The fast convergence between computing, technology, and synthetic biology, the production of programmable DNA circuits, and advances in CRISPR-based editing are redefining the limits of biology. The proliferation of bio-OSs (“bio-operating systems”) and programmable cells is a significant advancement. We are entering a period in which biology is engineered and coded just as you would code a computer program, where even debugging is programmed, and cells can be deployed on your cellular phone. Nonetheless, this biotechnological progress has long surpassed the regulatory guardrails of the past. Not that we should abandon the efforts of the National Institutes of Health (NIH) and Food and Drug Administration (FDA); however, the regulatory frameworks they use were all set under a paradigm of biomedicine (well before synthetic biology) and are not necessarily designed for the dual-use risks, ethical considerations, and geopolitical vulnerabilities inherent in synthetic biology and bio-engineering. One way to mitigate the risks and ensure the safety of the public, while also providing for our national security interests, is to create a new legal framework—one that considers synthetic biology as an infrastructural programming device, not just as a biomedical tool. When we consider bioengineering in a law and policy context, it raises several public safety, national security, and global bioethics considerations that could provide a sounder basis for developing regulations.
Programmable Life and the Rise of Bio-OS
Technology has democratized the accessibility, fidelity, and scalability of gene editing. Simultaneously, advancements in biocomputing, particularly with the development of DNA-based logic gates and DNA-based memory storage, have enabled living cells to perform computational functions, ranging from diagnostics to conditional gene expression and basic decision-making. Companies such as Synthego, Ginkgo Bioworks, and Asimov are building platforms that treat cells as programmable substrates, providing APIs for genetic logic, modularized gene circuits, and machine learning–inspired bio-design.
While a "bio-OS" is appealing for its ability to abstract biological complexity into computational frameworks, this abstraction also creates risks. If organisms can be programmed, they also can be hacked, misused, and accidentally released. Current regulatory frameworks, developed largely in response to recombinant DNA technologies in the 1970s and 1980s, do not adequately evaluate the dynamics and evolving nature of genetic circuits utilized in living systems. Existing regulatory systems do not adequately measure the risks posed by the reality of open-source gene libraries, cloud-based biofoundries, and the transatlantic propagation of genomic data.
Oversight Gaps in a Post-CRISPR World
There is great oversight by the NIH and the FDA around biomedical research and the development of gene therapies. Oversight from both agencies is largely reactive and only covers clinical applications (drugs and medical devices). For instance, CRISPR tools that allow for somatic editing for (rare) diseases (as one example) fall under FDA Investigational New Drug (IND) processes, while basic gene research is mainly recognized under NIH guidelines by way of institutional biosafety committees (IBCs).
This oversight is adequate for novel therapeutics developed to be singular interventions but does not effectively address the systemic ambitions of synthetic biology. There is no legal definition of a “genetic app,” and there are no pathways for licensing reprogrammable cells for environmental or industrial applications. Programmable organisms that operate in ecosystems (i.e., self-spreading vaccines, bioremediation microbes, agricultural biosensors) exist in regulatory gray zones, often requiring cross-agency collaboration that lacks formal authority or clear jurisdiction.
There is also no broadly agreed-upon ethical framework for gene drives, synthetic embryos, or the modification of heritable germlines, especially now that these tools have been developed to become more automated and modular. For example, the DARPA-funded Safe Genes program and the Broad Institute's gene circuit research demonstrate how new innovations are progressing more quickly than the development of ethical consensus. Finally, while bioweapons development is illegal under the Biological Weapons Convention (BWC), synthetic biology’s civilian dual-use risks are completely unaddressed.
The Dual-Use Dilemma
The dual-use issue, wherein research meant for benevolent ends can be easily repurposed for harmful ones, is particularly prevalent in synthetic biology. Biocomputing tools could be used to design better pathogens or evade the immune system. The publication of the genome of the 1918 flu virus and the subsequent synthesis of the virus that causes horsepox have already made researchers, governments, and public health practitioners nervous about the democratization of pathogen synthesis. CRISPR-based systems have made it plausible to create gene drives that target staple crops (like rice) or specific ethnic populations (like indigenous Papua New Guineans)—a consideration we might once have only imagined in the realm of science fiction.
The involvement of private sector investment in bio-OS platforms expands this concern to the degree that bio-OS platforms behave more like software companies (fast, scalable, iterative) and less like traditional biotech companies (traditional biotech companies tend to be therapeutics-focused and regulated). This is a concern because, like other areas of cloud computing, we lack the internal biosecurity culture, which has developed in research and government laboratories over several decades. At the same time, cloud-enabled tools such as CRISPR design platforms are becoming ubiquitous tools for malicious actors to exploit.
Synthetic biology also challenges the moral foundation of what it means to be human, ecological integrity, and our responsibility to the evolution of life. Should we modify embryos for the purposes of disease prevention? Should gene-edited organisms be patentable or open-source? Should bio-OS platforms be regulated like AI systems, with audits embedded, traceability, and kill switches?
Toward a New Legal Architecture
A forward-looking legal paradigm for synthetic biology must be preventative, layered, and globally coordinated. Programmable biological systems must be viewed as a new and different category. In developing this framework, we must expand the scope of risk assessment for systems-level behaviors, impacts on ecosystems, and risk of unintended spread.
We recommend the creation of an interagency task force similar to CFIUS, styled on a review process for platforms based on security or dual-use risk. Ethically mandated protocols must be established to prioritize third-party audits and reporting, environmental assessments, and ongoing monitoring. "Kill-switches," traceability, and synthetic nutrients provided using biologically encapsulated systems should be required and comparable to cybersecurity structures for digital systems.
Global Coordination and Democratic Oversight
International cooperation is essential. To update the role of bioengineering in programmable biology, the Biological Weapons Convention and UNESCO bioethics declarations will need to be updated. Harmonizing regulations will also be necessary to eliminate loopholes and ensure uniform enforcement, much like the common international standards for nuclear safety have been established worldwide. Public transparency—with oversight of databases for genome-editing, domestic and international orders for DNA synthesis, and designer bioengineering through machine learning and artificial intelligence—should be made mandatory for all stakeholders. The public can help democratic oversight through citizen science, interdisciplinary councils, and open policy making.
The intersection of synthetic biology and information technology will require a new regulatory system that must be smart, agile, and ethical. No one is better positioned for this essential role than the NIH and FDA. But neither agency should handle this paradigm shift alone. If we fail to create, test, and refine a coordinated legal framework for how programmable life is brought forward, we may be making a net social loss. It is time to act to make sure that programmable life is established within a safe advancement process that will take place under reasonable oversight.