Wednesday, October 7, 2026
They Buried
We Dug It Up
⌕ Search

Box 22 Asks If The Work Is Enhanced. An Administrator Ticks It.

Nine institutions, 360 submissions, one tick-box. In six of the nine it is completed by a grants administrator working from the abstract alone. Every one of the 360 answers is correct. Two institutions learned this from our enquiry.

The compliance screen as it appears to the person filling it in. Box 22 is the ninth item in the second column. Engraved for They Buried

It asks whether the proposed work "would be reasonably anticipated to enhance the transmissibility or virulence of a potential pandemic pathogen." Yes, or no.

A "yes" is not a refusal. It routes the application out of the ordinary queue and into a departmental review that has now absorbed four years of hearings, two competing frameworks and a great deal of shouting.

This newspaper did not ask whether that review works. We asked something narrower: who physically ticks the box.

What we asked for

We wrote to seventeen institutions and asked for the 40 most recent applications at each that named a pathogen, together with the submission system's audit log for each form — the user account that keyed the answer, the timestamp, and whether the principal investigator's account ever opened the completed form.

Nine answered. Seven released the logs under records law. Two released them after a telephone call, on the view that a submission audit log is administrative metadata rather than research material.

That is 360 forms.

Who ticks it

In six of the nine institutions, Box 22 is completed by a grants administrator.

The administrator works from the abstract. This is not a lapse in the workflow; it is the workflow. At those six institutions the abstract is the only part of the proposal the compliance screen shows on the same page as the box. The research plan is four clicks away, and the logs show those clicks are rarely made.

In three of those six, the investigator's account never opened the completed form before submission. In 118 of the 360, a certification about pandemic pathogens went to a federal agency under a scientist's name without that scientist having seen the answer.

Figure Who physically completed Box 22, in 360 submissions from nine institutions
Grants administrator, from the abstract216 — six institutions, one workflowPrincipal investigator, personally97 — two institutions require itDepartmental research office34 — reads the full research plan firstInstitutional biosafety officer13 — one institution, on flagged organisms onlyOf those: form never opened by the PI118 — a subset, three institutionsOf those: answered 'yes'0 — and every 'no' is correctEach bar counts submissions. The first four bars partition all 360 by the user account that keyed the answer. Thelast two bars are subsets of that total, not additions to it, and are marked.
The account that keys the answer is recorded by every submission system we obtained data from. The abstract is the only part of the proposal that the compliance screen displays alongside Box 22 at six of the nine institutions; reaching the full research plan takes four further clicks. They Buried, from records requests to nine institutions and their submission-system audit logs

Every answer was right

Not one of the 360 was answered wrongly.

We paid two microbiologists who work with select agents, and who do not know each other, to answer Box 22 themselves from the 360 abstracts with the institutions and investigators stripped out. They agreed with the submitted answer 360 times out of 360. They disagreed with each other twice, on two proposals neither would have ticked yes.

Every submitted answer is "no", and almost none of them is close to the line. The 360 include catheter-infection surveillance, four nutrition trials, a vaccine cold chain in Malawi, and a great deal of work on soil bacteria.

The two who found out from us

Two of the nine institutions told us they had believed their investigators completed the box personally, and learned otherwise when they went to answer our request.

One has since added a required acknowledgement: the form cannot be submitted until the investigator's account has opened the completed compliance page. It took, their research office told us, an afternoon.

The other is still deciding.

What this is, and what it is not

It is not concealment. Nothing here was hidden, and we obtained all of it by writing letters.

It is not incompetence either. The administrators are transcribing an answer the scientist has already given, in the one document a scientist has every reason to make exact.

What we can say is this. The single control on which four years of argument has turned is, most of the time, operated by somebody whose job description does not mention pathogens, from a summary written by somebody else, on a screen that shows nothing else.

That may be entirely adequate. In 360 attempts it was. We found no case near the line, which means we have not seen the workflow tested, and the desk would rather say so than pretend that 360 easy questions answered correctly tells us how a hard one would go.

Sources & Method

We did not ask whether the departmental review works. We asked a narrower and more answerable question — which user account keys the answer to Box 22 — and obtained the 40 most recent pathogen-naming submissions from each of nine institutions, with the submission system's audit log for each form. We then paid two microbiologists who do not know each other to answer all 360 boxes themselves from de-identified abstracts.

Who we spoke to

  1. Nine research institutions, Submission records for the 40 most recent applications naming a pathogen at each. Requested under state public-records laws and the federal act; seven released in full, two released after a telephone call on the basis that submission audit logs are administrative metadata March–July 2026 Three institutions asked what we intended to do with the audit logs. All three released them anyway.
  2. Marisol Quintana-Beddoe, Senior grants administrator, a public university in the Midwest, 19 years in post. Interviewed by telephone twice and then in person, with her employer's knowledge; given the full draft and three weeks to answer May and July 2026 Her reply is printed in full at the foot of this page and is the strongest argument against this story.
  3. Dr. Anselm Ruiz-Trevelyan, Institutional biosafety officer at the one institution where the biosafety office completes the box. Interviewed by video call; supplied his office's own internal audit of 300 prior submissions June 2026 His audit found the same thing ours did: no wrong answers, and nobody senior aware of who was answering.
  4. Two blind reviewers, Microbiologists who work with select agents, at different institutions, unknown to each other. Paid to answer Box 22 themselves from 360 de-identified abstracts, with no sight of the submitted answers July 2026 Agreed with the submitted answer on all 360. Disagreed with each other on two, on neither of which would either have ticked yes.
  5. A departmental policy official, Works on the review framework the box triggers. Interviewed on the record about policy and on background about practice; text of the box confirmed against the published form July 2026

What we could not confirm

  • Whether any of the 360 should have been a 'yes'. Our reviewers answered from the abstract, which is the same material the administrators had. Neither we nor they saw the work as actually performed, and a proposal is a description of an intention, not a record of an experiment.
  • Whether nine institutions tell you anything about the other several hundred. These are the nine that answered a records request. We asked seventeen. The eight that did not answer may differ from the nine that did in exactly the way that would matter, and we have no way to find out.
  • How the workflow behaves on a hard case. In 360 submissions we found no application near the line, so we have not observed what happens when the abstract is genuinely ambiguous — which is the only circumstance in which any of this matters.
Disclosure. This newspaper paid the two blind reviewers $2,400 each, in advance, with no clause tying payment to any finding, and $186 in records-request fees to three of the nine institutions. No payment was made to any interviewee.

How Others Covered This

The same events, as reported elsewhere on the same day. We list what each outlet had that we did not, as well as what we had that they did not — including where we come off worse. Why we print this.

  1. The Hollow Post
    The Box Nobody Wants To Tick — And The Clerks Ticking It

    Read the administrator workflow as a deliberate insulation of investigators from a certification they would rather not make.

    Had that we did not

    The three institutions where the investigator never sees the completed form. That is the real finding and they got there a week before us.

    Left out

    That all 360 answers are correct, which their own reporter had in the same dataset and which appears nowhere in 1,900 words.

  2. Signal & Ledger
    Compliance Load: What Box 22 Costs A Research Office Per Submission

    Costed the workflow at 11 minutes a form and advised research administrators on staffing the queue.

    Had that we did not

    The four-click distance between the compliance screen and the research plan, measured, which we then measured ourselves.

    Left out

    Any suggestion that the eleven minutes might be short rather than long, or that a queue is a strange place to put this particular question.

  3. They Buriedthis newspaper
    Box 22 Asks If The Work Is Enhanced. An Administrator Ticks It.

    Asked only who completes the box, obtained 360 forms with their audit logs, and had every answer independently re-derived from the abstract.

    Had that we did not

    All 360 submitted answers, both blind reviewers' answers, and the two disagreements between them.

    Left out

    Our headline says 'an administrator' as though that were the alarming part. Sixteen named women and three named men do this work, we quote one of them, and the piece never establishes that any different arrangement would have produced a different answer. — V. Ashcombe-Doyle, standards editor

Right of Reply

They Buried contacted Marisol Quintana-Beddoe, senior grants administrator on 12 May and 9 June 2026 by telephone, in person on 27 June, and sent the full draft on 21 July with three weeks and no conditions. Replied by email on 6 August 2026. Printed entire and unedited, at her request, including the parts about this newspaper.

You have written a story in which the safety of the world rests on me, and that is not what happened, and I would like to say why before your readers decide it did.

I have completed that box, or its predecessors, something over four hundred times. You are right that I have never been in a laboratory. You are right that the screen shows me the abstract. You are right that reaching the research plan takes four clicks, and you are right that I do not usually make them, and I told you all four of those things myself, unprompted, because none of them is a secret and all of them are in the manual.

Here is what your piece leaves out, and it is not a small thing.

I am not deciding anything. I am transcribing. The investigator writes the abstract. The investigator signs the certification page. If the abstract said what your box is looking for, the answer would be visible in the first two sentences, because scientists describe their own work accurately when they are asking for money for it — that is the one moment in the whole process when they have every incentive to be exact about what they intend to do. My job is to move the words the scientist wrote into the field the agency built. When you call that 'operating the control', you are describing a filing clerk as a safety interlock, and then being alarmed at the clerk.

And I want to be careful here, because I do not want to sound as though nothing worries me. Something does. It is not that I fill in the box. It is that in three of your nine places the scientist never looks at what went out under their name. That is a real problem and you found it and you should have led with it, and instead you led with me. Those are not the same finding. One is about a workflow that could be fixed on a Tuesday afternoon with an acknowledgement checkbox. The other is a story about a woman with a job title you find funny.

You asked me at my kitchen table whether it frightened me to be the one who ticks it. I said no and you wrote that down and I have thought about it since, and my answer is still no, but I want to give you the better version of it. What would frighten me is a system where nobody could tell you who ticked it. Every one of those 360 forms has my name or somebody's name on it, with a timestamp, and you got them by asking. You did not need a source. You did not need a leak. You filed a request and nine institutions sent you their audit logs, and two of them read your questions and changed how they work.

That is a system functioning. I understand it makes a duller headline than the one you used. I have read your newspaper for six years and I thought duller was rather the point of you.

Published unedited under our right-of-reply guarantee.

How was this story?

We publish the result, whatever it is. Reader verdicts appear on the front page and in our newsroom metrics.

4,201 verdicts · 57.0% loved it

Readers' Letters 0

Printed at once under the name you give and read by the desk afterwards; anything unfit is removed, with a note saying so, and nothing else is ever deleted — only corrected. Letters that changed something in the story carry a mark saying so, and there are 5 of those across the archive.

  1. No letters yet on this story. Yours would be the first.

Write to the desk