The UK Has a Solid Biological Security Strategy

Would that the United States had the courage to parallel that direction

I spend a lot of time criticizing the U.S. government’s approach to biological security policy, largely because it spends so much time developing a narrative that doesn’t change the status quo and rehashes old rhetorical statements. I dislike those individuals, often in the public health community, who insist that the solution is to create a giant federal organism that controls all biosecurity and uses biodeterrence to address all biological threats (natural diseases, deliberate biological incidents, and accidental biological releases). I equally dislike it when the DoD CB defense community decides that it needs to do more work in the public health sector, citing “biothreats” as a national concern while ignoring its original mandate. It’s with some pleasure, then, that I can look at the United Kingdom for a well-developed and well-executed biological security strategy that uses clear language and identifies achievable objectives to pursue its political goals in this field.

The UK government just released its latest implementation report on its biological security strategy, covering July 2025 through July 2026. It’s important to be clear on the terminology. In 2023, the UK government released its Biological Security Strategy. I had some issues with it, but it was a better product than the 2018 and 2022 U.S. National Biodefense Strategies. Since then, the UK government has released two implementation reports, one in 2025 and one for 2026. An implementation report id intended to reference back to a strategy to say, “here’s what we identified as objectives, here’s what we actually did, and here’s where we’re going.” The U.S. government is remarkably bad at doing implementation reports or performance plans that build off of strategic plans, even though the Government Accountability Office has routinely told government agencies how to do this.

The 2022 US National Biodefense Strategy uses a similar but different framework, identifying the main lines of effort as assess, prevent, prepare for, respond to, and recover from biological threats. I’m assuming that the British government combines what we call “prevention” and “preparation” into their prevent area and combines what we call “respond and recover” into just one category of respond. I’m okay with that, but here’s been my first issue with terminology. The U.S. government approach aligns this terminology with “national preparedness,” which has always led me to question why people prefer to use the term “biosecurity” — which has multiple definitions but generally refers to only deliberate threats — instead of “biopreparedness,” which would align much better with national guidance.¹ Anyway. Not going to solve that issue today.

I don’t like the term “biothreat” as a collective term because it confuses the very important differences between how a government responds to natural disease outbreaks (which constitute the overwhelming majority of “biothreat” concerns) with the actions of violent individuals or nation-states to deliberately harm people, animal, or crops with biological weapons.² I do appreciate that, at the national level and looking across all government agencies, there can be a narrative that addresses all biological threats because there is this desire to contain a biological threat and reduce public vulnerability using all possible government tools. The US public health community deliberately (in my opinion) combines the two issues because they think they will get more attention (funding) from Congress if they talk about mysterious, shadowy groups releasing anthrax or engineered genetic material in public venues and that they have the key to fixing that threat.³ The UK government neatly gets around this issue by broadly using the term “biothreats” in its overall summary and then zeroing in on addressing specific biological risks with distinct approaches. The US strategies generally lack this specificity and suffer in implementation as a result.

The UK strategy’s implementation report identifies 15 outcomes associated with its four pillars and three strategic enablers that cut across all pillars. I don’t intend on talking about all of them in any depth, but rather to point out the good aspects of their plan and whether the US government has any parallel to the UK efforts. Before I do, let me point out this interesting section on “technological advances.”

Improvements in nucleic acid synthesis are expanding the ability to engineer biological components and develop novel diagnostics, therapeutics and vaccines. At the same time, robotic laboratory platforms are automating experimentation and enabling high-throughput research at previously unattainable speeds. These interconnected technological advances are reshaping biotechnology and global health, creating significant opportunities for scientific progress, disease prevention and biosurveillance.

These same advances also introduce significant biological security risks, giving greater access to the necessary skills and knowledge to perform high-risk research at a low cost. This increases the risk of accidental misuse and provides new opportunities for hostile actors to pursue the development of biological weapons.

…

These technological capabilities are evolving more rapidly than traditional policy frameworks can adapt, creating gaps in oversight, biological security regulation, and preparedness. Policy must be reflective of the speed, scale and dual-use nature of engineering biology and AI. To capture the opportunities and effectively mitigate emerging risks, we must keep pace with technological advancements through adaptive interventions, strengthened international coordination and proactive horizon scanning, working at pace on upstream preventative measures and strengthening our preparedness and ability to respond at pace and scale.

Okay, sure, why not. It sounds serious and yet is generic in its narrative. At the least, it’s not the scary story that US analysts are promoting with regards to “the convergence of AI and biotech.” Amusingly, the very next section is identifying five global infectious disease outbreaks in the last year, “emphasizing the need for sustained and cohesive action.” That’s opposed to ZERO identified deliberate biological incidents or laboratory accidents in the same timeframe (at least within this report’s assessment). Let’s look at some of the achievements.

UNDERSTAND

The UK has developed a “Biothreats Radar” (BTR) that provides its interagency with global situational awareness and outbreak reports. If I am reading this right, this is a framework that reflects what the National Biosurveillance Network sees for policymakers. The UK NBN has been criticized for a slow roll-out, and this BTR is supposed to help. The US has its National Biosurveillance Integration Center in the DHS Office of Health Policy, which has been criticized for a lack of cooperation by other government agencies. I don’t know how effective our system is.⁴ The UK also hosted a national exercise (Exercise Pegasus) to work the pandemic issue.

Over the next year, they plan to continue developing the BTR and connect with international partners, collect more data from clinical and environmental sources, and develop their modeling and simulation capabilities for improved decision-making. There are plans for improving data flow into their NBN and improving public understanding and awareness of biological risks. These actions are in general directly opposite of the actions undertaken by the US Dept of Health and Human Services in this administration. There are US health experts who talk about One Health, just as the British do, but it’s unclear to what extent US healthcare policy is implementing a One Health approach.

PREVENT

The UK published a new Pandemic Preparedness Strategy and backed it with one billion pounds to “strengthen domestic resilience.” It has developed guidance for genomic research and has promoted national efforts in engineering biology. The UK has its own biological threat reduction program that seems very similar to the US BTRP, except that it’s funded at a fraction of what the US DoD spends annually. It has also presented its findings on Russian Federation violations of the CWC and BTWC to the relevant treaty bodies. I’m not sure this action will prevent future Russian use of CB agents to assassinate people outside of its borders, but hey, I guess you can try.

Next year, the UK government intends to keep evaluating research guidance and promoting best practices, support international counterproliferation activities, and work to reduce the access to hazardous biological materials. Of course, they intend to work the actions identified in the pandemic strategy, and there is a commitment to improve the surveillance of cross-border food. In the United States, one sees no commitment to a pandemic strategy and cuts to FDA inspectors who work the border (thus, incidents like Taylor Foods happen).

Again, it’s unclear to what extent the US government are implementing prevention efforts, particularly against bad actors who might believe that there were advantages to using biological weapons against a vulnerable US population. Certainly the 2022 National Biodefense Strategy clearly illustrates that the government understands what to do in prevention activities. We just don’t know what they’ve actually done in the past or what they plan to do over the next year.

DETECT

In this area, the UK has worked to get its NBN on track and tied into data services. The UK published a new approach to biosurveillance focusing on improving ties to industry and academia. They hope to improve domestic resilience through advanced microbial forensics and attribution capabilities that will speed up the processing of clinical samples. There’s a long section in here that talks about the UK’s approach to biosurveillance, which is defined as “the systematic collection, analysis, and interpretation of data to detect and monitor biological threats and hazards.” And that’s what most people think of, except that in US strategy documents, biosurveillance is defined as all information and indications “related to all-hazard threats or disease activity affecting human, animal, plant, and environmental health to achieve early detection and provide early warning.” The latter is a much higher burden of responsibility, not just biohazards, and I think people outside of the public health community do not appreciate the difference between these two definitions.

I would also suggest that the UK is far better positioned to develop a centralized biosurveillance network than the US government because of its “unique strengths.”

A centralised healthcare system provides opportunities for deep collaboration between clinicians and public health officials, for example with respiratory metagenomics. Our world-leading science and research base demonstrates particular prowess in areas such as genomics, bioinformatics and modelling. Government has invested to build on these strengths, including announcing over £1 billion investment for a new National Biosecurity Centre in APHA Weybridge, alongside UKHSA Harlow and Defence Science and Technology Laboratory (Dstl) Porton Down in a Network of National Biosecurity Centres. These strengths act as a powerful deterrent to malicious threats.

There is this assumption that, if adversarial nation-states and sub-state groups understand that Britian (or the United States) has an advanced biosurveillance capability, then certainly these governments will be able to quickly detect and identify a biological outbreak to the point that its impact is negligible. There is a belief, which I think is faulty, that this will deter said adversaries. For the United States, given its federalized public health approach and eviscerated national leadership, it’s just laughable to believe that the detection and response capability to any disease outbreak — natural, deliberate, or accidental — would be either timely or attributional. I think the UK government is being very aspirational here as well. This belief that biosurveillance and forensics will deter bad actors ignores the rationale of sub-state groups in particular. If all they want to do is cause national panic and distrust of the government because of a deliberate biological incident, they’re going to do it, if not just for the political impact of such an event. There’s no basis of conducting deliberate biological outbreaks based on expected casualty counts. Just look at the Amerithrax incident. Five deaths, 17 sickened by anthrax exposure, a nationwide panic for years, billions of dollars going to biodefense-related projects for DHS and HHS. Look at any of the tens of thousands of “white powder” scares over the past decades. But there is this almost religious belief that, if you spend enough money tying in data streams and building information portals, it’s going to pay off in reducing threat, because bad actors will be deterred by your awesome capabilities.

(Ambulances outside of Darent Valley Hospital, source: Wikipedia)

RESPOND

The thing that jumps out in this section is the UK’s understanding that this is a global issue that requires working with the World Health Organization. You can’t have global health security without working with other organizations and nations, a concept of which the United States has clearly abandoned. Running a national-level pandemic exercise is a good way to identify measures to improve national readiness and the ability to coordinate a federal response.

The future actions seem to be “more of the same” — work the international response coordination, develop response capabilities per their pandemic preparedness strategy, more exercises. Nothing wrong with that. Looks like a lot of investment into its life sciences research and development, as well as improving its domestic capability to produce mRNA vaccines at scale. They are working a partnership with Moderna to “bolster preparedness and health resilience to future biological threats,” which is interesting. They are committed to improving their ability to remediate affected sites and the environment after a biological incident, to include with robotic systems.

I’ll venture that both the British and US governments are fairly good on federal response to medical incidents, to the extent that they understand the issue and can roll out resources quickly. However, (again) the lack of a nationalized system in the United States means that the state health agencies (and sometimes the local level) will be responsible for the initial execution of medical response activities. They look to the feds for funding because why should they tax their own citizens to provide a reliable and effective medical response capability for bioincidents when HHS has such a large budget? Maybe that’s too cynical. but the initial response to a deliberate or natural disease outbreak will be slow to ramp up in the United States because of how public health is set up. There is a lot of focus on response, because the same resources can apply to all three biological threats. Ideally, for deliberate biological incidents and laboratory accidents, there should be more focus on prevention, but governments seem to be graded on their response to an unfolding crisis more than their ability to interdict and stop the crisis in the first place.⁵

I’m going to stop here. There are probably others who could more critically evaluate the UK Biological Security Strategy, notably here’s a "Centre for Long-Term Resilience” who has thoughts. And that’s a point that I want to emphasize before leaving. The implementation plan does talk about how their actions will deter malicious acts, but the strategy doesn’t talk about “biodeterrence” as a concept. Instead, this concept is much more about domestic resilience and preparedness for a range of biological risks, developing capabilities and measuring their progress. That’s admirable. There are too many people and organizations in the United States who seem to believe that without a biodeterrence strategy, the United States will remain vulnerable to deliberate biological incidents.

These efforts to develop a “biodeterrence strategy” usually amount to attempts to beef up existing public health programs under the assumption that an improved biosurveillance and response capability will discourage adversaries. As I said above, I think that’s bullshit. It doesn’t fit within existing deterrence concepts⁶ or how governments actually practice deterrence. It vastly overestimates the capabilities of an ideal health system that doesn’t exist and will never exist in the United States, and it vastly overestimates the interest of sub-state groups and nation-states to develop and use biological weapons against a nation with a massive intelligence and military complex. A strategy to develop and mature US resilience to biological risks, ideally through a biopreparedness approach that didn’t just focus on response, would be a much better option. I would only hope that US policymakers will examine the UK Biological Security Strategy and adopt many of its approaches for its own.

Of course, this administration won’t do that (MAHA death cult that it is). But I hope the next administration is paying attention.

1. As a sidenote, the UK strategy correctly understands what a vision statement is supposed to be - aspirational, pointing to a direction, not an outcome. The US strategy’s vision is to “actively and effectively assess, prevent, prepare for, respond to, and recover from” biological threats, which is more appropriately a mission statement. There’s nothing aspirational in the US vision.

2. The problem with “biothreats” and even “biohazards” is it forces a focus on the response aspect of preparing for the possibility of people being harmed by a biological organism. This is the public health community’s big pitch, that a common (and robustly funded) response phase to “biothreats” would be the most logical approach. But with regard to deliberate biological threats that involve human agents, the ideal approach is to prevent that from happening to begin with. Terminology matters.

3. It’s entirely possible that there are well-meaning public health experts who (naively) believe that the solution to deterring bad actors from using biological weapons against the US homeland is a robust and comprehensive public health system. But that isn’t realistically possible without dramatic reform and restructuring of the US health care system, from a federalized system to a nationalized system (which is never going to happen).

4. The CDC has a Global Operating Center and DoD has an Armed Forces Health Surveillance Branch that supposedly feed into the NBIC. Other govt agencies (FDA, USDA, in particular) should be working with this, but the GAO has its doubts.

5. It’s hard to claim success over the lack of a crisis happening, even though that’s the ideal. Congress will only incrementally improve response capabilities, usually as a result of a crisis in which noted capability gaps are identified.

6. Yes, I know about deterrence by denial, but the medical community stretches the definition to unrealistic expectations - lots of money to cover all existing diseases and emerging/genetic disease outbreaks isn’t going to happen. Let alone an adversary believing that you have this exquisite capability.