How to Mail-Order a Pandemic Virus

The gene genie has been out of the bottle for some time. In late 2023, two graduate students working under FBI supervision at the Massachusetts Institute of Technology (MIT) Media Lab ordered fragments of a virus from 38 commercial DNA synthesis companies. The virus in question was the 1918 “Spanish flu” variant of influenza—the pathogen responsible for one of history’s most devastating pandemics, which killed an estimated fifty million people worldwide. The orders were placed on behalf of an organisation that conducts no laboratory experiments, and shipping was requested to an address with no laboratory facilities—both details that should have triggered scrutiny. The students used simple evasive strategies to disguise what they were ordering.

Of the 38 companies they contacted, 36 shipped the fragments anyway. Only one firm detected a potential hazard and asked for proof of biosafety approval. The rest—including twelve of thirteen members of the International Gene Synthesis Consortium, the industry’s own voluntary biosecurity body—sent the material without question. The students then demonstrated that standard synthetic biology techniques could assemble the pieces into an infectious virus identical to the one that plagued combatants during the First World War and killed far more people than the fighting did.

That unsettling experiment, led by MIT biosecurity researcher Kevin Esvelt and his students Rey Edison and Shay Toner, exemplifies a threat that is at once highly technical and urgently practical. The knowledge and infrastructure needed to engineer a pandemic pathogen, once confined to a handful of elite military and civilian research institutions, are quietly becoming more accessible. And artificial intelligence is accelerating the process in ways that policy has not yet addressed.