At the start of the exercise, known as Dark Winter, the group heard that patients had turned up at hospitals in Oklahoma, Pennsylvania and Georgia, complaining of aches and fevers and exhibiting unusual rashes. Each patient had visited one of three shopping centers, and lab tests confirmed that they didn’t have flu or measles. They had all contracted smallpox, an ancient scourge that killed more people than war did during the 20th century but hadn’t been seen since 1977. The mock cabinet mobilized emergency workers and deployed what was left of the nation’s old vaccine stock. Yet the disease spread to 25 states and 10 foreign countries during the exercise, and epidemiologists projected 3 million cases and a million deaths within 90 days. “We all left the room humbled by what we did not know and could not do,” Hamburg recalled last week, “and convinced of the urgent need to better prepare our nation against this gruesome threat.”

Compared with a smallpox pandemic, the current anthrax scare hardly qualifies as news. But the recent spate of contaminated mail will be remembered less for the pain it caused than for the message it sent. Like the now quaint explosion that shook the World Trade Center in 1993, this fall’s anthrax attacks have turned a distant fear into a fact of life. Bioterror is no longer a hypothetical hazard but a real one, as dangerous as nuclear war. And as experts have long warned, our defenses are not what they might be.

Where do the biggest threats lie? Almost any pathogen could be put to malicious use, but the government’s official A list includes a half-dozen agents that could quickly infect large numbers of people, causing high mortality and widespread panic. Variola (smallpox) and Bacillus anthracis (anthrax) top the list, followed by the bacteria that cause plague, botulism and tularemia and the viruses for hemorrhagic fevers such as Ebola. Unlike bombs or chemicals, these agents can be spread invisibly through the air. Attacks may go unnoticed for days or weeks as infections incubate. Treatment may be futile by the time symptoms appear.

Most of these diseases can be treated in their earliest stages. But only an extremely vigilant doctor thinks of plague or anthrax while examining a middle-class Manhattanite. In a large-scale attack–one involving, say, three tablespoons of aerosolized smallpox virus in a mall or airport–caring for patients would pose a second challenge. Most U.S. hospitals work so close to capacity that the onset of flu season can swamp their emergency rooms. But federal agencies can intervene massively when the situation warrants, flying in the personnel, equipment and supplies to treat more than 5,000 people at a time. And the Bush administration has just announced plans to expand its antibiotics stockpile enough to treat 12 million people at once.

Antibiotics alone won’t save us from bioterror. Pulmonary anthrax is usually untreatable by the time it’s recognized, and there is no pharmaceutical treatment for smallpox. Vaccines exist for both. The catch is that both are in short supply, and neither is ideal for routine use. The anthrax vaccine–a series of six shots, followed by annual boosters–was approved in 1970 for soldiers, scientists, veterinarians and millworkers. The vaccine has not been tested in children, however, and the sole manufacturer suspend-ed production last year after its facilities failed several FDA inspections. The company–BioPort Corp. of Lansing, Mich.–expects to resume production in November. But no one is suggesting that all Americans line up for the vaccine. Anthrax is still too rare to warrant the effort.

Smallpox is not just rare but technically extinct. Health workers eradicated it during the 1970s with a vaccine called Dryvax. Then they retired Dryvax, a compound made in live cows, to spare people the rare but sometimes fatal complications. The logic was impeccable–no smallpox, no vaccine–but there was a hitch: the Soviet military was secretly working to cultivate variola as a weapon. Officially, there are only two samples of variola left on earth–one in Russia, one in the United States–but few experts doubt that when the Soviet empire dissolved in the early ’90s, samples found their way into the hands of potential terrorists. Where does that leave us today? Americans vaccinated before 1980 may still have some immunity, but those born after 1972 are about as well shielded as the people who greeted Cortes when he reached the New World in 1519.

Federal officials are rightly worried. The CDC has enough old Dryvax in storage to inoculate 7 million to 10 million people during an emergency, but a Dark Winter outbreak could require many times that amount. Researchers at St. Louis University are now testing Dryvax in different concentrations to see how healthy volunteers respond. If the watered-down vaccine provokes an adequate immune response, scientists may be able to dilute the whole stockpile, turning 7 million doses into 70 million or even 700 million. For good measure, the government is also working with private companies to produce a new smallpox vaccine–one grown in sterile test tubes instead of live calves–in the quantities needed to treat the whole population. The CDC launched the initiative last year, hoping for results by 2004. Last week Health and Human Services Secretary Tommy Thompson said he was expanding that effort and now expected to complete it in 2002.

Success won’t end this new arms race. Just as biotechnology has revolutionized drug and vaccine research, it has opened the door to countless forms of evil. Before the Soviet Union fell, its weapons makers were working on designer viruses that could turn people’s immune systems against their bodies (“The symptoms were irreversible,” says Sergei Popov, a scientist who worked in the program), or that combined the worst aspects of different pathogens. Surviving the 21st century may require high-tech countermeasures, but it will also require beds and medicines and better grass-roots disease surveillance. “We can’t predict all the possible scenarios,” says Stephen Morse of Columbia University’s Center for Public Health Preparedness. “We have to be ready for the unknown.” Judging by recent events, the surprises won’t be pleasant ones.