The use of biological agents and toxins for nefarious purposes (i.e., bioterrorism, biological warfare, and bio-criminality) and efforts employed to thwart their use are of utmost importance to the public health and law enforcement communities. For the purposes of this paper, we are defining bioterrorism as the threat or use of biological agents and toxins (i.e., viruses, bacteria, fungi, or their toxins) by individuals or groups motivated by political, religious, ecological, or other ideological objectives, while biological warfare (BW) is defined as a specialized type of warfare using biological agents or toxins conducted by a government against a target (Ryan and Glarum, 2008). We do not consider the use of biological toxins for entirely nonpolitical goals (such as revenge or profit) as bioterrorism, but rather bio-criminality. This paper focuses on toxins, which are harmful substances produced by plants or within living cells or organisms. Toxins can be small molecules, peptides, or proteins that are capable of causing illness after contact with, or absorption by body tissues interacting with biological macromolecules such as enzymes or cellular receptors. Toxins have been used for nefarious purposes by bioterrorists and criminals, as well as produced and stockpiled for use in BW programs.

The earliest recorded use of toxins in warfare was in the sixth century B.C. when Assyrians contaminated the water supply of their enemies with the fungus Claviceps purpurea (rye ergot), which produces alkaloids related to lysergic acid (Haarmann et al., 2009). The first known examples of state-supported bioterrorism with a toxin occurred in 1978 and involved the Bulgarian Secret Police’s attempted assassination of Vladimir Kostov, a Bulgarian defector who had served as a news correspondent and was also a major in the D. S. (Bulgarian equivalent of the K. G. B.). A small metal pellet was injected into Kostov who subsequently became ill but did not die (Rozsa and Nixdorff, 2006). In a separate incident the same year in London, the Bulgarian Secret Police assassinated Georgi Markov, a dissident and announcer for Radio Free Europe, using technology supplied by the Soviet Union (Rozsa and Nixdorff, 2006). He died 4 days after a small platinum-iridium pellet containing ricin was injected into the back of his thigh by means of a modified umbrella tip.

In 1991, members of the Minnesota Patriots Council attempted to poison an Internal Revenue Service (IRS) official, local law enforcement, and a U. S. Deputy Marshal with ricin that they had extracted from castor beans purchased from a mail order house. They planned to use dimethyl sulfoxide to deliver the ricin transdermally. Four members were arrested after the group was infiltrated by the Federal Bureau of Investigation (FBI) (Carus, 2002).

Between 1990 and 1995, the Aum Shinrikyo, a doomsday religious cult, attempted on at least 10 occasions to disperse biological agents and toxins against the civilian population and authority figures in Japan (Wheelis and Segistima, 2006). Three of these incidents involved the dispersal of a crude preparation of botulinum toxin. In 1990, they outfitted a car to disperse liquid material through the exhaust system and drove the car around the parliament building. In 1993, they attempted to disrupt the wedding of Prince Naruhito by spreading botulinum toxin in downtown Tokyo via an automobile. In 1995, they planted three briefcases designed to release botulinum toxin in a Tokyo subway. This attack was unsuccessful because a cult member substituted a non-toxic agent for the toxin (Carus, 2002).

Toxins have also been used by individuals for nefarious purposes. For example, in 1995, Dr. Debora Green, an oncologist, attempted on three occasions to kill her estranged husband (Dr. Michael Farrar) by putting ricin in his food (Carus, 2002). A more recent demonstration of the continuing threat from ricin occurred in 2003 when a letter signed “Fallen Angel” complaining about new federal trucking regulations and a threat to use ricin was discovered in a postal facility in Greenville, South Carolina. The letter was enclosed in a package with a vial containing ricin and addressed to the White House (Schier et al., 2007). Numerous incidents and hoaxes involving ricin have occurred in the United States (Department of Health and Human Services, 1996; Carus, 2002). In 2015, Jesse William Korff, a 20-year-old Florida man was sentenced to 110 months in prison after he was found guilty of producing, transferring, selling, and smuggling abrin and ricin, and conspiring to kill a woman in the United Kingdom. Korff had advertised the sale of these toxins on the dark web and provided prospective purchasers with information about the quantities necessary to kill a person of a given weight, along with instructions how to secretly administer the toxin to avoid suspicion by law enforcement officers (Department of Justice Office of Public Affairs, 2015).

Toxins (both lethal and incapacitating) have been part of state-supported BW programs including those of Canada, France, the U.S., U.S.S.R., U.K., South Africa, Iraq, Syria, Japan, and North Korea (Chemical and Biological Weapons: Possession and Programs Past and Present.pdf, 2021). Most of these programs were discontinued and stocks of agents destroyed after the Biological Weapons Convention came into force in 1975. However, not all countries complied with the agreement. In 1995, Iraqi authorities acknowledged they had loaded toxins into various types of munitions. These included 100 botulinum toxin bombs, 16 aflatoxin bombs, 13 botulinum toxin and 2 aflatoxin missile warheads, and 122-mm rockets filled with botulinum toxin and aflatoxin (Mangold and Goldberg, 1999).

These events and others have led to changes in the way scientists in the United States and other countries acquire and work with certain toxins. For example, more than 20 years ago the U.S. promulgated regulations (i.e., Select Agent Regulations, 2022) designed to ensure the biosafety and biosecurity of activities involving the possession and use of hazardous biological select agents and toxins, and the facilities in which these activities occur (Morse, 2015). A key component of these regulations is a list of biological agents and toxins (i.e., select agents and toxins) that have the potential to pose a severe threat to human health and safety and economically impact agriculture through threats to animal and plant health or their products. CDC was delegated by HHS to administer the Select Agent Regulations that pertain to human health. The Bioterrorism Preparedness and Response Act of 2002 ( Public Law 107-188, 2002 ) requires that the list of select agents and toxins be reviewed and republished at least biennially and that the HHS Secretary consider specific criteria in determining whether to include a biological agent or toxin on the list. With respect to toxins these criteria are: 1) the effect on human health from exposure to the toxin; 2) the methods by which the toxin is transferred to humans; 3) the availability and effectiveness of pharmacotherapies and immunizations to treat and prevent illness resulting from a toxin; and 4) any other criteria including the needs of children and other vulnerable populations that the HHS Secretary deems relevant. The Select Agent Regulations outlines an exclusion to the regulations as long as the aggregate amount of the toxin (e.g., the aggregrate amount of serotype A–G for botulinum toxin or A–E for staphylococcal enterotoxins) under the control of a principal investigator (PI), treating physician or veterinarian, or commercial manufacturer or distributor does not, at any time, exceed the permissible limit.

We evaluated risk-based multi-criteria decision analysis techniques to inform select agent designation, applying the approach broadly to include non-select agents to evaluate its generality (Pillai et al., 2022). Toxins were not included in this previous evaluation since identifying toxins for inclusion on the list of select toxins and assigning exclusion limits presented some unique challenges including: 1) toxins are non-replicating; 2) toxins are not transmissible from person-to-person; 3) while some are toxic at very low doses (e.g., botulinum toxin), they are often produced or present in small amounts requiring purification and concentration; 4) some active toxins may have medical uses (e.g., botulinum toxin); 5) some toxins are produced by microorganisms commonly encountered in the clinical laboratory (e.g., staphylococcal enterotoxins); and 6) some toxins are waste products of industrial processes (e.g., ricin).

We have developed and applied DSF approaches for addressing these challenges and for assessing toxins for inclusion as select toxins. In addition, we developed attack scenarios to determine the amount of toxin needed to impact public health and applied the results to suggest exclusion limits.

The attack scenarios involved the introduction of toxin into a fluid daily consumable product supply chain to simulate an ingestion scenario and the release of an aerosolized toxin into three high-population density public facilities to simulate inhalation scenarios. By design, these scenarios were meant to capture close to “worst case” conditions from the defender’s perspective. Real-World attempts would likely produce fewer exposures than modeled in this study. Excluded toxin limits (i.e., amount of toxin under an established limit to support a PI’s research or teaching activities without the requirement to register with the Federal Select Agent Program) were based on the amount estimated to expose up to 10 people by inhalation or up to 100 people by ingestion to median LD₅₀ or median TD₅₀ of toxin. These thresholds were chosen based on SME input for the number of casualties that would be considered a significant public health threat and/or associated response. It is likely that the number of people exposed to amounts below the LD₅₀ or TD₅₀ will be much greater for these scenarios, and the number of people who believe themselves to be exposed, should the release be made public, may be greater yet.

A key limitation to the modelling approach has been the lack of LD₅₀ or TD₅₀ data for inhalation and ingestion routes of exposure for some toxins of potential interest. In this study, all the toxins modeled to inform recommendation of permissible levels have at least one known or published LD₅₀ or TD₅₀ value. An alternative approach was also explored that solicited SME input regarding the amount of toxin considered reasonable for a PI to possess for conducting laboratory research or teaching. The overall intent of this study was to present a methodology using the DSF and associated exposure scenario results in sufficient detail so that other countries and responsible entities can employ these methods as additional data become available, thus continuously improving the process.

A DSF was developed and used to evaluate 30 toxins (Table 1) for consideration and inclusion as a select toxin. To assist in the evaluation of toxins against the DSF criteria, we developed fact sheets based on literature reviews coupled with SME input and review. These data are summarized in Table 3. At each decision point in the framework, toxins may drop from further consideration as a possible select toxin. For example, the “Production” criterion (Figure 1) resulted in the elimination of alpha-Amanitin and Aflatoxin from further consideration since they were scored as very difficult to produce, generate, or synthesize in sufficient quantity to cause a mass casualty event by a non-state actor. Another 11 toxins are eliminated from consideration as a select toxin because of low mortality rates (<1%), three toxins are eliminated due to existence of effective vaccination programs, and one toxin (cholera toxin) is eliminated due to the effectiveness of supportive therapy at mitigating ≥90% of disease. Botulinum toxin, while having an effective medical countermeasure for treatment, is not eliminated by the DSF due to the severity of illness, the long duration for recovery, the lack of rapid availability of medical countermeasures and the need for intubation and mechanical ventilation thus limiting countermeasures’ effectiveness in a bioterrorism attack resulting in mass exposures (Rao et al., 2021). In the case of staphylococcal enterotoxin (A–E), although the mortality rate is low in natural clinical cases, the environmental stability, resistance to high temperature, high morbidity rate (serving as incapacitating weapon) and potential mortality rate in an aerosol bioterrorism scenario was taken into consideration in the DSF (Hale, 2012).

The results of this DSF analysis indicate all currently designated HHS select toxins, and none of the other toxins considered in Table 1, are recommended for consideration as a select toxin (Figure 1).

Inhalation and ingestion scenarios were modeled for those toxins recommended for consideration as a select toxin and where the inhalation or ingestion LD₅₀ or TD₅₀ values are known (all recommended toxins have at least one known LD₅₀ or TD₅₀ value). Table 4 summarizes toxin release amounts needed to generate exposure to an LD₅₀ or TD₅₀ for at least 10 people in analyzed inhalation scenarios and at least 100 people in analyzed ingestion scenarios, as calculated from our models. Based on these results, the proposed toxin permissible limit is suggested to be the lesser of the results from the inhalation and ingestion scenarios (Table 4).

An alternative approach was also explored that solicited SME input regarding the maximum amount of toxin considered reasonable to possess for conducting laboratory research or teaching. A summary of the SME recommendations regarding reasonable levels for laboratory research are provided in Table 4. Other than botulinum neurotoxin, the SMEs felt that most scientific research can be performed effectively with 1 g of material, and as such there is no need for any non-select agent registered laboratories to possess greater than 1 g of purified toxin material at any given time, suggesting 1 g for consideration as an exclusion limit. For botulinum toxin, the SMEs felt a total of 10 mg of purified toxin from all serotypes is the reasonable limit to possess for conducting research or teaching purposes in non-select agent registered laboratories.

The goal of this analysis was to inform selection of toxins for inclusion as a select toxin and associated exclusion limits. The original rationale for these limits was based on primary and secondary criteria. Primary criteria focused on the potential of the toxin as an aerosol threat. Secondary criteria focused on a variety of scenarios and historical use, including the potential of the toxin as an ingestion threat with a focus on food safety and/or typical quantities of toxin commonly used in biomedical research. The DSF and ingestion and inhalation scenario results described in this report support these primary and secondary criteria. While the DSF does not rule out any of the considered toxins because of their toxicity, it does rule out toxins as a select toxin based on factors that would play into the likelihood and consequences of a bioterrorism scenario, such as difficulty to produce a sufficient quantity to cause a mass casualty event, existence of effective vaccines and therapies, and overall mortality rate.

Comparison of proposed exclusion levels for select toxins based on the inhalation and ingestion modeling studies with the SME guidance on maximum research amounts (Table 4) shows agreement for botulinum toxin, saxitoxin, Staphylococcal Enterotoxin B and tetrodotoxin. For other select toxins, the modeling results suggest a higher permissible limit. The output of this DSF analysis agrees with the current select toxin designations, with all select toxins, and none of the non-select toxins in Table 2 being recommended for inclusion. In general, setting a threshold of 10 exposures to an inhalation LD₅₀ or TD₅₀ and 100 exposures to an ingestion LD₅₀ or TD₅₀ in worse-case scenarios, resulted in recommended increases to previous exclusion limits for some of the select toxins (Table 4).

The DSF and Toxin Parameters and Attack Scenarios described in this paper are useful for the selection of toxins as select toxins and setting exclusion toxin amounts based on the best current information. During this study, we identified several gaps in our knowledge of the LD₅₀ and TD₅₀ values for inhalation and ingestion exposure. As we continue to fill these gaps and our knowledge evolves, this framework will allow decision makers to update the list of select toxins and associated exclusion toxin amounts in a consistent and data-based manner.

The goal of this effort was to explore the use of DSF—logic tree approaches to identify toxins as select toxins. The output of this DSF analysis agrees with the current list of select toxins and did not identify any additional toxins for consideration at the current time. This approach was complemented with modeling studies of inhalation and ingestion scenarios to determine exclusion limits for scientists to possess and use without being subject to the Select Agent Regulation. Although we evaluated 30 toxins in this study, it is important to note that there are still scientific gaps associated with many of these toxins. As these gaps are addressed, the scientific community can continue to leverage this methodology to further refine this report’s findings in support of the Federal Select Agent Program. It is also important to note that based on the opinion of consulted SMEs, there is no need for any research laboratory to possess greater than 1 g of toxin to conduct any meaningful research to advance science. However, this is not a statutory criterion used to evaluate select toxins.