Tailored intelligence to detect unusual epidemic activity following the explosion at Vector, Russia

We used open source data from the EpiWATCH observatory to monitor for early disease signals in Russia and surrounding countries following an explosion at a BSL 4 laboratory, Vector, in Siberia in September 2019. Upon news of the explosion at Vector on September 16th 2019, the EpiWATCH team added the Russian language and key words Russia, Siberia, Novosibirsk, and Koltsovo to the Standard Operating Procedures, in addition to the usual epidemic-specific keywords used in EpiWATCH. We also searched for outbreak reports in countries bordering Siberia, including Mongolia, Kazakhstan and China. Given local spread of an epidemic could manifest in these countries, we included searching in Chinese, Mongolian and Kazakh. We added “Ukraine” as a key word, given current conflict between Russia and Ukraine. Data collection began in September 2019, one week after the explosion, with this considered the baseline. We demonstrate a method for rapid epidemic intelligence following an incident of concern, the explosion at Vector. There were some unexplained outbreaks in Russia in the three months following the explosion. No unexplained outbreaks were detected in countries bordering Russia, nor in Ukraine in the three months following the explosion. We detected an accidental release of brucella from a laboratory in China in early December 2019 and two reports of severe pneumonia prior to official reports, which could have been early COVID-19 cases. Best practice in preparedness should include surveillance for disease events in the months following an event of concern at local, national and global levels. In the absence of official surveillance data, open source intelligence may be the only available means of detecting outbreaks and enabling early response and mitigation for the rest of the world. EpiWATCH was able to identify reports of Russian outbreaks in the weeks and months following the Vector explosion, which allowed monitoring of outbreaks of concern without a known cause.


Introduction
On September 16 2019, an explosion occurred at the biosafety level 4 (BSL-4) State Research Centre of Virology and Biotechnology building (Vector) in Koltsovo, in the Novosiberisk region of Siberia, Russia (1). The explosion was allegedly caused by a gas cylinder, and was followed by a fire. The fire spread through the ventilation system and affected an area of 30 square meters. The explosion on the fifth floor of the six-storey building shattered all the glass in the building. An official statement by the Russian government indicated that no pathogens or risk was present, yet Vector contains the largest collection of security-sensitive pathogens known. A gas explosion can propagate a shock wave at speeds of 1500-2000 metres/second. The flame propagates at a much slower speed (typically 20-25 m/second and up to several 100 m/second) (1). Unburned gas is propagated ahead of the flame, therefore, if any pathogens were present, they may have been aerosolised well outside of the building at subsonic speeds, ahead of the fire and before the fire was widespread (1).
If dispersion of pathogens occurred, disease may arise in the local area around Vector, and spread to nearby regions by direct person-to-person transmission and further afield by travel. Epidemic infections can result in epidemic growth each incubation period. Countries with land borders close to Siberia may be at risk. These include Mongolia, Kazakhstan and China. Although Ukraine is further from the explosion site, this would also be an area of interest, given the current conflict between Russia and Ukraine. Other conflict-affected areas within 2000km include Jammu and Kashmir in India. If classified research was occurring at Vector, especially on engineered, hybrid or synthetic pathogens, there may be a deliberate lack of official reporting on subsequent epidemics. There may also be unusual clinical syndromes resulting from novel pathogens. The explosion may also have been deliberate, to enable theft of pathogens (1) -in this case, serious or engineered pathogens could be released anywhere in the world. A combination of global disease surveillance, heightened awareness and political intelligence is needed to recognise potential biological warfare arising from theft of pathogens.
The potential timing of epidemic events arising from the explosion would depend on the incubation period of pathogens dispersed by the explosion. It could range from days (influenza) to several weeks (smallpox, Ebola). The upper range of the incubation period of Ebola is 42 days, and new or engineered pathogens would have an unknown incubation period. The rest of the world depends on timely epidemic intelligence to mitigate global impacts of pathogen release. Traditional public health surveillance, if available, is often not timely, due to delays in reporting and the need for validation by health authorities (1). A lack of surveillance may be due to limited resources for surveillance (such as in low income countries) or the censorship of information. In this case, enormous quantities of open source data can be utilised for rapid epidemic intelligence, because news media may report outbreaks prior to formal notification, and people discuss epidemics and illness on social media (2). EpiWATCH, an automated epidemic observatory, has been developed between 2016-2019, utilising open source data such as social media and news feeds. It is more timely than clinical syndromic surveillance (3).

Aim
To use open source data from the EpiWATCH observatory to monitor for early disease signals in Russia and surrounding countries following the explosion at Vector in September 2019.

Methods
An open source epidemic observatory, EpiWATCH was developed at the University of New South Wales (UNSW) as a management web application, enhanced by machine learning, and has collected data since 2016. The full prototype consists of three software packages that all run on a single server. The software dependencies are all well-established open source projects. The software has a data gathering program, which is scheduled to run on a regular basis. The database is curated, cleaned and enhanced by weekly expert review as new data is collected.
Upon the news of the explosion at Vector on 16 September 2019, the EpiWATCH team added the Russian language and key words Russia, Siberia, Novosibirsk, and Koltsovo to the Standard Operating Procedures, in addition to the usual epidemic-specific keywords used in EpiWATCH. We also searched for outbreak reports in countries bordering Siberia, including Mongolia, Kazakhstan and China. Given that local spread of an epidemic could manifest in these countries, we included searching in Chinese, Mongolian and Kazakh. We added "Ukraine" as a key word, because of the current conflict between Russia and Ukraine and given that the security breach of the explosion could result in theft and deliberate release. Data collection began in September 2019, one week after the explosion, with this considered the baseline. Previous EpiWATCH data from 2016-19 did not include searching in Russian, so was not a valid baseline. Figure 1 shows the number of early reports in the area. Note that Figure 1 reflects reports, not case numbers. Figure 2 is a map of the location of these reports, with case numbers.

Results
Since the Vector lab explosion, there have been 244 reports of outbreaks in Russia up to 31 December 2019. Multiple outbreaks occurred around October 22, November 6 and December 13, 2019. Outbreaks including the acute respiratory virus infection (ARVI), pneumonia, "SARS" and influenza were reported in different districts in October and November. An outbreak of 7,859 cases of "SARS" and influenza was reported on October 22 in the Samara region, but mentioned specific pathogens including influenza, parainfluenza and adenovirus being identified in the laboratory. Another outbreak mentioning "Acute Respiratory Viral Infection (ARVI)" occurred from October 28 to November 4, and resulted in 12,765 ARVI cases in the Irkutsk region. An outbreak of pneumonia in Nadym had a very high reported case fatality rate, but occurred on the background of past outbreaks of pneumonia which had occurred in this area prior to the Vector explosion. A seasonal increase in the incidence of community-acquired pneumonia was reported in the Primorsky Territory in November, where the proportion of sick children was 47.2% (4). Of concern are two large outbreaks of acute respiratory illness in Voronezh (7,198 cases, Oct 8) (5) and Vladimir (9,953 case, Oct 23) (6). No virologic diagnosis was reported in Voronezh, but mixed viral diagnoses of adenovirus and bocavirus were isolated in Vladimir. Children were affected disproportionately in both outbreaks, and in the Vladimir outbreak, incidence rates higher than the average regional incidence rate were reported in Kolchuginsky and Sobinsky districts. Also, the influenza and "SARS" season in Russia came two weeks ahead of schedule (7), and thousands of people were infected with "SARS" and influenza in Samara (8,000 cases, Oct 22) (8) and Irkutsk (13,000 cases, Nov 5) (9). The closest report to Koltsovo was in Tyumen, 1,300 Km away, of 3 cases of presumed Haff diseases, a rare rhabdomyolysis syndrome associated with consuming fish (10). Further searching identified the syndrome to include paralysis, numbness of the limbs and renal failure. One report cited 11 cases receiving dialysis for renal failure. This outbreak is concerning because Haff disease is not confirmed, and the outbreak was accompanied by illness and death in a large number of dogs and cats. A food poisoning event occurred in St Petersburg in October, related to meals prepared by a food service, resulting in 19 employees having gastrointestinal symptoms (11). In November, 4 children were poisoned in Altai after drinking the contents of a bottle, presumably containing antifreeze (12). On December 13, two teenagers were poisoned by an unknown substance and died in Moscow (13). Novokuli, which had an anthrax outbreak, is an area of endemic anthrax. Other diseases such as salmonella, diphtheria, meningitis, listeria and staphylococcus were reported in multiple districts in Russia. In addition, we detected a Tweet about biological warfare in Russia, which appeared to be from a fringe conspiracy theory group. MacIntyre CR, Chen X, Kunasekaran M, Kannan A, Nayak V, Bayaraa K, Sitnikova E, Nguyen PY & German T. Tailored intelligence to detect unusual epidemic activity following the explosion at Vector, Russia. Global Biosecurity, 2020; 1(4).
There were no signals of unusual or unexpected outbreaks in neighbouring countries as of 31 December 2019. No reports were found from Mongolia. Figure 3 shows the outbreak reports from China (N=50) during the surveillance period. Of the total 50 reports, 36 (72%) reports were disease outbreaks in mainland China. Since the Vector lab explosion, a plague outbreak occurred Inner Mongolia, which was the closest area to Russia. In mainland China, plague has been endemic in Inner Mongolia, spread by rodents or due to hunters there eating contaminated meat. The recent plague outbreak occurred between October and November. On October 26, one confirmed bubonic plague case was recorded in the Inner Mongolia Autonomous Region, where the person visited a region where plague foci were identified before illness (14). On November 12, a couple from Inner Mongolia were reported in Beijing caused by eating raw marmot meat and kidney (15). The third case occurred in Xilingol League (Inner Mongolia), in a hunter who got an infection after eating a wild rabbit (16). The fourth case was a rural herder in Inner Mongolia (17). People who contacted with those confirmed cases were quarantined.
We identified the early signals of a brucellosis outbreak when 96 cases were reported on December 7 (18). On December 26, China 's Gansu Provincial Government first issued that a total of 181 students and staff of Lanzhou Institute of Veterinary Research were infected with Brucella, one of whom had clinical symptoms, and the rest were asymptomatic and disease-free (19). The outbreak investigation states that it was initially caused by bacteria-containing gas emitted from the Lanzhou Biopharmaceutical Factory from July 24 to August 20, 2019 (19). According to reports, the factory used expired disinfectants during the production of Brucella vaccine, so the waste gas and discharge was not completely sterilised. People at the Lanzhou Institute of Veterinary Research, which is more than 400 meters away from the factory and in the downwind direction, inhaled and contracted the bacteria-containing aerosols. On December 10, the outbreak spread to Harbin, a city in Heilongjiang Province, resulting in 13 people being Brucella antibody-positive, and the infected persons had short-term animal contact during research work in the laboratory of Lanzhou Veterinary Research Institute in August (20).
Additionally, before the COVID-19 outbreak was first officially declared by authorities on December 31, 2019, we identified the early signals such as unknown pneumonia and lung infection. As early as November 22, a severe pneumonia case from Xiangyang was transferred to Wuhan for treatment (21). On December 26, we also found a report of one suspected novel coronavirus (22). However, this webpage was no longer accessible and the content of this news report has been redacted.
There were several reports of other diseases and outbreaks of known aetiology.  Figure 4 shows outbreak reports in Ukraine during the surveillance period. The significant increase of reports in October was due to botulism, diphtheria, hepatitis A, polio and leptospirosis outbreaks, and multiple measles clusters were reported from October to December. Ukraine has been suffering a major measles epidemic in the years prior to the Vector explosion. There was also an epidemic of diphtheria, with rates doubling in 2019 due to the low vaccination rate in Ukraine (23). Other outbreaks include botulism linked to fish products from the Podolsk food base (24), and hepatitis A disease in school students in Dnieper and Chernigov (25). In addition, we detected a Tweet about pneumonia in Ukrainian troops in Donbass although the pathogen is still unknown (26).  Figure 5 shows the outbreak reports in Kazakhstan during the surveillance period. Respiratory infections were frequently reported from October to December in 2019, particularly in November. Around 55,000 cases of acute respiratory viral infection have been recorded in Kazakhstan since the beginning of the epidemic season (27). In 2019, 11,000 people were infected with measles in Kazakhstan, and most of the cases were amongst unvaccinated children (28). On November 27, a measles outbreak affected 648 cases in one day (29). The influenza season started in November and was one month earlier than expected. The first influenza cases in this season were reported in Mangistau region and Shymkent, and type B was circulating (27). Kazakhstan had 2,879 cases of influenza registered as of November 19, 2019 (27). There was also a pertussis outbreak in North Kazakhstan in 2019, with 72 suspected cases and around 36 confirmed cases (30). Additionally, as of November 1, 2019, 3,307 people living with HIV have been registered at the Almaty AIDS Center, and 56 children with HIV-positive status were registered in Almaty on November 30 (31). Intestinal infections caused by salmonellosis, E.coli and undiagnosed reasons were reported in schools, and children were mostly affected (32). MacIntyre CR, Chen X, Kunasekaran M, Kannan A, Nayak V, Bayaraa K, Sitnikova E, Nguyen PY & German T. Tailored intelligence to detect unusual epidemic activity following the explosion at Vector, Russia. Global Biosecurity, 2020; 1(4).

Conclusions
We demonstrate a method for rapid epidemic intelligence following an incident of concern, the explosion at Vector. No unexplained outbreaks were detected in countries bordering Siberia, nor in Ukraine in the three months following the explosion. Best practice in preparedness should include surveillance for disease events in the months following an event of concern at local, national and global levels. In the absence of official surveillance data, open source intelligence may be the only available means of detecting outbreaks and enabling early response and mitigation for the rest of the world. EpiWATCH was able to identify reports of Russian outbreaks in the weeks and months following the Vector explosion, which allows monitoring of outbreaks of concern without a known cause. Thousands of ARI cases were reported in Voronezh and Vladimir, both reported to be negative for influenza testing, and had affected children more than adults. The cause of the illness was unknown in Voronezh. In Vladimir, a mixed viral diagnoses of adenovirus and bocavirus was reported. In unknown or newly emerging disease outbreaks, mixed viral identification may be an incidental finding or may reflect co-infections. The other outbreak of concern, although small, was presumed Haff disease in Tyumen. This is a poorly understood, rare rhabdomyolysis syndrome, with cases apparently occurring within one family and linked to consumption of fish. Other reports of similar events should be monitored closely and cross-checked against global surveillance.
Heightened surveillance and awareness is also needed globally, especially in surrounding countries. In neighbouring countries, we did not find signals of unknown, serious outbreaks except for two reports of severe pneumonia in China from November onward. We also identified an outbreak of brucellosis in China in early December, related to another laboratory accident of a breach in a facility producing brucella vaccines.
Given the long incubation period of some infections, and possible missed chains of transmission in early epidemics, surveillance should continue for several months following an event of interest. Open source data is a powerful source of rapid intelligence for quickly identifying serious epidemics, and provides more rapid signals than traditional disease surveillance. EpiWATCH can also overcome the limitations of poor official reporting, lack of human resources or deliberate censorship of information (32). In this case, official reporting is unlikely and open source data is the only means of intelligence about epidemics. The large volume of such data from news feeds and social media can provide information about disease events in a timely manner. It should be noted that the COVID-19 pandemic began within three months of the event. SARS-COV-2 has a long incubation period of 2 weeks, so epidemic growth from a single case could take months before an epidemic was large enough to be detected. We did not find any evidence of a relationship of the pandemic to the explosion, except a temporal relationship and the apparent genesis of the pandemic in China, a country bordering the affected area. In separate research we identified signals of COVID-19 in China prior to December 2019, adding to the evidence that the genesis of the pandemic may have been earlier than December (33). The early outbreaks of unknown severe respiratory illness in Russia appear to have affected children disproportionately, which is inconsistent with COVID-19 being the cause. There was no severe pneumonia signal in China prior to November 2019.
In summary, following the Vector explosion, the EpiWATCH observatory was adapted and customised to search for events around this incident. We have also developed a tool to provide a likelihood of unnatural origin of epidemics, adapted from the Grunow-Finke criteria (4). This can be used together with surveillance data to investigate unusual or unexplained outbreaks in the months after any event of concern such as a laboratory accident. Epidemic signals should be combined with political intelligence such as occurrence of conflict and war, to determine the risk of global spread of early epidemics.