The FBI used flawed scientific methods to investigate the 2001 anthrax attacks that killed five people and sickened 17 others, federal auditors said Friday in a report sure to fuel skepticism over the FBI’s conclusion that Army biodefense researcher Bruce Ivins was the sole perpetrator.

The 77-page report from the Government Accountability Office says the FBI’s research, including novel microbial forensic tests, did not provide a full understanding of how bacteria change in their natural environment and in a laboratory. This failure to grasp the reason for genetic mutations that were used to differentiate between samples of anthrax bacteria was a “key scientific gap” in the investigation, the report says.

The GAO also found a lack of rigorous controls over sampling procedures and a failure to cite the degree of uncertainty in measurement tools used to identify genetic markers. “Although the complexity and novelty of the scientific methods at the time of the FBI’s investigation made it challenging for the FBI to adequately address all these problems, the agency could have improved its approach,” the report said.

The GAO didn’t take a position whether Ivins, who worked at Fort Detrick in Frederick, Md., made and mailed the envelopes that contained anthrax.

This is the second government report to find fault with the FBI’s methods. The National Research Council said in 2011 that federal investigators overstated the scientific case against Ivins but that the evidence was consistent with the FBI’s conclusions.

Ivins died in July 2008 of an apparently intentional Tylenol overdose as the Justice Department prepared to indict him.