We live in an age of breathtaking advances in the life sciences. Achievements in sequencing, or plotting the genetic blueprint of an organism, have been astounding, and may lead to great benefits in public health and medicine. But biological research can be dual-use: that which improves the lot of mankind can also be flipped around to create disease.

Mother nature does this through mutation. But how serious is the threat that a person would deliberately create a dangerous agent, and harm others with it? Do terrorists, or nations, harbor the intention, and can they summon the capability?

While some diseases occur easily in nature and are highly contagious, others require sophisticated work before they can be used as a weapon, and are probably too difficult for today's terrorist groups, although not for nation-states. The Aum Shinrikyo cult in Japan tried to make a biological weapon but failed. During the Cold War, the Soviet Union clandestinely build a massive biological weapons research and production complex. In 2001, five letters carrying anthrax spores were put in the U.S. mail, at least 22 people were sickened and five died. According to the FBI, it was the act of a lone insider in a U.S. military biological defense laboratory. (For a look at bioweapons over the last century, see this article by Milton Leitenberg, senior research scholar at the Center for International Security Studies, University of Maryland.)

Two recent events have rekindled long-standing questions about how far we should go to prevent the deliberate creation and spread of biological agents for use in war and terrorism. There aren't easy answers.

The first event is the just-completed review conference in Geneva for the Biological and Toxin Weapons Convention. Signed in 1972 and put into force in 1975, the treaty bans the development, production, acquisition, retention, stockpiling and transfer of infectious disease agents and natural poisons (toxins) for hostile purposes, and the weapons or other delivery systems for them. Unfortunately, the agreement has never had a serious verification mechanism. The treaty failed to stop the Soviet Union, South Africa and Iraq from attempting to build illicit biological weapons programs.

Every five years, a treaty review conference is held in Geneva. On Dec. 7, Secretary of State Hillary Rodham Clinton became the first U.S. Secretary of State to address a review conference.  She declared that the risk of a bioweapons attack is "both a serious national security challenge and a foreign policy priority" for the United States. "A crude, but effective, terrorist weapon can be made by using a small sample of any number of widely available pathogens, inexpensive equipment, and college-level chemistry and biology," she declared.

But at the same time, the United States has abandoned efforts to put legally-binding verification measures into the treaty. The argument is that scientific research has advanced so swiftly that traditional arms control measures are obsolete. In 2001, the Bush administration scuttled a negotiation over the previous six and a half years aimed at creating a protocol for improved verification and transparency. President Obama has not changed this position. Clinton told the review conference "it is not possible, in our opinion, to create a verification regime that will achieve" the goal of bolstering confidence that all nations are complying with the treaty. Instead, she called for some "other steps" such as revising the annual reporting system in which countries are supposed to be transparent about potentially dangerous biological activities.

Judging by some preliminary reports from those who attended, the review conference made little or no progress in strengthening the treaty. Five countries -- Pakistan, Russia, India, Iran and China -- largely blocked any major progress. As a result, the conference outcome was to once again kick the can down the road to future meetings.

Consider this: a three-person staff, known as the "Implementation Support Unit," is assigned to work on treaty issues in between the review conferences. A proposal to expand the staff to five people failed to gain support in Geneva. In contrast, the Organization for the Prohibition of Chemical Weapons, which oversees the 1993 chemical weapons treaty, has a staff of about 500 people. That pact contains tough verification provisions.

How dysfunctional is the biological weapons treaty? There is a reporting system, created in 1987. Each year, nations are supposed to submit a report known as a Confidence Building Measure detailing research, disease outbreaks, legislation and past activities, among other things. In the last year, fewer than 40 percent of signatories to the treaty even bothered to submit the forms. If nations can't lift a finger to do the paperwork, how much effort are they going to put into watching out for abuses?

At the review conference, there was renewed discussion about focusing on the rapid changes in life sciences. Sounds good. But there seems to be little willpower, either in the United States or elsewhere, to do anything about the fact that the biological weapons convention is a toothless tiger.

The second recent event was caused by a laboratory experiment. Researchers led by Ron Fouchier of Erasmus Medical Center in Rotterdam modified the H5N1 virus, better known as avian influenza or bird flu. Up until now, the virus has been quite lethal in humans, with a fatality rate of about 60 percent in confirmed cases, but it has not been very transmissible among people. The researchers under Fouchier introduced a number of mutations into the virus that could make it highly transmissible through the air, and they demonstrated this in ferrets, which are considered a good stand-in model for humans in testing influenza strains. The experiment was carried out in a special, high-security laboratory, but it raised a terrifying prospect -- if the modified strain got out, or was created somehow by a person with malevolent intent, it could lead to a devastating pandemic. In announcing his results, Fouchier said he wanted to help prevent just such a deadly crisis: “We now know which mutations to watch for in the case of an outbreak and we can then stop the outbreak before it is too late. Furthermore, the finding will help in the timely development of vaccinations and medication.”

The research raised the question of whether the results should be published. (Another study along similar lines was also performed by scientists at the University of Wisconsin and University of Tokyo.) After a review by the National Science Advisory Board for Biosecurity, the U.S. government took the unprecedented step of recommending  that two prominent journals, Science and Nature, withhold key details of the research, so that it would not fall into the wrong hands.

Understandably, this is a thorny problem. Scientists chafe at restrictions which could stifle discovery and innovation, potentially hurting society more than helping it. The results of the Fouchier research could be valuable to those combatting influenza, a virus that mutates rapidly and can pose a real threat to populations. Some experts suggested that it be distributed on a need-to-know basis. The secrecy is worrisome, but it might also be prudent in this case. Paul Keim, chairman of the science advisory board, told ScienceInsider, "I can't think of another pathogenic organism that is as scary as this one." He added, "I don't think anthrax is scary at all compared to this."

Similar worries were touched upon last year by a U.S. presidential commission studying developments in synthetic biology, which involves using engineering techniques to create new biological parts or devices, or re-designing existing ones. More regulation is not necessary at this time, the panel said, but synthetic biology should be watched closely. Separately, efforts are being made in the United States to improve the monitoring of biological research by scientists, companies and government. Yet much of it remains voluntary. What happens if a real rogue actor comes along and breezes right past the voluntary roadblocks?

At the same time, it is impossible to put this remarkable and fast-moving science under lock and key. These are not nuclear warheads. Biological research can be carried out in small laboratories the size of a garage and agents carried in a test tube that fits in a shirt pocket. We need to encourage the science, without forsaking security. It will require new thinking. We're not there yet.

The information superhighway is getting crowded, and there are bandits around.

For a revealing look at the immense river of digital data that the world has generated in recent years, see the April 1 issue of Science magazine. Two researchers have attempted to estimate the global capacity to store, communicate and compute information. They found that, between 1986 and 2007, general-purpose computing capacity grew at an annual rate of 58 percent, telecommunications at 28 percent, and stored information at 23 percent. There’s also a pie chart showing that 80 percent of communications in 1986 were fixed analog — those wonderful old land-line phones!—while in 2007 global communications were 97 percent digital. The research article is complex, but chock-full of other measurements about the data onslaught.

Great benefits and some new hazards have come from this digital revolution. The upside is the immense upswing in communication, creativity, discovery and productivity. We take more photographs, read more news, search for more info, listen to more music and watch more videos with less effort than ever before in human history. Scientists can probe genomes and distant planets with tools never before available to mankind.

The hazard is that, on some days, the information superhighway looks like the road from Benghazi to Tripoli. The Stuxnet worm showed just now nasty things can become. In its annual internet security threat report,  Symantec says that Stuxnet and another attack mechanism, Hydraq, were last year’s standout malware. Hydraq was attempting to steal intellectual property from major corporations; Stuxnet was apparently designed to disrupt Iran’s nuclear enrichment process. According to Symantec, both will, unfortunately, be useful in teaching programmers how to do it again. Overall, Symantec says it recorded over 3 billion malware attacks last year.

Nations are starting to wake up to this new battlefield, too. There’s an interesting series of essays in the Spring edition of Strategic Studies Quarterly, which is published out of the Air University at Maxwell Air Force Base, on the implications of cyber conflict. In one piece [pdf], Christopher Bronk imagines the use of cyberwar by China in the year 2020. This is a clever and fascinating exercise in futurology. In another article [pdf], Chris C. Demchak and Peter Dombrowski argue that the global cyber battlefields are already being fortified. While we like to think of the internet as a borderless space, they report otherwise:

Today we are seeing the beginnings of the border-making process across the world’s nations. From the Chinese intent to create their own controlled internal Internet, to increasingly controlled access to the Internet in less-democratic states, to the rise of Internet filters and rules in Western democracies, states are establishing the bounds of their sovereign control in the virtual world in the name of security and economic sustainability…

The consensus among states changed after Stuxnet. If such malicious software can take down whole energy systems at once, states have no choice but to respond if they are to protect their own governmental and military operations and uphold their responsibility to protect citizens and corporations. The Stuxnet method and its success thus changed the notion of vulnerability across increasingly internetted societies and critical infrastructures. The days of cyber spying through software backdoors or betrayals by trusted insiders, vandalism, or even theft had suddenly evolved into the demonstrated ability to deliver a potentially killing blow without being anywhere near the target. Forcing nuclear centrifuges to oscillate out of control from an unknown and remote location suggests that future innovations might be able to destroy or disrupt other critical infrastructures upon which modern societies depend.

In earlier decades, nuclear, chemical and biological weapons, as well as conventional arms, have been subject to arms control treaties that attempted to limit the creation of the weapons and their use. The treaties weren’t perfect: some were violated, some were weak and lacked enforcement. A good question that needs to be debated today is whether it is possible or desirable to create arms control agreements to limit cyber conflict. As I pointed out in a recent article in FP, cyber conflict exists in a shadowy, unaccountable world, not easily limited by treaties.

Elisabeth Fischer, writing for army-technology.com, has asked a series of experts on whether the time has come for rules of cyber warfare like those that govern conventional warfare. She found a lot of conflicting views. 

In January, Karl Frederick Rauscher and Andrey Korotkov led a Russian-American study by the East-West Institute on whether the Geneva and Hague Conventions could be adapted to cyber space.  The study pointed out that so-called critical infrastructure — things that are necessary for the basic welfare of civilian populations — are often quite difficult to separate from other facilities when it comes to cyberspace. An attack on a power grid or computer network could take down both hospitals as well as military targets. Can these be separated in a cyber conflict? Questions like that are still unanswered.

Another plunge into the legal issues around cyberwar is offered in Strategic Studies Quarterly by Prof. Charles J. Dunlap Jr., of Duke University. He argues [pdf] that the tenets of the law of armed conflict are “sufficient” to address most of the important issues of cyber war. The problem is not so much law, he says, as the inherent uncertainty of war and targeting.

The fog of war exists in cyberspace too.