U.S. policy requires federally funded labs to buy synthetic DNA from screened suppliers

The U.S. released the National Policy for Nucleic Acid Synthesis Screening on 5 November. Science reports it as a response to growing concern that artificial intelligence could make creating dangerous pathogens even easier. For the first time, scientists funded by the U.S. government must buy synthetic nucleic acids and benchtop synthesis equipment from U.S.-approved suppliers. Those vendors must verify customers' identities and screen orders for potentially dangerous sequences, for example ones that could encode toxins or pathogens. The requirements roll out in stages over the next 340 days.

The policy replaces a voluntary system of self-regulation. In 2010 the U.S. government released guidelines that recommended synthetic biology companies vet customers and screen orders. They were voluntary, and various biosafety groups called for greater oversight. Still, many companies agreed to comply, most notably members of the International Gene Synthesis Consortium, an industry group responsible for most DNA synthesis worldwide. Drew Endy, a synthetic biology researcher at Stanford University, sums up the change: "Screening moves from voluntary to verified." He calls it "a real step forward."

The background is that scientists have made synthetic DNA for decades, but technology now allows longer and longer sequences that can be assembled into genes or even whole bacterial and viral genomes. Labs often order sequences online from synthetic biology companies, and benchtop synthesizers now let scientists make what they want in-house, which further erodes obstacles to bioterrorism.

Kevin Esvelt, a biotechnologist and biosecurity expert at the Massachusetts Institute of Technology, says the policy "does something instead of nothing" and will make it harder to misuse DNA. The policy applies only to federally funded scientists, but he believes it will spur synthetic biology companies to apply the screening to all customers, making it harder for "competent lone wolves" to obtain synthetic DNA for nefarious purposes.

Experts also point to several gaps. Esvelt notes that screening is required only for sequences of 50 base pairs or longer. A would-be bioterrorist, he argues, could stitch a dangerous sequence together from much smaller fragments ordered from multiple suppliers. He says he has built an algorithm that can screen sequences as short as 30 base pairs for risk and made it freely available. He calls this "the main flaw in an otherwise pretty great policy." He also says the rule on verifying customer identity is "very underspecified" about how to do it.

Gigi Gronvall, an immunologist and biosecurity expert at Johns Hopkins University, says "We're only addressing the U.S. with this policy." She also points out that the policy covers only newly built DNA synthesis equipment, leaving countless existing benchtop machines open to misuse. The policy encourages manufacturers to offer trade-in or buy-back programs for now obsolete machines but does not mandate them. She adds that focusing on synthetic DNA ignores other ways to manipulate DNA that do not require making it from scratch. In her view too much emphasis goes to one type of bioterror threat; screening is necessary but "just one tool," and more resources should go to vaccine development, hospital preparedness and other measures for responding to future pandemics, natural or humanmade.

Enforcement is a third worry. The policy makes the National Institute of Standards and Technology (NIST) responsible for ensuring the rules are correctly enforced, without necessarily providing the resources. Endy says NIST "is being asked to do a lot of work here, on a short clock, only if money is available," and adds, "I'm guessing they don't have the money." Esvelt predicts extra work for institutional biosafety officers and says the policy's greatest flaw is that it does not come with extra funds for institutional biosafety committees and officers, who he says are dramatically underfunded.

Key facts

The National Policy for Nucleic Acid Synthesis Screening, released on 5 November, requires U.S. government-funded researchers to buy synthetic nucleic acids and benchtop synthesis equipment from U.S.-approved suppliers.
Suppliers must verify customers' identities and screen orders for sequences that could encode toxins or pathogens; the requirements roll out in stages over 340 days.
It replaces a voluntary system dating from 2010 guidelines, which many companies, including International Gene Synthesis Consortium members, followed anyway.
Screening is required only for sequences of 50 base pairs or longer; Esvelt says fragments from multiple suppliers could get around that and says his free algorithm screens down to 30.
Experts also flag U.S.-only scope, no mandate to replace existing benchtop machines, and NIST enforcement without clear funding.

Why it matters

Screening of synthetic DNA orders moves from voluntary to verified, in Drew Endy's words. Until now the U.S. relied on 2010 guidelines that companies could follow or ignore. The policy arrives as concern grows that AI could make creating dangerous pathogens even easier, and as benchtop synthesizers let scientists produce DNA in-house. Kevin Esvelt calls the policy great because it does something instead of nothing.

Who it affects

Directly, U.S. government-funded scientists who make and manipulate DNA sequences, and the suppliers and equipment makers they buy from, who must be U.S.-approved, verify customers and screen orders. NIST is charged with ensuring correct enforcement. Esvelt expects the effect to spread beyond funded labs, as synthetic biology companies may screen all customers. Institutional biosafety officers should also expect more work, he says.

How to use it

For funded researchers, the practical change is that synthetic nucleic acids and benchtop synthesis equipment must come from U.S.-approved suppliers, who will check identity and screen orders. The requirements arrive in stages over the next 340 days. The source does not say when each stage takes effect, and it does not say which suppliers are on the approved list or how suppliers get approved. Esvelt says his screening algorithm for sequences as short as 30 base pairs is freely available.

How solid is it

The policy is an official U.S. document released on 5 November, and the account comes from Science, which quotes three named experts: Esvelt (MIT), Gronvall (Johns Hopkins) and Endy (Stanford). They broadly welcome it. The criticisms are their own assessments, such as Endy's guess that NIST lacks the money. The 30 base pair algorithm is Esvelt's own claim. The source gives no funding amount for NIST or for biosafety committees.

Risks and caveats

Gaps named by the experts: the 50 base pair threshold could be sidestepped by ordering smaller fragments from several suppliers; identity verification is underspecified; the policy covers only newly built equipment, so countless existing benchtop machines stay open to misuse, and trade-in or buy-back programs are encouraged but not mandated; it addresses only the U.S.; and it covers synthesis from scratch, not other ways to manipulate DNA. Gronvall calls screening just one tool and argues for more investment in vaccines and hospital preparedness. The source gives no penalties or consequences for non-compliance.

“Don’t bother building a fence if there’s going to be an obvious huge gap in it.”

— Kevin Esvelt, biotechnologist and biosecurity expert at the Massachusetts Institute of Technology, on the policy's 50 base pair screening threshold