In September and October 2001, contaminated letters laced with Bacillus anthracis were sent through the mail to two U.S. senators and members of the media. Postal facilities in New Jersey, Washington, D.C., and elsewhere became heavily contaminated. The anthrax incidents highlighted major gaps in civilian preparedness to detect anthrax contamination in buildings. GAO was asked to describe and assess federal agencies' activities to detect anthrax in postal facilities, assess the results of agencies' testing, and assess whether agencies' detection activities were validated.

Federal agencies conducted several sampling activities, including developing a sampling strategy and collecting, transporting, extracting, and analyzing samples. They primarily collected samples from specific areas, such as mail processing areas, using their judgment about where anthrax would most likely be found--that is, targeted sampling. The agencies did not use probability sampling, which would have allowed agencies to determine, with some defined level of confidence, when all results are negative, whether a building is contaminated. The results of the agencies' testing in 286 postal facilities were largely negative--no anthrax was detected. However, agencies did not use validated sample collection and analytical methods. Thus, there can be little confidence in negative results. With a validated process, agencies and the public could be reasonably confident that any test results generated by that process would be reliable. The Department of Homeland Security (DHS) is the principal agency responsible for coordinating the federal response. Thus, in its 2005 report, GAO recommended that the Secretary of Homeland Security develop a coordinated approach to improve the overall process for detecting anthrax and increase confidence in negative test results generated by that process. DHS stated that while it has overall responsibility for coordinating the federal response during future biological attacks, other agencies have the lead responsibility for validation. Therefore, uncertainty over which agency would take the lead role--that is, who is in charge--in improving the overall process for detecting anthrax, including validation of the methods, continued after GAO issued its report. On the basis of these uncertainties, GAO recommended in its May 9, 2006, testimony that DHS's approach to validating the overall process start with a strategic plan that would include a road map outlining how individual agencies' efforts would lead to the validation of the individual activities as well as the overall process, noting that such a plan would assist DHS in monitoring progress and measuring agency performance toward improving the detection of anthrax and other prioritized threat agents. While DHS generally agreed with these recommendations, it stated that it cannot ensure validation studies would be done, since "there are legal limitations in DHS authority to direct the activities of other agencies." Also, since validation would require a sustained effort over a long period, DHS noted that it could not mandate commitment of other agencies' funds, over which it has no control. Until responsibility is accepted for ensuring that sampling activities will be validated, the fate of the validation process will remain uncertain. Without validation, if another anthrax attack were to occur tomorrow, federal civilian agencies would not be able to conclude with any given level of statistical confidence, in cases of negative results, that a building is free of contamination.