The first UK Microbial Forensics Consortium workshop examined how the UK would investigate and attribute potentially engineered biological incidents. Participants identified gaps in roles, forensic methods, data sharing and communication, and proposed actions such as SOPs, capability mapping and enhanced training to strengthen the UK's microbial forensics and bioattribution capability.

First convening of the UK Microbial Forensics Consortium 2024

Workshop summary

Sana Zakaria, Teodora Chis, Rebecca Lucas, Toby Webster, Sarah Winder, Ondrej Palicka

ResearchPublished Dec 2, 2025

The UK Microbial Forensics Consortium (UKMFC) was established to enhance the UK's capability to investigate, analyse and attribute potentially engineered or deliberately released biological threats. During its first in-person convening in November 2024, RAND Europe delivered a scenario-based workshop involving more than 100 experts spanning human, animal and plant health, environmental monitoring, defence, security, law enforcement, intelligence and bioinformatics. The workshop stress-tested how the emerging consortium would mobilise during a microbial forensics investigation, using an ambiguous Salmonella outbreak scenario to explore operational, scientific and organisational challenges.

Participants examined how UKMFC would become aware of an incident, when escalation would be appropriate, and what scientific, forensic and analytical capabilities would be required. Discussions highlighted uncertainty around roles, responsibilities, triage thresholds and the involvement of security stakeholders.

Participants emphasised the need for clear communication channels, both within the network and externally, including consistent approaches to public messaging in incidents with potential national-security implications. They also highlighted the need to balance collaboration and information sharing with appropriate handling of sensitive data.

The workshop identified opportunities to strengthen UKMFC through the development of centralised standard operating procedures (SOPs), improved coordination mechanisms, training, enhanced data infrastructure and a clearer understanding of capability requirements. These insights will inform the development of UKMFC's Initial Operating Capability and future investment through innovation programmes such as the DASA-funded competition.

Key Findings

Triggers and engagement

  • Participants stressed the need for clear thresholds for UKMFC involvement, noting uncertainty about when routine outbreaks should escalate to national-level investigation. Early engagement could mitigate risks, but frequent alerts could generate noise and false positives.

Scientific and forensic capabilities

  • While the UK has strong biosurveillance and genomic analysis capability, many participants were unfamiliar with processes specific to forensic attribution, including chain-of-custody, evidence preservation and detection of genetic engineering. Participants identified gaps in knowledge of available capabilities within the network and highlighted the need for shared methodologies, training and agreed analytical pipelines.

Data sharing and operational processes

  • Data-sharing agreements, secure information-handling processes and interoperable systems were viewed as essential but not yet in place. Uncertainty around roles, responsibilities and statutory duties risked delays in escalation. Participants emphasised the importance of developing centralised SOPs, consistent protocols, and clear communication pathways, including for transitions from routine public-health investigation to higher-sensitivity forensic investigation.

Communication and public messaging

  • Participants noted that communicating risk, uncertainty and emerging evidence is a critical capability that remains underdeveloped. Mixed or premature messaging could inadvertently escalate concern or prompt misinformation. A unified narrative and guidance on engaging policymakers, media and the public were identified as high-priority needs.

Recommendations

  • Establish centralised SOPs defining alert thresholds, roles, responsibilities, and escalation pathways, supported by clear processes for engaging security, law-enforcement and intelligence partners.
  • Map current capabilities, address knowledge and data-sharing gaps, and develop shared analytical pipelines, training and guidance for forensic sampling, engineering detection and attribution analysis.
  • Develop a unified communication framework and undertake regular exercises to test technical, operational and communication capabilities.

Topics

Document Details

Citation

Chicago Manual of Style

Zakaria, Sana, Teodora Chis, Rebecca Lucas, Toby Webster, Sarah Winder, and Ondrej Palicka, First convening of the UK Microbial Forensics Consortium 2024: Workshop summary. Santa Monica, CA: RAND Corporation, 2025. https://www.rand.org/pubs/research_reports/RRA3748-1.html.
BibTeX RIS

Research conducted by

This work was prepared for the UK Defence Science and Technology Lab by RAND Europe.

This publication is part of the RAND research report series. Research reports present research findings and objective analysis that address the challenges facing the public and private sectors. All RAND research reports undergo rigorous peer review to ensure high standards for research quality and objectivity.

This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to this product page is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial purposes. For information on reprint and reuse permissions, please visit www.rand.org/pubs/permissions.

RAND is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.