Can a 50-year-old treaty still keep the world safe from the changing threat of bioweapons?

Livia Giorgina Carpineto for Vox

How geopolitics and technological advances are making this a riskier world for bioweapons.

GENEVA — Venomous Agent X is a deadly nerve agent, though you likely know it by another name: VX. It’s an amber, oil-like liquid that targets the body’s nervous system. A single drop on the skin can kill within minutes. In 2017, North Korea is believed to have used VX to assassinate Kim Jong Un’s estranged half-brother in a Malaysian airport. Kim Jong Nam suffered severe paralysis, dead in about 20 minutes from a weapon of mass destruction.

Sean Ekins and his team thought of the toxin for a possible experiment, one he needed to meet a last-minute deadline for a presentation at the Spiez Laboratory in Switzerland, at a conference examining how developments in science and technology might affect chemical and biological weapons regimes. Ekins is a scientist and CEO of Collaborations Pharmaceuticals, a lab that uses machine learning platforms to seek therapeutic treatments for rare and neglected diseases. He and his colleague Fabio Urbina wanted to test and see if they could flip their AI software, MegaSyn. Instead of steering the software away from toxicity, they wanted to see if they could guide the model toward it.

The scientists trained the software with some 2 million molecules from a public database, and then modeled for specific, toxic traits.

In just six hours, the AI generated some 40,000 molecules that met the scientists’ criteria, meaning that, based on their molecular structure, they all looked quite a lot like toxic chemical agents. The AI designed VX. It designed other known toxic agents. It even designed entirely new molecules that the scientists hadn’t programmed for, creating a sketch for potentially lethal and novel chemical compounds.

The experiment was computational — a digital recipe for molecules like VX, not a physical creation of it or any other substance. But Ekins and his team used open source, publicly available data. The AI they used was also largely open source as well; they just tweaked the models a little bit.

Ekins was horrified. What he and his colleague had thought was a banal experiment ended up creating a cookbook for chemical agents. “If we could do this,” Ekins said, “what’s to stop anyone else doing it?”

VX, after all, is a banned substance under the Chemical Weapons Convention. A lab can’t just produce or go out and order up VX; countries face inspections to make sure they don’t have the stuff, or something like it, hanging around. VX doesn’t exist in nature, and it has no dual uses; that is, it has no therapeutic value or positive benefit. The only reason to have VX is to kill.

That isn’t the case for many things found in nature, like a virus or, well, your own DNA. Which is why this experiment got so much attention, not just among chemical warfare experts but among those who worry, specifically, about biological weapons. It showed just how simple it might be to apply it to the things that exist all around us, that can’t be tightly controlled, and that very likely have dual uses. Machine learning could be used to find ways to tweak a virus to make it less virulent, or more treatable. Or it could be used to make that virus more difficult to detect, or more deadly. And, if you or a nation-state are so inclined, wield it as a biological weapon.

Biological weapons, of course, are outlawed, too. The Biological Weapons Convention (BWC) prohibits the production, use, development, stockpiling, or transfer of biological toxins or disease-causing organisms against humans, animals, or plants. More than 180 countries are party to the pact, which came into force in 1975 as the first multilateral treaty to ban an entire class of weapon. And in the years since, the taboo against state use of biological weapons has largely held.

Yet a volatile geopolitical environment, combined with the rapid advance and increased access in the ability to edit and engineer pathogens, is straining and testing the nearly 50-year-old BWC as never before.

“It’s like a race between the technology being developed really quickly and the biosecurity committee racing to put the safeguards around it,” said Jaime Yassif, vice president of global biological policy and programs at the Nuclear Threat Initiative.

No treaty is perfect, but from the BWC’s beginnings, critics have said it lacked vital elements, like a verification mechanism to make sure everyone is following it. Global tensions, scientific advances, and the ever-expanding repertoire of what is possible with both biology and chemistry are making those flaws and cracks ever more visible.

Late last year, at the Ninth Annual Review Conference for the Biological Weapons Convention at United Nations Headquarters in Geneva, Switzerland, countries broadly agreed that they needed to find ways to strengthen the pact, to make it fit for purpose in a more chaotic, unpredictable world.

As is often the case in arms control, agreement is one thing, action another. The same forces buffeting the treaty are also making it nearly impossible to update it for a different age, or even agree on what it means now. The longer the BWC stands still, the faster barriers against a deliberate biological attack begin to fall away. That makes the world more vulnerable than ever to a threat the international community tried to eradicate 50 years ago.

Illness, weaponized

Biological weapons are the “poor man’s atom bomb,” said Yong-Bee Lim, the deputy director of the Converging Risks Lab and Biosecurity Projects Manager at the Council on Strategic Risks. They are weapons that can often be built on the cheap, using materials found in nature. Even before the world understood what caused disease, countries used things against their enemies they knew carried contagion: catapulting plague-infested corpses over fortified walls, or giving or selling clothes or blankets from smallpox patients.

But biological weapons were always held in a separate category in warfare. They are inherently risky: Contagions are hard to control and contain, and the same pathogens that can infect your target can also sicken you and your population. This is also why they tend to be used as a stealth agent of war; humanity has a general repugnance toward disease and poison that doesn’t extend to other armaments. “It has always been seen as an ungentlemanly weapon,” said Filippa Lentzos, a biosecurity expert and associate professor at King’s College London. “It’s never an element of your arsenal that you are proud to display. It’s always an underhand thing.”

Mark Wilson/Getty Images

A sign at the Veterans Gate at Fort Detrick Army Medical Research Institute of Infectious Diseases is shown August 1, 2008, in Frederick, Maryland

Those factors helped bolster a taboo against biological weapons, which the international community first tried to prohibit with the 1925 Geneva Protocol against chemical and biological methods of warfare. That pact didn’t stop many countries from building biological weapons programs through World War II, with germs used most notoriously by Japan in China. Well into the Cold War, the United States had a program of its own housed outside Washington, DC, at Fort Detrick, along with a chemical and biological weapons testing base in Utah.

The US wasn’t alone. The Soviet Union also had an offensive biological weapons project, as the two superpowers raced to match each other in armaments. But in the late 1960s, some high-profile mishaps linked to the US chemical and biological weapons programs — including a toxic cloud from a test of VX that killed or injured 6,000 sheep — along with public anger over the use of herbicides like Agent Orange during the Vietnam War, prompted Congress to pressure the Nixon administration to review the biological and chemical weapons programs. “Biological weapons have massive, unpredictable and potentially uncontrollable consequences,” President Richard Nixon said in 1969 after the release of the review, which essentially concluded that these kinds of offensive programs weren’t worth the risks.

The US would ultimately renounce the use of biological warfare, instead focusing its research on defense and safety measures. The American decision, which came after other allies turned away from their biological weapons programs, seeded the conditions for the creation of the BWC.

States have not engaged in known biological weapons attacks since — which is not the same thing as saying the treaty hasn’t been violated. The Soviet Union continued to build a big and sophisticated biological weapons program in the decades after it signed the BWC. That became clear after the fall of the USSR in 1991. Other signatories have been suspected of maintaining offensive weapons programs at different points post-1975, including South Africa and Iraq. Today, US intelligence assesses that Russia and North Korea maintain active offensive programs, both in violation of the BWC.

The good and the bad of the BWC

The BWC calls the deliberate use of biological weapons “repugnant to the conscience of mankind.” The document itself is short, just 15 articles, with the first explicitly banning the development, production, stockpile, and transfer of microbial or biological agents or toxins, “whatever their origin or method of production.”

It is broad and not particularly specific, but given the dual-purpose and rapidly changing nature of biological research, that is also its strength: “It does make the convention quite future-proof,” said Daniel Feakes, chief of the BWC Implementation Support Unit (ISU), the main body overseeing the convention.

The BWC is designed to be adaptable, but that also comes with a problem: It makes it difficult to ensure everyone who says they are following the BWC really is. Or, in arms control treaty-speak: It has no legally binding verification regime.

The Chemical Weapons Convention is arguably narrower, banning specific agents. It also has an enforcement body that carries out inspections. Nuclear treaties between the US and Russia, though they’re almost all but officially dead, included robust data-sharing and inspection. “Verification is a pretty standard element of most disarmament conventions, and that’s why people keep on coming back to the issue in the BWC,” Feakes said.

The BWC has none of that. Some of it has to do with the unique nature of biological weapons, which are distinct from things like chemical agents or nukes. But that has left the BWC with a huge gap since its inception.

Frank Barrett/Keystone/Hulton Archive/Getty Images

From left, Nikolai Lunkov, the Russian ambassador; David Ennals, the British minister for foreign and Commonwealth Affairs; and Ronald I. Spiers, minister at the American Embassy, signing the certificates of deposit for the Biological Weapons Convention at Lancaster House in London on March 26, 1975.

“The holy grail that we’ve struggled with with the Biological Weapons Convention is how do you verify that the countries that have signed up to the treaty are not making biological weapons?” said Kenneth Ward, US special representative to the Biological Weapons Convention.

The closest thing that BWC has to a verification are Confidence Building Measures (CBMs), essentially a book report on a country’s bio activities. Not every country participates, or makes the documents public, and there is no way to fact-check what any country says.

And even if there were, the BWC is currently ill-equipped for such a task. The annual budget for the BWC is currently about $1.8 million, which in the past has come out to less than most McDonald’s franchise restaurants, according to one estimate in a 2020 book. About two-thirds of countries pay less than $1,000 into the BWC, including about 50 that pay around $100. That is considerably less than the Organization for the Prohibition of Chemical Weapons (OPCW), which has an estimated 2023 budget of more than $80 million to implement the Chemical Weapons Convention.

The Implementation Support Unit (ISU) that oversees the BWC just had its staff grow by a quarter — from three to four people. Compare that, again, to the OPCW, which has about 500 staff members. According to Feakes, what resources the ICU has mostly end up going toward the organizing and managing big meetings, like the Ninth Annual Review Conference. Even then, it’s barely enough: By the Friday morning session of the first week of the Review Conference in Geneva last year, the UN Web TV broadcast of the BWC negotiations had to be cut off because of cost concerns. If you can’t keep the live feed running, good luck preventing the potential proliferation of biological weapons.

That means the actual implementation of the BWC looks something akin to matchmaking, where a state may ask for technical or assistance or training, and the ISU seeks out another country or partner that might have the ability to actually do it, because the ISU definitely doesn’t.

But trying to fit BWC into the mold of other disarmament treaties is a lot trickier than you might think, largely because of the dual-use nature of biology. A nuclear warhead or VX gas has one purpose: warfare. But something like anthrax can and has been used as a biological weapon, and a legitimate lab may need to have anthrax on hand to make a vaccine. The same equipment you might use to try to find a cure to a virus or disease is much the same equipment you’d need to replicate or manipulate a virus for a biological attack. Germs are self-replicating which means countries don’t have to keep huge stockpiles of dangerous viruses.

Life science itself is far more decentralized than nuclear research, for example. Labs are spread out, and with materials fairly accessible. You can buy DNA online, and with technologies like benchtop DNA synthesis, you can print DNA in your lab with a tool that’s about the size of a microwave. There are far more people with expertise in the biological sciences, from geneticists to lab techs, around the world than there are nuclear scientists. A terror group getting ahold of weapons of mass destruction is always a risk, but the diffusion of biology means it’s probably easier to weaponize a virus — and certainly harder to detect — than it is to make a nuke. And, of course, the BWC only deals with nation-states anyway.

“You don’t want to create false confidence in a verification regime,” Ward, of the US State Department, said. “You have to be clear: What can we verify? What can we not verify? And we’re never going to be able to verify on a daily basis, is every biological facility in the world doing good things instead of bad things? It’s impossible to know.”

It’s also not like anyone hasn’t tried, either. Across decades, countries have attempted to figure out some way to create a verification mechanism. Perhaps the closest the BWC came was in 2001, but US opposition effectively sidelined efforts to create a more formal and transparent mechanism for verification for 20 years.

A lot has happened in those 20 years, including dramatic advances in life sciences — the mapping of the human genome, CRISPR gene-editing technology, mRNA vaccines, and more — which means the nature of biological threats is changing, too. Some verification is better than nothing, and almost certainly better than an absolute free-for-all — as the pandemic itself showed.

What is a bioweapon today — and tomorrow?

In a city, in one corner of the world, people start showing up to the hospital. They have some sort of respiratory illness, but it’s not clear what. The cases range in their severity: It is often fatal in older or immunocompromised people; for others, a mild to severe illness. Others still are asymptomatic, a virus in their bodies, spreading without any outward sign.

Jim Watson/AFP via Getty Images

A Pentagon Force Protection Agency (PFPA) member looks on after washing down a Red Cross Volunteer who simulated being infected with the anthrax virus during exercise “Gallant Fox 06” outside the Pentagon in Washington, DC, May 17, 2006.

From there, the virus spreads, and spreads, and spreads. It shuts down economies, upends politics. Millions die; millions more get sick. A vaccine is developed quickly, so are treatments, but none are a perfect shield, especially as the virus, now out in the world, changes.

This is not a bioweapon but the Covid-19 pandemic. (Which, it’s worth emphasizing, is not a bioweapon, even if debates on its origins continue.) But what Covid-19 did do was show just how disruptive an entirely unintentional biological event can be. A deliberate one, or even the accidental release of a virus from a legitimate lab, could be far worse. (A 2018 pandemic tabletop exercise by the Johns Hopkins Center for Health and Security modeled for a release of an engineered bioweapon and ended with 150 million people dead.) It’s still not easy to create such a deadly bioweapon, “but barriers are coming down, and risks are increasing,” Lentzos said.

Barriers are coming down because of the expansion and advancement in the life sciences. There is gene editing, which has been made easier and more powerful with tools like CRISPR. A bad actor could use it to make a virus more transmissible, or more fatal, or more resistant to treatment. There is synthetic biology, which enables scientists to manipulate or even design entirely new organisms — maybe tailor-made to infect livestock, or a country’s wheat supply, or even a specific person. Then there are the computational tools, like the artificial intelligence used by Ekins where huge databases and the power of computing let scientists rapidly sift through potential pathogens much faster, or find new combinations of molecules to create entirely novel viruses.

Scientists also better understand how the body works; what regulates our hormones, immune systems, and neurotransmitters. Many experts I spoke to talked about bioregulators — systems that regulate our normal bodily functions — as a possible tool of manipulation. This knowledge has plenty of benign applications, and potentially revolutionary ones, but could also be applied for military or political manipulation: speeding up someone’s heart rate, or causing organ failure, or even altering moods, so all of a sudden an even-keeled president is an erratic one.

There isn’t really a question as to whether such an attack would fit under the BWC. Even though we were decades away from decoding the human genome when the convention was signed, its Article 1 prohibition against any deliberate use of biological material or a toxin fits under the definition.

But the larger question is whether the spread and development of these technologies incentivizes their malign use. That depends a lot on the political environment — on why a country would take the risk of breaking international law and norms. In a world where other disarmament treaties are falling away, great power competition is rising, and hybrid threats from cyber to information warfare offer the plausible deniability some governments seek, countries may start to see it as a risk worth taking.

Russia’s war in Ukraine is an example of how these dynamics are playing out. Moscow has very deliberately spread misinformation — amplified by everyone from the Chinese government to right-wingers in the US — alleging that the US has been funding bioweapons labs in Ukraine, including claiming that Washington and Kyiv have collaborated on an infection that is targeting certain groups, delivered by bats and birds. The claims have been disproven, and rejected by the United Nations Security Council, but some experts and officials fear it could serve as the basis for a false flag attack.

Biological attacks can also be difficult to verify because pathogens are naturally occurring, and even if scientists detect a new one, it’s difficult — if not impossible — to know if it’s something that has been deliberately created or something that emerged accidentally from nature or a lab. And given what Covid-19 demonstrated about the cracks in our defense against biological threats — and how little has been done to fix them over the past few years — a future bioweapon might “prey upon those existing vulnerabilities that haven’t been addressed,” said Saskia Popescu, a biodefense expert at George Washington University.

Decentralization further complicates matters, especially as the bioeconomy and biomanufacturing expands. The BWC is focused on nation-states, but this diffusion and access — again, you can buy DNA online and have it shipped to your lab — opens up opportunities for bad actors. “It’s easier for more and more people with less and less skills coming in the door to either make a pathogen from scratch or tinker with it to make it more dangerous,” said Yassif. “And that’s not contained within a few high-level labs, in a world-class lab with lots of resources. It’s increasingly democratized and distributed.”

Together, this creates a dangerous dynamic: The international bioweapons regime is basically standing still, as technology and geopolitics race ahead of it.

Can the BWC keep up?

All of this tumult spilled over at the Palais des Nations, United Nations headquarters in Geneva, this past December. There, states-parties to the Biological Weapons Convention gathered for the Ninth Annual Review Conference, or “RevCon,” as it’s known. These happen every five years, although the Covid-19 pandemic had delayed the scheduled meeting. It would ultimately complicate this one as well, as diplomats and delegates started testing positive. By week’s end, the officials presiding over the conference did so in KN95 masks — an outcome that felt a little too on-the-nose for a conference designed to shore up protections against biological threats.

Mario Tama/Getty Images

Nurses Albert Legayada (L) and Fred Bueno care for a Covid-19 patient in the ICU at Sharp Grossmont Hospital amid the coronavirus pandemic on May 6, 2020, in La Mesa, California

In the Palais des Nations, a strange combination existed of low expectations and high hopes. The low expectations were mainly a hangover from the ghosts of BWC RevCon past, where states struggled to reach consensus. The war in Ukraine had also increased tensions, with Russia, in particular, playing spoiler because no one would give credence to their Ukraine bioweapons claims.

Yet many officials and experts hoped the disruptive power of Covid-19 would focus minds, providing a reminder of the threat of any kind of biological risks. New initiatives buzzed about, including ethical guidelines for scientists working in technologies that could be manipulated or misused. The Tianjin Biosecurity Guidelines for Codes of Conduct for Scientists included 10 principles for those practicing in the life sciences, an effort to raise awareness and accountability to mitigate biorisks. China, in particular, had championed these guidelines, which lots of other countries supported, too, including the United States. There were also discussions about creating a scientific or technical body, one that could review and advise on the latest biological and life science developments.

And, at long last, the United States cracked open the door to verification discussions. Ward said it was partly an acknowledgment from the Biden administration of the disruptive nature of Covid-19, but it was also an effort to move past two decades of ill will.

But that is always a tough task within international forums. The reality within the Palais was both slightly more boring and slightly more complicated. Politics played a big role in this. Russia, and some other familiar faces, including Iran used the forum to air their particular grievances — Moscow on Ukraine, Tehran on sanctions. The BWC is built on consensus — all the states-parties have to agree — so just one country can spoil the mood, and the progress.

Most of the intense discussions happened behind closed doors; out in the brightly lit conference room, the delegations discussed, line by line, exactly what should be in the RevCon text, in the most passive-aggressive public edit of all time. Countries went back and forth on word selection, striking this or seeking to add that — respectively, of course — until slowly all the add-ons and enhancements to the BWC fell away.

But, in the end, there was some progress, or as the line went: “modest success.” The hopes for adopting those ethical guidelines for scientists or even bare-bones verification measures failed. But the states-parties at the BWC agreed to establish a working group — meeting once a year, for about two weeks or so — to examine a long list of priorities, like advances in science and technology, and a possible road map for bioweapons verification.

“Issues like verification, it’s now formally in the agenda or the work plan of the intersessional program, the first time in two decades,” said Izumi Nakamitsu, the United Nations high representative for disarmament affairs.

This is what counts for progress in the world of bioweapons governance: no substantive changes yet, but at least everyone is talking. The group will meet this August for the first time, after setting its agenda last month, with the goal of transforming the BWC by the time of the next RevCon about five years from now. Which is better than nothing when it comes to weapons of mass destruction.

In the meantime, the threats to the BWC are accelerating. The world is a more dangerous and tense place. Disinformation around bioweapons is also eroding the taboo against the use. This includes Russia’s playbook of continued accusations about bioweapons in Ukraine and elsewhere. But a top Republican recently claimed, with zero evidence, that the Chinese spy balloon shot down over the Atlantic Ocean in February was equipped with bioweapons.

And maybe it doesn’t sound so crazy, as science speeds ahead. ChatGPT has amplified concerns around artificial intelligence and what it is capable of. Ekins’s software designed VX and thousands of other molecules in six hours, after all. “We’re just a small piece of the pie,” Ekins said, of the VX experiment. “But what else is happening out there?”

This reporting was made possible by a grant from Founders Pledge.