Appendix J: Teaching with the Biosecurity Handbook
MPH programs with health security concentrations, schools of public policy and international affairs, life sciences graduate programs, and biosecurity fellowships can teach from the Biosecurity Handbook without asking permission or paying a fee. The materials below are built for an instructor with limited calendar time: short session tracks, maps to recognized frameworks, journal club questions for every chapter, case discussions, and assessment items with answer points. The full 12-week seminar, with a grading rubric and coursework rules, is the Course Syllabus Template.
These materials support local teaching. They are not an accredited course and do not replace a program’s own curriculum, biosafety, or research-security review.
Who the Materials Serve
No laboratory or programming background is needed. The sessions treat risk assessment and governance, not technique.
| Setting | Suggested starting point | Typical slot |
|---|---|---|
| MPH health security or global health concentration | Eight-session track, or the 12-week syllabus | Elective or concentration course |
| Public policy, security studies, and international affairs programs | Four-session track plus the governance sessions of the eight-session track | Seminar unit |
| Life sciences graduate programs and responsible-conduct training | Four-session track, sessions 1 and 2 first | Training series |
| Biosecurity fellowships and early-career programs | Eight-session track with the journal club guide | Cohort seminar |
| Preventive medicine and infectious disease training | Sessions on surveillance, countermeasures, and AI for defense | Didactic series |
Coursework and Information Hazards
The course analyzes how biological risk is assessed and governed. The coursework rules in the Course Syllabus Template apply to every session on this page: no assignment asks for, and no submission contains, methods for acquiring, creating, enhancing, or weaponizing biological agents or for evading screening and biosafety controls; learners do not probe AI models for hazardous biological information; and a learner who encounters hazardous content stops, does not record or share it, and reports it to the instructor. Discussion questions below are written at the level of policy, evidence, and institutional decisions.
Session Tracks
Each session runs 60 to 90 minutes: learners read the assigned chapter sections beforehand, the instructor frames the question for ten minutes, the group works through one case or one primary source cited in the chapter, and the session closes with one or two assessment items. The framework column names where a session gives learners practice; the program decides whether an activity counts toward its own competency documentation.
Four-Session Track
| Session | Question for the session | Read before | Case for discussion | Framework link |
|---|---|---|---|---|
| 1 | What does biosecurity protect against, and how are threats compared? | What Is Biosecurity?; The Biological Threat Landscape | Sverdlovsk 1979 | CEPH 5 |
| 2 | Who decides whether risky research proceeds, and on what evidence? | Dual-Use Research of Concern (DURC); Gain-of-Function Research: Science, Risk, and Governance | SARS laboratory escapes, 2003 to 2004 | CEPH 12; WHO framework values and principles |
| 3 | What would show that an AI system changes biological risk? | How AI Amplifies Biosecurity Risk; LLMs and Information Hazards; Red-Teaming AI Systems for Biosecurity Risks | Aum Shinrikyo and technical barriers | CEPH 4 |
| 4 | Which controls work, and who enforces them? | DNA Synthesis Screening; Policy Frameworks for AI-Bio Convergence; The Biological Weapons Convention and International Governance | DNA synthesis screening, 2009 to present | CEPH 15; WHO framework tools and mechanisms |
Eight-Session Track
Twelve Sessions or a Semester
The Course Syllabus Template sets out a 12-week seminar with weekly readings, discussion questions, assignments, a grading rubric, coursework rules for information hazards and generative AI, and a 6-week intensive version. Programs that start with the four- or eight-session track can move to it without changing readings.
Framework Maps
CEPH MPH Foundational Competencies
CEPH’s 2024 accreditation criteria require an accredited school or program to assess every MPH student at least once on each of 22 foundational competencies, through a specific assessment activity it documents in a competency matrix (CEPH, 2024). For an MPH course in health security, the handbook can supply the material for several of those activities.
| CEPH foundational competency | Chapters that supply the material | Activity that could assess it |
|---|---|---|
| 4. Interpret results of data analysis for public health research, policy, or practice | Red-Teaming AI Systems for Biosecurity Risks; Outbreak Detection and Surveillance | Memo interpreting a published AI capability evaluation for a policymaker, stating what it does and does not show |
| 5. Compare the organization, structure, and function of health care, public health, and regulatory systems across national and international settings | The Biological Weapons Convention and International Governance; The Chemical Weapons Convention and OPCW | Comparison of verification under the two conventions |
| 12. Discuss the policy-making process, including the roles of ethics and evidence | Dual-Use Research of Concern (DURC); Gain-of-Function Research: Science, Risk, and Governance | Brief tracing how one oversight policy was made and revised |
| 15. Evaluate policies for their impact on public health and health equity | Policy Frameworks for AI-Bio Convergence; Global Surveillance Equity: LMIC Capacity as Collective Security | Assessment of an AI-bio policy proposal, including who bears its costs |
| 22. Apply a systems thinking tool to visually represent a public health issue in a format other than standard narrative | The Future of Biosecurity; Synthetic Biology and the Democratization of Biotechnology | System map of where governance controls sit between an idea and a physical biological product |
The program decides whether these activities meet its own assessment requirements and documents them in its competency matrix.
WHO Global Guidance Framework for the Responsible Use of the Life Sciences
WHO’s 2022 framework sets out values and principles to guide the governance of biorisks and the tools and mechanisms that put them into practice. Its annexes are built for teaching: Annex 1 provides seven scenarios to assist implementation, Annex 2 three case studies on gaps in the governance of biorisks, and Annex 3 examples of awareness raising, education, and training; the framework treats education, training, and codes of conduct as part of governance alongside laws and regulations (WHO, 2022).
| Framework element | Where to use it |
|---|---|
| Values and principles to guide the governance of biorisks | Session 2 of the four-session track; Dual-Use Research of Concern (DURC) |
| Tools and mechanisms for governance | Session 4; Policy Frameworks for AI-Bio Convergence |
| Annex 1 scenarios | Tabletop exercise in any session, with learners assigned to stakeholder roles |
| Annex 2 case studies | Paired with the Case Studies in Biosecurity Failures and Successes appendix |
| Annex 3 education and training examples | Course design and faculty development |
Journal Club Guide
The chapter is the briefing; the source is the evidence. Choose one primary source cited in the chapter (a study, treaty text, policy, or evaluation report), assign it with the chapter, and give the group 60 minutes in three parts: what the source claims (10 minutes), whether its evidence supports that claim (30 minutes), and what decision it should change and for whom (20 minutes). The chapter questions further down are written for that last part.
Starter Sources
Four sources the handbook discusses in detail suit first sessions because they are about how risk is measured and governed rather than how harm is done. Each is read with its chapter, and the question gives the middle 30 minutes a focus. The guidance on coursework and information hazards above applies to all of them.
| Source | Read with | Design question |
|---|---|---|
| Urbina et al., 2022, Nature Machine Intelligence: a drug-discovery model redirected toward predicted toxicity | AI-Enabled Pathogen Design | The candidates were computational predictions, not synthesized compounds. What does the result show about dual use, and what would the authors have needed to show for a stronger capability claim? |
| Mouton et al., 2024, RAND: a red-team study of language models and biological attack planning | Red-Teaming AI Systems for Biosecurity Risks | The study compared model-assisted teams with an internet-only condition. Why does the baseline matter, and why is a null result here not a ceiling for current models? |
| Wittmann et al., 2025, Science: AI-redesigned toxin variants and DNA synthesis screening | DNA Synthesis Screening | No proteins were produced, and screening patches were developed with providers before publication. What does this show about coordinated disclosure, and which gaps in screening remain? |
| Pannu et al., 2025, PLOS Computational Biology: mapping dual-use research categories to AI evaluation targets | Dual-Use Research of Concern (DURC) | Which of the mapped categories can be tested with current evaluation methods, and which would need new ones? Who should own those evaluations? |
Questions by Chapter
| Chapter | Discussion questions |
|---|---|
| What Is Biosecurity? | Where does the source draw the line between biosafety and biosecurity, and does the distinction hold in practice? Which institutions are responsible for each? |
| The Biological Threat Landscape | How does the source weigh natural, accidental, and deliberate threats, and what evidence supports the weighting? Which threat category gets the least attention relative to its risk? |
| Pathogens of Concern | What criteria put an agent on a priority list, and when were they last revised? What does a list-based approach miss? |
| Laboratory Biosafety, Biosecurity, and Cyberbiosecurity | How was the risk assessment in the source conducted, and by whom? Which failures in the source were technical and which were organizational? |
| Dual-Use Research of Concern (DURC) | Who reviewed the research before it started, and who reviewed it before publication? What would a better review process have changed? |
| Outbreak Detection and Surveillance | How quickly did the source’s system move from signal to verified event to notification? What obligations under the International Health Regulations applied? |
| Medical Countermeasures and Biodefense | What assumptions about demand and supply did the source’s preparedness plan make, and which failed? Who pays to keep countermeasure capacity ready between emergencies? |
| Attribution and Biological Forensics | What standard of evidence did attribution in the source meet, and who judged it? How could an inaccurate attribution have escalated? |
| Global Surveillance Equity: LMIC Capacity as Collective Security | Which countries in the source lacked detection capacity, and what did that cost others? Who should fund that capacity, and on what terms? |
| Synthetic Biology and the Democratization of Biotechnology | Which barriers has wider access lowered, and which still hold? Where should oversight sit when capability spreads beyond institutions? |
| DNA Synthesis Screening | What does the screening regime in the source cover, and which orders or providers fall outside it? Is the regime voluntary or required, and what difference does that make? |
| Gain-of-Function Research: Science, Risk, and Governance | What benefits did the researchers claim, and were they demonstrated? How should a funder weigh unmeasured benefits against unmeasured risks? |
| Gene Drives and Environmental Biosecurity | What does the source show about population-level effects outside the laboratory? Who must consent before a field release, and how? |
| AI and Machine Learning Fundamentals | Which property of the model in the source (training data, scale, tool access) matters most for biosecurity? What would the authors need to show for a capability claim to be credible? |
| How AI Amplifies Biosecurity Risk | Does the source measure capability, uplift to a person, or real-world consequence? Which step between information and harm does the source leave unexamined? |
| LLMs and Information Hazards | Was the comparison against internet search, textbooks, or no assistance, and does that choice change the conclusion? How should results like these be published without spreading the hazard? |
| AI-Enabled Pathogen Design | Which claims in the source rest on computational prediction and which on laboratory validation? Where in the design-to-product pathway can controls act? |
| AI for Biosecurity Defense | Was the defensive tool tested prospectively, and against what baseline? Who would act on its output, and how fast? |
| Digital Biosurveillance: From Wearables to Real-Time Genomics | What stage of development has the capability reached: research, pilot, or routine use? What privacy and equity costs come with continuous monitoring? |
| Cloud Labs and Automated Biology | Which traditional safeguards assume a trained person in the room, and what replaces them in a remote laboratory? Who screens users and protocols? |
| Autonomous AI Agents in Laboratory Contexts | Which actions could the agent in the source take without a human approving them? Where should the approval boundary sit? |
| Red-Teaming AI Systems for Biosecurity Risks | Which of the five analytical layers (capability, uplift, safeguards, operational validation, governance assurance) does the evaluation cover? What would make its statistics credible? |
| The Biological Weapons Convention and International Governance | How does the absence of a verification mechanism shape what the source can conclude? Which confidence-building measures could states adopt now? |
| The Chemical Weapons Convention and OPCW | Which features of chemical weapons verification could transfer to biology, and which could not? Why? |
| Policy Frameworks for AI-Bio Convergence | Which gap between biosecurity policy and AI policy does the source address? Who would enforce the proposal, and across which borders? |
| The Future of Biosecurity | Which assumptions drive the scenario the source considers most likely? What evidence in the next few years would change that judgment? |
Case Discussions
Case Studies in Biosecurity Failures and Successes holds historical cases with cross-cutting lessons and a practitioner’s checklist. A role-based format works well: assign learners the roles of national health official, laboratory director, treaty negotiator, intelligence analyst, and scientific journal editor, and have each argue from that role before the group reaches a decision.
| Case | Prompts |
|---|---|
| Sverdlovsk 1979 | What made the true cause hard to establish for so long? What does the case teach about verification under the Biological Weapons Convention? |
| The 2001 anthrax letters | What did the investigation rely on to reach its conclusion, and what remained contested? How did the case change laboratory oversight? |
| SARS laboratory escapes, 2003 to 2004 | Which failures recurred across laboratories? Which controls would have interrupted them? |
| 2014 CDC anthrax and smallpox incidents | How did routine practice drift away from written procedure? What would detect that drift earlier? |
| Smallpox eradication | Which conditions made eradication possible, and which of them exist for other threats? What did leadership contribute? |
| DNA synthesis screening, 2009 to present | How did a voluntary industry practice develop, and where are its limits? What would change if screening were required? |
Assessment Questions
The items below suit short-answer quizzes, oral examination prompts, or the closing minutes of a session. Answer points are collapsed so the page can be projected.
- Distinguish biosafety from biosecurity, and give one control that serves each.
- Why is dual-use research of concern a narrower category than dual-use research?
- Name the three broad categories of biological threat, give one historical example of each, and say which is most frequent.
- Why is DNA synthesis described as a chokepoint for biosecurity, and what are the limits of screening?
- A study reports that a language model answered biology questions accurately. What would it need to show before supporting a claim of meaningful uplift to someone seeking to cause harm?
- What distinguishes the Biological Weapons Convention from the Chemical Weapons Convention in verification?
- How do cloud laboratories challenge safeguards that assume a trained person is physically present?
- Why does surveillance capacity in low- and middle-income countries matter for global security?
- What role does attribution play in deterrence and response?
- Under the WHO framework, which mechanisms besides law and regulation contribute to the governance of biorisks?
- Biosafety protects people and the environment from accidental exposure through containment and safe practice; biosecurity protects agents, materials, and information from theft, misuse, diversion, or intentional release. Containment levels serve biosafety; access control and personnel reliability programs serve biosecurity (What Is Biosecurity?; Laboratory Biosafety, Biosecurity, and Cyberbiosecurity).
- DURC is a policy category for research that could be directly misapplied to pose a significant threat with broad consequences; much dual-use research does not meet that definition, and high-consequence research is not automatically DURC (Dual-Use Research of Concern (DURC)).
- Natural outbreaks, such as Ebola or pandemic influenza; accidental releases, such as the 2004 SARS laboratory outbreak in Beijing; and deliberate misuse, such as the 2001 anthrax letters. Natural outbreaks are the most frequent; deliberate misuse is rare but high-consequence (The Biological Threat Landscape).
- Biological information must become physical DNA, and synthesis providers can check sequences and customers before filling orders. Coverage depends on which providers screen, which sequences are flagged, and whether benchtop and non-member providers are included (DNA Synthesis Screening).
- Benchmark accuracy measures capability. Uplift requires a comparison with what the same person could do with other resources, and real-world consequence requires evidence about the physical steps that remain (How AI Amplifies Biosecurity Risk; Red-Teaming AI Systems for Biosecurity Risks).
- The Biological Weapons Convention has no inspection or verification mechanism; the Chemical Weapons Convention has the OPCW, which inspects declared facilities and verifies destruction (The Biological Weapons Convention and International Governance; The Chemical Weapons Convention and OPCW).
- Users design experiments remotely and robots execute them, so physical access control, institutional review, and observation by laboratory staff may not apply in the usual way; screening of users and protocols has to replace them (Cloud Labs and Automated Biology).
- A blind spot anywhere delays detection everywhere: variants and outbreaks that arise where there is no sequencing or surveillance capacity can spread before they are recognized (Global Surveillance Equity: LMIC Capacity as Collective Security).
- Credible attribution supports deterrence, enables prosecution, diplomacy, or other response, and prevents false accusations from escalating (Attribution and Biological Forensics).
- Informal mechanisms such as ethical, social, and professional norms, publishers’ review processes, funders’ measures, education, training, and codes of conduct (WHO, 2022).
Citing the Version Used in a Course
The handbook is revised continuously, so a syllabus should record the date on which learners read it. The Changelog lists what changed after that date.
Tegomoh B. The Biosecurity Handbook: Biological Security in the AI Era. 2025. Accessed [date]. doi:10.5281/zenodo.18252920
Reuse and Adaptation
The handbook text is licensed under the Creative Commons Attribution 4.0 International License (Creative Commons, CC BY 4.0). Programs may copy, excerpt, translate, and adapt it into slides, course packs, learning management systems, and assessments, including for courses that charge tuition, provided they give credit, link to the license, and note any changes. An attribution line can read:
Adapted from The Biosecurity Handbook by Bryan Tegomoh, MD, MPH (biosecurityhandbook.com), licensed under CC BY 4.0. Changes: [describe].
Studies, figures, treaty texts, and quotations from other sources keep their own terms; cite them from the original.
Contact
Using this handbook in a course or program? Tell us. A line on the program, the sessions used, and what did not work helps decide what to revise next.