it's easier to change them if you could point at successful examples. ‘Hey, this country or this zone is already doing it very successfully’; if they can extend people’s lifespan by 10 years, if they can reduce maternal mortality, and if they have a massive medical tourism where people come back healthier, then that is just very embarrassing for the FDA.
Q. Perhaps a comparison here would be the relationship between Hong Kong and China?
A. Correct, so having Hong Kong right in front of your door … ‘Hey, this capitalism thing seems to work, why don't we try it here?’ It was due to the very bold leadership by Deng Xiaoping that they experimented with it in the development zone of Shenzhen. It worked really well and then they expanded with more special economic zones that also worked.
Próspera is a private city and special economic zone on the island of Roatán in the Central American state of Honduras.
Q. Tell us about Prospera, the charter city in Honduras, that you are intimately connected with.
A. Honduras is a very poor country. It has a lot of crime, never had a single VC investment, and has a GDP per capita of 2,000 per year. Honduras has suffered tremendously. The goal of these special economic zones is to bring in economic development. That's their sole purpose. It's a homegrown innovation from Honduras that started in 2009 with a very forward-thinking statesman, Octavio Sanchez, who was the chief of staff to the president of Honduras, and then president. He had his own ideas about making Honduras a more decentralized system, where more of the power lies in the municipalities.
Inspired by the ideas of Nobel laureate economist Paul Romer, who gave a famous Ted Talk in 2009 about charter cities, Sanchez initiated a process that lasted for years and eventually led to the creation of a special economic zone legal regime that’s anchored in the Hunduran constitution that provides the highest legal autonomy in the world to these zones. There are today three special economic zones approved by the Honduran government: Prospera, Ciudad Morazan and Orchidea.
Q. How did you become interested and then involved in Prospera?
A. I read about it first in an article by Scott Alexander, a famous rationalist blogger, who wrote a very long article about Prospera, and I thought, this is amazing! Then I came to Prospera and I found it to be one of the most if not the most exciting project in the world going on right now and that it also opened my heart to the country and its people. Most of my friends there are Honduran, they have been working on this for 10 or more years. They want to remake Honduras and put it on the map as the place in the world where this legal and governance innovation started.
Q. To what extent is Prospera autonomous relative to the Honduran government?
A. What's interesting about the Honduran model is that it's anchored within the Honduran constitution, and it has a very clear framework for what's possible and what's not possible, and what's possible ensures the highest degree of legal autonomy anywhere seen in the world. Prospera has really pushed the model furthest in creating a common law-based polycentric legal system. The idea is that you don't have a legislature, instead you have common law and it's based on the best practice common law principles that a legal scholar named Tom W. Bell created.
One of the core ideas is that as a business you're not obligated to follow one regulatory monopoly like the FDA. You have regulatory flexibility so you can choose what you're regulated under. So, you can say: ‘if I do a medical clinic, I do it under Norwegian law here’. And you even have the possibility to amend it a bit. You're still required to have liability insurance, and have to agree to binding arbitration in case there's a legal dispute. And your insurance has to approve you. So, under that model the insurance becomes the regulator and they regulate through prices. The limiting factor is criminal law; Honduran criminal law fully applies. So does immigration law. And we pay taxes.
Q. Is there also an idea of creating a kind of healthy living there, and encourage medical tourism?
A. Yes, we specifically look for legal advantages in autonomy around creating new drugs, doing clinical trials, doing self-medication and experimentation. There is a stem cell clinic here and they're doing clinical trials. The island of Roatán is very easily accessible for American tourists. It's a beautiful island, and it's for regulatory reasons hard to do stem cell therapies in the United States, so they're flying in patients from the United States. Most of them are very savvy and often have PhDs in biotech and are able to assess the risk for themselves of taking drugs and doing clinical trials. We're also going to get a wellness center, and there have been ideas around establishing a peptide clinic and a compound pharmacy and things like that. We are developing a healthcare ecosystem.
Q. This kind of experimental tourism raises some ethical issues. What happens if patients are harmed? And what are the moral implications for society of these new treatments?
A. As a moral principle we believe in medical freedom: people have rights over their bodies, even at the (informed) risk of harm to themselves if no unconsenting third-parties are harmed; this is a fundamental right currently not protected effectively.
What we do differently is not changing ethical norms around safety and efficacy, we’re just changing the institutional setup. Instead of one centralized bureaucracy, like the FDA, we have regulatory pluralism that allows different providers of safety and efficacy to compete under market rules. Like under any legal system, common law in Prospera punishes malpractice, fraud, murder etc. This system will still produce safe and effective drugs, and it will still work with common sense legal notions like informed consent and liability for harm. There are regulations for medical practice, there is liability insurance and things like that. It will just do so more efficiently than the current way of doing things (unless it won’t, in which case it will change and evolve – or fail).
A direct moral benefit ´to what we do is that we increase accessibility. Typical gene therapies on the market cost $1 million dollars in the US. The gene therapy developed in Prospera costs $25,000. As to concern about whether such treatments are problematic, we do not share this perspective. We are for advancing science responsibly and we believe that both individuals and society stand to gain from improving the resiliency of the human body through advanced biotechnology.
Q. How does Prospera relate to the local Honduran population?
A. I think it's very important that our projects deliver local benefits and that they're well anchored in local communities. Because when you go to a new place, you're seen as a foreigner, and you're seen as potentially a danger or a threat. The most important thing for Prospera and Ciudad Morazan is to show we're creating jobs; we're creating employment; we're improving people's lives on the ground. Prospera is directly and indirectly employing 1,100 people. More than 2/3 of the people who are working for Prospera are Honduran. It has a lot of local service workers from the island, and it has educated Hondurans from the mainland for whom it's an alternative to going to the United States.
Q. What makes a good Prosperian citizen?
A. People in Prospera are very entrepreneurial. They're opening companies on a small scale. For example, Vehinia, who is the cook in the kitchen at Prospera, she's from the neighboring village and she started an NGO that is now funding a school where children from the local village can go to instead of a school that's 45 minutes away. There's very much a spirit of ‘let's exchange and trade with each other’. Some people might see that as a bit too commercial, but that's something about the culture that people accept and that people see as a good thing.
Q. Five years from now, if everything goes well, what do we see in Prospera?
A. I think Prospera will have at least 10,000 residents and I think Honduras hopefully will have more zones. There could be zones with a thriving industrial sector and sort of a labor-intensive economy and some that are very strong in pharmaceuticals, there could also be other zones for synthetic biology, and other zones focused on agriculture. The zones of Prospera, Ciudad Morazan and Orchidea are already showing the results we want to see, the results that we will eventually be measured by, and I'm tremendously excited about Honduras.
How to Measure Your Stress, with Dr. Rosalind Picard
Today’s podcast guest is Rosalind Picard, a researcher, inventor named on over 100 patents, entrepreneur, author, professor and engineer. When it comes to the science related to endowing computer software with emotional intelligence, she wrote the book. It’s published by MIT Press and called Affective Computing.
Dr. Picard is founder and director of the MIT Media Lab’s Affective Computing Research Group. Her research and engineering contributions have been recognized internationally. For example, she received the 2022 International Lombardy Prize for Computer Science Research, considered by many to be the Nobel prize in computer science.
Through her research and companies, Dr. Picard has developed wearable sensors, algorithms and systems for sensing, recognizing and responding to information about human emotion. Her products are focused on using fitness trackers to advance clinical quality treatments for a range of conditions.
Meanwhile, in just the past few years, numerous fitness tracking companies have released products with their own stress sensors and systems. You may have heard about Fitbit’s Stress Management Score, or Whoop’s Stress Monitor – these features and apps measure things like your heart rhythm and a certain type of invisible sweat to identify stress. They’re designed to raise awareness about forms of stress such as anxieties and anger, and suggest strategies like meditation to relax in real time when stress occurs.
But how well do these off-the-shelf gadgets work? There’s no one more knowledgeable and experienced than Rosalind Picard to explain the science behind these stress features, what they do exactly, how they might be able to help us, and their current shortcomings.
Dr. Picard is a member of the National Academy of Engineering and a Fellow of the National Academy of Inventors, and a popular speaker who’s given over a hundred invited keynote talks and a TED talk with over 2 million views. She holds a Bachelors in Electrical Engineering from Georgia Tech, and Masters and Doctorate degrees in Electrical Engineering and Computer Science from MIT. She lives in Newton, Massachusetts with her husband, where they’ve raised three sons.
In our conversation, we discuss stress scores on fitness trackers to improve well-being. She describes the difference between commercial products that might help people become more mindful of their health and products that are FDA approved and really capable of advancing the science. We also talk about several fascinating findings and concepts discovered in Dr. Picard’s lab including the multiple arousal theory, a phenomenon you’ll want to hear about. And we explore the complexity of stress, one reason it’s so tough to measure. For example, many forms of stress are actually good for us. Can fitness trackers tell the difference between stress that’s healthy and unhealthy?
Show links:
- Dr. Picard’s book, Affective Computing
- Dr. Picard’s bio
- Dr. Picard on Twitter
- Dr. Picard’s company, Empatica - https://www.empatica.com/ - The FDA-cleared Empatica Health Monitoring Platform provides accurate, continuous health insights for researchers and clinicians, collected in the real world
- Empatica Twitter
- Dr. Picard and her team have published hundreds of peer-reviewed articles across AI, Machine Learning, Affective Computing, Digital Health, and Human-computer interaction.
- Dr. Picard’s TED talk
Rosalind Picard