Biocrime or bioterrorism is the threat or use of microorganisms, toxins, pests, prions, or their associated ancillary products to commit acts of crime or terror. Microorganisms can malevolently be used as biological warfare agents, in bioterrorist acts, and in crimes without political intentions. Such actions can be directed against humans and animals and can lead to outbreaks of infections with high morbidity and mortality. In recent years microbial forensics has been established as a new scientific discipline to strengthen the law enforcement response especially in a bioterrorism event . These tools can also be applied to investigate the transmission of pathogenic microorganism caused by sexual abuse and other physical offenses .
The aim of this review is to describe the corner stones of microbial forensics as a novel type of forensic analysis defined as “the detection of reliably measured molecular variations between microbial strains and their use to infer the origin, relationships, or transmission route of a particular isolate” .
Several microorganisms are a severe threat to human and/or animal health and a country's agricultural economy. Their malevolent use can have a major socio-economic impact. A number of these pathogens can affect both humans and animals [zoonoses], can contaminate the environment for decades, or may establish new enzootic foci. The World Organisation for Animal Health [OIE] lists several of these agents as diseases of importance to international trade with serious export restrictions for countries where the diseases are endemic.
Biological warfare agents to be used against humans and animals were developed and weaponized in the fifties of the last century in several countries including the USA, the former Soviet Union and the United Kingdom. An international arms control and disarmament treaty, the Biological Weapons Convention [BWC], banned the use of biological weapons in 1972 [http://www.opbw.org/convention/documents/btwctext.pdf]. Today only few states are under suspicion of having biological warfare programs. Politically-binding confidence building measures provide a permanent transparency tool for building confidence in compliance with the BWC.
In the aftermath of the anthrax letters attacks in October 2001 that killed five people it has become evident that biocrimes can only be solved when genomic information can be used to identify the source of an organism. Evidence in a criminal investigation must be collected within the constraints of legal rules to ensure that any prosecution based upon that evidence can withstand judicial review in a court. Therefore, first responders must learn how to secure evidence and preserve the chain of custody . Quality-assurance and –control procedures have to assure that reliable evidence can be presented in court . Laboratories that have been officially accredited will be able to provide all relevant documents regarding quality control and assurance, proficiency test results, qualification of laboratory personnel etc. Also case specific material like photographs of gels, benchnotes, validation studies, and controls will usually be adequately documented. Evidence collection, transport, and storage need more attention than is usually needed for clinical routine samples. Test procedure will be according to standard operating procedures [SOPs] and any deviation of protocols will have to be documented. The final report should contain information about the specificity and accuracy of the applied tests and provide an interpretation of the result and its limitations.
Nucleic amplification and molecular-epidemiological techniques are essential tools in clinical microbiology for identifying pathogens and in outbreak investigations. Various typing tools have been developed for phylogenetic and phylogeographic studies. In forensic microbiology these methodologies can be used to detect and trace back the spread of microorganisms in the context of a crime. Whole-genome sequencing provides the most comprehensive, reliable and reproducible information about a strain, but until recently this technique was expensive and time consuming. The subsequent annotation of sequences was also a major endeavor. Nowadays this technique has become affordable and reference genomes for all select agents have been sequenced. They can be used to clarify the relationship of suspicious isolates with reference genomes.
Centralized reporting and surveillance systems on the national and international level are essential as single cases may be regarded as sporadic although they are part of a larger transboundary outbreak. Surveillance systems have already been established that store and provide DNA fingerprints of microbes being major causes of hospital-acquired or food borne infections.
Descriptive epidemiological data have to be analyzed with caution. Natural outbreaks can be difficult to discriminate from intentional use of microorganisms, especially if the organisms are endemic. Only molecular-epidemiological tools can corroborate the chain of infection.
This review will discuss the value of diagnostic and molecular-epidemiological tools developed for select agents and will provide examples of investigations focused on for example Bacillus anthracis, Francisella tularensis, and Yersinia pestis. The critical role of sample collection, packaging, transport, and storage will be highlighted.
2. Sample collection
Laboratories involved in forensic microbiology analysis must be prepared to deal with chain-of-custody documentation, secure storage of evidence, tracking of individual items of evidence and their derivatives and all the legal requirements for handling evidence. Chain- of-custody protocols document the unbroken chain of records showing who had handled the evidence, where and under which conditions [temperature, time etc.] the material had been stored and whether access to the samples was restricted . The NATO document AEP-10 “Handbook for Sampling and Identification of Biological and Chemical Agents [SIBCA]”, 2007, 5th Edition, Procedures and Techniques, Volume 1 [STANAG 4329] provides practical guidelines how to sample select agents in the field even in a contaminated environment. These guidelines are used by NATO and Partnership for Peace [PFP] countries. Countries may have different national requirements, but general principles can be a guideline for Civilian-Military Cooperation [CIMIC] or purely civilian operational and forensic investigation teams. The European Guideline on Principles of Field Investigation “Biological Incident Response and Environmental Sampling” was published by the EU Commission, DG Health and Consumer Protection, Health Threats Unit in October 2006 and “describes the principles of response in the initial phase of a biological incident where the goal is to identify what has happened in order to initiate appropriate countermeasures”. These documents underline the necessity of planning and pre-mission briefings as the environment may be life-threatening. Moreover, the quality of primary samples is critical for subsequent analyses. The personal protective equipment is also affecting personnel by limiting mobility, flexibility, and time available to work at the scene .
3. Sample matrix analysis
In clinical microbiology the sample matrix is important to decide, whether the analyses requested by the clinician are appropriate and which tests should be performed. Unfortunately, requests are not always justified by the clinical presentation and the sample matrix is sometimes conflicting. For example a microscopical inspection of sputum samples will indicate, if the quality of the specimens is adequate. In forensic microbiology the same rules apply, but more detailed investigations may be necessary to obtain relevant information about the history of a specimen, environmental conditions, chemical and physical constitution of the matrix, presence of pollen etc. .
This can be achieved by particle sizing, electron microscopy, analytical chemistry, isotope analysis, and other techniques. However, several analyses will have to be performed outside appropriate laboratory safety containment [e.g. BSL-3 for Y. pestis] and therefore, specimens will have to be inactivated. Especially when anthrax spores have to be killed the inactivation with chemical or physical techniques is quite aggressive. This treatment does not only denature the pathogens but will also cause changes of the matrix. It has to be demonstrated for each method that the inactivation process does not interfere with the subsequent tests.
4. Biological agents
The Centers for Disease Control [CDC] in Atlanta have evaluated the priority of agents according to their relevance for national security due to ease of dissemination and transmission from person to person, high mortality rates, the potential for major public health impact, risk of public panic and social disruption, and the requirement of special action for public health preparedness. Category A includes the most dangerous agents: Variola major virus [smallpox], Bacillus anthracis [anthrax], Yersinia pestis [plague], Clostridium botulinum toxin [botulism], Francisella tularensis [tularemia], and viral hemorrhagic fever viruses .
4.1. Microbe identification by classical microbiology
The identification of microbial agents – as defined by the SIBCA handbook - can be provisional [presumptive], when immunological methods, nucleic acid detection or cultivation and metabolic assays have been tested positive. Identification is confirmed by the combination of at least two of the above mentioned criteria. Unambiguous identification requires cultivation and in vivo studies [animal models] that prove the pathogenicity of the agent. However, animal models should be avoided for ethical reasons whenever possible.
Biological agents can be difficult to cultivate due to sample contamination, low number of bacteria or pretreatment of patients with antibiotics. Some bacteria are fastidious [F. tularensis, Brucella spp.] and require special nutrient media, and some need prolonged cultivation times [Brucella spp.]. Phenotypical characteristics such as antibiotic susceptibility and biochemical reaction profiles, susceptibility to specific phages, colony morphology and others are not always reliable. Mutations of agents can be induced or engineered, but naturally occurring atypical strains have also been found e.g. among Bacillus anthracis and Yersinia pestis isolates which can result in misidentification and treatment failure . Commercial biochemical identification systems are not optimized for these agents and can result in misidentification. Multiple antimicrobial resistances can occur through natural horizontal gene transfer or by genetic manipulation. Natural resistance to a multitude of antimicrobials is typical for Burkholderia pseudomallei. Francisella tularensis is naturally resistant to penicillins and cephalosporines. A very dangerous multidrug resistant strain of Yersinia pestis has been isolated from a patient with bubonic plague in Madagascar. This strain carries a self-transmissible plasmid with a genetic backbone also prevalent among Escherichia coli, Klebsiella spp. and Salmonella spp. conferring high-level resistance to streptomycin, tetracyclin, chloramphenicol, and sulfonamides . These facts underline the importance of cultivation and the assessment of antimicrobial susceptibility in addition to more rapid diagnostic tools. A polyphasic approach for identification and typing will help to avoid problems due to atypical genotype and phenotype, inhibition, or lack of specificity or sensitivity of assays.
Handling of select agents is highly dangerous and cumbersome and restricted to laboratories with biosafety-level 3 containment. Biosafety-level 3 laboratories have to be operated according to special regulations that require e.g. a sophisticated ventilation system and personal protective equipment [e.g. FFP3 masks, overalls, face shields, gloves etc.].
4.2. Nucleic acid amplification techniques
Many real-time PCR assays are highly specific and sensitive and shorten the time required to establish a diagnosis in comparison with conventional PCR protocols, cultivation, and biochemical identification methods. Therefore, real-time PCR assays have been developed for the identification of Bacillus anthracis, Brucella spp., Burkholderia mallei and Burkholderia pseudomallei, Francisella tularensis and Yersinia pestis . PCR results can be false negative due to inadequate quality of clinical samples, low number of bacteria in samples, DNA degradation, inhibitory substances and inappropriate DNA preparation.
Seroconversion may prove the exposure to a certain agent in the past. However, seroconversion can be expected only after several days or weeks and is of little use for rapidly diagnosing infections caused by highly pathogenic agents. It will be difficult to organize serological investigations [including follow-up tests] when a terrorist attack causes mass casualties that need medical treatment or when the situation is complicated by civil unrest, war or natural catastrophes at the same time.
Various immunological assays have also been used to identify pathogens in samples of patients and environmental samples. Hand-held test kits can be used as bed-side tests and are useful under field conditions, but clinical validations hardly exist and most tests are “for scientific use only”. Immunochromatographic lateral-flow assays have been developed e.g. for brucellosis, tularemia, and plague [4; 29; 37; 44]. Limitations of these immunological assays are that they are frequently not available commercially, not specific enough, or have not been validated and licensed for use in humans or animals. Moreover, cross-reactions may cause false positives and modified or missing antigenic structures can cause false negatives.
5. Typing and strain identification
Differences among microbes have to be assessed to determine whether strains are from the same source or lineage or from a different origin. The accuracy and precision will depend on the typing method, expected mutation rates, and other characteristics of the organism. In court scientists may need to quantify the reliability of a relationship among strains determined using molecular phylogenetic analyses. This will establish the probability of association to a certain source of infection .
Techniques for forensic microbiology can be very similar to those being used for phylogenetic and epidemiological investigations e.g. for food-borne outbreaks.
Molecular-epidemiological tools used for genotyping are most promising and have been applied in the past to elucidate the origin of biological agents. Especially whole genome sequencing and bioinformatic tools for comparison of genomes are potent tools, but technical complexity and costs are still prohibitive for routine application.
In several chapters of the highly recommendable book “Microbial Forensics” by Bruce Budowle and many other “founders” of this new scientific discipline it was demonstrated that only highly specialized knowledge of microbial genetics will allow an assessment of the relevance of typing results obtained by Multi-locus Sequence Typing [MLST], Variable Number of Tandem Repeats [VNTR], Single Nucleotide Polymorphisms [SNPs] analysis or other typing tools [“Microbial Forensics” B. Budowle. ISBN 978-0-12-382006-8]. Validation of typing assays and data of large collections of strains from all over the world are crucial for microbial forensic investigations. Typing methods should be reproducible, stable during the study period, applicable to every isolate, discriminating among isolates, and discrimination should be concordant with the epidemiological picture . DNA sequence-based data are robust, portable, easy to compare, and amenable to computerised analysis for phylogeographical and epidemiological studies. However, the quality of open access sequence databases depends on the accuracy of submitted sequences and is consequently sometimes not reliable.
6. Select agents
Bacillus [B.] anthracis is the causative agent of anthrax and a member of the Bacillus cereus group. This group includes B. anthracis, B. cereus, B. thuringiensis, B. weihenstephanensis, and B. mycoides. These closely related bacteria can be discriminated by using phenotypic characteristics. B. anthracis is typically non-motile, susceptible to penicillin, lysed by the gamma phage, and colonies are non-hemolytic with a typical morphology. However, more than 24 hours are required to assess these characteristics and misidentification can occasionally occur due to variations of the phenotype. Natural infections result mostly in cutaneous anthrax. Anthrax caused by inhalation is rare, but the spores of B. anthracis can easily be disseminated in aerosols. The spores are very stable and persist in the environment especially in soil for many years or even decades .
In the fall of 2001 an attack with “anthrax letters” resulted in 22 cases including five deaths in the USA. This incident was investigated using VNTR analysis as described by Keim  and sequencing of pag A coding for the protective antigen which is one of the toxin genes of the bacterium. The obtained B. anthracis strains were all identical and could be identified as the Ames strain [18; 31]. The Ames strain was originally isolated from cattle in Jim Hogg County, Texas, in 1981 . Whole genome sequencing revealed Ames specific SNPs and real-time PCR assays using TaqMan MGB probes were designed to rapidly identify the strain that was used in the bioterrorist attacks . This was a novel microbial forensic tool for differentiating natural outbreaks from an attack. However, in 2001 the CDC used MLVA for subtyping isolates and in a future attack other strains might be used which would require fast adaptation of this methodology. Massively parallel sequencing [MPS] technology will allow rapid whole-genome characterization .
Plague is caused by the gram-negative bacterium Yersinia pestis and is still endemic in natural foci of Asia, Africa, and America in rural areas . The affected population is mostly poor and is living under deplorable hygienic conditions. Due to the high lethality of plague a rapid and reliable identification of the organism is crucial, but medical services and laboratory facilities are very scarce in the endemic regions of Africa and Central Asia.
The validation of diagnostic assays for infectious diseases like plague can be demanding because of very limited access to clinical samples and isolates. None of the previously published real-time PCR assays for diagnosing plague had been clinically validated so far.
In Madagascar a relevant number of cases is reported each year and a good surveillance system based on the well equipped laboratory facility at the Institut Pasteur in the capital Antananarivo is in place. In a retrospective clinical study we evaluated real-time PCR assays by testing lymph node aspirates from 149 patients with a clinical diagnosis of bubonic plague. In this study results of real-time PCR assays targeting the virulence plasmids pPCP1 [pla], and pMT1 [caf1 and Ymt] were compared with an F1-antigen immunochromatographic test [ICT] and cultivation of the organism. Out of the 149 samples infection with Y. pestis was confirmed by culture in 47 patients while ICT was positive in 88 patients including all culture proven cases. The most efficient real-time PCR assay was the 5´-nuclease assay targeting pla being positive in 120 cases. It can therefore be recommended as diagnostic tool for establishing a presumptive diagnosis when bubonic plague is clinically suspected . Assays for targets on the chromosome and on the second Y. pestis specific plasmid were included because strains lacking one of the specific plasmids occur naturally and can also be highly pathogenic [13; 51].
The evolution and phylogenetic analysis of Y. pestis has been studied with MLVA and Clustered Regularly Interspaced Short Palindromic Repeats [CRISPR] [8; 24]. These genotyping tools can also be used to trace a particular isolate and to determine its geographic origin. VNTRs will facilitate to distinguish between infections caused by attacks and naturally occurring plague infections. Isolates from human cases can be linked now effectively with isolates from environmental sources . A genetic match with environmental isolates was found in four out of nine human cases.
Whole-genome characterization of Y. pestis strains revealed dozens of SNPs per strain that differ relative to a reference genome and can be used for forensic microbiological investigations in the future .
6.3. Glanders and melioidosis
Burkholderia [B.] mallei is a gram-negative bacterium causing glanders and farcy in horses, donkeys, and mules [solipeds] and has been classified by the CDC as a priority category B biological agent.
Glanders in horses presents with pneumonia, purulent nasal discharge, and poor general condition, whereas farcy is a chronic cutaneous disease with massively enlarged lymph vessels [“farcy-pipes”] and nodules developing into ulcers. Equines are the only known reservoir for sporadic infections in humans. Humans develop a clinical picture resembling melioidosis which is caused by the closely related bacterium B. pseudomallei.
In 2004, an outbreak of glanders in horses was reported to the Office International des Epizooties by the United Arab Emirates. In addition to cultivation and phenotypical identification a new real-time PCR assay was developed for the specific identification of B. mallei, which detected the bacteria in tissues of two horses .
B. pseudomallei is the etiologic agent of melioidosis, a tropical disease that is highly endemic in Southeast Asia and Northern Australia. B. pseudomallei is a facultative intracellular, opportunistic pathogen that can be acquired by inhalation or by contact of skin lesions with contaminated soil or water. The clinical presentation of melioidosis is variable including subclinical infection, cutaneous lesions, fulminate septicaemia and rapidly progressing pneumonia. Identification of the pathogen and specific antimicrobial therapy are critical, because B. pseudomallei is resistant to ampicillin and broad- and expanded-spectrum cephalosporines due to the production of a beta-lactamase.
Real-time PCR assays have been developed as rapid identification tools, but several assays were evaluated with strain collections and spiked samples only [30; 40; 41; 43]. In fatal septicaemia the amount of bacterial DNA that can be extracted from blood is high enough to be detectable using real-time PCR , but a study in Thailand has shown that this diagnostic tool may be of little clinical value when compared with conventional diagnostic approaches . MLST analyses have shown that strains from Thailand and Australia can be discriminated and that some sequence types found in environmental samples are underrepresented among clinical isolates thus indicating that they may be less pathogenic for humans [12; 48]. However, VNTR typing did not reproduce this geographic discrimination, but proved to have a higher resolving power that can be used to analyse outbreaks for microbial forensic purposes [11; 45].
Francisella [F.] tularensis is a biological agent of category A and the causative agent of tularemia. The subspecies F. tularensis subsp. holarctica can be found in many regions of the northern hemisphere, but the subspecies F. tularensis subsp. tularensis occurs only in North America. Surprisingly, isolates of F. tularensis subsp. tularensis were recovered repeatedly from fleas and mites captured in the region of the Danube river basin, close to Bratislava in Slovakia . This was extremely unusual and warranted further investigations. Multiple-locus variable-number tandem repeat analysis has been developed to elucidate the worldwide genetic relationships among F. tularensis isolates and to distinguish natural outbreaks from intentional [terrorist] dissemination . The two Slovakian isolates clustered with the highly pathogenic laboratory strain Schu4. The isolate FSC198 was finally sequenced completely and found to be almost identical to the laboratory strain Schu4 . A comparison of mutation patterns of an isolate propagated from Schu4 in vitro [FSC043] and FSC198 indicated that FSC198 diverged from its progenitor Schu4 and has subsequently passed life-cycles in a natural environment . This is a remarkable example for a microbial forensic investigation that also demonstrates how much effort is needed to elucidate the potential origin of an isolate and under which conditions it may have propagated.
In the above mentioned study it was not possible to clarify the phylogeographic expansion of F. tularensis completely . This can be explained by the low genetic diversity of F. tularensis subsp. holarctica and the limited number of Francisella strains available from certain geographic regions. Local inconsistencies in the genetic relationship were found and attributed to homoplasy effects. Recently, the phylogeography of F. tularensis was further investigated using SNP analysis and insertion/deletion events [INDELS] [39; 49]. This is a promising straight forward approach that can be used to analyze the relationship of closely related strains. Outbreaks on a local scale can be investigated and the work load of sequencing of relevant gene loci is acceptable and affordable.
7. Animal pathogens and agroterrorism
“Agroterrorism is the deliberate tampering with and/or contamination of the food supply with the intent of adversely affecting the social, economic, physical and psychological well-being of society” . Agroterrorism carries less risk for the terrorist, could be carried out more covertly, and does not require sophisticated methodology for weaponization . Important vulnerabilities are intensive production practices, increased susceptibility of immunologically naïve animal populations, and rapid and fast movement of animals and their products over long distances . Attacks can result in disastrous economic losses due to eradication measures [mass culling], international trade embargos, loss of jobs, increased consumer costs, and may even cause difficulties in sustaining the food supply .
8. Quality assurance
Quality assurance is required to verify whether practices and test results are providing reliable and relevant information and quality control can verify whether test conditions are functioning appropriately to yield reproducible results. The Scientific Working Group on Microbial Genetics and Forensics has developed Quality Assurance Guidelines for Laboratories Performing Microbial Forensic Work to provide a framework for laboratories that carry out microbial forensic analysis .
9. Reporting and surveillance systems
The Global Early Warning and Response System for Major Animal Diseases, including Zoonoses [GLEWS] is the combined effort of WHO, FAO, and OIE. For zoonotic events, alerts of animal outbreaks can provide direct early warning so that human surveillance could be enhanced and preventive action taken.
Crops, rangeland and forests can also be targets of biological attacks. However, the field of plant pathogen forensics is beyond the scope of this chapter. The interested reader can be referred to a comprehensive review written by Fletcher et al. .
Profiling of forensic soil samples by determining the bacterial content may provide valuable information, but depends on several factors such as heterogeneity within a habitat, distance of collection sites, and time [15; 28].
Microbial forensics is a young scientific discipline and probably only few scientists and institutions are aware of the methodological and quality assurance requirements. Epidemiological tools can be used to trace strains and to clarify the chain of infection, but typing systems have to be especially evaluated for forensic purposes. Classical microbiological techniques are indispensable, but most recent developments including very rapid whole genome sequencing complement the polyphasic approach needed for diagnostics and typing. Only large collections of strains from all over the world and high quality sequence data will provide the basis for meaningful results in microbial forensic investigations. International and interdisciplinary cooperation will improve our capabilities to rapidly identify the agents, elucidate the source, and provide these results as evidence in court.