In the days after Sept. 11, 2001, a handful of anonymous letters laced with white powder spread new terror through a nation still reeling from the hijackers’ attacks. The powder was deadly anthrax; the letters had scribblings of Islamic extremist rhetoric. Five people died, and 17 others were sickened or injured.

In this atmosphere of dread, policies quickly emerged with profound and lasting import for our national security.

The mailings helped spur swift passage of the Patriot Act, which gave the government broad new powers to eavesdrop and spy on citizens. Congress and the Bush administration also agreed to a major expansion of laboratories equipped to cultivate, store and study microorganisms that could be used in biological terrorism.

More than 11,000 scientists are being hired to staff no fewer than 17 major and many more smaller labs across the nation, administered by federal agencies and at least a dozen universities. Billions of federal dollars are funding research on new vaccines and antibiotics that might protect us from anthrax, plague, tularemia, Ebola and other frightening germs. The benefits, if any, are years away. But the risks of these new “biocontainment” labs are serious and present now.

The country is owed a thorough review of the decision to launch the labs, informed by long-overlooked lessons from the anthrax attacks. After examining thousands of pages of documents related to the FBI-led investigation of the case and conducting hundreds of interviews for a book about it, I found that the most apparent threat of biological attack looms within our own labs.

Indeed, the evidence from the mailings case points convincingly to an insider, a once-trusted, now-deceased Army microbiologist, Bruce Ivins.

I have been struck by the unwillingness of those responsible for the boom in biodefense research to address Ivins’s role and to publicly acknowledge the risks inherent in the labs’ proliferation. The vetting of scientists who are and will be handling anthrax and other deadly pathogens continues to fall far short of the strict controls for specialists who work in the Army’s nuclear or chemical warfare programs.

As Einstein warned, we can’t solve problems with the same thinking we used when we created them. Our system for securing biodefense facilities has already failed. Rather than fix it, we have multiplied opportunities for breaches.

It is telling that the system failed dramatically within America’s crown jewel of biodefense research, USAMRIID, the U.S. Army Medical Research Institute of Infectious Diseases, at Fort Detrick, Md., where Ivins was a civilian employee from December 1980 until his suicide in July 2008.

One need not be convinced of Ivins’s guilt to realize he should not have been allowed anywhere near the Army’s anthrax, let alone given unrestricted, 24/7 access to live spores for nearly 28 years.

Until he took his own life while waiting to be indicted for the attacks, Ivins for decades carried out secretive, anonymous schemes to punish those who offended him. He twice burglarized sorority houses, part of a vendetta he began as a college student when a member of that sorority turned him down for a date. He stole a colleague’s lab notebook, jeopardizing her chance to complete her doctorate, and taunted her with an unsigned note, telling her where she could find it: in a U.S. mailbox.

In 1987, Ivins filled out a routine Army medical form on which he placed question marks next to these items regarding his mental history: “Memory Change,” “Trouble with Decisions,” “Hallucinations,” “Improbable Beliefs” and “Anxiety.” One year before the anthrax attacks, he said he was beset by “paranoid, delusional thoughts.” He described his impulses to do harm.

And he told his therapists twice, most recently in July 2000, that he had plotted to murder two women whose attentions he craved, including a recently departed lab technician. For well over a year before the fall of 2001, he was treated with antidepressants and the antipsychotic drug Zyprexa.

It was no secret at USAMRIID that Ivins was receiving psychiatric treatment. Still, neither his supervisors nor any other officials acted on the warning signs. As an Army major wrote in September 2008 in response to my request for records under the Freedom of Information Act, “Dr. Ivins was never evaluated by USAMRIID for mental fitness.”

A panel of behavioral analysts later concluded that Army officials had ample information to reject Ivins as a job applicant and, failing that, bar him from working with anthrax. The panel found that the anthrax attacks “could have been anticipated — and prevented.’’

Instead, any concerns at USAMRIID about Ivins’s state of mind were trumped by deference to his privacy and his status as a respected senior scientist.

That is a breakdown of supervision sadly similar to the Army’s failure to intervene when Army psychiatrist Nidal Hasan displayed jarring instability, long before he allegedly went on a shooting rampage at Fort Hood, Tex., in 2009.

Some retired Army officials I interviewed are appalled at the laxity in vetting those who handle anthrax and other deadly pathogens. If Ivins had worked within the Army’s nuclear or chemical warfare programs, they note, his use of antidepressants or antipsychotic drugs alone would have caused his suspension from sensitive duties.

But many Army officials remained in a state of denial. An internal review in September 2008 found that the “biosurety” program at USAMRIID had worked and no danger signs had been missed. This absurd conclusion undermines the Army’s credibility.

It also reflects an us-against-them mind-set that pervades the biodefense research community. If Ivins is seen as the perpetrator, the thinking goes, USAMRIID will lose trust and might even be shuttered. If USAMRIID is vulnerable to the budget ax, could my lab be next? Colleagues of Ivins who believe he was the perpetrator of the anthrax attacks told me they have stayed silent for fear of professional repercussions, including loss of their jobs.

Some of Ivins’s supervisors argue that he was innocent, and they have been successful in thwarting new restrictions. One of the ideas rejected by the National Science Advisory Board for Biosecurity was to require that at least two researchers always be present for lab work with anthrax or other lethal pathogens. That would have made it hard for Ivins to put in his string of solitary late nights in the lab before the anthrax mailings. The advisory board also turned aside a requirement for standardized psychological evaluations for lab personnel.

At Fort Detrick, the two-person rule is not utilized. The most conspicuous reaction there has been to build sprawling new complexes operated by the National Institute of Allergy and Infectious Diseases and the Department of Homeland Security.

Officials from the biocontainment labs told me that tighter controls and mandatory screenings would drive up operating costs and repel qualified scientists. Every lab manager I met also acknowledged privately his concern about the difficulty of detecting a skillful insider bent on disseminating a lethal biological agent. A rogue scientist could slip a test tube under a cuff or into a pocket undetected by video cameras, or evade psychological screenings. And if a lab worker knew he might lose his job at the first hint of instability, would he seek treatment for anxiety or depression?

To work in a biodefense lab is neither a universal right nor a matter of academic freedom. It is a privilege. Reasonable protective measures based on the evidence, not wishful thinking, must be implemented to prevent a future attack from within.

After the anthrax breach, Congress and the White House cannot let the Army simply say, “Trust us.’’

David Willman is a Pulitzer Prize-winning investigative reporter and the author of “The Mirage Man: Bruce Ivins, the Anthrax Attacks, and America’s Rush to War.”

Read more from Outlook, friend us on Facebook, and follow us on Twitter.