How hard is it to build your own weapon of mass destruction? We take a crash course in supervirus engineering to find out.

Anthrax. Smallpox. Ebola. For thriller writers and policy crusaders, biological warfare was a standard what-if scenario long before anyone mailed anthrax to government and media offices in 2001. Pentagon war games like Dark Winter, held just before 9/11, and this year’s Atlantic Storm suggested that terrorists could unleash germs with the killing power of a nuclear weapon.

Scientists, though, have always been skeptical. Only massive, state-sponsored programs—not terrorist cells or lone kooks—pose a plausible threat, they say. As the head of the Federation of American Scientists working group on bioweapons put it in a 2002 Los Angeles Times op-ed: “A significant bioterror attack today would require the support of a national program to succeed.”

Or not. A few months ago, Roger Brent, a geneticist who runs a California biotech firm, sent me an unpublished paper in which he wrote that genetically engineered bioweapons developed by small teams are a bigger threat than suitcase nukes.

Brent is one of a growing number of researchers who believe that a bioterrorist wouldn’t need a team of virologists and state funding. He says advances in DNA-hacking technology have reached the point where an evil lab assistant with the right resources could do the job.

Gene hackers could make artificial smallpox—or worse—from standard lab supplies.

I decided to call him on it. I hadn’t set foot in a lab since high school. Could I learn to build a bioweapon? What would I need? What would it cost? Could I set up shop without raising suspicions? And, most important, would it work?

To find out, I meet with Brent at the Molecular Sciences Institute, his company in Berkeley. The 49-year-old researcher has a few million dollars a year in government funding and a staff of 25. He’s the co-author of the must-read lab manual Current Protocols in Molecular Biology, and hardly seems like someone in the grip of apocalyptic fervor. As he shows me around the lab—a few quiet rooms of workbenches, pipette stands, pinky-sized test tubes and the odd PowerBook—we plan our attack.

Experts used to think that distributing a killer germ would require a few vats and a crop duster. Brent and I have a different idea. We’ll infect a suicidal patient zero and hand him a round-the-world plane ticket. But we need a dangerous virus—smallpox, maybe. We won’t be able to steal a sample; we’ll have to make our own.

Too dangerous, Brent says. He gives me a proxy mission: Modify something mundane into something strange. In this case, rejigger standard brewer’s yeast to manufacture a glowing cyan-colored protein usually found in jellyfish.

Brent smiles and shrugs at my disappointment. “All life is one,” he says, and he’s not just being Zen. All over the world, laboratories like Brent’s splice genes—the techniques are as common as the Pyrex beaker, and getting easier every day. Getting yeast to sport blue genes takes the same skills and gear as adding the genes for something toxic. DNA is just the stuff that tells cells what proteins to make—the only real difference between being able to insert a single gene and inserting all the genes that make a virus is experience.

It’s time to find out what kind of genetic engineer I am.

Making DNA turns out to be easy if you have the right hardware. The critical piece of gear is a DNA synthesizer. Brent already has one, a yellowing plastic machine the size of an office printer, called an ABI 394. “So, what kind of authorization do I need to buy this equipment?” I ask.

“I suggest you start by typing ‘used DNA synthesizer’ into Google,” Brent says.

I hit eBay first, where ABI 394s go for about $5,000. Anything I can’t score at an auction is available for a small markup at sites like usedlabequip.com. Two days later I have a total: $29,700—taxes and shipping not included. Nucleosides (the A, C, T, G genetic building blocks) and other chemicals for the synthesizer cost more than the hardware—in the end, a single base pair of DNA runs about a buck to make. Enough raw material to build, say, the smallpox genome would take just over $200,000.

The real cost of villainy is in overhead. Even with the ready availability of equipment, you still need space, staff, and time. Brent guesses he would need a couple million dollars to whip up a batch of smallpox from scratch. No need for state sponsors or stolen top-secret germ samples. “An advanced grad student could do it,” Brent says. Especially with the help of some high schoolers who actually went to lab classes.

But how would I find the gene sequence? Simple. I went to the Web site of the National Center for Biotechnology Information (no password required) and downloaded the DNA sequence for a 770-base pair gene called the Enhanced Cyan Fluorescent Protein. That’s what Brent wanted me to program into my yeast. It took me about 15 minutes to find. Far easier to track down was the 200,000-base pair sequence for smallpox. Only two known samples of smallpox exist; the blueprints are free online.

It's glowing. Is that good?

I load my nucleosides into the ABI 394, and it’s as easy as replacing a toner cartridge. I transmit a test sequence from my Mac and go to lunch. When I come back, I have a custom strand of genetic material waiting for me. This is the anyone-on-Slashdot-can-do-it part of the job.

These days, many labs don’t even bother synthesizing their own genes. They order nucleotide chains online. That’s right: mail-order genes. Just to test this out, I buy a sequence from MWG Biotech in High Point, North Carolina, and have it shipped to my house. Three days later, I’m sitting on the train to Berkeley holding a FedEx box. MWG didn't do anything wrong, but not long ago New Scientist magazine approached sixteen other custom DNA shops to find out if they scan incoming orders. Could a terrorist order a killer virus piece by piece? Only five of the sixteen said they screen every sequence.

Still, mail-order is cheating. If you were a smart terrorist, you’d make the thing yourself to avoid suspicion. You can't order smallpox, but anyone’s allowed to buy raw genetic material and lab equipment—the government only monitors certain radioactive, toxic, or otherwise scary substances.

Getting living cells to absorb synthetic genes is where biotech stops looking like IT and turns into French cooking. The process, called transformation, happens in nature only rarely; it’s part of the way microorganisms evolve. In the lab, you can improve the odds it’ll work by softening up the host cells with chemicals and removing sections of their DNA with tailor-made enzymes. Douse the hosts with synthetic DNA and some fraction of them slurp it up. And some fraction of those start making the protein that the gene codes for. It doesn’t matter if it’s jellyfish fluorescence or smallpox (though obviously smallpox is more complicated).

It sounds like submicroscopic surgery, but all you do is squirt chemicals into a culture dish and let it all soak overnight. In the morning you come back to see if it worked or, more likely, didn’t. My first batch flops. My second, too. One of the MSI researchers offers to break Brent’s rules and do it for me while I watch. It doesn’t work for him, either.

Eventually, we fumble our way to a plastic dish full of translucent goop. If I’d been working on smallpox—and really committed to my cause—this would have been the part where I’d inject a lab animal with the stuff to see if it got sick. Then I’d give myself a dose and head off on a days-long, multi-airport, transnational suicide run. But it was just yeast. Set on top of a black light, it glowed an eerie bright blue, like a Jimi Hendrix poster. My creation ... lived.

Biotech's growth curves leave Moore's Law in the dust.

Would the nations of the world kneel before my awesome power? I asked an expert. Three years ago, Eckard Wimmer headed a team of researchers at SUNY Stony Brook that made live polio virus from scratch, part of a Defense Department project to prove the threat of synthetic bioweapons. So how much of a leap is that from cyan-tinged yeast?

“A simple laboratory technician would have trouble,” he says. With smallpox, “the virus is very large and brings with it enzymes that it needs to proliferate. If you just made the genome and put it into a cell, nothing would happen.”

In the wild, viruses hijack host cells and turn them into virus replication factories. Wimmer was sure any one of the 2,847 members of the American Society for Virology could figure out how to do the same.

Soon, though, I might not even need that expertise. DNA synthesis is following a kind of accelerated Moore’s law—the faster and easier it gets, the faster and easier it gets. Last year, a group of researchers synthesized DNA strands of more than 300,000 base pairs—longer than the smallpox genome—using a method that eliminates most of the shake-and-bake lab steps I’d spent weeks learning.

The rush toward DIY genetics is reflected in so-called Carlson curves, plotted by Rob Carlson, a physicist-turned-biologist (and Brent’s former lab partner at MSI) who worked them out in 2003. “Within a decade,” Carlson wrote in the journal Biosecurity and Bioterrorism, “a single person could sequence or synthesize all the DNA describing all the people on the planet many times over in an eight-hour day.”

Today, when he’s not tinkering with cellular-scale measurement gadgets at the University of Washington, Carlson designs custom proteins on a computer in his Seattle home. According to his calculations, if the current pace of biotech proceeds for another decade, cooking up a lethal bug will be as easy and cheap as building a Web site. “You don’t need a national program,” Carlson says. “The technology’s changing fast, and there’s nothing we can do about it.”

Even if he’s wrong about the timeframe, if someone solves the problem of synthesizing RNA (the single-stranded adjunct to DNA), it would open the door to modifying influenza or retroviruses like HIV—and in 1918 the flu managed to kill 20 million people without any help from bioterrorists.

Bolstered by what scientists like Carlson and Brent are saying, bioweapon policy wonks are calling for an all-out biodefense program. Worried about bacteria and viruses of mass destruction, the federal government pushes nearly $6 billion a year toward research. Tara O’Toole, director of the University of Pittsburgh’s Center for Biosecurity, says after-the-fact vaccines won’t stop a plague; they take months to develop and deploy. She believes the only option is a general-purpose virus detector and destroyer, which has yet to be invented. The cost would be enormous, but don’t think of it as just an antiterror tool. “If we do what we need to for biodefense, we’re going to do an enormous amount of good for routine health care and global disease,” says O’Toole. “We could, as a planet, eliminate large lethal epidemics of infectious disease in our lifetime.”

Brent agrees. He’s been tinkering on a general virus detector as a side project. “Of course I’d be thrilled to see a huge expenditure on defense,” he says. “But the truth is, it’ll probably take an attack to get us there.”

We might not have long to wait. Every hands-on gene hacker I polled during my project estimated they could synthesize smallpox in a month or two. I remember that game from my engineering days, so I mentally scale their estimates using the old software manager’s formula: Double the length, then move up to the next increment of time. That gives us two to four years—assuming no one has already started working.—Paul Boutin