On October 2, the World Health Organization (WHO) learned from media reports that a 28-year-old employee of the Irkutsk Anti-Plague Research Institute, Darya Shipilova, had died after being hospitalized with severe pneumonia. WHO wrote to Russian health authorities the next day. Moscow's answer, on October 6, failed to identify what had killed her. The formal outbreak notice WHO published on October 10 recorded that the organization still didn't have a confirmed diagnosis for Shipilova.
WHO's request was made under the International Health Regulations (IHR) [PDF], the international framework that Russia has agreed to follow as a WHO member. The Irkutsk incident highlights a weakness of these regulations: they cannot hold countries accountable for lacking transparency around potentially harmful disease events. If what happened in Irkutsk was a containment failure, no international instrument obliges Russia to say so. There is no harmonized certification scheme for high-containment laboratories, no global registry of where they are, and no mandatory international reporting of laboratory-acquired infections—making it unclear how often they happen.
International instruments that could have been used to press Russia for information have been critically weakened
Russia's incentives point one way: to say as little as possible. If there were a containment breach, admitting it could make Russia look guilty of the very "biolab" story—that Ukraine was developing biological weapons—that it has spent four years falsely pinning on Ukraine. The reflex long predates Putin, and nothing in the current system has given it a reason to change.
Jennifer Nuzzo of Brown's Pandemic Center has drawn the right lesson from this incident, which is that a capable WHO and sustained scientific engagement abroad are the only instruments that work on a state well practiced in obfuscation. However, international instruments that could have been used to press Russia for information have been critically weakened. The United States, historically WHO's largest funder, completed its withdrawal in January 2026. WHO, bracing for the loss, cut its planned 2026–27 budget by a fifth, collapsed 76 headquarters departments into 34, and began shedding staff—the kind who field verification requests and run risk assessments that could have been used for clarity in Irkutsk. The scientific channel into Russia was also cut from the Russian side. Paul Keim of Northern Arizona University, who calls the Irkutsk institute's director a friend, says that U.S. ties to Russian science fell apart after the invasion of Ukraine.
A History of Opaque Reporting
The body that would have run the assessment under IHR is Rospotrebnadzor, a federal service that answers directly to the government instead of to the Ministry of Health. The agency's mandate is unusually broad. It writes and enforces the country's health and safety codes, inspects everything from restaurant kitchens to border crossings, fields consumer complaints about shoddy goods, and runs disease surveillance nationwide. It's Russia's National IHR Focal Point under Article 4, the channel through which all official communication with WHO flows.
Rospotrebnadzor also owns and operates a far-flung antiplague network: five research institutes and 12 stations, one of them at Kyzyl in Tuva, the Siberian republic that supplied some of the strains Shipilova worked with. Those strains come from the wild. The plague bacterium lives in rodents across the Eurasian steppe, in ground squirrels on the Caspian lowlands and marmots across Siberia and Central Asia. The tsars began building laboratories and border outposts [PDF] to watch those reservoirs in 1897, three years after the plague bacillus was first identified there. The Soviets expanded the network to six institutes and some 80 stations. The Irkutsk institute was established in 1934. When the Soviet Union broke up, Russia kept five of the six research facilities.
Rospotrebnadzor has little international oversight: the agency that owns the antiplague laboratory also investigated the pneumonia death and reported the result to Geneva. Structurally, that arrangement is not unusual. In Britain, the body that speaks to WHO is the UK Health Security Agency, which also runs the country's high-containment laboratories at Porton Down. In the United States, it was the Department of Health and Human Services, parent of the Centers for Disease Control and Prevention (CDC) and its laboratories—at least until the Trump administration's withdrawal from WHO took effect in January 2026. In most countries, reasonably enough, the first people to investigate a laboratory accident work for the agency that owns the laboratory. The difference in Russia is who is able to investigate next.
When a CDC lab mishandled anthrax in 2014, Department of Agriculture inspectors were on site within 10 days of the discovery, issued a cease-and-desist order that only their own reinspection could lift, and testified alongside the CDC director [PDF] before a House subcommittee. On paper, Rospotrebnadzor's response was similar. By the agency's own account to WHO, "five Rospotrebnadzor organizations, including three research institutions," carried out the investigation, ran more than 5,500 tests, and convened two supposedly independent inquiries. But Russia has not named those independent bodies, and the inquiries' findings remain unavailable to the public.
The Irkutsk answers are familiar to Russia experts: no plague registered, and no high-threat pathogen detected. The pneumonia was listed as of "undetermined etiology." Russia communicated its COVID-19 statistics the same way. In spring 2020, deaths in the republic of Dagestan were being recorded as deaths with the coronavirus instead of from it—a choice that shrank the count without technically falsifying any number. The republic's health minister said at least 40 doctors alone had died of the virus, at a time when Moscow's tally showed 27 deaths total for all of Dagestan. By late 2021, the double bookkeeping had gone national. On October 29, 2021, the government's coronavirus task force reported 24,031 COVID deaths for September—and hours later Rosstat, the state statistical agency, reported at least 44,265.
None of this started with COVID. In 1979, an anthrax outbreak in Sverdlovsk killed at least 64 people. For 13 years the official story was that tainted meat had caused the deaths, until glasnost-era president Boris Yeltsin admitted that the military had been behind it.
Russia has reported other incidents more quickly. In 2004, a scientist at Vector, the Rospotrebnadzor virology center outside Novosibirsk, pricked herself with an Ebola-contaminated needle and died two weeks later. The world learned of it from a Russian news agency three days after her death, and WHO—by the New York Times's account, which Vector disputed—only that same week. When a thawed reindeer carcass set off anthrax [PDF] on the Yamal peninsula in 2016, and when a boy in Altai caught bubonic plague from a marmot that same summer, both were reported promptly. Those two cases were natural occurrences, not potentially embarrassing lab accidents.
Holding Russia Accountable
When Russia neglected to volunteer details about the lab incident, the WHO approached the country "in accordance with Articles 9 and 10″—the provisions that let the agency act on outside reports and oblige a state to verify them on request—and asked for further information "in accordance with Article 6," which requires a state to notify WHO unprompted.
Under international law, whether Russia broke any rule by not notifying WHO depends on an assessment that Russia should have conducted under the IHR. The IHR's Annex 2 [PDF] sets out a decision instrument—included as a one-page flowchart—that a state is required to run within 48 hours [PDF] for any event involving pneumonic plague, or for any potentially international event of unknown cause. The flowchart weighs four criteria (seriousness, unusualness, risk of international spread, risk of travel or trade restrictions), and any two of them oblige a country to notify the WHO within 24 hours of that assessment.
Nobody outside that country sees the flowchart answers unless a notification is made. Russia did not confirm whether it followed this process, let alone what it found. The IHR's verification provisions—WHO's power to take a rumor seriously and oblige a state to respond to it within 24 hours—were written after Beijing spent months hiding SARS in 2003.
The one escalation available to WHO, Article 10(4) [PDF], says WHO should share what it knows with other states parties if a state refuses its offer of collaboration and the risk warrants it. That's not much of a lever, but WHO has pulled it at least once. When Tanzania refused to share Ebola test results in 2019, WHO published a notice saying so and told other governments what it made of the risk. In this case, WHO has offered Russia support, but Russia hasn't said whether it accepted, and WHO hasn't said whether the country asked. Instead of escalating, WHO settled for reminding "all States Parties," in the advice section of its notice, to apply the Annex 2 instrument.
Inside Russia, officials have wrapped up the story. On October 8, the governor of Irkutsk Oblast declared the regional investigation complete and the pneumonia to be community-acquired three days after he had called its cause undetermined, and with no new laboratory result in between. The new label is a convenient one. It requires no pathogen and no lab result, and by definition it locates the infection outside the laboratory. Russia made heavy use of the same category throughout 2020, when untested COVID cases were recorded as community-acquired pneumonia by the thousands. "It was a test," the governor said, "but we passed it with dignity." The Kremlin, asked about reports of a second affected employee, waved off most of the media coverage as false information and directed the public to Rospotrebnadzor.
Sharing knowledge with other countries under Article 10(4) does not firmly hold countries accountable, but it is a start. Tanzania continued not to share official data, and paid nothing for it. Under the current IHR, a state may skip notification, answer late and incompletely, reclassify a death without new evidence, brush aside independent reporting as fabrication, and experience no consequences. No treaty will change that, but the United States still can—by restoring the funding and the laboratory partnerships [PDF] that give WHO and Russia's neighbors more visibility into situations where Russia is evasive.
