A decade after the 9/11 attacks, it is easy to forget the anthrax letters that sprang up just a few weeks later and to dismiss the fear that swept the country as a relic of a fragile moment that already belongs to history. But in the wake of those events, many national-security experts began to reconsider the risk of a biological attack — and reached some unsettling conclusions. Since the collapse of the Soviet Union, most scientists had assumed that the difficulty of building a bioweapon was far beyond the ability of a terror cell, but looking again in the early 21st century, many experts came to believe that advances in laboratory technology brought the science within reach. “What took me three weeks in a sophisticated laboratory in a top-tier medical school 20 years ago, with millions of dollars in equipment, can essentially be done by a relatively unsophisticated technician,” Brett Giroir, a former director at the Defense Advanced Research Projects Agency (Darpa), told me recently. “A person at a graduate-school level has all the tools and technologies to implement a sophisticated program to create a bioweapon.”

Even some nuclear experts began to wonder if the risk of a biological attack had eclipsed the nuclear threat. Graham Allison, the founding dean of Harvard’s John F. Kennedy School of Government and a leading expert on nuclear proliferation, told me: “Nuclear terrorism is a preventable catastrophe, and the reason it’s preventable is because the material to make a nuclear bomb can’t be made by terrorists. But in the bio case — oh, my God! Can I prevent terrorists from getting into their hands anthrax or other pathogens? No! Even our best efforts can’t do that. I think the amazing thing is that one hasn’t seen more bioterrorism, given the relative ease of making a bioweapon and the relative difficulty of defending.”

How a biological attack might unfold depends on a number of variables, including which biological agent is used, the extent of its weaponization, the amount released and the method of delivery. Some agents, like the smallpox virus, are highly contagious and could spread widely from a small release. Others, like the plague and tularemia bacteria, are not typically contagious but are relatively easy to make into wet slurry and disperse. Some of the most vivid descriptions of how such an attack might look come from the national-security exercises used to develop biodefense policy. The exercise briefed to Dick Cheney in 2001, for example, was known as Dark Winter and was coordinated by the Center for Strategic and International Studies and the Johns Hopkins Center for Civilian Biodefense Studies. It took place over two days at Andrews Air Force Base, with former Senator Sam Nunn playing the role of president, David Gergen acting as national-security adviser, the former C.I.A. director James Woolsey leading intelligence and the retired four-star general John Tilelli serving as chairman of the Joint Chiefs of Staff. As the smallpox virus began to appear, first in Oklahoma and then in pockets across the nation, the participants quickly discovered that the country had no standing response plan and only enough vaccine to protect 5 percent of the public. Within weeks, as many as a million people in the United States were estimated dead.

Not all experts are convinced that simulations like Dark Winter offer a realistic view. Milton Leitenberg, a prominent arms-control expert, has argued that the exercise relied on faulty premises to increase the death toll and “assure a disastrous outcome.” In particular, Leitenberg objects to the rate of secondary transmission assumed in the Dark Winter exercise. This is the figure to describe how many additional people each patient would infect, and it is highly contextual, depending on biological traits, like the genetic vulnerability of the target population; social habits, like the number of personal interactions by each victim; and meteorological conditions, like the weather and the time of year. Because the exercise was set in winter, which is favorable to smallpox, and because Americans are not routinely vaccinated, planners assumed a transmission rate of 10 new infections by each victim. Leitenberg says that number should be three. Other estimates vary. The Centers for Disease Control and Prevention uses a range of five to seven; the last comparable cases of smallpox to appear in Europe averaged between 9 and 17; and the authors of a 1999 article in Science magazine used the same figure as Dark Winter. But if Leitenberg is right, the death toll from the exercise would be much lower — most likely in the tens of thousands.

Whatever the transmission rate of smallpox, the more salient question for biodefense may be whether an attack will happen at all. On this, the expertise of microbiologists is limited, but there is surprisingly broad agreement among the officials in charge of national security over the past 10 years. Since 2001, senior members of both the Obama and Bush administrations, who have reviewed classified intelligence, have consistently placed biodefense at or near the top of the national-security agenda. In 2004, a report from the National Intelligence Council warned, “Our greatest concern is that terrorists might acquire biological agents.” Michael Chertoff, the secretary of Homeland Security between 2005 and 2009, told me, “In terms of catastrophic attacks, bio was at the top of the list.” In 2008, the director of national intelligence, Adm. Mike McConnell, described a biological attack as “my personal greatest worry.” In 2009, McConnell’s successor in the Obama administration, Dennis Blair, warned the Senate Select Committee on Intelligence that “the terrorist use of biological agents represents a growing threat.” In November 2009, the National Security Council estimated that a biological attack could place “hundreds of thousands of people” at risk of death and cost more than $1 trillion. Heidi Avery, a top biodefense official in the White House, told me recently that biological terrorism poses “the ultimate asymmetric threat; it should be considered in the same class as the nuclear threat.” And a report by the Congressional Commission on the Prevention of Weapons of Mass Destruction Proliferation and Terrorism, formed in 2007, concluded: “To date, the U.S. government has invested most of its nonproliferation efforts and diplomatic capital in preventing nuclear terrorism. The commission believes that it should make the more likely threat — bioterrorism — a higher priority.”

To heighten the nation’s biodefenses, the federal government has invested more than $60 billion since 2001, developing and distributing air sensors, educating doctors about the symptoms of bioterror pathogens and distributing medical supplies for biodefense to hospitals around the country. At the root of these efforts is a list of specific biological agents, known as “material threats,” that have been identified by the Department of Homeland Security as the most urgent pathogens to defend against. These include smallpox, anthrax, ebola, plague and a handful of lesser-known organisms.

Since 2004, the Department of Health and Human Services has overseen a program called Project BioShield to develop and stockpile vaccines and treatments, known collectively as “medical countermeasures,” to defend against the pathogens. After seven years, the achievements of BioShield are measurable. According to Robin Robinson, who directs the countermeasure program at Health and Human Services, there is currently enough smallpox vaccine in the stockpile to inoculate every United States citizen; enough anthrax vaccine to respond to a “three-city attack”; and a variety of therapeutic drugs to treat the infected. Yet many other goals of the program are incomplete and, in some cases, not even begun. After spending hundreds of millions of dollars, for example, to develop a new vaccine for anthrax that would replace the controversial formula developed 50 years ago by the Army — which is known to have serious side effects and has never been approved for children — there is still no new vaccine. There also are no new broad-spectrum antibacterial drugs in the stockpile and no new antivirals. “We don’t even have candidate products” for antivirals, Robinson told me.