# News this Week

Science  28 Nov 2008:
Vol. 322, Issue 5906, pp. 1310
1. TAINTED MILK SCANDAL

1. Hao Xin,
2. Richard Stone

BEIJING—A weeks-long investigation into China's tainted milk scandal has left scientists astonished by the technical sophistication of those who used melamine to adulterate food products. Chinese investigators, meanwhile, are puzzling over the precise mechanisms of exposure and toxicity in infants who developed kidney damage.

At a closed workshop with U.S. experts here last week, Chinese scientists presented early results of an ongoing probe into the mass poisoning that left at least four infants dead and sickened more than 53,000 others after they drank baby formula tainted with melamine, an industrial chemical used primarily as a plastics stabilizer and fire retardant. The workshop capped a busy week in which the Chinese government trotted out measures to improve food safety, and the U.S. Food and Drug Administration (FDA) opened its first offices in China. “After melamine, there will be more transparency, more openness,” says Chen Junshi, co-chair of the Sino-U.S. workshop and a risk-assessment specialist at China's Center for Disease Control and Prevention here. U.S. officials are speaking in more sweeping terms about the impact on $2 trillion worth of imports a year: “This is nothing short of a redesign of food and drug safety to meet a 21st century challenge,” says U.S. Health and Human Services Secretary Michael Leavitt. The melamine scandal came to light last September, when the central government learned that scores of infants in Gansu Province had been hospitalized with kidney stones, evidently after being fed infant formula with high levels of melamine. In the weeks that followed, powdered formula, fresh milk, and other products from some two dozen companies were found to contain melamine. Police have detained more than 30 people suspected of adulterating milk, including the general manager of one of China's largest powdered milk makers, Sanlu, based in Shijiazhuang. In an interview with Science last month, Premier Wen Jiabao expressed sorrow for the poisoning and vowed an aggressive response (Science, 17 October, p. 362). Researchers say the adulteration was nothing short of a wholesale re-engineering of milk. Weeks ago, investigators established that workers at Sanlu and at a number of milk-collection depots were diluting milk with water; they added melamine to dupe a test for determining crude protein content. “Adulteration used to be simple. What they did was very high-tech,” says Chen. Researchers have since learned that the emulsifier used to suspend melamine—a compound that resists going into solution—also boosted apparent milk-fat content. Sanlu baby formula contained a whopping 2563 mg/kg of melamine, adding 1% of apparent crude protein content to the formula, says Jerry Brunetti, managing director of Agri-Dynamics in Easton, Pennsylvania. Milk, he notes, is only 3.0% to 3.4% protein. Chen says a dean of a school of food science told him that it would take a university team 3 months to develop this kind of concoction. Investigators have concluded that as-yet-unidentified individuals cooked up a protocol for a premix, a solution designed to fortify foods with vitamins or other nutrients. In this case, it was deadly. Several milk-collecting companies were using the same premix, Chen says: “So someone with technical skill had to be training them.” So far, Chinese scientists have fingered only melamine as the toxic agent. Published studies on cats and rats indicate that melamine reacts with an accomplice—cyanuric acid—to form melamine cyanurate crystals found in kidney stones. Both melamine and cyanuric acid were present in wheat gluten imported from China during the North American pet-food recall last year; the mixture killed dozens of cats and sickened thousands of other pets. In the tainted milk products, however, Chinese researchers have found only trace amounts of cyanuric acid—parts per billion, or roughly 1% of the amount of melamine in the samples, says Chen. “Our scientists concluded that melamine by itself caused the kidney stones. But one unresolved issue is how high the melamine levels have to be for this to happen.” Some experts are skeptical. George Daston, a toxicologist with Procter & Gamble Co. in Cincinnati, Ohio, who with colleagues published a study in Toxicological Sciences online on 9 August, doubts that “melamine alone caused the kidney stones.” He says that “melamine and cyanuric acid are so tightly associated with each other, it can be difficult to extract the compounds from the contaminated products.” U.S. chemists “found melamine but not cyanuric acid in their initial attempts to identify the contaminant” in pet food, says Daston; subsequent analyses, he says, uncovered significant amounts of cyanuric acid. To settle questions about the new melamine cases, Chen says, “we need more data.” The World Health Organization will hold an expert consultation on these issues in Ottawa next week. Many other strands of the tragedy have yet to be unraveled. Although it's evident that adulteration was to blame for baby formulas with high melamine levels, it's unclear whether very low levels of melamine contamination—the lowest tested level was 0.09 ppm—might have come from nonprotein nitrogen (NPN) additives in ruminant feeds or from plastic packaging. NPN additives such as biuret and urea are used in cattle feed in many countries, including the United States. The Chinese government supported research in the 1990s on NPN feed additives and has encouraged their use. Since then, a cottage industry has sprung up selling dan bai jing (protein essence), whose specific ingredients are unknown, for use in livestock feeds. China has heightened its vigilance, and the odds of melamine slipping through the safety net again are vanishingly low. But the problem of adulterated livestock feeds may be harder to resolve. After FDA traced last year's poisoned pet food to gluten from China tainted with melamine scrap—melamine, cyanuric acid, and related compounds—China's agriculture ministry issued a standard for determining levels of melamine in feeds and banned the use of this and other harmful compounds in June 2007. The ban appears to have had little effect. Authorities in Hong Kong recently uncovered melamine in eggs and in fish feed. The measures announced last week should help keep attention focused on the contamination problem. The National People's Congress is expected to pass a new food-safety law next month that would establish a food-hazard monitoring system and a risk-assessment committee under the health ministry. Meanwhile, the governing State Council ordered the ministry last month to sort out confusing food standards. For instance, soy sauce, depending on how it's made and used, is subject to four standards. One unresolved problem is segmentation of food control and inspection, with one agency overseeing farms, another one responsible for food manufacturers, and so on up to the dinner table. “Scientifically, this is a terrible system,” says Chen. Last week, FDA opened three offices in China—in Beijing, Guangzhou, and Shanghai—whose eight inspectors and technical experts will team up with Chinese experts to monitor traffic in food products. It plans to open two offices in India next month and two in Latin America in January. China's State Food and Drug Administration also plans to open U.S. offices to share technical expertise and work more closely on policing imports. The global network “will require new science for detection and investigation of contamination,” says FDA Commissioner Andrew von Eschenbach. But the challenges facing China are immense. The country has 200 million farming households and more than 500,000 food manufacturers, many of which employ fewer than 10 people, says Chen. “Most companies don't care about their reputation,” he says, and can dissolve and reconstitute elsewhere. “Food adulteration is inevitable and will be with us for many years.” Chen expects food and feed adulterators to raise their game. “The sophistication of the techniques will improve the next time,” he says. Li Shaomin, a management professor at Old Dominion University in Norfolk, Virginia, who studies the business environment in China, agrees. “When millions of people experiment with new ways to make money without moral self-constraint, the chance of new products that can evade existing testing methods is pretty high,” he says. “Unless the people who put melamine into milk lose sleep, the product-safety problem in China will go on.” 2. FRANCE # Will French Science Swallow Zerhouni's Strong Medicine? 1. Martin Enserink PARIS—Dull moments have become rare in French science and higher education. Since President Nicolas Sarkozy took office 18 months ago, heavily contested reforms have come at a frenetic pace. Still, most were child's play compared with what a high-wattage international committee prescribed in a surprisingly blunt report released on 13 November. The panel, led by former U.S. National Institutes of Health (NIH) director Elias Zerhouni, proposes a massive overhaul of French life sciences research that would create a single, strong funding agency and likely spell the death of several existing institutes. The government has welcomed the report (tinyurl.com/inserm) as an endorsement of its own reformist program. Speaking at the 120th anniversary of the Pasteur Institute 2 weeks ago, research minister Valérie Pécresse promised Zerhouni—who grew up in Algeria and is fluent in French—that the proposals would “not remain a dead letter.” But trade unions are up in arms, and Sauvons la Recherche, a left-wing researchers' movement that has fought the recent changes every step of the way, says it read the report with “astonishment” and “alarm.” The panel—which included U.S. Nobelists Harold Varmus and Peter Agre, as well as top researchers and science administrators from Switzerland, the United Kingdom, Canada, and France—had been asked to review the performance of France's National Institute for Health and Medical Research (INSERM). But it took the liberty of making a diagnosis—and prescribing a remedy—for the country's entire biological and medical research sector. That sector is “strikingly” fragmented, the panel says: In addition to INSERM's €650 million effort, there are life science programs at the National Center for Scientific Research (CNRS), the Atomic Energy Commission, the National Cancer Institute, and at least four others. That leads to “unnecessary bureaucratic turf battles” and scientists spending “an inordinate amount of time” chasing funds, says the panel, which also criticizes INSERM's byzantine and unwieldy governance structure. INSERM doesn't have its own institutes or campuses; most of its researchers are in so-called mixed units based at, and co-administered by, universities or other host institutes. That creates even more paperwork and “diffuses responsibility and authority,” the report says. As to INSERM's scientific output, some of it excels, but the “large bulk … is published in lower-tier journals.” (“Our job was to be very candid,” Zerhouni says.) What's needed, the group concludes, is bold action. That includes setting up a strong, unified agency to fund all of the life sciences—presumably a new version of INSERM. If that agency also conducts research itself, those labs should be clearly set apart, as is the case with NIH's intramural labs, Zerhouni says. The mixed units should be abolished and, in most cases, be absorbed by the university they're physically based at; INSERM could simply send them grant money. To manage science well, the universities should have more flexibility, autonomy, and strategic direction, the report says. A lot of that jibes neatly with what the government is already trying to do, a spokesperson for Pécresse says. A law passed last year gives universities the option of cutting themselves loose from state control, and so far, 20 of them have done so. Last month, Pécresse also announced a package of measures—including financial bonuses—to make science careers more attractive, another urgent priority listed by the review panel. The central idea of consolidating the life sciences has been gaining currency for some time in France, says neurobiologist Alain Prochiantz of the école Normale Supérieure in Paris, who co-authored a petition in favor of a single institute earlier this year. A group currently studying the problem at the ministry's request is expected to deliver a report soon that insiders believe will include a proposal for a new umbrella directorate to coordinate INSERM and the life sciences within CNRS. But Zerhouni warns that would be “a cop-out” that could actually add a layer of unneeded complexity. “They really need to cut bureaucracy drastically,” he says. Still, says biologist Jules Hoffmann, president of the French Academy of Sciences, the directorate could be an intermediate structure that would “ideally, one day, melt everything together.” Radically altering INSERM would put the French government on a collision course with the unions, warns Françoise Cavaillé, an INSERM developmental biologist who's active in SNCS, a researchers' union. National institutes such as INSERM play an indispensable role as operators of research, she says. “We don't feel like falling into the Anglo-Saxon model” in which universities compete for project-based funding. Anger among the unions against the government was already on the rise. Sauvons la Recherche recently called on scientists to stop providing expert appraisals for the National Research Agency and the Agency for Evaluation of Research and Higher Education—two hotly contested innovations by the previous government—and demonstrations were planned in Paris and in Bordeaux for 27 November. The panel's plans would create a tangle of practical and legal problems as well. Dissolution of the mixed units could create messy divorce fights, and Zerhouni's proposal to raise the age at which scientists get tenure—now often between 30 and 35—might run afoul of French laws that put limits on temporary labor contracts. Still, says Zerhouni, France has little choice if it wants to stay competitive. He has been “very impressed” by the government's appetite for change; as to the unions' worries, he says: “I hope they realize this is pro-scientist. … I think people are tired of these complicated lives.” 3. ASTRONOMY # Giant Scope Heads Europe's Wish List 1. Daniel Clery European astronomers have asked policymakers to green-light a 42-meter-wide giant telescope that they promise will keep them at the forefront of world astronomy. The planned European Extremely Large Telescope (E-ELT) got top billing this week in an infrastructure road map for the field, alongside a global radio telescope called the Square Kilometer Array (SKA). Funding the ambitious plan would give Europe “a world lead in astronomy, as it has in particle physics,” says Martin Rees, the U.K.'s Astronomer Royal. That may be a tall order, however. Europe spends roughly €2 billion per year on astronomy and would have to boost that amount by 20% over the next decade to pay for all the listed projects. Commissioned by a group of European funding bodies called Astronet, the road map lists more than a dozen projects, both ground-and space-based, that Europe's astronomers would like to achieve in the next 10 to 20 years. The proposed detectors cover the whole electromagnetic spectrum, as well as particles from space and gravitational waves. European astronomy has always been fragmented. The European Southern Observatory (ESO) handles a number of large projects, whereas the European Space Agency (ESA) oversees most space missions. National agencies carry out many other efforts. In 2005, many of these funders formed Astronet and asked astronomers to identify their main scientific goals (Science, 5 October 2007, p. 35). Then they asked for a list of the tools needed to achieve them. “At the beginning, it looked almost impossible to do, because of the complexity of Europe,” says astrophysicist Michael Bode of Liverpool John Moores University in the U.K., who led the exercise. In contrast to the U.S. decadal surveys of astronomy and astrophysics, which rely heavily on “town meetings,” Astronet asked a number of subject panels and user groups to work up a draft road map. It was released online earlier this year and chewed over at a symposium in June. Some tensions emerged: Advocates for E-ELT and SKA were worried that Europe could not afford two billion-euro projects, both of which are now in the design phase. E-ELT's huge segmented mirror would give it 100 times the sensitivity of today's front-rank ground-based scopes; a decision on its construction could be made as early as 2010. Not as advanced in preparation, SKA would spread as many as 4000 radio dishes over thousands of kilometers in either Australia or South Africa (Science, 18 August 2006, p. 910). The Astronet road map lays out “a phased plan with a real hope of both succeeding,” says Bode. The road map also endorses a 4-meter solar telescope, a high-energy gamma-ray telescope array, and a neutrino telescope that uses a huge volume of Mediterranean seawater as its detector. In assessing space missions, the road map closely mirrors a list of proposals that had recently been through the selection mill of ESA's Cosmic Visions program. “We were heartened by that,” Bode says. Top priorities for large missions were a gravitational wave detector and an x-ray observatory. Also listed were Laplace and Tandem, proposed missions to the Jupiter and Saturn systems. Among medium-sized missions, ones to detect dark energy and study the sun stood out. Now that Europe's astronomers have spoken, the attention is shifting to the various funding agencies. “Discussions [on E-ELT] already started some time back,” says ESO Director General Tim de Zeeuw. “Our 14 member governments are actively engaged in finding ways to pay for it and build it.” 4. HUMAN GENETICS # Interest Rises in DNA Copy Number Variations--Along With Questions 1. Jennifer Couzin PHILADELPHIA, PENNSYLVANIA—Like a kaleidoscope, the human genome keeps offering up new views. The latest, causing excitement here last week at the annual meeting of the American Society of Human Genetics, concerns duplicated or missing blocks of DNA, known as copy number variations (CNVs). Large CNVs, millions of DNA bases in length, have been detected for some time, for example, in children with mental retardation. But as geneticists peer closer, they are finding CNVs everywhere, in every size, all across the genome (Science, 7 September 2007, p. 1315). “Many of us in the field were just blown away when we realized how often all of us have regions of the genome that are missing or present in extra copies,” says Jan Friedman of the University of British Columbia in Vancouver, Canada, who attended last week's meeting. “We just had no idea [the genome] was so plastic.” The study of CNVs, like any emerging field, is plagued by uncertainty. Often the technology used was not designed to detect CNVs, making results difficult to interpret. And it's not at all clear which CNVs alter the function of genes or influence disease. Last week, scientists at the meeting described links between CNVs and various cancers, schizophrenia, autism, body mass index, and Crohn's disease. But in nearly all these cases, questions remain as to whether CNVs are coincidentally present, are linked to another genetic disease driver, or are themselves causing ill health. Many research groups are now conducting broad sweeps of genomes in various species, and in healthy and sick people, to get a sense of CNV patterns. Alexandre Reymond of the University of Lausanne in Switzerland presented unpublished research describing a survey of CNVs in mouse genomes and six different mouse tissues, including the brain, liver, and heart. Reymond wanted to learn how often CNVs popped up in different mouse strains—including wild mice caught outdoors. He was curious as to whether CNVs affected gene expression and whether expression changed across tissues and during development. He found wide effects: Genes that fell within CNVs tended to be expressed at lower levels; CNVs influenced expression of genes nearby; and the expression of affected genes varied depending on where one looked in the body. Other CNV maps are being assembled at the Wellcome Trust Sanger Institute in Hinxton, U.K., and the Broad Institute in Cambridge, Massachusetts. Don Conrad and his colleagues at the Sanger Institute have their eyes on smaller common CNVs, as little as 500 base pairs in length. Checking about every 50 base pairs across parts of the genomes of people of African and European ancestry, they uncovered more than 10,000 CNVs—suggesting that other efforts, which have identified about 1500 common ones, are missing most CNVs. Although “there haven't been many” CNVs linked to disease yet, Conrad said in his talk, “there might be quite a few out there.” Indeed, he noted that 129 of the 419 genetic-association regions pinpointed in genome-wide association studies hunting for disease DNA contain a common CNV. The Wellcome Trust Case Control Consortium, which has scanned the genomes of thousands of people for variations in single DNA bases that might be associated with seven chronic diseases, is now performing a similar survey of copy number variation. They want to learn whether certain patterns of CNVs stand out in particular diseases. So far, they're not finding more CNVs in individuals with disease compared with those without but are finding that the CNVs in the genomes of those with, say, diabetes are not the same CNVs that show up in healthy people. The key variable with these CNVs is “kind of where they are rather than how many there are,” says Matthew Hurles of the Sanger Institute, who presented the unpublished research. In the Wellcome Trust work, as in many other CNV studies, quality control is a major challenge. Rare CNVs can trigger false positives, says Hurles, suggesting a connection to disease that isn't really there. In addition, it's easier to detect deleted DNA than it is DNA that has been duplicated, which may bias results. Although results are often murky, some solid work points to a role for CNVs in neuropsychiatric disease. Earlier this year, research published in The New England Journal of Medicine tied a deletion in chromosome 16 to cases of autism, and other work linked it to cases of developmental delay. But two recent papers on schizophrenia, published earlier this year in Science (25 April, p. 539) and Nature—some data from which were also presented last week—came up with very different results. One group reported that rare CNVs were three to four times more common across the genome in those with schizophrenia than those without; the other reported 1.15 times as many. “There must be some underlying truth that explains both,” says Steven McCarroll of the Broad Institute, who described his efforts to examine CNVs that might travel with DNA previously linked to disease. Technology may play a critical part, he says: “The smallest CNVs you might see on one platform but not on the other.” Despite such limitations, CNVs have become a popular target for disease gene studies. At last week's meeting, Rehab Abdel-Rahman of the University of Edinburgh in the U.K. described a CNV culled from more than 2200 cases of colorectal cancer. The CNV, which includes a gene that helps control the immune system, appeared in 14% of cancer cases but fewer than 4% of controls, she said. Other work linked CNVs to body mass index and to retinoblastoma that may be passed to children by their fathers. One critical question is whether these CNVs are inherited or spontaneous. The latter, many believe, are much more likely to drive disease but also much less common. Another question is whether CNVs show up in many cases of a disease or just a handful. “We're still really in a learning curve,” said Stephen Scherer, who studies autism genetics at Toronto's Hospital for Sick Children. Much of the work remains imprecise and very preliminary, but, he notes, “the data are getting much better.” 5. SCIENCE AND SOCIETY # Science Goes Hollywood: NAS Links With Entertainment Industry 1. Jon Cohen LOS ANGELES, CALIFORNIA— Near the end of the movie Titanic, actress Kate Winslet stands on a plank of wood and looks up at the night sky. “There was one sky Kate Winslet should be looking at,” astrophysicist Neil deGrasse Tyson said at an unusual gathering of 350 Hollywood moguls and prominent scientists who met here on 20 November to launch a new collaboration called the Science & Entertainment Exchange (SEE). “It was the wrong sky. I was pissed off.” Tyson, who heads the Hayden Planetarium at the American Museum of Natural History in New York City, said he met Titanic director James Cameron by chance and pointed out that the stars on the left side of the screen mirrored the stars on the right. “He said, 'The last time I checked, the film made$1 billion.'” Tyson says he replied, tongue in cheek, “Imagine how much more you could have made.”

Aligning the stars correctly may not have helped Titanic's bottom line, but Tyson's gripe does reflect a sense within the scientific community that movies and television too often botch the science—even when it would take little extra effort to get it right. With that in mind, the National Academy of Sciences (NAS) launched SEE, which it hopes will “be a service to all of Hollywood” by connecting scientific authorities to the people who produce, write, direct, and animate films and TV shows, explained NAS President Ralph Cicerone. The operation will consist of a “simple office” in Los Angeles to, as director Jerry Zucker put it, “bring our two best friends together who haven't met.”

Although Hollywood is not suddenly shopping for scripts that dramatize the world of science—which many here noted rarely provides a gripping narrative—Zucker (Airplane, Ghost) and his producer wife, Janet, saw that too much distance separated the two endeavors. The Zuckers became intimately involved with the scientific community when they helped push through a 2004 proposition that created the California Institute for Regenerative Medicine to pursue stem cell research with state funds. Then one of their employees introduced them to Cicerone, and together they dreamed up SEE. A key part of their plans for SEE, which they demonstrated here, is to hold salons that enable the entertainment community to learn about cutting-edge scientific advances and discuss them with the researchers at the front. For now, NAS is bankrolling SEE's first-year budget of $490,000 from its endowment, but NAS and the Zuckers are looking for other funders. SEE held its glitzy inaugural—replete with fluorescent Pyrex beakers as centerpieces on the lunch tables—at 2000 Avenue of the Stars, a high-rise in Century City with spectacular views across the city. The daylong gathering featured a short film by the Zuckers that spoofed the sometimes tense relationship between Hollywood and science, but they repeatedly urged the attendees not to waste time grousing about problems. Instead, they organized six interactive salons led by leading researchers in climate change, robotics, astronomy, genomics, neuroscience, and infectious diseases. “We're not here to complain about the way you depict scientists,” said Cicerone. “We want to establish a partnership. We think there really is a synergy. Certain aspects of both science and entertainment do overlap.” Jerry Zucker noted that both, for example, “are very creative fields with lots of personal passion,” and he joked that scientists “are just like you and me except they got perfect scores on their SATs.” The gathering brought together an eclectic who's who from two wildly different walks of life. In addition to Tyson, scientific speakers included Nobel Prize-winning physicist Steve Chu, J. Craig Venter of human genome fame, and neuroscientist V. S. Ramachandran. Hollywood attendees included cartoonist Seth MacFarlane (Family Guy), writer/producer Lawrence Kasdan (Big Chill, Raiders of the Lost Ark), and director/writer Kimberly Peirce (Boys Don't Cry). Valerie Plame Wilson, who became an accidental celebrity after the Bush Administration revealed that she worked in covert operations at the CIA, also chaired a session as a favor to the Zuckers, who are making a movie about her book, Fair Game. Reviews of the get-together were largely two thumbs up. “I'm very pleased to see them doing this,” said Kip Thorne, a theoretical physicist at the California Institute of Technology in Pasadena (who is working on a science-fiction movie, Interstellar, with Steven Spielberg). Kasdan said the day was “incredible,” noting that the strong turnout at the various salons shows that the entertainment industry wants deeper ties to science. Will SEE have what Hollywood calls legs? “I'm an experimental scientist,” said Venter. “This is an interesting experiment.” Venter did not mention that most experiments fail. And the entertainment community is no stranger to grand ideas that fizzle out. Then again, this is Hollywood, which is in the business of turning dreams into reality. And many scientists seem eager to help make that reality more real. 6. ECOLOGY # Canada's Experimental Lakes 1. Erik Stokstad In remote Ontario, a network of lakes is dedicated to bold ecological manipulations. Research there has helped explain algal blooms and acid rain. As the unique outdoor lab turns 40, some wonder whether it is past its prime. In remote Ontario, a network of lakes is dedicated to bold ecological manipulations. Research there has helped explain algal blooms and acid rain. As the unique outdoor lab turns 40, some wonder whether it is past its prime In 1966, fisheries scientist Waldo Johnson had a big idea. Algal blooms were plaguing Lake Erie, and the Canadian government had created the Freshwater Institute to study the problem. Johnson, as the new director, proposed to pollute several small lakes intentionally to figure out exactly what was going on. If researchers manipulated the entire lake ecosystem, he argued, they might be able to mimic what happens in nature and find some answers. The government agreed, setting aside dozens of remote lakes for research. The world-renowned facility that resulted, the Experimental Lakes Area (ELA), changed the face of freshwater ecology, ushering in an era of what researchers there call “extreme science.” Over the decades, ELA researchers and collaborators from around the world have conducted more than 50 massive experiments, including building dams and setting up fish farms. In a practice that would surely raise eyebrows elsewhere, they have dumped toxic metals, synthetic hormones, and other pollutants into pristine lakes. “Everyone has the same reaction: 'I can't believe they let you do that,'” says ELA's chief scientist Michael Paterson, a zoologist with Canada's Department of Fisheries and Oceans (DFO), which runs the facility. “We use these lakes the way medical researchers use white mice.” ELA was pivotal in fingering phosphorus from detergents as the culprit in algal blooms, and experiments in lakes there provided compelling evidence of the harm caused by acid rain. U.S. and Canadian environmental policies were forged in part on the strength of ELA's science. “It's hard to overstate the impact they've had,” says James Elser of Arizona State University (ASU), Tempe. Forty years later, ELA still hosts first-rate science, say many ecologists. With$13 million of infrastructure, finely characterized lakes, and decades of baseline data, the site can tackle problems few others can. All is not rosy, however. Researchers complain that government bureaucracy has long limited the lab's full potential, although this may change with a new arrangement for funding. Half of the staff scientists there are nearing retirement, and recruiting top talent can be a challenge. As ELA celebrates its 40th birthday, even some of the lab's old hands wonder aloud whether the place is due for some rejuvenation.

Young blood

In many ways, the stars were aligned when Johnson sketched out plans for the outdoor lab, which became useful for studying much more than eutrophication. In 1967, a pair of technicians was sent out to find an area with many lakes of various sizes, remote enough to be pristine yet within 300 kilometers of Winnipeg, where the Freshwater Institute was located. Flying by plane and helicopter, the technicians named hundreds of lakes, simply giving them sequential numbers. Eventually, 46 lakes in 17 small watersheds were selected.

The setting is ideal. The lakes and surrounding pine forests rest on granite bedrock, so there is little groundwater, which means the lake chemistry is relatively simple to study. And the diversity of the lakes' sizes and depths makes for an exceptionally versatile ecological lab.

## Slide Show: Canada's Experimental Lakes

Limnologist Jack Vallentyne, hired from Cornell University, was put in charge of assembling a crack team of scientists. He recruited respected experts from Japan, Poland, Italy, and other countries, as well as “hot, young blood,” as he called the younger members of the team. In his bid to persuade scientists to move to Winnipeg and endure long, cold winters, Vallentyne touted the opportunity to do whole-lake experiments on a scale unmatched anywhere else.

In what turned out to be a strategic move, Vallentyne put a young limnologist, David Schindler of Trent University in Peterborough, Canada, in charge. In the summer of 1968, Schindler set up a field camp with a few trailers and got to work. (Schindler is a member of Science's board of reviewing editors.)

ELA's original mission was to examine the problem of eutrophication. The pressing question in the late 1960s was which nutrient triggers excessive algal growth. Studies in small tanks done elsewhere had yielded conflicting data. Some scientists thought the culprit was phosphorus, principally in detergents and sewage; others thought it might be nitrogen from fertilizer and sewage, or carbon, or perhaps even trace metals.

In a now-famous experiment (Science, 24 May 1974, p. 897), the team divided Lake 226 with a plastic curtain and added phosphorus to one half. When it turned a distinctive murky green, they had their answer. It was an aerial photograph from this experiment that largely persuaded policymakers to phase out phosphorus from detergents. “I think that's the single most powerful image in the history of limnology,” Elser says. When Schindler took the results—and the photo—to government hearings in Canada and the United States, he put ELA on the map as a hub of innovative, policy-relevant research.

Next, Schindler tackled one of the most contentious issues of the day, acid rain. In a series of experiments conducted between 1976 and 1988, researchers added sulfuric and nitric acid, pollutants that lead to acid rain, to Lake 223 and others. The results showed that the pristine ecosystem began to suffer at significantly less acidic conditions than electric utilities maintained. They also demonstrated harm cascading through the food web, with plankton species disappearing and fish not reproducing—as had been seen in lakes already damaged by acid rain. One of the key contributions of ELA, points out ecologist Gene Likens of the Cary Institute of Ecosystem Studies in Millbrook, New York, was that it provided experimental evidence that helped convince skeptics of observational studies. Schindler and his colleagues were also able to perform experiments showing that lakes would slowly recover when the pH returned to normal.

Once again, Schindler made the rounds of government offices and congressional hearings in Canada and the United States with his data and images—this time starving trout whose prey had died and species that had vanished. Although ELA was by no means alone in studying acid rain, many say Schindler's ability to communicate science in simple, homespun terms—he appeared widely on television and in newspapers and magazines—helped spark stricter regulations on power plants. In 1990, the U.S. Congress passed major amendments to the Clean Air Act that helped reduce acid rain (Science, 6 November 1998, p. 1024).

They were heady times. The federal government and other funders were generous, and the researchers who flocked to the site each summer were essentially given free rein. True, there were a few rules, Schindler recalls. For example, once an experiment ended, the lake had to be restored to its original condition. Other than that, “in the early days, we could do pretty well what we pleased,” he says. The camaraderie was strong. “It was nirvana when I got there,” recalls John Rudd, who first arrived at ELA as a graduate student in 1972. Researchers worked full-time, brainstorming late into the night. “We lived our science together, week after week,” says Rudd.

Ecology's supercollider

But change was afoot. In 1979, the Fisheries Research Board, which had been run mostly by university scientists, was dissolved; the Freshwater Institute and ELA were transferred to DFO. The move put department officials, not scientists, in charge and eventually had a large impact on the direction of the research, says Schindler.

DFO's primary focus was on marine rather than freshwater issues, and ELA gradually lost its favored status. Raising funds for experiments became increasingly hard. “We'd always fall through the cracks,” Schindler recalls. Fed up, he left for the University of Alberta, Edmonton, in 1989.

Also at about that time, a few officials with the province of Ontario began to look askance at ELA's practice of dosing the lakes with one pollutant after another. One example in particular sticks in the craw of Robert Hecky, who took over as director after Schindler.

ELA scientists had been adding cadmium, a metal released from smelters and coal-fired power plants, to Lake 382 to see whether provincial regulations were tight enough to protect aquatic organisms. A few years after Schindler left, Ontario's then-minister of environment halted that work, forbidding ELA scientists from adding any more cadmium. “They threatened to shut down the whole ELA if we didn't stop,” recalls a still-outraged Hecky—despite the fact that power plants were emitting greater concentrations of cadmium on a regular basis. Hecky says he soon realized that plans to add polychlorinated biphenyls to the lakes weren't going to fly, either.

The nadir came in 1996, when the federal government tried to shut ELA during a round of belt-tightening. Hecky resigned in protest. Scientific societies such as the American Society of Limnology and Oceanography rushed to ELA's defense, and the lab was saved. ELA is secure now, assures Robert Lambe, DFO's regional director in charge of the Freshwater Institute. “It's not in the crosshairs.”

But the years have taken a toll, say scientists inside and outside ELA. Old-timers say that DFO grants are smaller and harder to come by now. “The federal money to conduct experiments has dried up,” Rudd says. A long-term experiment on flooding of wetlands may have to be shut down if funds to repair the dam can't be found.

The biggest impact has been the decline in staffing; the number of DFO scientists working full-time at ELA has fallen by about half since the early 1990s, to six today. Researchers from other institutions still flock to the lab with the spring thaw, although now it tends to be graduate students and technicians rather than professors who stay the whole summer, Rudd says.

In terms of technological prowess, ELA remains unmatched. Over the years, DFO replaced the dented trailers with comfortable dormitories and a first-rate laboratory. ELA is still “the supercollider of ecology,” says Schindler. In a recent experiment to gauge the impact of freshwater aquaculture, for instance, researchers had to build a 12-ton cage on the ice of Lake 375 in-30°C weather. Every spring, starting in 2003, the cage was stocked with 10,000 rainbow trout that had to be trucked in from nearly 1900 km away. There are not many places in the world with ELA's combination of experience setting up big infrastructure and onsite research capacity, as well as detailed background records and reference lakes, notes DFO's Cheryl Podemski, who ran the experiment.

Perhaps the most ambitious experiment of the past decade is METAALICUS (see sidebar, p. 1319), in which researchers added isotopes of mercury to Lake 658 and its watershed for 7 years in a row. The goal is to figure out how the pollutant moves through the ecosystem and builds up in fish. The final dose of mercury was added in 2007, and now team members are keeping tabs on water quality and aquatic life.

Next?

Other experiments at ELA have finished their active phase as well. In 2007, all the fish were removed from the aquaculture operation for the last time. Now researchers are watching to see how the lake returns to its natural state. That's also the case with ELA's endocrine disrupter study. Over 3 years, researchers added synthetic hormones to Lake 260 to study the effects of birth-control pills in wastewater. At hormone concentrations currently found in municipal wastewater, minnow populations crashed, they found, in the first ecosystem-scale study to show the impact of these pollutants on fish populations.

But now, for the first time in ELA's storied history, no major lake manipulations are on docket. Part of the reason no big manipulations are planned is that half of the staff scientists are about to retire, says Paterson, who is “terrified” of the looming brain drain. But he is heartened by a new alliance with Environment Canada that he hopes will bring new funds to ELA and enable scientists to broaden the scope of their research again.

One key issue ELA ought to be immersed in is climate change, Paterson concedes. In fact, Rudd and Schindler tried to sell the idea of studying climate change to DFO in the 1990s, but there was no interest, they say; DFO officials felt it wasn't within the department's mandate. “For the first time, there's a major widespread problem that's going on that we're not [studying] at ELA,” says Rudd, who retired in 2002 but continues to work on METAALICUS. ASU's Elser and others say ELA could have been more aggressive since then. “It helps to have senior leadership that can knock heads,” Elser says.

Schindler agrees that the lab needs an infusion of fresh blood, especially someone with a bold vision for ELA's future who will battle the bureaucracy for funds. Recruiting the best and brightest isn't easy, however; government salaries aren't competitive with those at top universities, and DFO can't even offer start-up funding to set up new labs. But with three positions that will need to be filled, Paterson will soon be sifting through resumés. With any luck, he might find another Schindler in the bunch—somebody who can set the course for the next 40 years.

7. ECOLOGY

# Contaminating a Lake to Save Others

Over the past 9 years, some 15 principal investigators from eight institutions have joined forces at a remote experimental station in Canada (see main text) to tease apart how mercury in air pollution cycles through the environment.

LAKE 658, CANADA—Even at the Experimental Lakes Area (ELA), the birthplace of “big” ecological experiments, METAALICUS is ambitious. Over the past 9 years, some 15 principal investigators (PIs) from eight institutions have joined forces at this remote experimental station (see main text) to tease apart how mercury in air pollution cycles through the environment. By adding stable isotopes to Lake 658 and the surrounding watershed, researchers are studying how mercury percolates through soil and into lakes, how microbes make it bioavailable, and the rates at which it accumulates in fish. Already, the $15 million project, formally known as the Mercury Experiment to Assess Atmospheric Loading in Canada and the United States (METAALICUS), has generated policy-relevant results. Several attributes made ELA an ideal location for METAALICUS, says one of its leaders, geochemist David Krabbenhoft of the U.S. Geological Survey in Middleton, Wisconsin. For one, the relatively low rates of background deposition to the lake made it easier to detect the tiny amounts of mercury isotopes—just 12.5 grams (a sixth of a teaspoon)—that they added each year. Even more important, the remote location and the history of successful research at ELA lowered the chance of public objections. Just in case, Canadian researchers held public briefings in Dryden and Kenora, the closest towns. METAALICUS was years in the planning. After a 3-year pilot project at ELA, the researchers first added isotopes in June 2001, trickling 202Hg throughout this 8.3-ha lake by boat. Depositing the other two isotopes—198Hg onto an adjoining wetland and 200Hg onto the surrounding forest—proved far more challenging. In a nail-biting maneuver, a crop-duster had to fly low overhead repeatedly, precisely spraying an extremely dilute mist of mercury. Had a droplet of either 198Hg or 200Hg drifted into the lake, it would have confounded the findings. Within 2 months, 202Hg was detected in fish. In a paper published in September 2007 in the Proceedings of the National Academy of Sciences, the team reported that mercury levels rose by a third in young yellow perch over the first 3 years of the experiment. This suggests that lowering industrial emissions of mercury should quickly reduce fish contamination in lakes where most of the mercury falls directly from the atmosphere to the water. The final doses of mercury were added to the ecosystem last year. Earlier this fall, a crew of technicians was busy looking for signs of isotopic mercury trickling through the forest soil. Monitoring will continue for several more years to figure out the rate at which the forest soils release mercury after it lands from the atmosphere. “It's slow, but we can't tell you whether it's 20, 100, 1000 years” for the isotopes to make their way into the lake, says biogeochemist Cindy Gilmour of the Smithsonian Environmental Research Center in Edgewater, Maryland, a co-PI on a new$570,000 U.S. National Science Foundation grant to explore the question. The work is crucial, Krabbenhoft notes, because it will provide insights into the impact that past mercury emissions will have on future fish generations.

METAALICUS is not only the largest experiment in ELA's history, but it is also the first that has moved beyond lake manipulation, ELA's original mandate, to manipulation of the surrounding terrestrial ecosystem as well. “Broadening the perspective beyond lakes adds a lot,” says Stephen Carpenter of the University of Wisconsin, Madison, and would be an effective way to maximize the scientific potential of ELA. “They need to think really, really big.”

# A Universe Past the Braking Point

1. Yudhijit Bhattacharjee

A decade after racing to tell the world about "dark energy," an acclaimed astrophysicist pushes to streamline the search for Type Ia supernovae--celestial milestones that may help explain space's ever-accelerating expansion.

A decade after racing to tell the world about “dark energy,” an acclaimed astrophysicist pushes to streamline the search for Type Ia supernovae—celestial milestones that may help explain space's ever-accelerating expansion

On the bookcase behind Adam Riess's desk sits a framed cover of Time honoring Edwin Hubble, the astronomer who discovered in 1929 that the universe is expanding. On an adjacent shelf lies a stack of Riess's lab notebooks, some of which—from Riess's research as a postdoc at the University of California, Berkeley—record a discovery as dramatic as Hubble's own. During the Christmas break of 1997-98, working feverishly on a silent campus where even the heat had been switched off, the 28-year-old Riess scribbled equations and calculations based on observations of distant, exploding stars: supernovae. His analysis showed that gravity was not slowing the expansion of the universe as theory predicted. Rather, a mysterious repulsive force—or dark energy—suffused through space seemed to be accelerating that expansion.

Riess feared at first that he had made a mistake. Even after he mustered the confidence to share his shocking results, his Ph.D. adviser and collaborator Robert Kirshner asked him to triple-check his findings. “In your heart you know this is wrong,” Kirshner e-mailed Riess in January 1998.

Convinced that he was right, Riess acted with hallmark urgency to publish a paper 9 months ahead of a rival team led by Saul Perlmutter of Lawrence Berkeley National Laboratory in California. Both teams have since shared credit for the discovery. In 2006, Riess, his teammate Brian Schmidt of the Australian National University in Canberra, and Perlmutter won the $1 million Shaw Prize in Astronomy. And last month, Riess won the so-called genius prize from the John D. and Catherine T. MacArthur Foundation, along with$500,000 over 5 years to spend as he pleases.

Now a professor at Johns Hopkins University in Baltimore, Maryland, Riess plans to spend part of his latest prize on a new way to search for Type Ia supernovae: exploding stars that researchers use as “standard candles” to measure astronomical distances. He hopes to equip telescopes with special filters that will eliminate the need to take spectra of supernova candidates, a process that can take up to an hour per supernova. “I like to think of them as 3D glasses for Type Ia supernovae,” he says of the filters. By enabling cosmologists to use telescope time more effectively and make better use of upcoming sky surveys, he says, the technique could accelerate the study of dark energy.

Some colleagues question the merit of the idea and say it exemplifies Riess's fondness for shortcuts. “I am not enthusiastic about it,” says Kirshner, who thinks false identifications will outweigh any timesaving benefit. But if Riess's plan succeeds, it could send him skating past the competition.

For Riess, that is a familiar place to be. Researchers who have followed his career credit his success to luck, mathematical skill, creativity, and foresight—blended with a healthy dose of aggression. “Adam excels at beating people to the punch,” says Andy Howell of Las Cumbres Observatory Global Telescope Network in California, who has co-authored papers with Riess even though he belongs to a rival team. “He isn't the most careful person in the world, but he is always first.”

Bright lights, big cosmos

Riess is short and has curly reddish hair. He looks younger than his 38 years and can appear boyish if you mentally subtract the goatee from his face. When talking, he often breaks into a grin. Riess's Ph.D. student, Dan Scolnic, describes him as a down-to-earth and good-humored guy who recently dispensed some brotherly advice on dealing with a breakup. (You don't really understand relationships till you're 25, Riess told him.)

Riess played a lot of soccer growing up in Warren, New Jersey, which he says may have fostered his competitive streak. His mother was a psychologist. His father was an aeronautical engineer who quit the profession to start a frozen seafood supply store and a New York-style delicatessen. “I washed dishes there,” says Riess. He likes to make the point that he was just an average kid. “I wasn't down in the basement laboratory.”

Nevertheless, Riess says he was “deeply intellectually curious” about everything, pestering adults with questions. “There's a bell curve of curiosity in children. Adam was at the far end,” says Riess's older sister, psychiatrist Gail Saltz. “Lots of boys bang their toys and break them. He was the kid who would bang it open to see how it worked.” At the age of 8, for example, Riess stuck the antennas of his remote-controlled toy car into a socket to learn about electricity. “All the lights in the house went off,” he recalls.

At school, Riess took a liking to history and science. “I remember looking at stars and my father telling me that the distances to some were so great that their light had taken millions of years to get to us,” he says. “We were seeing them the way they were millions of years ago, when dinosaurs roamed the planet. I was fascinated by this concept of cosmic time.”

He was just as fascinated with technology. In seventh grade, he learned to program a TRS-80, the clunky PC of that era, and during summer vacations he worked at RadioShack. “I was ahead of the curve, but Bill Gates I was not,” he says, with measured modesty.

After majoring in physics at the Massachusetts Institute of Technology in Cambridge, Riess enrolled at Harvard University and flirted with the idea of writing a thesis on the search for extraterrestrial intelligence. Instead, he joined Kirshner's lab and worked on measuring the expansion rate of the universe. Impressed by Riess's bent for math and statistics, Kirshner assigned him a problem that he felt was too mathematical for anybody else in the group: improving the measurement of distances across the universe from the brightness of Type Ia supernovae.

Type Ia supernovae are the brightest things in the universe. They begin when a burnt-out star—a white dwarf—in a binary system sucks up matter from its companion star. If the white dwarf grows to a mass known as the Chandrasekhar limit, it undergoes a thermonuclear fusion as powerful as 10 billion suns, visible billions of light-years away. Because in principle every Type Ia releases the same amount of energy, how bright they appear from Earth tells astronomers how distant they are.

Researchers learned in the early 1990s that each Type Ia actually burns a little differently, with a unique light curve representing the star's ascent to a dazzling peak and descent to darkness. Riess figured out these differences and developed a technique to characterize the light curve of an observed Type Ia, correcting for the dimming effect of dust clouds in front of it. The technique yielded more precise estimates of a supernova's distance. And that information, combined with its redshift—a change in frequency caused by the stretching of light waves across space—enabled researchers to measure the rate at which the universe was expanding when the supernova exploded.

For his postdoc, Riess joined the High-z Supernova Search Team at UC Berkeley. Led by Brian Schmidt, it had already analyzed a set of 22 nearby supernovae. Working under Alex Filippenko, Riess began analyzing observations from 12 distant supernovae and made his big discovery at the end of 1997. After overcoming his own doubts about it, Riess was frustrated by his team members' caution about publishing the finding. He knew that Perlmutter's team had more supernovae in its data set, and he pushed the others to seize the moment. “I realized that if they publish more data before we do, we wouldn't be adding very much,” Riess says. Schmidt says it was Riess's laserlike focus “that enabled the High-z team to get its paper out in a timely manner.”

Colleagues say the work highlighted Riess's strong preference for crunching numbers over making observations. “Adam doesn't have a very good tolerance for physical discomfort. He doesn't like being too hot or too cold. His idea of astronomy is to work at home on his laptop, in his slippers,” Kirshner says with a laugh. Riess agrees. “My biggest problem with observing is that I am not a night owl. When I am so sleepy, it's hard for me to make the best decisions. Did we get enough signal on this supernova? Should we move on to the next? There are people who are much better at that part than me. But I love the data!”

Harvesting stars

The 1998 paper made headlines around the world. As a follow-up, Riess decided to trace the history of dark energy. Nowadays, he reasoned, the universe is expanding because the outward push of dark energy more than balances the attractive force of gravity. At some point in the past, however, when the universe was smaller and its matter more densely packed, cosmic gravity must have outweighed dark energy, causing the universe to decelerate.

To test the idea, Riess needed a Type Ia supernova burning eons away—at a record-high redshift. By sheer serendipity, the Hubble Space Telescope had observed exactly such a star; by analyzing it, Riess and his colleagues proved in a 2002 paper that the cosmos had indeed slowed down during this early epoch. Then Riess used the telescope to find six more Type Ia supernovae from the young universe. A 2004 paper based on analysis of their light curves confirmed that the universe had decelerated for several billion years before beginning to accelerate.

Although 1000 or so Type Ia supernovae have been found, researchers need many more to better understand dark energy by quantifying the expansion history of the universe in greater detail. Riess's filter project, conceived in collaboration with Harvard astronomer Christopher Stubbs, is an attempt to leapfrog toward that goal. The filters are thick glass disks the diameter of a pancake, each designed for a different redshift. Objects seen through them with the naked eye appear dark and reddish. When he tried them on the Magellan optical telescope this summer, Riess says, the filters made Type Ia supernovae look 30% brighter or dimmer, depending on their redshift. It's a very creative idea with a potentially high payoff, says Filippenko.

Critics, however, doubt that Riess's filters will shortcut the need for observations. Astronomers have used similar filters to spot distant galaxies. But supernovae are another story, says Howell. Any filter capable of spotting their distinctive absorption and emission lines would have to let in such a broad band of wavelengths that the signal would be hard to separate from the sky's background noise. “It takes a fairly detailed spectrum to determine the type of a supernova convincingly,” says Howell. “So unless he gets spectra for all of his targets,” there will be errors.

Riess acknowledges that he needs many more supernovae to test the idea. If it works, he plans to implement it during the ground-based Panoramic Survey Telescope and Rapid Response System (Pan-STARRS) sky survey to be conducted from atop Mauna Kea in Hawaii.

Riess isn't worried that the discovery of dark energy would be the capstone of his career. “I can imagine that there would be some discoveries after which everything seems boring to work on,” he says. “But this one really seems like the tip of an iceberg.” One hopes for Riess that the peak of his career's brightness curve lies ahead.

9. CRYPTOGRAPHY

# University Hackers Test the Right to Expose Security Concerns

When students in the Netherlands picked apart the world's most common smart card system, were they torpedoing its manufacturer or protecting the public's right to know?

When students in the Netherlands picked apart the world's most common smart card system, were they torpedoing its manufacturer or protecting the public's right to know?

NIJMEGEN, THE NETHERLANDS—In winter 2006, Roel Verdult was looking for a project for his master's thesis in computer science here at Radboud University Nijmegen. Flavio Garcia, then a doctoral student, laid down an unusual challenge. “He said, 'Well, for a goal, let's start with free parking,'” Verdult recalls. Garcia wanted Verdult to intercept and commandeer the communications between a gate controller at a parking lot and the “radio-frequency identification” (RFID) cards people wave in front of it to activate it.

Thus began an adventure that in March would lead Verdult, Garcia, and colleagues in Radboud's software security and correctness program to crack the secret messages exchanged in the world's most widely used RFID system, the MIFARE Classic. The card system opens parking gates, but it also tallies fares in the London Underground, the Netherlands' OV-Chipkaart transit system, and dozens of other transportation systems around the world. It also controls access to military bases, nuclear power plants, and myriad other buildings, the researchers say.

The team's “hack” would bring the Dutch secret service to the Radboud lab, force the country to consider replacing more than 600,000 transit fare cards, and prompt a lawsuit from the system's manufacturer, NXP Semiconductors, which sought to suppress the researchers' work. The episode has thrown a spotlight on the tension between an academic's desire to publish and the potential damage that could result. In this case, a judge ruled that the Radboud group had a right to publish their findings, as they did last month.

The company is not happy: “Broadly publishing detailed information … is, in our understanding, not responsible disclosure of sensitive information,” says NXP spokesperson Alexander Tarzi. Garcia counters that, with a billion MIFARE Classic cards in circulation, the public should know they do not provide real security: “I believe the world is better off with this information out there.”

A peek inside

If a hacker is supposed to be a geeky loner holed up in his cluttered bedroom, the Radboud guys don't fit the stereotype. Garcia, 30, drives a 2001 Alfa Romeo GTV sports car, used to race motocross, and says he enjoys the nightlife. Verdult, 26, practices karate and has a vicelike handshake and an easy smile. But both have been fiddling with computers since they were children. Growing up in Argentina, Garcia started programming simple video games at age 7. As an undergraduate intern at a software company, Verdult figured out how to run the company's software on computers lacking a special license chip—and alerted his boss.

To tackle the MIFARE Classic system, Verdult and Garcia built a €40 gadget to listen to the conversations between its RFID cards and readers. They joined forces with master's student Gerhard de Koning Gans, who built a similar device that talked to a reader as well. “Security evaluations are an intrinsic part of this field,” says Bart Jacobs, director of Radboud's software security and correctness program. “We regularly ask our students to do them.”

The Radboud team had to figure out how the MIFARE Classic reader and card scramble their messages. The messages are binary numbers—strings of 0s and 1s—that spell out commands, such as “Deduct €1.60 from the amount recorded on the card.” As in many cryptographic schemes, the messages are scrambled using another sequence of 0s and 1s called a “key stream.” In a conversation, each bit of each message is combined with a bit of the key stream through an “exclusive or” (XOR), a maneuver just like adding the two bits, except that the sum of 1 and 1 is set to zero. (If a command is 1100 and the key stream 0101, the XOR-scrambled message is 1001.)

Ideally, the key stream should be random, but being a machine, a MIFARE Classic reader cannot generate a truly random string of 0s and 1s. Instead, it relies on a complex but predictable recipe. (The card has the same system, which it synchronizes to the reader's.) The challenge was to figure out this secret recipe. If they could do that, the researchers could calculate the key stream to decipher any conversation or even send commands to rewrite or clone cards.

The Radboud students weren't the only ones prying into the system. Karsten Nöhl, a grad student at the University of Virginia, Charlottesville, and Henryk Plötz, a grad student at Humboldt University in Berlin, literally hacked open chips from MIFARE Classic readers and cards to see the wiring inside, as they reported at the Chaos Communication Congress in Berlin in December 2007.

At the system's heart lay a digital circuit called a linear feedback shift register (LFSR). It takes 48 0s and 1s jumbled in a row and, with each tick of the chip's clock, shifts them all one space to the left, spitting out the leftmost bit and using a feedback circuit to inject a 0 or 1 into the empty spot at the right (see diagram). A hugely long string of seemingly random bits emerges from the LFSR's left end. That output is too predictable to make a key stream, however. So, in the MIFARE Classic, certain bits of the LFSR feed into a filter function—which Nöhl and Plötz didn't reveal—for more scrambling. With each clock tick, the filter uses the current settings of those bits to calculate one bit of key stream.

Nöhl and Plötz showed parts of how the system works. But knowing how a thing works doesn't guarantee you can break into it, says Wouter Teepe, a postdoc at Radboud. “I can take apart the lock in my door to see how it works,” he says. “But even if my neighbor has the same [type of] lock, knowing how it works doesn't mean I can get into his house” without the key.

De Koning Gans and Verdult quickly found oddities in this exchange of hellos. Every time the reader was switched off and on again, it issued the same challenge nonce. For certain combinations of a card's ID and nonce, even the scrambling of the reader's nonce remained the same. That suggested that the ID number and nonce, XORed together, fed into the LFSR, marching in from the right like jurors into a box, presumably to scramble things even more.

Oddly, instead of 32-bit IDs and nonces, the reader would also accept ones 48 bits long. That flaw meant that researchers could set all the bits in the LFSR. It also meant that they could feel out the filter function by changing the bits one by one while keeping everything else the same. “Basically, we could choose the input of the filter function and also tell what comes out,” says Peter van Rossum, an assistant professor at Radboud. “If you stare at it long enough, you can figure out what [the function] is.”

Knowing the filter, the researchers needed only the initial 48-bit setting of the LFSR—the key—to calculating the appropriate key stream. Verdult found that if a card didn't reply to a reader's challenge, then the reader sent a 32-bit “halt” command, but it would scramble it. That was a blunder because hackers could strip out the easily guessed message to get the 32-bit stretch of key stream that scrambles it. The team found a way to snare 32 more bits as well.

In principle, the Radboud hackers were done. If they fed a reader a valid ID and any old nonce, it would reveal 64 bits of key stream. From those bits they could work backward to find the 48-bit key and then generate the entire key stream. In practice, that calculation would take months. Then Ronny Wichers Schreur, a 42-year-old doctoral student at Radboud, noticed that only every other bit of the LFSR feeds into the filter function. That meant the odd and even bits of the key stream could be treated separately, slicing one huge problem into two far smaller ones that could be solved within a second.

To prove the system had been broken, three members of the team went to London to take a free subway ride. Using de Koning Gans's device, they sensed the ID number of an Oyster Card and fed it into a turnstile to get the card's key. Back in their hotel room, they loaded the key into a reader they'd bought for a few hundred euros and then recharged the card at will. At Radboud, they filmed themselves using a similar approach to clone a passerby's building-access card.

An unscrambled “Halt!” message

Group-leader Jacobs knew that cracking the system was “immediately a matter of national security.” On Friday, 7 March, he told university officials, who immediately informed the Dutch government. The next day, two agents from AIVD, the Dutch secret service, showed up. On Sunday, the researchers alerted NXP. They planned to keep quiet until they could publish, giving NXP time to address the problem. But on 12 March, the Netherlands' Minister of the Interior, Guusje ter Horst, announced that the system had been compromised. In a press conference that day, the researchers promised not to divulge the hack's details until autumn.

NXP wanted them hushed for far longer. In June, it sued to stop publication, arguing that it would violate the company's copyrights and damage the company and its clients. The university had to fight back, says Roelof de Wijkerslooth de Weerdesteyn, president of the executive board of Radboud: “It is the responsibility of scientists to go for the truth and to publish the truth.”

The Dutch court agreed. On 18 July in the district court of Arnhem, Judge R.J.B. Boonekamp found that NXP couldn't claim copyright to a design it had kept secret and that the company hadn't shown that publication would cause enough damage to warrant limiting the scientists' freedom of expression.

On 6 October, at the European Symposium on Research in Computer Security in Málaga, Spain, Garcia presented the team's work, delivering a paper rich in conceptual detail but short on how-to pointers for hackers. Nevertheless, by month's end, anonymous hackers had posted on the Web a computer program for attacking MIFARE Classic readers.

Bruce Schneier, a security technologist in Minneapolis, Minnesota, says that NXP created its own problems by ignoring a key principle of cryptography: Good systems use designs that are so hard to crack that the details can be made public. “Only very bad systems rely on secrecy,” Schneier says. NXP has apparently taken that lesson begrudgingly to heart: While continuing to market the MIFARE Classic, it has introduced a new RFID card system that uses a public design.