Should We Be Worried About Bioweapons?
An Analysis of Historical Case Studies - Part 1: Non-State Actors
UPDATE: This piece has been finalized and published separately below as one part in a long essay series on AI biorisk.
This piece is more analytical/formal in tone than what I usually publish on Substack; it’s part of the opening section of a longer policymaker-facing essay on AI biosecurity risks (in progress), and it begins with the historical foundations. Consider yourself warned.
I. Successes
Note: Refers to successful deployment of a biological agent, not necessarily success in achieving overall objectives.
A. 1984 Rajneeshee Bioterror Attack
In September 1984, the Rajneeshee cult deliberately contaminated salad bars in ten Oregon restaurants with salmonella in an effort to incapacitate voters before the 1984 Wasco County election.
Later investigations revealed that the attackers had a “fairly sophisticated medical research laboratory” at their commune, where they cultivated salmonella purchased over-the-counter from a Seattle scientific supply house. Ma Anand Puja, a former nurse who ran the Rajneesh Medical Corporation, provided the minimal medical expertise needed to culture common pathogens. Authorities also later discovered that the cult had explored using additional lethal pathogens, including HIV.
Though the cult had access to a medical research laboratory, the actual salmonella cultivation took place in a shed:
In a simple shed, under the supervision of Ma Anand Puja, the cult mass-produced the Salmonella using simple petri dishes, an incubator, and a freeze-drier [14]… Producing large quantities of bacteria is cheap and can be easily done with even rudimentary equipment and skills [18].
The attack poisoned 751 people and hospitalized 45, while causing panic that drained the local economy. To this day, the Rajneeshee operation remains the largest bioterrorist attack in U.S. history.
B. WWI German Biological Sabotage Program
During WWI, Dr. Anton Casimir Dilger– a German-American medical doctor specializing in tissue culture research– carried out a German biological warfare sabotage program targeting Allied livestock supplies. With the help of his brewmaster brother and housekeeper sister, Dilger converted his basement into a makeshift bacterial laboratory where he began cultivating deadly bacterial cultures in liquid form. He used anthrax and glanders bacteria to infect horses and mules being shipped from U.S. ports to Europe. Dilger also coordinated directly with German General Staff.
His basement was located less than six miles from the White House, and as a result of the program, “thousands of horses and mules were killed” (National Archives).
C. 2001 Anthrax Letters (also known as the Amerithrax case)
Following the September 11 attacks, a series of anthrax attacks were carried out through letters containing anthrax spores sent via the mail. The spores had been treated with additives to increase their inhalability, which suggested the involvement of someone with highly specialized, advanced technical expertise. The primary suspect was Bruce Ivins, a veteran biological-weapon researcher for the US Army.
The attack killed 5 people and injured 17, with many survivors suffering long-term fatigue and memory loss even years later. It also created widespread panic at a moment when the nation was already reeling from 9/11.
II. Failures
A. 1993 Aum Shinrikyo Anthrax Attack
In July 1993, doomsday cult Aum Shinrikyo aerosolized a liquid suspension of Bacillus anthracis (anthrax) from the roof of an eight-story building in Kameido, Tokyo, but the operation resulted in no human casualties.
The operation failed because:
They used an attenuated B. anthracis strain (used vaccine strain incapable of causing disease in healthy individuals);
Their Bacillus anthracis liquid suspension had low spore concentrations (significantly below the optimal 10⁹ to 10¹⁰ organisms/mL needed for effective biological weapons);
Sunlight exposure inactivated the spores before they could cause infection; and
Equipment failures meant they were unsuccessful in creating proper particle distribution.
Aum had laboratories for experimenting with bioweapons in Kamakuishki and Tokyo. In addition to anthrax, the group also “cultured and experimented with botulin toxin, cholera, and Q fever” (CDC). After failing to deploy a bioweapon, they later transitioned to successful chemical attacks, including the Matsumoto Sarin Attack and the Tokyo Subway Sarin Attack (not detailed here since this analysis is about bioweapons).
B. 2018 Cologne Ricin Plot
In June 2018, Sief Allah H., a 29-year-old ISIS sympathizer, successfully produced enough ricin for “up to 1,000 toxic doses” and assembled a bomb with explosives and metal ball bearings for a planned mass-casualty attack on a crowded indoor venue. This marked the first time a jihadi terrorist in the West successfully produced the toxic biological agent, demonstrating that technical barriers to simple bioweapons are sometimes surmountable with publicly available instructions.
German authorities discovered and put a stop to the plan via online surveillance operations, specifically after the U.S. CIA provided a tip about his large order of 3,300 castor seeds purchased over the internet.
C. 1995 Minnesota Patriots Council Ricin Plot
The Minnesota Patriots Council was an anti-government militia that attempted to assassinate federal law enforcement officials (including US Marshals, IRS agents, and local sheriffs) using ricin. The group successfully extracted ricin from mail-ordered castor beans using publicly available instructions and basic solvent knowledge gained through their work as carpet cleaners. They initially found and purchased castor beans through an advertisement in a right-wing magazine.
Ultimately, the Minnesota Patriots Council successfully produced enough ricin to kill over 100 people, despite their result being significantly less potent than professional-grade toxin.
Similarly to the Cologne Ricin Plot, law enforcement detected and disrupted their activities before they could carry out planned attacks.
D. 1998 Toxic Terror Case
The perpetrators of the Toxic Terror Case were Larry Wayne Harris, a microbiologist and white supremacist with ties to “Aryan Nations,” working alongside WIlliam Leavitt, a friend who “own[ed] biological laboratories in Nevada and Germany.”
The pair planned to release bubonic plague bacteria in the New York subway system; law enforcement raided their labs after they “mail-ordered freeze-dried bubonic plague germs.” During the raids, officials also found vials containing suspected anthrax. Harris reportedly told a witness that he had procured enough anthrax to “wipe out the city.”
Addendum: ISIS Laptop of Doom
The Islamic State's Terror Laptop of Doom revealed a comprehensive biological weapons research program documented on laptop of a Tunisian ISIS operative with university-level scientific training. Uncovered in 2014, it contained a “19-page document in Arabic on how to develop biological weapons and how to weaponize the bubonic plague from infected animals” containing guidance like “[u]se small grenades with the virus, and throw them in closed areas like metros, soccer stadiums, or entertainment centers… best to do it next to the air-conditioning.”
III. Analysis
Successes
Takeaways
A. Rajneeshee represents a case where despite minimal expertise, the perpetrators were still able to succeed because they chose an easier pathogen to synthesize. The expertise bottleneck varies by pathogen.
B. Dilger was able to maintain operational security by relying on his siblings to help him with his work. While he had to rely on a home laboratory, it’s likely that coordination with German General Staff enabled him to procure advanced materials and equipment.
C. The Amerithrax (aka Anthrax Letters) case is perhaps slightly more difficult to assess with confidence because Bruce Ivins’s guilt remains contested. However, if Ivins was the culprit, key success factors include highly specialized expertise and authorized access to dangerous pathogens as a researcher for the U.S. army.
The Dilger and Ivins cases demonstrate that specialized biological knowledge poses severe risks; advanced expertise can enable catastrophic biological attacks.
Failures
The failed cases fall into two main categories: technical incompetence and detection via surveillance.
Technical Incompetence
The Aum Shinrikyo Anthrax Attack failed on technical problems. However, had Aum expanded their technical expertise beyond their compartmentalized leadership structure, there’s a reasonable chance their attack may have succeeded. Their operation went undetected through deployment, and every failure point (strain selection, spore concentration levels, dispersal, sunlight exposure, etc) represented knowledge gaps that additional specialized expertise could have addressed.
The Amerithrax case demonstrates that the technical barriers Aum encountered were surmountable with proper expertise.
Detection via Surveillance
Unlike Aum's technical failures, the Cologne and Minnesota Patriots cases succeeded at the production phase. These actors proved that certain bioweapon manufacturing is already within reach of non-experts using publicly available information. What prevented attacks was detection and disruption by law enforcement, rather than inability to create functional weapons.
Whether Toxic Terror succeeded at the production phase is less clear, as the vials found by law enforcement were only suspected to contain anthrax. It could plausibly fall into either of the above categories, depending on whether the recovered materials were viable and weaponizable.
IV. Conclusion
Bioweapons have been created and deployed effectively in several documented attacks. The Rajneeshee, Dilger, and Amerithrax cases prove that bioweapon development and deployment are within reach of motivated non-state actors.
At the same time, these successes have been mostly limited in scope and severity. Several other large-scale near-misses have failed primarily due to technical incompetence or detection by law enforcement.
AI, alongside other existing and emerging technologies, threatens to erode some of the barriers that have historically caused malicious actors to fail. That will be the subject of Part 2 of this series!1
Unless I decide to do another case study analysis focused entirely on government-sponsored programs (like the Soviet Biopreparat), in which case it will be Part 3.
now that's a fact I can count on
I think you could make more explicit that you are focusing on non-state actors (it's in the subtitle but I missed that initially) + that you are not aiming for a comprehensive list but what I assume is more of an attempt to look for "archetypes" of historical case studies (?).