Homeland Security Bulletin

(1)

With Tighter Homeland Security Measures, Users of Biological

Agents Must Meet Substantial New Regulatory

Obligations-Applications for Clearance Due November 12, 2003

11111

Kirkpatrick

&

Lockhart

LLP

Homeland Security Bulletin

Kirkpatrick

&

Lockhart

LLP

DECEMBER 2003

Two of the most significant legal tools developed in the nation’s efforts to protect itself from terrorist attacks are the USA PATRIOT Act (“Patriot Act”)2_{and the Public} Health Security and Bioterrorism Preparedness and Response Act (“PHSBPRA”).3_{Together the measures} have created new and substantial regulatory obligations for users of certain biological agents. The Patriot Act set standards for the appropriate use of select biological agents, requires new background checks applicable to those desiring to work with these substances and their corporate supervisors, and establishes new and severe criminal and civil penalties for failure to comply. Most significantly, the PHSBPRA expanded the control regime that previously governed the use of dangerous biological agents and toxins by requiring facilities to register if they possess any of several types of enumerated agents, and is no longer triggered by the transport or movement of such agents. Most deadlines for registration have now passed, the most recent being November 12, 2003. Those that have not complied should consider doing so quickly.

This Alert outlines some key requirements of this new regulatory regime, and some of the issues that remain unresolved.

OVERVIEW OF THE NEW REQUIREMENTS FOR ENTITIES HANDLING SELECT AGENTS

Most of the regulations promulgated pursuant to these two statutes employ the PHSBPRA as the predicate statute, but utilize terms defined by Congress in the Patriot Act, most notably the term “restricted persons,” 4

which designates on individual who may not handle certain substances. The PHSBPRA specifies the substances that are the focus of the law. The Patriot Act prohibits “restricted persons” from transporting, shipping, possessing, or receiving any “biological agent or toxin.”5

To ensure that “restricted persons” do not have improper access to these materials, the regulations require that the Attorney General conduct a “security risk assessment” on entities and individuals who have requested access to regulated agents.6_{The results of this assessment are given} to the appropriate agency (see below), which can grant, deny, or revoke access accordingly.7

Responsibility for the implementation of these laws and regulations fell first to the Department of Health and Human Services (“HHS”) and the Department of Agriculture (“USDA”), according to the statutory distinction between threats to persons and threats to agriculture. These agencies in turn delegated enforcement responsibilities to the Center for Disease Control and Prevention (“CDC”) and the Animal and Plant Health Inspection Service (“APHIS”), respectively. Although each agency has promulgated separate regulations,8_they jointly created a uniform registration system that utilizes a common registration document: the Application for Laboratory Registration for Possession, Use, and Transfer of Select Biological Agents and Toxins (“Application”).9

What is regulated? The substances that the PHSBPRA

regulates can be broken down into two basic categories: substances that pose a threat to human life, and substances that pose a threat to agricultural production. The

(2)

Homeland Security Bulletin

substances that pose a threat to human life are identified as “Select Agents or Toxins,” and include viruses, bacteria, fungi, toxins, genetic elements, recombinant nucleic acids and recombinant organisms.10_{The substances posing a threat to} agricultural production are “Listed Plant Pathogens” or “High Consequence Livestock Pathogens and

Toxins.”11_{Because some substances pose a threat to} both human life and agricultural production, these agents have been identified as “Overlap agents.”12 Since the law regulates these varying types of substances similarly, the above substances will be referred to collectively as “regulated agents.”13_Mere possession of a regulated agent now warrants registration, whereas prior to the passage of the PHSBPRA, only the transfer of regulated agents triggered the need to register. Prior registrations undertaken in accordance with previous regulations must now be updated to meet the new standards.

Who is regulated? Recently promulgated regulations

establish the means by which entities possessing regulated agents may comply with the PHSBPRA and the Patriot Act. As noted, mere possession of a regulated agent warrants registration,14 _{and prior} registration undertaken for transfers must be updated to meet the new standards. Any entity possessing such regulated agents must now register with the

government, unless subject to an exemption. There are also new or expanded regulations governing safety, security, disaster planning, training, recordkeeping, and transfers. In addition to these new requirements, entities in possession of regulated agents are subject to inspections by the Department of Health and Human Services (“HHS”).15

MEETING THE REGISTRATION REQUIREMENTS

An entity seeking to register under the PHSBPRA must identify a Responsible Official (“RO”), who must “be familiar with the regulations of this part [42 C.F.R. Part 73].”16_{The RO must also be responsible for ensuring}

that the requirements of the appropriate regulations are met.17_{By registering, the RO is certifying that the} facility meets the requirements to work safely with regulated agents, that only authorized personnel have access to regulated agents, and that the entity will keep accurate records of the regulated agents transferred to and from its facilities.18

An entity possessing regulated agents must either register or be the subject of an exemption. Clinical or diagnostic laboratories are exempt from registration,19 as are those entities in possession of products approved under another federal act.20_{Entities seeking to utilize} either of these exemptions need not register, nor apply for an exemption.

Entities handling investigational products, or those dealing with public health or agricultural emergencies, may also be exempt, but they must affirmatively seek exempt status.21_{Similarly, entities dealing with} attenuated strains of regulated agents which no longer pose a threat to human health or agricultural

production, and have been so identified on the CDC website,22_{are exempt. They must, however,}

affirmatively seek exempt status. Entities can apply for exempt status by utilizing CDC Form 0.1317/APHIS Form 2042.23

Whether an entity must register with the CDC or APHIS depends on the type of regulated agent the entity possesses. A categorized list of regulated agents is available from the CDC website.24_{Since “Select} Agents or Toxins” have been deemed to pose a threat primarily to human health, possession of such agents requires registration with the CDC. “High

Consequence Livestock Pathogens and Toxins” and “Listed Plant Pathogens” must be registered with APHIS since they pose a threat to agricultural production.25_{“Overlap” agents that pose a threat to} both human health and agricultural production can be registered with either the CDC or APHIS. If an entity possesses agents regulated exclusively by HHS and also possesses agents regulated exclusively by APHIS,

(3)

DECEMBER 2003

_Kirkpatrick

_&

_Lockhart

_LLP

the entity must register with both agencies. Since the forms have been standardized, this burden is somewhat eased.

REGISTRATION ISSUES

Registration application packages can be accessed on the CDC website.26_{The RO is responsible for filling} out the first four sections of the Application. Section one covers the entity information (address, name of RO, etc.), while Section two is the certification by the RO and Alternate RO that the entity meets the

requirements specified in the regulations. Section three is a checklist of select agents used, possessed or transferred by an entity. Section four has two parts, the first of which (4A) requires detailed information about the select agents and the laboratories where they will be stored or used. Part 4B requires extensive information about the persons authorized to work with the select agents (name, date of birth, address, supervising principal investigator, agents/toxins, laboratory building, laboratory room, and job title). A “principal

investigator” or “laboratory supervisor” chosen from each distinct building/laboratory controlled by the parent entity must complete Section five, “Laboratory Information.” In addition to providing his or her

resume, the principal investigator must provide detailed information about each agent worked with or stored in the laboratory buildings and rooms listed in Section 4B (including the name, strain designation, date acquired, address of facility from which it was acquired, etc.). The regulations suggest that an entity with several non-adjacent laboratories would be well advised to select several RO’s, rather than several laboratory supervisors, since “[a] certificate of registration will cover activities at only one general physical location (a building or a complex of buildings at a single mailing address.)”27 There is little guidance on this issue, however, and it remains to be seen how this provision will be enforced, especially at large facilities with multiple (nonadjacent) buildings. Section five also requires entities to submit a floor plan for each laboratory where select agents are

used or stored, and includes 44 questions about the interior, safety features, architecture and infrastructure of the laboratory.

In addition to filling out the CDC/APHIS Application,

all entities,28_{persons who own or control the entity,}29

the RO, the alternate RO, and all individuals

authorized to have access to select agents or toxins are required to have an approved security risk assessment by the Attorney General.30_{To obtain a security risk}

assessment, regulated entities must submit a “Bioterrorism Preparedness and Response Act, FBI Information Form” (Form FD-961).31_{This form} applies to RO’s, individuals with access to select agents, and those in a position of authority such that

they could issue orders to those responsible for controlling access (for example, corporate officers and

principal stockholders).32_{It is unclear how far up a} corporate ladder this registration obligation extends (e.g., board of directors, etc). Section I of the FBI form requires the name, address, and type of entity, while Section II requires the Federal Income Tax Employee Identification Number and information about the entity’s leadership personnel, including the names, dates of birth, and Social Security numbers of corporate officers, directors and principal stockholders. Private academic institutions must complete Section II. Like the CDC/APHIS Application, the FBI Form requires the RO, Alternate RO and individuals with access to regulated agents to provide extensive personal information in section III.33_{The FBI also requires} those persons to submit a fingerprint kit.34_{Note that} the RO and Alternate RO must submit the more extensive information (including the fingerprint kit)

whether or not the RO personally accesses regulated agents. Indeed, the HHS suggests that, in choosing an

RO, “the [RO] should not be an individual actually using, working with, or transferring and receiving the select agents and toxins.”35

Because both forms are required, FBI Form FD-961 and CDC Form 0.1319 should be considered in tandem

(4)

Homeland Security Bulletin

to complete one’s registration. The original deadline for the submission of forms FD-961 and CDC Form 0.1319 (APHIS Form 2044) was April 12, 2003.36 Because of the unavailability of fingerprint kits and other administrative problems, HHS and the Department of Agriculture recently extended that deadline to November 12, 2003. 37_{As a result, entities} who submitted the required information to the Attorney General by that date will be eligible for a provisional registration certificate if they meet the other regulatory requirements. This extension allows entities that have submitted the required forms to continue to have access to regulated agents in the interim period while the Attorney General completes the security risk assessment.

The Attorney General is required to report the results of the security risk assessment to the relevant agency head (HHS or APHIS), which can in turn grant or deny access based on the assessment. Entities who are denied access will be given an opportunity to provide information rebutting the reason for the denial (e.g., proof that a denied employee is not a “restricted person” under 18 U.S.C. 175b).

Neither the statute nor implementing regulations specify what, if any, judicial review is available from an erroneous assessment issued by the Attorney General or the administering agency. Arguably such action is “final agency action” subject to judicial review in the appropriate United States District Court pursuant to federal question jurisdiction, as final agency action under the Administrative Procedures Act. But it is unclear how the record for such a decision will be compiled by the Attorney General or the administering agency.

BEYOND REGISTRATION: ADDITIONAL REQUIREMENTS

In addition to registration, there are a number of other regulations with which entities must comply. Section 73.10 imposes safety requirements, including the development and implementation of a safety plan, and

annual inspections by the RO.38_{Instead of containing} substantive safety provisions, the regulation directs entities to “consider” already-promulgated standards for safety, enunciated in several CDC/NIH publications, and the Code of Federal Regulations.39_{RO’s should} read Section 73.10 carefully, as there are some parts of the referenced publications that are highlighted and others excluded. This raises the question of whether a violation of the regulation can be established by showing a violation of a preexisting standard. Additionally, subsection (c) indicates certain types of experiments that may not be conducted “unless approved by the HHS Secretary.”40

Section 73.11 details security measures that must be implemented at facilities housing regulated agents. This provision requires entities to develop security plans that must be reviewed by the RO at least annually, or following any undefined “incident.”41_{Again, RO’s} should read this section of the regulation in detail, as it contains numerous specific provisions, including required reporting to the RO of a number of events that may trigger additional measures or investigation.42_The security plans were required to be implemented by September 12, 2003, including any additional training of personnel required by the plan.43

In addition to the training required for compliance with the security provisions, Section 73.13 details other training that should be undertaken under the plan. This includes orientation training for new employees and annual “refresher” courses.44_{Section 73.14 governs} transfers of regulated agents, and mandates the use of CDC Form EA-101/APHIS form 2041.45_Section 73.15 describes the records that must be kept by a registered entity. These records include an up-to-date accurate list of individuals approved for access to regulated agents, training records, and an accurate and current inventory of regulated agents, among others.46 Section 73.16 allows for inspections of facilities by the HHS Secretary “without prior notification and with or without cause.”47_{The constitutionality of the “without}

(5)

DECEMBER 2003

_Kirkpatrick

_&

_Lockhart

_LLP

Section 73.17 requires registered entities to report “theft, loss or release” to the appropriate authorities. A form has been created, which must be filled out, in addition to any other forms of notification.48 CONCLUSION

The Patriot Act significantly increased the sanctions for violations of the laws governing the use of regulated agents. Even appropriate possession of regulated agents without registration can result in a fine and up to five years in prison,49_{whereas improper possession,} defined as possession for a purpose other than “prophylactic, protective, bona fide research or other peaceful purpose,” is punishable by a fine and up to ten years in prison.50_{Engaging in the transfer of a}

regulated agent to an unregistered person or entity is also a crime, punishable by a fine and up to five years in prison.51_{Meeting these obligations is important for} the regulated community. It may also be important to local governments and others where regulated entities are located. BARRY M. HARTMAN 202.778.9338 bhartman@kl.com CRAIG P. WILSON 717.231.4509 cwilson@kl.com THOMAS D. MANGANELLO 202.778.9213 tmanganello@kl.com

For further information regarding this Homeland Security Bulletin,

or our law firm’s Homeland Security practice, please contact:

Boston Roger C. Zehntner 617.261.3149 rzehntner@kl.com

Dallas Julie E. Lennon 214.939.4920 jlennon@kl.com

Harrisburg Craig P. Wilson 717.231.4509 cwilson@kl.com

Los Angeles David P. Schack 310.552.5061 dschack@kl.com

Miami Daniel A. Casey 305.539.3324 dcasey@kl.com Troy J. Rillo 305.539.3355 trillo@kl.com

Newark William H. Hyatt 973.848.4045 whyatt@kl.com Brian S. Montag 973.848.4044 bmontag@kl.com

New York Eva M. Ciko 212.536.3905 eciko@kl.com

Pittsburgh Thomas J. Smith 412.355.6758 tsmith@kl.com

Mark A. Rush 412.355.8333 mrush@kl.com

San Francisco Robert J. Sherry 415.249.1032 rsherry@kl.com

Washington Barry M. Hartman 202.778.9338 bhartman@kl.com Dick Thornburgh 202.778.9080 dthornburgh@kl.com

(6)

Homeland Security Bulletin

Appendix A to 42 CFR Part 72-Select Agents

CDC Rules APHIS Rules

Subject (apply to select agents) (apply to plant pathogens) Regulations in C.F.R. 42 C.F.R. § 73.0 et seq. 7 C.F.R. §331 et seq.

Registration 42 C.F.R. § 73.7 7 C.F.R. § 331.8

Registration Form CDC Form 0.1319; APHIS Form 2044;

FBI Information Form FD-961 FBI Information Form FD-961

Responsible Official 42 C.F.R. § 73.9 7 C.F.R. § 331.9

Safety 42 C.F.R. § 73.10 7 C.F.R. § 331.11

Security 42 C.F.R. § 73.11 7 C.F.R. § 331.11

Training 42 C.F.R. § 73.13 7 C.F.R. § 331.12

Transfers 42 C.F.R. § 73.14 7 C.F.R. § 331.13

Transfer Form CDC Form EA-101 APHIS Form 2041

Recordkeeping 42 C.F.R. § 73.15 7 C.F.R. § 331.14

Inspections 42 C.F.R. § 73.16 7 C.F.R. § 331.15

Notification for Theft/

42 C.F.R. § 73.17 7 C.F.R. § 331.16

Loss/Release of Agent

Notification Form CDC Form 0.1316 APHIS Form 2043

Exemptions 42 C.F.R. § 73.6 7 C.F.R. § 331.4

Exemption Request Form CDC Form 0.1317 APHIS Form 2042

Comparison of Select CDC and APHIS Regulations

12. Viruses causing hantavirus pulmonary syndrome 13. Yellow fever virus

Exemptions: Vaccine strains of viral agents (Junin

Virus strain candid #1, Rift Valley fever virus strain MP-12, Venezuelan Equine encephalitis virus strain TC-83, Yellow fever virus strain 17-D) are exempt.

BACTERIA

1. Bacillus anthracis

2. Brucella abortus, B. melitensis, B. suis 3. Burkholderia (Pseudomonas) mallei 4. Burkholderia (Pseudomonas) pseudomallei 5. Clostridium botulinum

VIRUSES

1. Crimean-Congo haemorrhagic fever virus 2. Eastern Equine Encephalitis virus 3. Ebola viruses

4. Equine Morbillivirus 5. Lassa fever virus 6. Marburg virus 7. Rift Valley fever virus

8. South American Haemorrhagic fever viruses (Junin, Machupo, Sabia, Flexal, Guanarito) 9. Tick-borne encephalitis complex viruses 10. Variola major virus (Smallpox virus) 11. Venezuelan Equine Encephalitis virus

(7)

DECEMBER 2003

_Kirkpatrick

_&

_Lockhart

_LLP

6. Francisella tularensis 7. Yersinia pestis

Exemptions: vaccine strains as described in Title 9

CFR, Part 78.1 are exempt.

RICKETTSIAE 1. Coxiella burnetii 2. Rickettsia prowazekii 3. Rickettsia rickettsii FUNGI 1. Coccidioides immitis TOXINS 1. Abrin 2. Aflatoxins 3. Botulinum toxins

4. Clostridium perfringens epsilon toxin 5. Conotoxins 6. Diacetoxyscirpenol 7. Ricin 8. Saxitoxin 9. Shigatoxin 10. Staphylococcal enterotoxins 11. Tetrodotoxin 12. T-2 toxin

Exemptions: Toxins for medical use, inactivated for

use as vaccines, or toxin preparations for biomedical research use at an LD50 for vertebrates of more than 100 nanograms per kilogram body weight are exempt. National standard toxins required for biologic potency testing as described in 9 CFR Part 113 are exempt.

RECOMBINANT ORGANISMS/MOLECULES

1. Genetically modified microorganisms or genetic elements from organisms on Appendix A, shown to produce or encode for a factor associated with a disease.

2. Genetically modified microorganisms or genetic elements that contain nucleic acid sequences coding for any of the toxins listed in this Appendix, or their toxic subunits.

Endnotes

1 This is the fifth in a series of articles discussing new federal environmental regulatory requirements arising in connection with Homeland Security. Background information and the previous three articles can be found at the K&L website www.kl.com by following the link to “Practices and Industries” and “Homeland Security.”

2 Pub. L. No. 107-56.

3 Pub. L. No. 107-188. The PHSBPRA also includes measures intended to protect food and drug production, which has resulted in the promulgation of regulations, including mandatory registration with the FDA, which are not addressed here. See 21 C.F.R. Parts 1, 11 and 16.

4 A “restricted person” is defined as an individual who: (A) is under indictment for a crime punishable by imprisonment

for a term exceeding 1 year; (B) has been convicted in any court of a crime punishable by imprisonment for a term exceeding 1 year; (C) is a fugitive from justice; (D) is an unlawful user of any controlled substance (as defined in section 102 of the Controlled Substances Act (21 U.S.C. § 802)); (E) is an alien illegally or unlawfully in the United States; (F) has been adjudicated as a mental defective or has been committed to any mental institution; (G) is an alien (other than an alien lawfully admitted for permanent residence) who is a national of a country as to which the Secretary of State, pursuant to section 6(j) of the Export Administration Act of 1979 (50 U.S.C. App. 2405(j)), section 620A of chapter 1 of part M of the Foreign Assistance Act of 1961 (22 U.S.C. § 2371), or section 40(d)

of chapter 3 of the Arms Export Control Act (22 U.S.C. § 2780(d)), has made a determination (that remains in effect) that such country has repeatedly provided support for acts of international terrorism; or; (H) has been discharged from the Armed Services of the United States under dishonorable discharge. 18 U.S.C. §175b(d)(2) (2003).

There are a number of potential legal issues involving the definition of a “restricted person,” that are only briefly mentioned here:

1) Currently, aliens from Cuba, Iran, Libya, North Korea, Sudan, Syria and Iraq are considered “restricted persons” because of subsection (G). 18 U.S.C. § 175b(d)(2)(G) (2003).

2) The issue as to whether the identification of and discrimination against aliens (pursuant to 18 U.S.C. § 175b(d)(2)(G)) in matters of employment is constitu-tional. This question is beyond the scope of this analysis, but for one discussion of the rights of aliens see Neal K. Katyal & Laurence H. Tribe, Waging War, Deciding Guilt: Trying the Military Tribunals, 111 Yale L.J. 1259, 1300 (2002).

3) The term “mental defective” is not defined in the statute, although it appears in 18 U.S.C. § 842(a)(6) (2002), and is defined in 27 C.F.R. § 478.11 (2003) (governing sales of firearms).

5 18 U.S.C. § 175b(a)(1) (2003). 6 42 C.F.R. § 73.8(a) (2003).

(8)

Homeland Security Bulletin

...

Kirkpatrick

&

Lockhart

LLP

Challenge us.

BOSTON ■ DALLAS ■ HARRISBURG ■ LOS ANGELES ■ MIAMI ■ NEWARK ■ NEW YORK ■ PITTSBURGH ■ SAN FRANCISCO ■ WASHINGTON

®

www.kl.com 7 In addition to examining whether or not a person is a

“restricted person,” there are other criteria that the Attorney General may utilize, including the person’s involvement in certain other types of crime, “having a knowing involvement with an organization that engages in . . . terrorism”, or “being an agent of a foreign power.” 42 C.F.R. §73.8 (d)(2) (2003). 8 42 C.F.R. § 73 et seq. (2003) (promulgated by HHS), 7 C.F.R.

§ 331 et seq., and 9 C.F.R. § 121 et seq. (2003) (promulgated by APHIS). NOTE: To eliminate the need for duplicate citation throughout this article, regulations are cited to 42 C.F.R. § 73, rather than the 7 C.F.R. § 331. For the reader’s convenience, a table has been included at the end of this Alert that cross-references each set of regulations.

9 CDC Form 0.1319/APHIS Form 2044.

10 42 C.F.R. § 73.4 (2003); The complete list of select agents is listed at the end of this article and is available at http:// www.cdc.gov/od/sap/42cfr72.htm.

11 7 C.F.R. § 331.3 (2003); The complete list of high conse-quence livestock pathogens and toxins is available at: www.aphis.usda.gov/vs/ncie/bta.html and the complete list of plant pathogens is available at: www.aphis.usda.gov/ppq/ permits.

12 42 C.F.R. § 73.5 (2003); The complete list of overlap agents is available at: www.aphis.usda.gov/vs/ncie.

13 It should also be noted that, in addition to the specifically listed biological agents or toxins, the regulations extend to forms or elements of these regulated agents, including genetic elements, recombinant nucleic acids, and recombinant organisms derived from or encoded with the genetic material of the regulated agents. See 42 C.F.R. § 73.4(e) and § 73.5(e) (2003).

14 42 C.F.R. § 73.7 (2003). Registration is not required for regulated agents that are in their “naturally occurring environment,” provided that the agent has not been intention-ally introduced, cultivated, collected, or otherwise extracted from its natural source. 42 C.F.R. § 73.5(f) (2003). 15 42 C.F.R. § 73.16 (2003).

16 42 C.F.R. § 73.9(a)(2) (2003). 17 42 C.F.R. § 73.9(a) and (c) (2003). 18 42 C.F.R. § 73.9(c) (2003).

19 42 C.F.R. §73.6(a) (2003). Note that although these facilities need not register, they are still subject to reporting compo-nents of the regulations.

20 42 C.F.R. §73.6(b) (2003) (An example of one such act would be the Federal Insecticide, Fungicide, and Rodenticide Act). 21 42 C.F.R. § 73.6(c)-(e) (2003).

22 See http://www.cdc.gov/od/sap/exclusion.htm 23 42 C.F.R. Part §73.6 (2003), forms available at: http://

www.cdc.gov/od/sap/addforms.htm; http:// www.aphis.usda.gov/ppq/permits/agr_bioterrorism/ exempts.pdf

24 See http://www.aphis.usda.gov/vs/ncie/pdf/ agent_toxin_list.pdf

25 Note that there are two separate addresses for registration, one for animal pathogens, and one for plant pathogens: a) for animal pathogens: Animal and Plant Health Inspection Service, Veterinary Services, National Center for

Import-Export, 4700 River Road, Unit 40, Riverdale, MD 20737-1231; b) for plant pathogens: US Department of Agriculture, Plant Protection and Quarantine, Biological and Technical Services, 4700 River Road, Unit 133, Riverdale, MD 20737-1236. See http://www.fbi.gov/terrorinfo/

bioterrorfd961.htm

26 42 C.F.R. § 73.21(a) (2003). See http://www.cdc.gov/od/sap/ 27 42 C.F.R. §73.7(f) (2003).

28 Except for local, state or federal governmental agencies. 42 U.S.C. § 73.8(a) (2003).

29 42 U.S.C. § 73.8 (c) (2003). 30 42 C.F.R. § 73.8(b) (2003).

31 42 C.F.R. § 73.8(c) (2003). Form available at: http:// www.fbi.gov/terrorinfo/bioterrorfd961.htm

32 See form at: www.fbi.gov/terrorinfo/bioterrorfd961.htm 33 In Section III, the individual must submit personal

informa-tion such as residence and citizenship, and certify that they are not a “restricted person” (by answering a series of questions). In Section IV the person authorizes an investigation into their background.

34 The FBI has established a fax number for obtaining finger-print kits. 304-625-3984 (as of June 6, 2003).

35 See Guidance Document for Application for Laboratory Registration for Possession, Use, and Transfer of Select Biological Agents and Toxins, http://www.cdc.gov/od/sap/

downloads2.htm. 36 42 C.F.R. § 73.0(b)(2).

37 See, 68 Fed. Reg. 62,245 (Nov. 3, 2003) (to be codified at 42 C.F.R. § 73); 68 Fed. Reg. 62,218 (Nov. 3, 2003) (to be codified at 7 C.F.R. § 331). 38 42 C.F.R. § 73.10 (2003). 39 42 C.F.R. § 73.10(a) (2003). 40 42 U.S.C. § 73.10(c) (2003). 41 42 C.F.R. § 73.11(c) (2003). 42 42 C.F.R. §73.11(7) (2003). 43 42 C.F.R. § 73.0(c)(2) (2003). 44 42 C.F.R. §73.13(b) (2003).

45 42 C.F.R. §73.14(c) (2003), form available at: http://www.cdc.gov/od/sap/addforms.htm; http://www.aphis.usda.gov/ppq/permits/ agr_bioterrorism/transfer.pdf. 46 42 C.F.R. § 73.15(a) and (b) (2003). 47 42 C.F.R. § 73.16 (2003).

48 42 C.F.R. § 73.17(f); forms are APHIS form 2043, CDC form 0.1316, available at: http://www.cdc.gov/od/sap/

addforms.htm.

49 18 U.S.C. § 175b(c)(1) (2003). 50 18 U.S.C. § 175(b) (2003). 51 18 U.S.C. § 175b(b)(1-2) (2003).