Will hackers find bioweapon secrets in the cloud?

The collision of big data and decoded genetic information is creating a wealth of opportunities for biologists, engineers and public health researchers. However, there is also the potential that advances in computing and genetics are providing potentially catastrophic opportunities for malefactors to hack into research computers to find information that could be adapted to create biological weapons.

This nightmare scenario would have sounded far-fetched a few years ago. But according to panelists at an event sponsored by the Center for Science, Technology, and Security Policy at the American Association for the Advancement of Science, advanced research in virology, genetics, and other areas could result in unintended discoveries with the potential for weaponization. The relatively open culture of academia and the lax cybersecurity posture of many academic and research institution creates vulnerabilities that need to be addressed in the near term, experts said.

In the days of the Manhattan Project, when government marshalled the efforts of research scientists to create a nuclear weapon, security was simpler than it is today, noted Mark Greaves, technical director for analytics in the National Security Directorate at Pacific Northwest National Laboratory. Nuclear security evolved from a set of principles that arose from its highly classified origins, and for about 50 years until the rise of the A.Q. Khan network in Pakistan, the world's nuclear powers did a good job of restricting access to nuclear materials.

With biologics, the threat is compounded by the fact that the biotechnology and bioengineering industries have grown up independent of the national security apparatus, and creating an after-the-fact security system based on the nuclear research model -- with closed, restricted data and software systems and custom-built supercomputers -- is impossible. Instead Greaves hopes that cybersecurity best practices could help researchers control access to their data. At the same time, some legal framework will help. Government funders could require advanced cybersecurity controls as a condition of funding biological research housed in a commercial cloud.

Researchers might not know the consequences of their investigations, noted Special Agent Edward You of the FBI's Biological Countermeasures Unit. Research into the genome of an organism could yield unanticipated information about lethal pathogens – and such findings could be discovered only well after such research is widely disseminated.

Robert Sloan, a computer scientist at the University of Illinois, Chicago, is even less optimistic about cybersecurity hygiene. "Breaches are rampant of anything connected to the Internet," he said, noting that even in 2014, some of the most basic security practices are not followed, leading to well-publicized commercial hacks.

"Things are not encrypted. They're not encrypted on the database, and not encrypted over the wire," he said. Moreover, even the best practices can't protect against a motivated nation-state actor. He suggested that researchers working with the most sensitive material think hard about whether it should be online at all.