The Making of a Biosafety Officer 

By David Gillum

The potential risks for accidents and misuse increase as biotechnology becomes more sophisticated, less expensive, and increasingly distributed. During my 28 years as a biosafety officer, I have dealt with laboratory explosions, fires, spills, needlesticks, eye contamination, accidental releases, and lost or unaccounted-for inventory—along with the day-to-day anxieties of keeping labs safe. Biosafety professionals are responsible for mitigating risks at universities, federal laboratories, health care facilities, nonprofits, and pharmaceutical and other commercial operations. While we—I am one of only a few thousand in the United States—have similar job titles, our backgrounds run the gamut from microbiology to chemistry, from high school or associate degrees to PhDs.

We are so diverse that it raises the question of how people become biosafety professionals and what makes them proficient. I will attempt to answer that question by looking at my own career, which has been characterized by the acquisition of what the late British epistemologist Michael Polanyi characterized as “tacit knowledge,” picked up here and there, both situationally and systematically, over nearly three decades. This learning process has bearing on the laws, regulations, policies, standard operating procedures, and written documents that govern biosafety; implementing those requires proficiency, and that is gained chiefly through on-the-job experiences plus extramural work that spans institutions and contexts. It is in the doing that regulations on pieces of paper become realized in the world.

The question of how the biosafety community generates and transmits knowledge is interesting in itself, but it is also an urgent issue. The need for biosafety workers is growing just as current professionals are skewing older: an estimated 54% are over 50 and one of the few surveys of the field suggests there are six times as many biosafety officers over 70 as there are under 30. Preparing more of us—and keeping the public safe as the complexity of biological research, health, and manufacturing projects burgeons—is made more difficult by the importance of tacit knowledge in our education. Methods for understanding, communicating, and mitigating risk are difficult to transfer to others. To enhance public health and safety, people in my line of work should ease this transfer by considering how the profession might be standardized and formalized.

It is in the doing that regulations on pieces of paper become realized in the world.

The question of how the community educates itself is also pressing because it is inextricably connected to how written rules of biosafety are carried out. It is through their translation—from paper edicts to institutional culture and to individual practice—that the public has been protected as biological experimentation evolved between 1976 (when the National Institutes of Health released its first guidelines on recombinant DNA) and 2023. The accumulated tacit knowledge of the country’s biosafety officers forms a web of precaution that picks up where rules leave off.

Today, those rules are being reconsidered. In January 2023, the US National Science Advisory Board for Biosecurity (NSABB) issued the Proposed Biosecurity Oversight Framework for the Future of Science. In response to President Biden’s Executive Order on Advancing Biotechnology and Biomanufacturing Innovation for a Sustainable, Safe, and Secure American Bioeconomy, federal agencies are now considering multiple new schemes to support biosecurity. Examining how the country’s biosafety officers have accumulated their knowledge could help formulate policies that are proactive and protective, rather than merely performative.

One day after Christmas

Over a biosafety career, on-the-job training forms a series of vividly remembered moments characterized by emergency, anxiety, and learning, which shape my approach to the job on a daily basis. In late December 2009, when I was the biological and chemical safety officer at the University of New Hampshire, the campus veterinarian called to say that a local 24-year-old woman had been diagnosed with gastrointestinal anthrax. The cause was unknown and state agencies investigating were joined by the Centers for Disease Control, the Federal Bureau of Investigation (FBI), and the Environmental Protection Agency (EPA), as well as other federal entities. Among the federal regulations for biosafety, the one known as 42 CFR 73—which governs the handling of potentially dangerous pathogens and certain toxins, called “select agents”—has very specific guidelines for inventory control. The veterinarian said our file manager for the Federal Select Agent Program at the Department of Health and Human Services (DHHS) had requested that we conduct an inventory to determine whether the campus’s samples of anthrax had been improperly accessed.

The campus was cold and deserted when the veterinarian and I met at the lab. We were both on edge, worried about what we might find. At that point I had been working in biosafety for more than 15 years, and I couldn’t help but be reminded of the anthrax mailings of 2001, which were followed by nearly a decade of investigation that initially focused on scientists. We put on laboratory coats, N95 respirators, nitrile gloves, and safety glasses, located the freezer key in its lockbox, and entered the necessary information into the logbook. After locating the cryogenic freezer boxes with the anthrax vials, we moved them to the biological safety cabinet and began to inventory each one. Our anxiety was suffused in a routine of familiar and highly proscribed procedures. Fortunately, we accounted for all vials.

Over a biosafety career, on-the-job training forms a series of vividly remembered moments characterized by emergency, anxiety, and learning, which shape my approach to the job on a daily basis.

A few days later, we heard that the patient had been exposed to anthrax in the campus ministry building while dancing as part of a drum circle. A team from the EPA and FBI had discovered that some of the drums used hides that had not been treated before they were imported to the United States. They believed that the drumming caused the anthrax spores to become airborne, exposing the individual. No one else became infected.

But once the mystery was solved, the public’s concerns increased, creating the need for new capacities and procedures for which there were no prewritten specifications. Drum owners around town began to worry about whether they were being exposed to anthrax. The university requested that my team accept drums at our hazardous waste facility. We quickly determined that it was not large enough for the instruments that were coming in. Over the next 48 hours, we worked with the facilities management department to construct a metal fence in a parking lot where concerned citizens could easilyand safely drop off their drums. Soon cars began to arrive, and people threw their drums, often wrapped in garbage bags, over the fence.

For me, experiences like this were very stressful, but I learned about emergency management and public response, how to engage with multiple federal agencies, and how to draw on my own and colleagues’ professionalism to cultivate an atmosphere of competence and calm. I also learned how to safely accept a pile of potentially hazardous drums in a parking lot. It would not have been possible to learn this from a book. 

Static rules, dynamic knowledge

As the anthrax example demonstrates, Polanyi’s distinction between “explicit knowledge” (i.e., knowledge that can be explained and transmitted to others) and “tacit knowledge” (i.e., knowledge that is composed of individual experiences) is highly relevant to biosafety. There are no simple knowledge databases that explain how to mitigate biological risk in experiments—never mind how to keep up with rapidly changing situations like an anthrax scare. Knowledge is gained from site-specific experiences, working side-by-side with others, understanding the processes and operations of different facilities, and having a sense of how enforcement of biosafety regulations and policies has evolved over time in response to new needs.

I learned how to safely accept a pile of potentially hazardous drums in a parking lot. It would not have been possible to learn this from a book. 

The rules themselves have remained relatively static. Over the past 50 years, five significant biosafety governance systems have been implemented in the United States to regulate biological research. In 1976 the National Institutes of Health released its Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules, and in 1991 the Occupational Safety and Health Administration released the Bloodborne Pathogens Standard in response to health care workers who were becoming ill with HIV and hepatitis from needlesticks. After 9/11, DHHS began the Federal Select Agent Program in 2002. Finally, the Policy for Institutional Oversight of Life Sciences Dual Use Research of Concern was instituted in 2014 and the Recommended Policy Guidance for Departmental Development of Review Mechanisms for Potential Pandemic Pathogen Care in 2017.

These rules provide a framework for oversight, but they do not explicitly describe how to conduct biosafety or provide mechanisms to ensure compliance. Out of the five, only two have penalties for and procedures to determine criminal culpability: the ones covering bloodborne pathogens and select agents. The others are considered government funding policies, meaning the recipients of federal funds must create an Institutional Biosafety Committee (IBC) to review relevant research on recombinant or synthetic DNA or RNA, or an Institutional Review Entity to review dual use work (research that could be harnessed for both benevolent or malicious purposes). But pathogenic experiments that don’t involve these molecules—such as research withnon-recombinant Ebola, avian influenza, or coronavirus—would not require an IBC review. Furthermore, noncompliance with the policies themselves does not always result in a loss of government funding. Thus, the management of biological risk in the United States primarily comes in the form of self-governance by the scientific community.

Biosafety remains informally organized, with neither formal degrees nor well-defined pathways leading to a career. A 2018 survey of American Biological Safety Association members found that nearly 50% had degrees in microbiology; other members held degrees in environmental health, public health, chemistry, infectious disease, industrial hygiene, engineering, occupational health, medicine, veterinary sciences, first response, security, and architecture. Roughly a third listed “other” as their major field of study.

In larger institutions, the biosafety officer is generally a full-time staff member. In smaller institutions, the officer may be a researcher, laboratory member, or a member of the environmental health and safety team. The National Institutes of Health’s 1979 Laboratory Safety Monograph, which was one of the first to describe the role, provided this guidance when selecting the biosafety officer:

The principal function of the biological safety officer should be to advise the principal investigator, the IBC, and the laboratory worker concerning the most appropriate safety practice that will assure the safe conduct of recombinant DNA research. Depending on the nature and extent of the institution’s recombinant DNA programs, the biological safety officer may be a full-time position, or the duties may be assigned to an individual who has other responsibilities. Where the institution has a comprehensive environmental health and safety program that includes expertise in biological safety, it would be useful to select the individual from the program’s professional staff.

This early emphasis on selection, rather than training, now means that the majority of biosafety knowledge is learned on the job, with little official pedagogy or academic coursework. For years, the field has debated whether biosafety experience outweighs biosafety certification or credentialing. Advocates for the former argue that experience is essential to understand the complexities of biosafety programs. Credentialing advocates argue that someone is not fully competent until they can pass a test and obtain a formal certification.

Biosafety remains informally organized, with neither formal degrees nor well-defined pathways leading to a career.

Further complicating the acquisition and transfer of knowledge, biosafety professionals themselves must balance what to share with others and what to keep secret. For example, acknowledging that an institution has a high-containment laboratory is usually fine; however, sharing how to access the lab is not. Some biosafety officers even refuse to share secrets with others in the profession, often out of a concern they could be viewed as failing to do their jobs appropriately or worries that they would be fired if their organization received negative media coverage. 

Becoming a biosafety professional

Like most people in my profession, I never set out to become a biosafety officer. In 1998, when I was a graduate student in the environmental health sciences program at the University of Massachusetts Amherst, expecting to earn my degree and then go work for a pharmaceutical company or government lab, I got a side job researching biological safety manuals, exposure control plans, and standardized biosafety inspection checklists from other universities for the school’s biosafety officer.

As part of my graduate studies, I took a class with the biosafety officer, where I was formally introduced to the politics of safety in an academic environment. We learned, for example, that there was a difference between who had the authority to shut down a laboratory in theory and who could do it in practice. We also discussed how to leverage the IBC to ensure a decision was not perceived as coming from a single person, and how tenured professors were often given more leniency than nontenured faculty and staff. This formal academic training gave me insight into the politics of how safety organizations worked in a large university and some perspective on how a person might accomplish the job under those unique conditions.

Complicating the acquisition and transfer of knowledge, biosafety professionals themselves must balance what to share with others and what to keep secret.

At the time, biosafety professionals assumed that changes in our responsibilities would come from changing biological capabilities—that is, through innovation—but history intervened: the next big change occurred in the rules themselves. On September 11, 2001, I had a full-time job in environmental health and safety at the Harvard University Longwood Medical School and was working in a safety office in the basement of the university’s Institutes of Medicine. A week later, the first letters containing anthrax were mailed in the United States. With everyone on high alert, I was tasked with creating a presentation for campus employees on how to handle mail. The only guidance available then came from the United States Postal Service, and it included a review of how to use latex gloves and an N95 respirator, how to identify and categorize suspicious mail, and what to do if someone found it. Although I had guidance from the school’s biosafety officer, we all had to think on the fly to create procedures to deal with new situations.

Soon enough there were new rules, but they too had to be interpreted. In late October 2001, Congress issued the USA Patriot Act, expanding the previous Biological Weapons Statute to include restrictions on who could possess or use certain biological agents and toxins. For the first six months after passage, it was unclear who would be accountable, how exemptions would be determined, how the university would gather the necessary information, and how the rules would affect those currently working with the materials. In this vacuum, I was tasked with reading the regulations and developing a summary of how it might impact the university.

In April 2002, when I started working for the University of New Hampshire (UNH) as the biological and chemical safety officer, the rules were still murky. To continue my education and strengthen my network, I joined an email listserv, signed up for a biosafety course, and enrolled in the American Biological Safety Association. The listserv became very active when DHHS issued their Preliminary Guidance for Notification of Possession of Select Agents in the Federal Register on July 12, 2002, and biosafety professionals across the country began to grapple with its implications.

Like most people in my profession, I never set out to become a biosafety officer.

The first thing institutions needed to do was assess whether they possessed any of this newly identified category of biological material: select agents.This was a remarkable moment of realization, as biosafety officers across the country needed to ask researchers and staff to go through freezers to see what they could find. There was no central repository of information, no library or clearinghouse. In order to have the knowledge, we had to create it. Suddenly, many different types and strains of select agents were reported on UNH’s campus, such as Bacillus anthracis (anthrax), Franciscella tularensis (tularemia), Yersinia pestis (plague), conotoxin, ricin, tetrodotoxin, and shiga-like toxin. If we had not bothered to ask people to make inventories, we may never have known these materials were present on campus. This is a classic example of biosafety’s unique relationship to knowledge: it must be constantly created at the junction between rules, human behavior, facilities, and microbes.

Consider the knowledge needed to maintain safe operations in a laboratory. To learn the intricacies of the electrical, plumbing, networking, and access control systems of UNH’s biosafety level 3 high-containment facility used to study anthrax and plague, I reviewed building floor plans, met with the building manager, and worked with information technology staff to install card- and pin-access door locks and to review cybersecurity systems for computers, printers, and telephones. I then spent countless hours talking with people who understood all the details of how the facility interacted with other campus systems, including how steam pipes connected to the autoclave, how to make sure the laboratory sink drains captured the wastewater influent so it could be disinfected prior to entering the sewer system, and which motors in the penthouse needed to be kept on emergency power to keep the facility under negative air pressure in an electrical outage.

The knowledge I gained was essential for in-the-moment snarls and complications that could have had dangerous implications. My familiarity with the plumbing of the autoclave meant I knew to turn off the steam quickly when a pipe burst in the ceiling. And when a drain elsewhere in the building clogged, I could track it back to that same autoclave, where an absent-minded researcher had probably used a plastic container that melted. And it wasn’t just information specific to this institution, or even this laboratory, that I needed to learn from other people within the system. I also needed to be able to find resources outside the system. When New Hampshire had an ice storm that led to a week-long power outage, I called around to grocery stores to find dry ice that we could put into the -80°C freezer so the anthrax and plague samples wouldn’t go bad.

In another instance demonstrating the complexities of tacit knowledge for biosafety officers, UNH information technology personnel didn’t want to go through the extensive background checks needed to access high-containment facilities. It fell to me to learn how to change the batteries when the battery-powered locks stopped working, reprogram them, and then ensure that everyone had the updated codes and electronic cards to access the lab.

Biosafety officers across the country needed to ask researchers and staff to go through freezers to see what they could find. There was no central repository of information, no library or clearinghouse.

These examples could have occurred in any of the last several decades, but the arrival of the federal select agent regulations in 2002 was a definitive moment for the life sciences. The regulations restricted who could perform research with listed biological materials and increased security measures, requiring background checks for individuals and prohibitions on using any controlled substances (including marijuana) by lab personnel and others with access to the agents. I had to inform colleagues in the microbiology department that they could no longer participate in the Federal Select Agent Program because of their nationality. Like many in the field, I felt this was unjust. I documented the many researchers who chose to destroy their biological materials and stop their work rather than comply with the new requirements. Without these experiences early in my professional journey, I may never have understood how certain aspects of biosafety are enacted before their importance or impact is fully understood. Just as it is important to appropriately transfer biosafety knowledge so officers can gauge diverse risks and hazards within an institution, it is also important to consider the risks of new controls on society at large.

Biosafety workers must develop the understanding that information is usually incomplete, perhaps because the right questions have not been asked. It takes experience to know what is not there. When I was managing a review committee, a researcher failed to report a portion of their plague research on the forms to register their activities. Only during questioning did the missing information come to light. Without it, the committee would not have been able to make informed, risk-based assessments. It is even more difficult to find knowledge that is concealed, whether through ignorance, laziness, or actual malice. Unfortunately, this is one of the weaknesses of self-regulating IBCs: they are only as good as the quality of the information provided to them.

And because of these larger security concerns, there is also knowledge that cannot be shared, even among people working in biosafety. Many of us working with security clearances are likely very familiar with not sharing certain kinds of information. Similarly, there are also forms of knowledge that may remain hidden indefinitely.

Integrating tacit knowledge into rulemaking and training

In retrospect, my career might be viewed as an ongoing 28-year experiment in how to keep lab workers, the community, animals, and the ecosystem safe. This experience offers guidance in considering how to make and enforce rules in the face of rapidly changing technology.

First, biosafety professionals’ knowledge should be incorporated into the rulemaking process. The tacit knowledge that is essential to enforcing rules could be valuable as new rules are written. Currently, biosafety professionals submit extensive comments on proposed rules during public comment periods. I have personally submitted dozens of comments. But the unique perspective offered by biosafety officers should be more formally recognized by, for example, including them as stakeholders on the committees involved in the government rulemaking process.

Biosafety workers must develop the understanding that information is usually incomplete, perhaps because the right questions have not been asked.

Second, the idea that biosafety can be enforced by a small, aging crowd of specialists is rapidly becoming outdated as bioscience experimentation evolves. The basics of biosafety must be a part of the education of everyone conducting life sciences research, as well as anyone interested in the subject. Principles of biosafety should be brought into elementary, secondary, and postsecondary classes and syllabi, textbooks, seminars, and webinars. It should be reinforced through innovative board or video games that teach the importance of biosafety and help students develop the sort of systemic thinking and problem-solving skills needed for effective biosafety.

What this guidance reflects is a shift in emphasis within biosafety from after-the-fact mitigation to proactive and rigorously data-based risk management. To maintain safe practices as the biosciences expand, the field needs to embrace a culture of ongoing experimentation, collaboration, and information sharing. Data and best practices about risk mitigation should be compiled, correlated, and freely shared through biosafety networking platforms and regular publications. The success of these activities will benefit from the involvement of interdisciplinary scholars who can help identify the processes that generate knowledge as well as those that require more research.

Biosafety professionals will likely always require on-the-job training to understand the scope and moral obligations of their role. Creating a formal, explicit component of biosafety training, however, could significantly speed up and strengthen the process. Key to this would be documenting biosafety knowledge and making it accessible for new officers to synthesize. Engaging biosafety professionals in research of their own processes could help to build empirical data and educate relevant personnel and scientists with oversight responsibilities for research involving agents that could be used as biological weapons or spur a future pandemic.

Finally, additional research is needed to appreciate who has a voice in the biosafety field and who does not, and why. This would help with improving biosafety tacit knowledge and recognizing what makes someone a credible authority in the field. My research here only focuses on my own personal and professional experiences, and there is significant room for other voices to be heard, discussed, and valued.

In Personal Knowledge, Polanyi wrote, “I have shown that into every act of knowing there enters a passionate contribution of the person knowing what is being known, and that this coefficient is no mere imperfection but a vital component of his knowledge.” Recognizing “the act of knowing”—in all its imperfect complexity—is essential to building a future of safe biological research.