'Critical Loophole' in U.S. Biosecurity Rules Allows Legal Assembly of 1918 Spanish Flu Pandemic Virus DNA: Journal 'Nature Communications'
"Under this flawed system, providers have no legal obligation to monitor or restrict access," MIT researchers confirm.
A new peer-reviewed study published Thursday in Nature Communications documents how current U.S. biosecurity regulations allow individuals to legally acquire the purported genetic material needed to recreate the 1918 influenza virus by purchasing unregulated DNA fragments from commercial suppliers, without triggering federal oversight or law-enforcement intervention.
The study abstract reads:
“U.S. select agent regulations ignore easily assembled DNA fragments, making synthesis screening ineffective regardless of accuracy. We acquired unregulated DNA collectively sufficient for a skilled individual to generate 1918 influenza from dozens of providers, demonstrating that fragments must be regulated as select agents.”
This establishes something that policymakers and the public are rarely told outright.
Access to the genetic blueprint of a historic pandemic virus is not hypothetical, restricted, or tightly controlled.
It’s legally obtainable today through ordinary commercial channels.
That access gap raises immediate national security concerns, exposing a regulatory system that claims strict control over what are said to be pandemic-capable pathogens while permitting their genetic components to circulate without centralized oversight, interagency review, or law-enforcement visibility.
Follow us on Instagram @realjonfleetwood & Twitter/X @JonMFleetwood.
If you value this reporting, consider upgrading to a paid subscription.
For advertising & sponsorship opportunities reaching 300,000+ monthly viewers, contact us by clicking below.
A ‘Critical Loophole’ & ‘Flawed System’
U.S. law bans whole pandemic pathogens but not their parts.
This allows anyone to legally buy and assemble the DNA for a virus that killed 50 million people, while market pressure discourages companies from asking questions or stopping it.
“Current U.S. regulations governing select agent pathogens contain a critical loophole: they cover intact DNA sequences capable of generating harmful agents, but ignore DNA fragments that can be assembled by anyone with modest laboratory skills (Fig. 1). Under this flawed system, providers have no legal obligation to monitor or restrict access. To explore this vulnerability, we fragmented DNA sequences encoding ricin toxin or 1918 pandemic influenza virus and ordered 2–8 pieces from each of 38 DNA synthesis providers. The companies collectively provided enough (legal) 400–500 base-pair fragments to generate (illegal) intact constructs several times over. Laboratory tests of equivalent harmless sequences confirmed that the pieces could have been assembled into constructs that a skilled individual could use to generate a virus that once killed 50 million people by following publicly available protocols. Responsible firms face an impossible choice: implement voluntary safeguards and potentially lose business to less cautious competitors, or ship dangerous but legal fragments. Market incentives discouraged them from verifying our identity, confirming a legitimate research purpose, or coordinating with others to determine whether we sought to obtain an intact agent. The question is whether policymakers will update select agent regulations to cover DNA fragments—enforced by mandatory stress-testing as in cybersecurity—to level the playing field and prevent misuse.”
Orders Placed Without Registration, Verification, or Alerts
The system did not fail to identify a bad actor.
It failed to even ask whether there was an actor.
No credentials, no facility, no declared research purpose were required—because the law does not require them.
Oversight did not break down; it never engaged.
“Despite using a pseudonym lacking molecular biology publications and providing an office shipping address and contact details for a desk-based nonprofit explicitly lacking any laboratory facilities, we obtained fragments encoding both ricin toxin and 1918 influenza virus from nearly all providers without registering with the Federal Select Agent Program (FSAP) or triggering any notifications of law enforcement. For context, research institutions in possession of select agents or intact DNA sequences sufficient to generate them must register with the FSAP, demonstrate proper facilities and safety protocols, undergo personnel screening, and maintain strict inventory controls. That anyone can legally obtain the DNA required to produce these same agents by ordering DNA fragments represents a critical failure in the regulatory framework.”
Assembly Confirmed Using Standard Laboratory Methods
“The complementary fragments were readily assembled using Golden Gate, one of the most widely used molecular cloning methods.”
“All 35 mutations were fixed with a high success rate on the first attempt.”
This removes the last comforting assumption—that even if someone obtained the DNA, putting it together would be prohibitively difficult.
The techniques described are standard, published, and widely taught.
The gap between legal purchase and functional assembly is narrow and shrinking.
Voluntary Screening ‘Fundamentally Inadequate’
“Of the 36 total providers that shipped legal select agent DNA fragments, only one requested evidence of authorization from a third party.”
“They shipped the fragments because they were legal and individually harmless.”
“Current regulations create a market where security compromises are effectively rewarded.”
This explains why industry self-policing cannot work.
Companies that slow down or ask questions lose business to those that do not.
The rules incentivize speed over scrutiny, compliance over caution.
What is framed publicly as “responsible screening” operates in practice as optional theater.
Post-Notification Stress Tests Still Failed
“All eight shipped completely undisguised 1918 influenza fragments.”
“Not one requested authorization, verified our identity, or reported the suspicious attempt to authorities.”
Even after the vulnerability was disclosed—even after law enforcement was reportedly aware—behavior did not change.
This undermines the idea that the system merely needs better awareness or communication.
The incentives and permissions remain unchanged, so the outcome remains unchanged.
Cost & Capability
“Collectively, our results reveal how inadequate select agent regulations prevent even responsible DNA synthesis providers from consistently implementing vital safeguards. Synthetic DNA sufficient to generate infectious 1918 influenza virus following standard laboratory assembly can be purchased for approximately $3,000; we obtained enough fragments to encode the virus several times over. As a result, anyone with modest laboratory skills and access to standard equipment can order and assemble DNA fragments sufficient to generate select agent viruses and toxins—including a pandemic virus that killed over 50 million people.”
This places the capability well within reach of universities, startups, private labs, and foreign actors operating entirely within the law.
The limiting factor is not money, infrastructure, or access to rare materials.
It is regulation—and that regulation currently does not apply.
A Failure of Risk Assessment
“That we could legally obtain fragments of DNA from virtually every gene synthesis provider that were collectively sufficient for a skilled individual to generate a virus that once killed 50 million people… represents a noteworthy failure of societal risk assessment and mitigation.”
“Voluntary measures have proven insufficient.”
The paper does not describe a future risk.
It documents a present condition.
Governments assert tight control over pandemic-capable pathogens while allowing their complete genetic components to circulate freely.
Bottom Line
The new Nature Communications paper shows that U.S. biosecurity controls are largely symbolic.
Whole pandemic pathogens are regulated, but their component DNA is not, allowing the genetic material for a virus that killed 50 million people to be legally purchased and assembled under current law.
Follow us on Instagram @realjonfleetwood & Twitter/X @JonMFleetwood.
If you value this reporting, consider upgrading to a paid subscription.
For advertising & sponsorship opportunities reaching 300,000+ monthly viewers, contact us by clicking below.
This'll be the same one that they couldn't get to infect anyone.
Even by getting the infected to cough into other peoples mouths.
Look it up.
Absolutley stunning how the fragment-level loophole bypasses thesame screening that applies to complete sequences. The fact that Golden Gate assembly worked with such high mutation fixation rates on firts pass kinda shows the technical barrier here isn't about sophistication anymore, its purely about whether someone chose to order the parts. I ran into similar commercial incentive issues when evaluating vendor compliance around dual-use compounds, the firms that slow down and ask tough questions genuinley lose contracts to those that just ship fast.