Regulating Dual Use Risks

1. Regulating Dual Use Risks Filippa Lentzos

2. Conceptualising Regulation Broad definition of regulation Always regulatory space in market Occupied by many regulatory influences

4. ‘Coercive’ mechanism: explicitly imposes certain practices ‘Normative’ mechanism: standardises particular practices ‘Mimetic’ mechanism: designates particular practices necessary for ‘success’

5. Key Questions What are the regulatory influences operating in the regulatory space of biological labs? What kind of authority do the different forms of regulation exert? How does the authority exerted alter depending on the lab context?

6. Ethnographic Fieldwork Biological labs: What kind? University-based, public, private, commercial, hospital, military Small, large, anything in between Benign organisms or highly infectious pathogens….or not whole organisms at all but tissue cultures, in-vitro cell systems, small molecules, gene sequences

7. Oversight of biological research is part of more general oversight for health, safety, and environmental concerns. Large companies: Dedicated ‘EH&S’ departments with 1-2 to 10-15 fulltime employees that evaluate, assess and control workplace hazards SMEs: contract out to EH&S consultants

8. Documentary Oversight Large companies: Based on ISO 14,000 environmental management system: ‘policies,’ ‘SOPs,’ ‘work instructions,’ and ‘forms’ There’s a hierarchy of documentation that starts with a policy that says, “We’re going to do ABC,” and then you have an SOP that says, “This is how we’re going to do ABC”. And then you have a work instruction maybe below that, that says, “In this building we’re going to do ABC this way. In this other building we’ll have to do it this way”. And underneath that are forms, “When I do ABC, here’s how I document that I actually did those steps.”

9. Translating regulatory requirements into practice involves more than “going online, downloading the regulations, and putting print-outs in a binder.” Regulations sound so black and white. But the truth is, it’s never black and white, it’s usually got lots of shades of grey. A big part of our job in EH&S is taking a regulation and then digesting it and interpreting how it actually applies to our facility. Where do we need to comply? Where are we exempt? If we are exempt, we need to document why. Typically we have to write a paragraph to put in our files about our interpretation of that regulation against our operations. And that way, if the agencies come, we can show them that we have considered this, and this is the basis for why we are not doing whatever they think we should do.

10. Policy on biosafety Details procedures for the safe use and handling of biological materials and recombinant DNA. Identifies hazards that may be encountered, and specifies practices designed to minimise or eliminate exposures to these hazards. Describes the use of appropriate safety equipment. We try to find somebody who has got something close to what we need. So we collaborate with our counterparts in other companies, and share their documents. We also draw on the biosafety programmes of the universities in our area.

11. Compliance incentives The company sets us yearly goals and your increase is based on how well you do. So at your performance review, you say: “This year I’m going to do this, this and this” and then if you do that – and your boss agrees – you can get a very high rating, which gets you a bigger raise. Now, they build safety and other issues into those goals. So you don’t want any OSHA-reported incidences, and this sort of thing. And so they say, okay, last year we had eight OSHA-reported incidences, the goal for next year, for all of our research people in, say chemistry, is six. And that means you don’t want to be the person that gets one of those, right?

12. SMEs: ‘Plans’ outlining workplace hazards and procedures for controlling them. Plans on: chemical hygiene, radiation safety, hazard communication, fire prevention, exposure control, workplace violence, respiratory protection, ergonomics, accidents and injuries ‘Biological Safety Plan:’ how to handle infectious materials ‘Blood-borne Pathogens Plan:’ how to handle blood-borne pathogens

13. Supervisory Structures Large companies and SMEs: overarching safety committee, subcommittees on biosafety, chemical hazards and radiation safety, individual safety officers They are our ears to the ground on formulating policy and developing compliance plans as changes occur.

14. Biosafety committee: reviews and approves all new projects & procedures involving either recombinant materials or biological agents, and considers why, how, who, where, etc. Internal Review Board to review and approve projects dealing with human tissue. Contracted out. The experiments generally can’t be done, nothing can be done, until you get approval from this team.

15. Internal incident reporting system: lab incidents are reported by researchers, investigations are carried out, and corrective action is taken Security: guards, CCTV, gates, badges, key cards, locks on cabinets and freezers At the very least this means a conversation with the person who did it about how they could have done something differently or better next time, or, if more serious, it might mean formally retraining a whole group of people.

16. Inspection Programmes Large companies: mirror external inspections by OSHA and EPA We try to coach them. We’re not the safety police. There’s a lot of safety departments that still act like the safety police and they take punitive steps and tell your boss. We try to reserve that for the 10% that we can never get to co-operate.

17. SMEs: ‘safety assessments’ 2-3 hrs on quarterly basis, plus surprise visits Issues often raised: poor record-keeping, mislabeled unlabeled containers and waste bags, wrong type of containerisation Discuss assessment report, any accidents, new regs, etc in safety committee meetings

18. Informal oversight practices Lab notebooks Professional norms, practices, experience Peer observation

19. Lab Notebooks Primary record of current and past expts Record: concept, intent, design of expts, observations during expt, resulting data Elaborate company-specific rules Crucial to biotech companies whose main assets are their intellectual property

20. It’s important to have strict documentation: when the key ideas occur; who actually delivered the ideas; who made the compounds for the first time; when it was tested for the first time, with what result. It’s more for the future. It’s not so much for the immediate present. …It’s not important until you have some product that potentially can make a profit. You know, when new scientists come in, particularly out of an academic environment, the amount of paperwork that we handle is way, way more than they’re used to. And it might seem like bureaucracy and paperwork, but in fact what they’re doing is documenting their work in a way that other people in the company can access or it can be accessed after they’ve left. It’s writing reports and documenting what you did, why you did it, what the results were, how you interpret the results. It’s equivalent to writing a scientific paper after you’ve done the work. Here it’s just continuous.

21. Professional Norms, Research Practices, and Experience Everyone also just generally brings in experience if they’re coming from another academic lab or from a different industrial setting. They bring experience with them in terms of how something in the lab was handled in their past life and the safest way of handling it, you know, if that safety issue can also be used here. People bring their own experience with them. A lot of the safety requirements are really just common sense on how to handle things. You’re trained from the start as a scientist to operate safely in the laboratory.

22. You know it because that’s the way things are done. It’s not because it’s a rule. It’s just that’s the way things are done and you do them that way. I mean, in grad school you do them that way. This is how it’s done, don’t change it. And if you’re doing it wrong somebody will definitely tell you. You start working in the lab and you just follow what the people in the lab are doing. I’ve been through the training every year through my graduate career and here. So, like I said, you know it, you don’t take notes. It’s nothing you could spout back verbatim, but you know it.

23. Peer Observation I know pretty much what everyone is doing and what they’re working on; how frequently they work with the radioactivity; what kind of experiments they do; how much radioactivity they are supposed to consume in the experiment. So, I can easily go the next day and check the forms where they are supposed to record the decontamination of their working space and the screening of the working space for the radioactivity. If the record is not there then, you know, I just sit with them for a minute and remind them that they should do it. And that’s pretty much it.

24. There’s policing in-house, if someone does something really stupid – and occasionally that happens – then everybody gets in on that individual or gets them to clean up their act. Everyone in the lab knows what everyone else is doing.

25. Lessons for Regulating Dual Use Risks There is a plurality of regulatory measures operating in private companies to oversee biological research. Any measure introduced to regulate dual-use risks would not operate in isolation, but would instead be merely one element in a regulatory space where other measures and influences are already in place.

27. Depending on their objective and the implementing context, regulatory measures and their modes of operation may be effective in their own right or in conjunction with each other. We need to consider how the various regulatory measures work in practice to assess which regulatory measures are effective and in which contexts.

28. In small, early stage biotech firms, research oversight is often provided by scientists alongside their primary duties. These companies rely more on informal, normative oversight systems like previous training, ‘visceral’ knowledge, experience from other labs, and peer observation. As companies get closer to market launch and commercial pressures become more acute, more formal and coercive oversight mechanisms gain more significance.

29. The authority the different forms of regulation exert depend on where in the developmental process a firm is located. Even when formal structures and procedures are in place, informal oversight mechanisms play an important – and often underappreciated – role.

30. Early on, for a small company, the biosafety people tend to be very technical as they are usually still working as researchers and only doing the biosafety job on a part time basis. At around 150 employees, companies can no longer rely on part-time biosafety officers. Ironically, it is when professional biosafety people are employed that “you loose an understanding of what’s going on.” They are administrators in inclination and ability. They only know the regulations you have to comply with. Mid-size companies move away from using scientists towards administrators that don’t know what’s going on at the bench top level. EH&S don’t deal with the real safety issues, they only handle the bureaucracy. They are administrators. They may chair the safety committee, but even so “they pretty much just turn the wheels.” Most EH&S safety people are technically incompetent, and completely antithetical to people in research. There is a natural schism between EH&S and scientists, and the earlier you are in the R&D process the bigger the gulf.

31. See, it only applies to standard viruses. There is no guidance for genetically modified viruses or for very large volumes of viruses. In the synthetic virus era you have to make your own rules – it has to be self-policing; you cannot have a set standard. We can derive strains that are more infectious than HIV. Yet, the biosafety officers are busy pushing airborne pathogens regulations. The real safety issues are inherently self-policed. The pursuit of following safety regulations is a distraction. You can’t develop regulations fast enough to follow evolving research. With basic research you just have to depend on people to have good IBCs, to have enough representation from the trenches to know what is going on. • The current, technical expertise of the people carrying out the research is fundamental in providing adequate oversight of the rapid pace and nature of change in the life sciences.

32. All three modes of regulation have important roles to play and truly effective regulatory frameworks will couple coercive modes of regulation with both normative and mimetic modes. An effective regulatory framework addressing risks of misuse must have multiple regulatory measures working through all three modes of regulation.