Public Health and Law Enforcement Joint Investigation of Unknown Suspicious Substances and Potential Threat Evaluations,Minnesota,2007-2016

Investigating Unknown Suspicious Substances

A variety of sources, including local law enforcement, first responders including hazardous materials (hazmat) teams, the Federal Bureau of Investigation (FBI), healthcare providers, and exposed individuals, reported incidents of unknown suspicious substances to the Minnesota Department of Health (MDH). Upon receiving notification, MDH collected information about the nature of the exposure, including where and how it occurred, the substance involved, delivery source, documentation of a threat, number of people exposed, whether decontamination had occurred, and whether anyone had experienced signs or symptoms of illness.

The local FBI Weapons of Mass Destruction Coordinator (WMDC) was notified promptly of the potential event. Together, the WMDC, MDH epidemiologists, and MDH public health laboratorians, known as the joint assessment team, evaluated the report to determine the nature of, and appropriate response to, the incident. Credibility criteria that were assessed before accepting the sample for testing at public health laboratories included one or more of the following: (1) an overt malicious written intent accompanying the material; (2) a high-profile target; (3) lack of a return postal address or other information identifying the sender, or other suspicious finding; or (4) a person exposed to the substance (but this finding alone did not initiate testing).

If the assessment indicated a potential threat, the response followed a written response and notification protocol. Public health and law enforcement investigations initiated during the response were conducted concurrently by MDH and WMDC, respectively. If the investigations overlapped, staff at both agencies are trained in joint criminal and epidemiologic investigations. Substances collected at the scene were tested at the public health laboratory. Data, including a description of events, on-scene contact, exposure and symptom information, notifications and sample testing that had occurred, and chain of custody documentation for each incident, were collected on an emergency sample information form and event log for suspicious substances.

All samples were field tested for radioactivity and explosives prior to acceptance. Once received at the public health laboratory, they were again screened for the presence of radiological agents immediately after receipt. Primary chemical screen and biological testing then proceeded. Chemical screen was conducted in a Class III biological safety cabinet and included Fourier transform infrared (FT-IR) spectroscopy and Raman spectroscopy to identify organic compounds, photo ionization detector to detect certain volatile compounds, and colorimetric test strips to identify explosives, oxidizers, and corrosive compounds. The sample was then aliquoted for biological and additional chemical testing. Biological test methods included culture, real-time polymerase chain reaction screening assay for a panel of potential biological threat agents, and select toxin testing by time-resolved fluorescence. Analytical chemistry was conducted after and if the biological threat screen was negative, and included gas chromatography-mass spectroscopy (GC-MS) to identify volatile and semi-volatile organic compounds, inductively coupled plasma/optical emission spectrometry (ICP-OES) or mass spectrometry (ICP-MS) to identify the elemental components, and x-ray diffraction to identify compounds based on their crystal structure, to further characterize the substance. Preliminary biological results were generally available 4 hours after sample receipt and were communicated to the exposed individuals and all other stakeholders as appropriate and determined during the initial assessment. Final biological and chemical testing results were available in 5 days and were communicated to the submitter.

Methods

For this analysis, test result summaries and data collection forms, including emergency sample information sheets and event logs, were reviewed and entered into an electronic line list. Credible incidents were further categorized as potential bioterrorism threats or public health concerns. Incidents of potential threat substances that did not meet criteria (ie, overt malicious intent, high-profile target, or suspicious finding) to indicate possible terrorism were categorized as public health concerns.

The focus of this analysis was suspicious substances that were encountered by the public; incidents that did not involve a suspicious powder or other substance, such as incidents at community water treatment facilities, primarily related to evidence of a break-in with no observable substance, were excluded. Descriptive analyses were conducted using SAS 9.4 (SAS Institute, Inc., Cary, NC) statistical software. Here we describe the findings from investigation of suspicious substances during 2007 to 2016.

Results

From 2007 to 2016, 89 potential threat reports were recorded by MDH, involving 105 potential exposure sites (a single threat incident could involve multiple sites). Of those, 56 (63%) reports were deemed credible by the joint assessment team, 50 (89%) of these were categorized as a potential bioterrorism threat, and 6 (11%) were categorized as a public health concern. Specimens were received by the public health laboratory and tested in all of these incidents. Thirty-three (37%) incidents were deemed to be not credible by the joint assessment team; 8 of these included exposed individuals but included no written threat and nothing to deem the substance suspicious, and 25 incidents did not meet any of the credibility criteria. Specimens were received and tested for 20 of these noncredible threats at the request of law enforcement.

A median of 3 credible incidents were evaluated annually (range, 2 to 15 threats). Of the 56 credible incidents, 52 (93%) involved only 1 potential exposure site, 1 involved 13 sites, 1 involved 3 sites, and 2 involved 2 sites. Forty-three (77%) of the credible incidents occurred in the Minneapolis-St. Paul metropolitan area, 7 (13%) incidents occurred in central Minnesota, 3 (5%) in southeastern Minnesota, 1 (2%) in northeastern Minnesota, 1 (2%) in northwestern Minnesota, and 1 (2%) occurred in south-central Minnesota.

Twenty-one (38%) of the 56 credible incidents included an overt threat; 25 (45%) incidents were deemed suspicious in some way (eg, no return address, rambling letter without direct threat); 18 (32%) targeted a high-profile person or a large number of the public; 32 (57%) incidents were initially reported to have led to human exposure; and 3 (5%) contained a substance posing a potential public health threat without other criteria. Only 1 credible incident met all 4 general credibility criteria, 6 (11%) incidents met 3 credibility criteria, 28 (50%) met 2 credibility criteria, and 21 (38%) met only 1 criterion (Table 1).

A total of 100 samples were tested by the public health laboratory from the 56 credible incidents. Forty-six (82%) of the incidents involved a powder, 5 (9%) involved a suspicious liquid, 2 (4%) involved deliberate contamination of food, 1 (2%) involved a suspicious powder and liquid, and 2 (4%) involved another substance (feces, Q-tip). The vehicle of the suspicious substance was most often a letter or postal package (n = 44, 79%). Other vehicles included a vial (n = 5, 9%), food or medication (n = 2, 4%), a bomb or bomb-like device (n = 2, 4%), an aerosol can (n = 1, 2%), a toolbox (n = 1, 2%), and a tree (n = 1, 2%). Radioactivity screening was equal to background levels for all samples from the 56 incidents. Analytical chemistry was performed on samples from 46 (82%) incidents, and no health risks were identified. There was insufficient sample quantity in 10 incidents to complete chemical testing after biological threats were ruled out. Biological testing was able to be performed on samples from 54 (96%) incidents, and no biological threat agents were identified. Nonpathogenic bacteria were isolated in 3 incidents, including Bacillus thuringiensis in 2. Biological testing was not conducted on samples from 2 incidents due to prioritization of chemical testing to confirm the identification of a suspected substance and insufficient sample quantity to conduct both types of testing. After screening for threat agents, there was sufficient material remaining in 46 (82%) incidents to further identify the substance(s) present in the sample. These samples were identified as common household substances or substances easily attainable by the public, such as magnesium silicate (talc), sugar, sodium bicarbonate (baking soda), and flour (Table 1). The types of substances identified were similar between credible and noncredible incidents (Table 2).

Exposure information was not consistently collected and recorded throughout the study period; however, information was available for 32 (57%) of the 56 credible incidents. A median of 1 person was exposed in each incident, with a range of 0 to 6 people exposed; at least 1 person was exposed in 25 (81%) of the 32 incidents with exposure information. Fourteen people in 5 incidents were noted to have symptoms at the time of the exposure; at least 6 people reported swelling and eye pain after ingesting medication marketed for pain relief at a local vendor, 3 reported throat irritation, 3 reported pulmonary irritation, 1 developed a rash, and 1 reported chest pain and vomiting and was referred to an emergency department for evaluation.

Consequences of these incidents were not consistently collected or recorded throughout the study period; however, anecdotally it is known that affected buildings were evacuated and closed for the remainder of the day in 6 incidents, including the evacuation of more than 200 people from a courthouse in 1 incident. Additionally, 1 hospital was reportedly put on lockdown, and 1 heating/ventilation/air conditioning (HVAC) system in a high school was turned off in response to a suspicious powder incident. These responses were implemented by local first responders or the building's security prior to involving MDH or the WMDC. The media became aware of and reported on 6 incidents. One person was convicted in a US District Court of providing false information and conducting hoaxes for his involvement in 3 of these incidents, 2 of which were the B. thuringiensis incidents.

Discussion

In Minnesota, an all-hazards approach was taken when testing samples and included radiological and chemical testing in addition to nationally approved biological-LRN (LRN-B) methods for biological testing. Testing was conducted with a goal of reducing time to test results while attempting to identify a broad range of substances, including all potential threats present in a mixed substance. For emergent situations, which is typical for suspicious substance evaluations, public health laboratory staff were available to conduct 24/7 testing and initiated testing promptly on receipt of samples. Once the sample arrived at the public health laboratory, ruling out a biological threat was possible within 4 to 6 hours. Final confirmatory results were available after 5 days, compliant with LRN-B protocols. Due to continuing concerns over bioterrorism and other threats to human health, the need for fast and reliable laboratory tests to rule out biological and chemical agents remains. ⁴

During 2007 to 2016, the joint assessment team determined that a majority (63%) of the incidents in Minnesota initially posed some potential threat and that 21 of these incidents were likely to be hoaxes, with an obvious intent to threaten the recipient. The remaining 37% of incidents were deemed noncredible and precautionary. This is different from the proportion of precautionary calls (2/3) versus hoaxes (1/3) described elsewhere. ⁵ The common household materials identified in these incidents are similar to those in previously published biothreat response summaries describing identification of detergents, salt, sugar, starch, and talcum powder.^5,6 Common and household substances were identified in both credible and noncredible incidents in Minnesota. Because there were no actual biological, chemical, or radiological terrorism incidents during the time period, it is difficult to draw any comparative conclusions about the substances identified. In the noncredible incidents, the substances may have been expected or accidentally included in the package, and the anxiety over finding powder in postal items led the recipient to raise an alarm. However, in credible incidents, it is reasonable to assume that the sender included a powder to imitate anthrax or another threat agent.

While none of the described incidents were determined to be bioterrorism or resulted in human infection, accompanying psychological harm or social disruption were inflicted. Additionally, although no bioterrorism agents were found in any of the credible incidents, chemicals and compounds were identified that are not innocuous and, depending on the route of exposure, could cause serious illness. These incidents have provided valuable learning lessons and opportunities for the joint assessment team to exercise their response as demonstrated below.

An incident that highlights the resources and interagency cooperation required to respond to a suspicious substance incident and the effects on the community occurred in Pine County, Minnesota, in 2013. On July 15, 2013, a letter containing white powder and a death threat was delivered to a lawyer's office; 1 person opened this letter and was considered exposed. Radiological, biological, and chemical analysis ruled out health threats, and the powder was identified as talc.

On November 19, 2013, 6 envelopes containing a threatening letter and white powder were delivered to a sheriff, judge, deputy, and court administrators. One envelope was opened, exposing 2 people, forcing the shutdown of the government center and the evacuation of more than 200 people. Approximately 10 hours after the letters were discovered, the public health laboratory was able to rule out a health threat. The next day, cultures from the powder began growing a heavy, pure culture, identified as a Bacillus species, not anthracis. Public health laboratory staff were confident that this was not B. anthracis, but if the cultures had been the result of environmental contaminants, mixed flora growth would have been expected. This indicated that the powder could have been used intentionally. The isolate from the powder was sent to the US Centers for Disease Control and Prevention for confirmation and was identified as Bacillus thuringiensis, a Gram positive, naturally occurring bacterium that is commercially available as a natural insecticide.

On December 9, 2013, a box containing a suspicious note and a bag containing powder, along with other items, was found on the roadside. Nine hours after the box was found, the public health laboratory ruled out biological threats. Again, the next day, cultures from the powder grew a pure culture of Bacillus species not anthracis, which was identified as B. thuringiensis.

One week later, an individual was arrested in connection with all 3 events. In August 2015, this individual pled guilty to and was convicted in US District Court of 1 count of providing false information and hoaxes, was sentenced to 46 months in federal prison, and was ordered to pay over $87,000 in restitution to the agencies involved in the response, including $28,000 to MDH. ⁷ The public health laboratory spent an estimated 40 total hours testing the samples associated with the letters sent to the county courthouse, at an estimated cost of $2,000 per sample to conduct the biological threat screening alone. MDH also constructed multiple risk communication messages in support of the affected community to explain the potential health consequences of exposure to these samples. The response required significant involvement from upper-level management in MDH, including individuals from the public health laboratory, the Office of Emergency Preparedness, and the Infectious Disease Epidemiology, Prevention and Control Division. This case highlights the substantial public resources that can be required to respond to a suspicious substance incident. The need for public health expertise and the fact that a conviction was able to be made demonstrates why public health and law enforcement agencies should continue to respond to such incidents.

The joint threat assessment process in Minnesota is similar to incidents in Idaho in 2001 in which joint conference calls including public health, law enforcement, and hazmat were held to evaluate and determine the need for testing in suspicious powder events. ⁸ In some parts of the country, including Minnesota, some hazmat teams have the equipment necessary to conduct preliminary testing in the field. ⁹ The joint assessment team has actively discouraged such testing due to concern for reduced performance of field tests, a propensity for false-positives, and the risk of consuming all of the sample in the field so that laboratory confirmation is not possible. In situations where there is insufficient sample quantity, the joint assessment team must prioritize either biological or chemical testing; in most cases, ruling out biological threats was prioritized over chemical analysis. In the timeframe of this analysis, 10 of the 56 credible incidents did not have enough sample to conduct both biological and chemical testing; in 3 of these, field testing consumed a majority of the sample, leaving an insufficient quantity for the public health laboratory to conduct chemical hazard screening and analysis.

Field testing cannot definitively identify what is truly in a substance, so if the entire sample is consumed in the field, law enforcement and public health officials have no way of knowing if an agent of concern has been used, thereby making decisions regarding the appropriate response difficult. Furthermore, LRN public health laboratories are specifically funded to respond to potential biological and chemical terrorism and public health emergencies; LRN test methods follow nationally approved protocols and procedures. Because of this rigorous testing performed at LRN public health laboratories, sample results are admissible and defensible in court, in the event of criminal investigation by law enforcement.

An example of a field screen demonstrating the negative impacts of providing a false-positive result that required considerable amounts of public resources occurred in 2011. A chemical assessment team was called to an abandoned trailer where there were containers of an unknown liquid; a field screen on the material identified dimethylamine, a mustard gas precursor. Because of concern over this result, the sample was flown on a law enforcement airplane to the public health laboratory for confirmatory testing. The public health laboratory determined the material to be urine and the chemicals to be only acetaminophen and diphenhydramine.

A second example of the negative impacts of field testing consuming necessary sample and providing a false-positive result occurred in 2014. A letter opened at the governor's mansion contained a small amount of white powder. The first responders on the scene obtained a positive protein test from the sample, possibly signifying a biological threat, which led them to recommend strip decontamination of the individuals in the room and transfer to the local hospital for evaluation. Strip decontamination based on a positive field screen alone has not been, and was not in this instance, recommended by MDH. Chemical screening and hazard analysis was unable to be conducted at MDH because of limited sample quantity, and biological screening was negative. Proteins can be found in many nonhazardous substances, and a positive protein test alone should not warrant decontamination of potentially exposed individuals. In both of these examples, had the joint assessment team been notified prior to the decisions made by the first responders, a threat assessment could have been made, likely conserving public resources and minimizing anxiety experienced by exposed individuals.

Minnesota's joint assessment and rapid response also were intended to minimize fear and disruption. The joint assessment's recommendation for decontamination was based on the type of exposure. Often, full decontamination is warranted in chemical exposures and less frequently in biological exposures. If decontamination were not necessary, people in the vicinity of the exposure were advised to leave the building, return home, shower, and launder their clothes as usual. Anyone experiencing signs of illness at the scene was advised to be medically evaluated. In order to assess whether decontamination is required, it is standard protocol to alert all parties of the joint assessment team together, so that recommendations can be made in an appropriate and relevant timeframe.

Elsewhere in the country, in some instances hazmat teams may require people exposed to dry powders to disrobe, undergo dry decontamination, and then dress in temporary hospital scrubs. ⁹ Some anecdotal evidence suggests that the decontamination procedure actually results in more anxiety in exposed individuals, contrary to the assumption that it would reduce anxiety.^5,9 To avoid the unnecessary and unpleasant decontamination of exposed people by first responders, it is important to notify all involved entities so that a quick threat assessment can be made.

Suspicious substances encountered by the public in Minnesota are low risk for health threats, but, like other events that public health agencies investigate (eg, cases of rare infectious disease), the potential consequences can be severe. The absence of overt malicious intent should not alleviate concern for bioterrorism or a public health threat. It is the responsibility of public health agencies to rule out any health threat in unexplained powders that have the potential to cause harm. Therefore, it is necessary to continue to take an all-hazards approach to suspicious substance incidents. These investigations intersect both public health and law enforcement agencies' responsibilities. Joint investigations like those conducted in Minnesota facilitate communication and minimize barriers to the response from both sides, in order to achieve the separate but overlapping goals, which ultimately allows for a more efficient and effective response to a potential threat. Working together on each event is imperative, as public health professionals can provide necessary testing to positively identify or rule out threats (technology that currently is not available to law enforcement) as well as provide epidemiologic and medical expertise to law enforcement. In turn, law enforcement authorities can provide assistance on identifying and containing the source of the exposure, working together with public health to more quickly identify the intent of the incident and whether there is a prolonged risk to the public. These incidents also allow key preparedness agencies to regularly practice response and testing methods. The roles and responsibilities of each agency have been determined and practiced, which is critical for epidemiologists, laboratorians, and the FBI if there is a need to investigate a real health threat event.

The overarching lesson learned from these 10 years of experience is the value of prompt notification to the joint assessment team. Early assessments can be made to determine field testing and decontamination strategies, maximizing efficient use of resources and minimizing fear and disruption to the exposed individuals and the public.