Microbial Forensics: Anthrax Letters and Biothreat Attribution

How microbial sequencing built the case in Amerithrax: the morphotype variants of Bacillus anthracis Ames strain, the FBI-USAMRIID investigation, whole-genome sequencing-based attribution, the post-2001 build-out of the National Bioforensic Analysis Center, and the COVID-19-era sequencing capacity that put microbial forensics on every public-health agenda.

Last updated: 18 Jun 2026

On 18 September 2001, letters postmarked from Trenton, New Jersey, began arriving at news media offices in New York and Florida. Three weeks later, a second wave addressed to senators Tom Daschle and Patrick Leahy left the same post office. By early November, 22 people had been infected with anthrax and five had died. The Amerithrax investigation, running seven years, built an entirely new forensic discipline that attributed the attacks to a single flask in a specific US Army laboratory through morphotype analysis and whole-genome sequencing.

Key takeaways

Bacillus anthracis cannot be identified by 16S rRNA alone (more than 99.5% identity shared with B. cereus); confirmed identification requires targeted PCR for pXO1 (lethal factor, protective antigen) and pXO2 (capsule biosynthesis) virulence plasmids, or whole-genome sequencing.
Four morphotype variants (A, B, C, D) from the Daschle letter matched only 8 of 1,070 Ames-strain cultures screened worldwide; all 8 traced to flask RMR-1029 at USAMRIID Fort Detrick, providing the population-genetic fingerprint of the source preparation.
The 2011 National Academy of Sciences review endorsed the morphotype-and-WGS attribution approach but confirmed that molecular evidence alone could not identify the individual perpetrator; access logs, email records, and timeline analysis were required as corroborating non-molecular evidence.
The NBFAC (National Bioforensic Analysis Center), established at Fort Detrick in 2004 and operated by the Department of Homeland Security, is the US federal government's primary bioforensics reference laboratory for criminal and counterterrorism cases involving select agents.
GISAID held over 15 million SARS-CoV-2 genome submissions by 2023; BEAST-based phylogenetics from this database was used in a 2021 UK coroner inquest to estimate a healthcare worker's infection source, the first medico-legal use of SARS-CoV-2 genomics beyond epidemiology.

Microbial forensics is the application of molecular biology, genomics, and population genetics to questions of origin and attribution in cases involving microorganisms, toxins, or other biological agents that cause harm or that are suspected of intentional misuse. Its foundational challenge is that microorganisms reproduce clonally by default, meaning that a flask of Bacillus anthracis Ames strain contains millions of organisms that are for practical purposes genetically identical to each other and to any other preparation of the same strain. The analytical task is therefore to find the genetic variation that does exist within a strain population, characterise it, and use it to connect a specific sample to a specific preparation and, ultimately, a specific laboratory. The phylogenetics and sequence alignment tools used in human forensic genetics are directly adapted to this microbial context.

The post-Amerithrax decade saw substantial institutional investment in this capacity. The US National Bioforensic Analysis Center (NBFAC) was established at Fort Detrick in 2004 as the primary bioforensics reference laboratory for the federal government. The UK's Health Security Agency (UKHSA, formerly Public Health England) maintains parallel capability at Porton Down. The Institut Pasteur in Paris and the Robert Koch Institut in Berlin hold reference collections and sequencing capacity for bacterial and viral agents relevant to bioterrorism scenarios. The COVID-19 pandemic, which required global real-time whole-genome sequencing of SARS-CoV-2 to track variant emergence, demonstrated that the infrastructure for microbial genomics forensics had become a permanent feature of public-health response, not only a counter-terrorism capability.

Three-tier microbial identification ladder: 16S rRNA gives genus-level placement only (B. anthracis shares more than 99.5% identity with B. cereus); MLST on 5 to 7 housekeeping loci reaches strain-level discrimination; whole-genome sequencing resolves individual SNP signatures for source attribution.

Bacillus anthracis Ames Strain and the Morphotype Discovery

The breakthrough in Amerithrax was not a DNA sequencer, it was a technician noticing that one flask of anthrax had colonies of four slightly different shapes growing on blood agar, when all previous microbiology said there should be only one.

Bacillus anthracis is a Gram-positive, spore-forming bacterium. Its two virulence plasmids, pXO1 (which encodes the tripartite anthrax toxin: protective antigen, lethal factor, and oedema factor) and pXO2 (which encodes the poly-D-glutamic acid capsule), distinguish it from closely related environmental Bacillus species including B. cereus and B. thuringiensis. All three share more than 99.5% 16S rRNA sequence identity. Identification of B. anthracis in a clinical or forensic context therefore requires either detection of the plasmid-encoded virulence genes by PCR (pXO1: lef, cya, pag; pXO2: capB) or whole-genome sequencing, not 16S rRNA alone.

The Ames strain of B. anthracis was isolated from a dead Texas cow in 1981 and became the primary strain used in US biodefence vaccine research because it is highly virulent in animal challenge models. By 2001 it was held at multiple biodefence laboratories. Because the Ames strain was thought to be genetically uniform, the initial assumption was that tracing the letters' material to a specific preparation would be impossible.

The breakthrough came from Patricia Worsham and colleagues at USAMRIID, who, while characterising the letters' spore preparations, noticed that cultures from the Daschle letter contained four distinct colony morphologies (morphotypes) on blood agar that were not present in the reference Ames Ancestor strain. These morphotypes, designated A, B, C, and D, differed in colony appearance due to spontaneous mutations that had arisen and been co-selected or co-maintained during specific laboratory passage history. The presence of all four morphotypes in the letters' preparation, at consistent proportions, became a microbial fingerprint. When investigators screened approximately 1,070 cultures held at laboratories that had received the Ames strain, only eight cultures contained all four morphotypes. All eight traced back to a single flask at USAMRIID, designated RMR-1029, maintained by the anthrax vaccine researcher Bruce Ivins.

Amerithrax attribution chain: morphotype isolation from the letters' spore preparation identified four colony variants; whole-genome sequencing confirmed single-nucleotide-polymorphism signatures linking all four morphotypes to the RMR-1029 reference flask at USAMRIID Fort Detrick.

Whole-Genome Sequencing and the Building of the Forensic Case

When morphotype identification narrowed the source to RMR-1029, the FBI assembled a consortium of academic laboratories to validate the finding by whole-genome sequencing, because the legal standard required more than one laboratory's opinion.

Validating the morphotype finding required an independent genomic approach. A consortium of academic and government laboratories, coordinated by the FBI's Weapons of Mass Destruction Directorate, performed whole-genome sequencing of the four morphotype variants isolated from the letters and compared them to the Ames Ancestor reference genome (GenBank accession AE017334) and to the RMR-1029-derived cultures.

The sequencing work identified single-nucleotide polymorphisms (SNPs) specific to each morphotype variant. These SNPs arose as somatic mutations during bacterial growth and were maintained as minority variants in the mixed RMR-1029 population. Because the mutations occurred independently (each morphotype arose by a different mutation event), finding all four in the letters' preparation simultaneously had a probability orders of magnitude lower than chance co-selection from any other Ames-strain preparation. The consortium's findings were subjected to external peer review and were considered sufficiently robust to support a criminal prosecution.

The genomic methodology used in Amerithrax was documented in a series of peer-reviewed publications, including a landmark paper in PNAS (Rasko et al., 2011), which was published after the FBI formally closed the case. The paper described how comparative genomics allowed the identification of strain-specific markers and validated the attribution approach, using the same whole-genome sequencing analysis pipelines now deployed in forensic human-identification casework. A subsequent National Academy of Sciences review (2011) endorsed the scientific soundness of the approach while noting that the interpretation of the statistical evidence against Ivins individually (who died in 2008 before trial) required care.

In the UK, the Defence Science and Technology Laboratory (Dstl) at Porton Down maintains a parallel whole-genome sequencing capability for biological threat agents. Porton Down contributed to the forensic investigation of the 2018 Salisbury Novichok poisoning, which, while a chemical rather than biological event, demonstrated that Dstl can produce forensic genomic evidence at the speed required for law enforcement response. In Germany, the Robert Koch Institut manages BNI-level-4 biosafety laboratory capacity for biothreat agent characterisation and has been formally integrated into Germany's biosecurity response planning through the Federal Office for Civil Protection and Disaster Assistance (BBK).

The National Bioforensic Analysis Center and the Post-2001 Infrastructure Build

Amerithrax demonstrated that the US had no institution whose sole mission was applying forensic standards to biological evidence, the NBFAC was the answer, and it took five years from the attacks to full operational capability.

The US National Bioforensic Analysis Center was established at Fort Detrick in 2004, initially housed within the National Interagency Biodefense Campus alongside USAMRIID and other agencies. It is operated by the Department of Homeland Security and provides forensic analytical support to federal law enforcement for cases involving biological agents potentially used in criminal or terrorist acts. Unlike a traditional forensic laboratory that receives physical evidence items and processes them through a standard menu of tests, the NBFAC maintains standing analytical capacity for select agents (as defined under the US Select Agent Program, 42 CFR Part 73) and provides scientific testimony in prosecutions.

NBFAC's methodology for biological evidence analysis draws directly on the lessons of Amerithrax. Microbial forensic analysis of an unknown spore or bacterial preparation now includes: a morphological characterisation under biosafety level 3 or 4 containment; multi-locus sequence typing (MLST) using five to seven housekeeping gene loci to place the isolate on a species-level tree; whole-genome sequencing to identify strain-specific SNPs, insertions/deletions, and plasmid content; comparison against a curated reference database of known strains from legitimate research and biodefence programmes; and statistical assessment of the probability that the seized preparation was derived from a specific source preparation.

The UK UKHSA maintains the National Bioterrorism Laboratory Network, coordinated through Porton Down, with four designated bioterrorism reference laboratories at NHS trusts. These laboratories operate under the National Infection Service framework and provide rapid diagnostic support (including whole-genome sequencing) for biological incidents. Their forensic reporting runs through established police-laboratory liaison channels and feeds into Crown Prosecution Service case files.

In India, the biosafety and bioforensics infrastructure is less centralised. The National Institute of Communicable Diseases (NCDC, New Delhi) and the National Centre for Disease Control (NCDC, part of the same complex) carry clinical reference capacity for dangerous pathogens. The Defence Research and Development Organisation (DRDO) maintains biodefence-relevant capability at the Defence Research and Development Establishment (DRDE) in Gwalior. Institutional coordination for a suspected biothreat event would run through the Ministry of Home Affairs crisis-management framework and through the National Disaster Management Authority, rather than through a single dedicated bioforensics laboratory.

Containment and sampling
Suspected biological material is handled under biosafety level 3 or level 4 containment. Initial characterisation includes direct microscopy, Gram staining, and spore staining. A portion of the sample is archived in a secure evidence repository.
Presumptive species identification
PCR for genus-level markers (16S rRNA) and, for select agents, direct virulence-gene PCR (pXO1/pXO2 for anthrax; F1 capsule antigen for Yersinia pestis). Rapid immunoassay lateral-flow tests provide a presumptive field result in 15-30 minutes.
Culture and morphotype characterisation
Isolates are cultured on appropriate media (blood agar for Bacillus spp.) and morphotype variants recorded by plate photography and microscopy. Variant colonies are sub-cultured and archived separately.
Multi-locus sequence typing
Five to seven housekeeping gene loci are sequenced for each morphotype variant. MLST places the isolate in the known strain phylogeny and flags unusual lineage positions.
Whole-genome sequencing and SNP analysis
Whole-genome sequencing (Illumina, Oxford Nanopore) generates a complete genome assembly. SNPs are called against a reference genome. Strain-specific markers are identified by comparison against a curated reference panel of known strains.
Attribution and expert report
Statistical assessment of the probability that the seized preparation matches a known source preparation. Written expert report to law enforcement with uncertainty bounds on attribution confidence.

COVID-19, SARS-CoV-2 Sequencing and the Forensics of Origin Attribution

The pandemic demonstrated that the global infrastructure for real-time pathogen whole-genome sequencing had grown from a counter-terrorism niche to a mainstream public-health instrument, and it brought the question of pathogen origin attribution back to the centre of geopolitical and forensic debate.

The SARS-CoV-2 pandemic required the rapid establishment of global sequencing networks at a scale never previously attempted. The GISAID (Global Initiative on Sharing Avian Influenza Data) database, established in 2008 for influenza genomics, became the primary repository for SARS-CoV-2 sequences, holding over 15 million submissions by 2023 from laboratories on every inhabited continent. In the UK, the COVID-19 Genomics UK Consortium (COG-UK) sequenced over 300,000 SARS-CoV-2 genomes in its first year of operation, providing the sequencing backbone for the identification of the Alpha and Delta variants and informing national policy on border restrictions and vaccine deployment. In India, the Indian SARS-CoV-2 Genomics Consortium (INSACOG) coordinated sequencing from 54 laboratories and contributed to WHO variant-of-concern designations.

This sequencing infrastructure has direct relevance to forensic microbiology. Phylogenetic analysis of SARS-CoV-2 sequences was used in a UK coroner inquest in 2021 to estimate the likely source of a healthcare worker's infection, using BEAST (Bayesian Evolutionary Analysis Sampling Trees) phylogenetics to compare the worker's viral sequence with contemporaneous sequences from patients in the same clinical environment. The same phylogenetic species identification and lineage reconstruction approach underlies forensic work on wildlife trafficking and non-human biological evidence. This represented one of the first uses of SARS-CoV-2 genomics in a medico-legal context beyond epidemiology.

The question of pathogen origin for SARS-CoV-2 itself illustrates the epistemic limits of forensic microbial attribution. Investigations by the WHO-convened Scientific Advisory Group for the Origins of Novel Pathogens (SAGO) and by US intelligence agencies produced divergent confidence assessments on the natural spillover versus laboratory-leak hypotheses. The forensic standard relevant to criminal attribution, beyond reasonable doubt, was not met by the available genomic evidence, illustrating a central lesson of microbial forensics: molecular data can narrow attribution to a population of possible sources but cannot always resolve attribution to a single source without corroborating non-molecular evidence. This was true in Amerithrax (where non-molecular evidence pointed to Ivins independently of the genomic findings) and remains true for any novel-pathogen origin investigation.

Key terms

Microbial forensics: The application of molecular biology, genomics, and population genetics to attribution questions in cases involving microorganisms, toxins, or biological agents used in crime or terrorism. Distinguished from clinical microbiology by the requirement for chain-of-custody evidence handling and court-grade reporting.
Morphotype: A visually distinct colony variant arising from a spontaneous mutation in a bacterial culture. In the Amerithrax case, four morphotypes of Bacillus anthracis Ames strain were identified; their co-presence in a preparation encoded a forensic signature linking it to a specific flask.
Multi-locus sequence typing (MLST): Species-level and strain-level characterisation using DNA sequences from five to seven conserved housekeeping genes. Provides higher resolution than 16S rRNA alone and lower cost than whole-genome sequencing; used as an intermediate step in microbial forensic workflows.
Select agent: A biological agent or toxin designated by the US Centers for Disease Control and Prevention and USDA as posing a severe public health risk and therefore subject to strict possession, use, and transfer regulations under 42 CFR Part 73. Bacillus anthracis is a Tier 1 select agent.
RMR-1029: The reference material repository flask at USAMRIID Fort Detrick that was identified as the probable source material for the 2001 anthrax letters, based on morphotype analysis and whole-genome SNP comparison in the Amerithrax investigation.
NBFAC: National Bioforensic Analysis Center, Fort Detrick, Maryland. Established 2004 as the US federal government's primary bioforensics reference laboratory for biological evidence in law enforcement and counterterrorism investigations.
Phylogenetic proximity: The principle in viral forensics that transmission between individuals is supported when their viral sequences cluster together in a phylogenetic tree separately from community strains, rather than being randomly distributed. Established as a forensic tool in the 1990 Florida HIV dental case.

Worked example

Amerithrax Spore Morphotype Attribution, Linking a Flask to Letters via Population Genetics

Four letters containing anthrax spores arrive at US Senate offices in 2001. The spores are genetically indistinguishable from a US Army strain. How does forensic genomics narrow the source to one flask?

Scene: October 2001. Letters addressed to US Senators Tom Daschle and Patrick Leahy contain a weaponised powder identified as Bacillus anthracis Ames strain. Five people die. The FBI AMERITHRAX investigation begins. The Ames strain is widely held in US biodefence laboratories: how can investigators distinguish one laboratory's preparation from another's?

Step 1 (Morphotype characterisation): Microbiologist Paul Keim and colleagues at Northern Arizona University identify four distinct colony morphotypes (variants A, B, C, D) on plates grown from the letter spores. Each morphotype corresponds to a different spontaneous mutation accumulated during passage in culture. The co-presence of all four morphotypes in specific proportions represents a population-genetic fingerprint of the flask's unique passage history.

Step 2 (Whole-genome SNP typing): FBI and NBACC laboratories develop whole-genome sequence comparisons of the morphotype-defining mutations in 1,070 B. anthracis Ames cultures held at 16 US institutions. Only eight cultures contain all four morphotype-defining variants. All eight trace to a single reference material repository (RMR-1029) at USAMRIID, Fort Detrick, Maryland.

Step 3 (Forensic attribution): The molecular evidence narrows attribution to the RMR-1029 flask and establishes that anyone with access to RMR-1029 had potential means of producing the letters. The 2011 National Academy of Sciences review endorses this forensic genomics approach while noting that molecular evidence alone cannot identify which of approximately 100 people with RMR-1029 access sent the letters. Non-molecular evidence (emails, access logs, timeline analysis) was required to focus on Bruce Ivins.

Conclusion: The Amerithrax case demonstrates microbial forensics at its operational boundary: WGS population genomics of bacterial morphotypes can link a biological weapon to a specific source preparation with high confidence, but converting source attribution to individual criminal attribution requires the same convergence of molecular and non-molecular evidence that characterises all complex forensic investigations.

Frequently asked questions

Why cannot 16S rRNA sequencing alone identify Bacillus anthracis in a forensic biothreat sample?

Bacillus anthracis and B. cereus share over 99.5% 16S rRNA sequence identity, so standard sequencing cannot reliably distinguish them. Forensic identification requires PCR for the virulence plasmids pXO1 (encoding protective antigen and lethal factor) and pXO2 (encoding the poly-D-glutamic acid capsule), or confirmation by whole-genome sequencing against the Ames Ancestor reference genome (GenBank AE017334). This limitation is covered in depth in [species identification by cytochrome-b, COI and 16S rRNA](/topics/forensic-biotechnology/species-identification-by-cytochrome-b-coi-and-16s-rrna), which explains the broader constraints of 16S for closely related taxa.

What is multi-locus sequence typing and how does it differ from whole-genome sequencing for microbial forensics?

MLST sequences 5-7 conserved housekeeping genes and assigns each isolate to a sequence type based on the allele combination. It provides strain-level discrimination at lower cost than WGS and is useful for population-structure analysis and phylogeographic tracing. WGS sequences the complete bacterial genome and detects SNPs, insertions, and deletions at every position, providing the highest resolution for source attribution. MLST is used as a screening step; WGS is deployed when precise source attribution is required, as in Amerithrax where four morphotype-defining SNPs had to be confirmed across 1,070 cultures. The [NGS data analysis](/topics/forensic-biotechnology/ngs-data-analysis-allele-calling-and-variant-callers) topic covers the variant-calling pipelines (GATK, FreeBayes) applied to these whole-genome datasets.

What is the phylogenetic proximity principle in viral transmission forensics?

The phylogenetic proximity principle holds that if two individuals are connected by a direct transmission event, their viral sequences cluster together in a phylogenetic tree rather than distributing randomly among community sequences. This occurs because transmitted viruses share a recent common ancestor and have had less time to diverge from each other than from the background population. The principle was established in the 1990 Florida HIV dental case and was applied in the 2021 SARS-CoV-2 UK coroner inquest. Proximity in the tree supports epidemiological linkage but does not exclude an unsampled intermediate host; community controls are required as a null hypothesis. The methods for building these trees are covered in [phylogenetics for species ID and lineage reconstruction](/topics/forensic-biotechnology/phylogenetics-for-species-id-and-lineage-reconstruction).

How are select agents regulated in the US and what does this mean for forensic access?

Select agents are listed under 42 CFR Part 73. Laboratories must register with the Federal Select Agent Program, restrict access to cleared personnel, document all transfers and inventory changes, and undergo periodic inspections. In a forensic context, evidentiary samples containing select agents must be handled and transferred through BSL-3 or BSL-4 registered facilities with chain-of-custody documentation satisfying both Select Agent Program regulations and FBI evidentiary requirements. NBFAC at Fort Detrick is the primary federal facility capable of handling such evidence under forensic standards.

Practice

Question 1 of 5· 0 answered

In the Amerithrax investigation, the letters' spore preparation contained four morphotype variants of Bacillus anthracis Ames strain. Why was the presence of all four variants significant for attribution?

Test yourself on Forensic Biotechnology with free, timed mocks.

Practice Forensic Biotechnology questions

Found this useful? Pass it along.

Spotted an error in this page? Report a correction or read our editorial standards.

Frequently asked questions

Your journey to becoming a forensic professional starts here.