If we agree that, in the present climate of fear of bioterrorism, some restrictions on the conduct and/or publication of certain types of biological research are likely, and if we further agree that, as I argued last month (see Genome Biology 2002 3(10):comment1014), it is to our advantage to preempt government action by devising for ourselves restrictions that we can live with, then the inevitable question becomes: how should these restrictions be administered?
There are many models for regulating behavior. For example, government agencies can run things directly; this model was largely followed in the conduct of research related to atomic energy in the decade or two after Hiroshima, and is largely responsible for the widespread public affection for nuclear power. Activities can be run privately but subject to regular inspection by the government; handling of radioactive and other hazardous materials is dealt with this way, with the result that all over the world people are eager to have toxic waste disposal sites located in their communities. Or things can be run privately but inspected - audited, if you will - by independent private contractors; around these parts this is often referred to as the Enron/Arthur Andersen model. And then there's self-regulation.
Self-regulation also has a somewhat checkered history. In the US, politicians generally vote on their own salary increases and watch over each other's ethics, with predictable results. Lawyers, as a rule, police one another through their Bar Associations - and the morals of lawyers have been standard material for humor since at least Shakespeare's time. Most police departments have 'Internal Affairs' divisions for investigating charges of police misconduct, and considering their opportunities for illegality the general honesty of the police is noteworthy; nevertheless, police corruption is the stuff of countless newspaper exposes, movies, novels and television shows. Physicians do better, but even there enough instances of serial medical malfeasance have slipped past medical boards to warrant sporadic efforts at outside control.
Yet compared to other forms of regulation, systems of self-regulation - when properly constituted - can work well. Their strength (as well as their potential for abuse) lies in their inherent circularity: because those doing the regulating are also the subjects of the regulation, there is a constant tension that pulls things back into balance when rules become either too loose or too strict. Furthermore, there is always the opportunity to take new information into account, since the regulators are the ones generating it. Perhaps the best example of a well-functioning self-policing system is provided by science.
Instances of scientific fraud are rare, in part because if a result is sufficiently noteworthy it will soon be checked by numerous other laboratories that were, or wish to become, competitors. Internal competition guarantees that no outrageous claim will go unchallenged, and the demand for reproducibility ensures that even most honest errors will be detected relatively quickly. Punishment for deceit is swift and permanent. Genuine mistakes do not doom scientists but do harm their careers enough to provide a strong incentive for one to check one's work carefully. This system of self-regulation is almost completely informal, but has been highly effective.
Yet when the specter of monsters generated by recombinant DNA research appeared in the 1970s, the scientific community realized that this informal system was not enough to reassure an increasingly frightened public. The result was the National Institutes of Health Recombinant DNA Advisory Committee (RAC), which, with the advice and endorsement of the 1975 Asilomar Conference on Recombinant DNA Research, set forth guidelines for the safe conduct of recombinant DNA experiments (see Genome Biology 2002 3(10):comment1014). The early, highly restrictive guidelines slowly evolved into more relaxed recommendations and regulations, as years of experience convinced both scientists and, more importantly, the general public that such research could be carried out safely with no disastrous consequences. But throughout this evolution the machinery for regulating the research has remained in place: a system of local Institutional Review Boards (IRBs) ultimately answerable to a national oversight committee. That system is also one of self-regulation, but it is a tiered process with accountability built in. I think it represents an excellent model for how the biology community might regulate research, particularly genomics-driven research on pathogens, that might conceivably be useful to would-be bioterrorists.
Don't misunderstand me here: I think that government is best that usually governs least, and I believe that nearly all forms of research should be unfettered and published openly and completely. I think it's naive to assume that we must keep things under wraps because our enemies would never think of them unless we put the ideas into their heads. The history of scientific research teaches us that most ideas are arrived at by a number of different people at about the same time, and, sadly, I see no reason why this principle should not apply to potentially evil ideas as well as to beneficial ones. We're better off in the long run, I think, making sure that all of us know what's possible so that we can bestir ourselves to doing something about it. But that doesn't mean that there might not be some experiments that we shouldn't do, or information that we might not want to have openly available. And if we're not sure about this, then I think in order to calm the fears of a public that is increasingly viewing us with suspicion and anxiety we need to accept some limitations.
But the point is that these limitations need to be self-imposed, and I think the IRB system represents an excellent way of going about it. Most US universities already have several institutional review boards: one for recombinant DNA research, another for research involving hazardous substances, a further one to oversee animal experiments and, in the case of medical schools, yet another for review of experiments involving human subjects. These boards are staffed by working scientists and are answerable, ultimately, not only to the administrations of their own institutions but also to the funding agencies that support research activities. The threat of even a temporary cut-off of grant support is enough to guarantee that the local boards will take their responsibilities seriously. But since local boards can't modify regulations as new evidence comes in, and because there should be a mechanism to appeal decisions that seem arbitrary or misinformed, someone is needed to watch over the IRBs and periodically review the regulations. In recombinant DNA research in the US, the RAC fulfills this function.
So one possible regulatory mechanism could look like this. Guidelines for safe conduct of research protocols involving, say, CDC category A, B, or C biohazard materials/agents and for adequate security regarding 'sensitive' materials and information will be developed by a Biohazard Advisory Committee (BAC) set up by the funding agencies. The composition of the BAC is a matter for community discussion, but I think it should have at least a majority of working scientists in the areas of microbiology, immunology, virology and genomics. Each institution receiving government support for such research must set up an IRB composed of knowledgeable internal scientists. (Privately funded research at these institutions would simply be subject to the same rules; research done in companies would be regulated by a different mechanism, providing an outlet for extremely sensitive projects for which the results might be unpublishable.) Thereafter, for any research specified in the guidelines as having a potential bioterrorism impact, the following procedure would be followed.
1. Research protocols and results must be submitted for local IRB review prior to submission of proposals for funding or of papers for publication
2. Following preliminary review, additional information may be requested prior to the IRB meeting
3. For clarification of regulatory questions, research protocols involving CDC category A, B, or C biohazard materials/agents may be submitted for BAC review prior to local IRB review and approval
4. Decisions of the IRBs may be appealed to the BAC for final adjudication
A number of variations are possible, but something like this would cause a minimum of disruption to research, would ensure that decisions are made by people who best understand the issues, and would create the least intrusive bureaucracy.
The fundamental problem with any regulatory system was pointed out by the Roman satirist Juvenal more than 19 centuries ago: Sed quis custodiet ipsos custodes?, or "But who will guard the guards themselves?" He gave no answer to this conundrum, and it may well be that there is no good one. But I think that, sometimes, if the ones being guarded become the guards themselves, the question can at least be rendered moot.