EXCLUSIVE – A series of recent leaks of emails and documents surrounding the EMA’s approval of the first COVID-19 vaccine by Pfizer/BioNTech  highlight the  intense political pressures regulatory agencies are under during the pandemic – as well as an oft-forgotten aspect of vaccine approvals – the quality control of vaccines during the leap from clinical trials to large-scale commercial production. Priti Patnaik & Lucien Hordijk explore.

Cyber leaks, public health, geopolitics, vaccine nationalism and political pressure come together in this heady story about the complex  challenges that the world’s strongest regulatory agencies are facing  as they review and approve new COVID-19 vaccines, developed at unprecedented speed.

When a series of emails and documents hacked from the European Medical Agency (EMA) in December 2020 surfaced in early 2021  on the dark web, they  revealed a cautionary tale about how even one of the world’s strongest regulatory agencies may be subjected to intense political pressures in their review of COVID-19 vaccines – even as they try to play by the book in their reviews. 

The hacked documents also shed light on an oft-ignored aspect of vaccine review and approval beyond safety and efficacy – that is quality-assurance of production processes as new vaccine products make the leap from clinical trials to large-scale production. 

Shortages Led to a Blame Game 

And the regulatory approvals did not, ultimately usher in a smooth vaccine rollout. Rather, vaccine  shortages have plagued most of Europe on the back of unanticipated production glitches, leading to a political blame game at the very top of the European Commission, (EC).  This, in turn, prompted  the EU to adopt new rules on export restrictions that have been widely criticised.

This story has four parts: what the leaked documents show; how authorities responded to the leaks; the potential motivations for the breaches by hackers seeking to undermine confidence in the vaccines; and what lessons can be learned from the EMA breaches.

Part I: The Language of Political Pressure 

On January 13th 2021 internal emails and documents from the EMA showed up on two hacker forums:  Raidforums, an English language marketplace for database breaches and leaks; and Rutor a Russian marketplace on “the dark web”. The dark web is home to encrypted online content not indexed by search engines.

These documents, dating from mid- to late November 2020, amounted to nearly 900 pages reports and memos, which included some 20 different email exchanges between EMA officials. They concern the review by EMA’s top management of the Pfizer / BioNTech vaccine in the lead up to its approval. The EMA first reported the cyberattack on December 9th, 2020.

The leaks illustrate two important aspects of the regulatory review process: 

• That the EMA was put under intense political pressure by the European Commission to hasten the regulatory process of the first vaccine approvals – particularly those of Pfizer/BioNtech and Moderna;
• During the Pfizer/BioNTech regulatory process,  the EMA  had concerns related to the consistency of vaccine quality during the commercial  production. Significantly, Pfizer  addressed these EMA concerns before the vaccine was approved.  But the episode illustrates why such issues would better be shared transparently as part of the regulatory review process, experts say [keeping in mind that US Food and Drug Administration review meetings are even aired publicly online]. 

As Dr Barbara Mintzes, Associate Professor, The University of Sydney Charles Perkins Centre and School of Pharmacy, and an expert on the interface  between clinical research and regulatory decision-making, observed: “I wonder why these issues with production quality were only made public via leaked documents that had become available on the dark web. Why were they not under open and public discussion? These types of exchanges should not be secret.”

Leaks Suggest EMA Was Under Pressure to Hasten Vaccine Approvals

The chain of leaked emails reveals that the EMA was operating under intense political pressure, exerted from the very top of the European Commission (EC), to speed up approvals for COVID-19 vaccines. 

Without rapid EMA approval of the Pfizer vaccine and others Brussels feared it could not keep its promise to deliver on  vaccines for all EU citizens simultaneously and by the end of  2020.

Already on 19 November, 2020, Commission President Ursula von der Leyen had publicly  announced that both BioNtech/Pfizer and Moderna vaccines could be approved by the EMA by the end of the year.

EMA members were uncomfortable with the political promises being made, as reflected in a series of internal emails between the EMA officials from November 12, 19 and 20, 2020, which were among those that came to light in January 2021.  

And  at the same time the pressures to adhere to the EC schedule were immense. While an EU directive allows member states to temporarily use unauthorized drugs in emergencies, the Commission wanted to avoid a situation where countries would begin issuing emergency permits for vaccines at national level, helter skelter.

Speedier approvals by other regulatory authorities including UK’s Medicines and Healthcare products Regulatory Agency (MHRA) and the US Food and Drug Administration also added to the pressure  on the EMA.

Even so,  the  email series reflects both the challenges as well as concerns  of EMA officials about ensuring adherence to a strict regulatory process, while keeping to Von der Leyen’s ambitious schedule for the approval of the Pfizer and Moderna vaccines. 

EMA Officials Had Concerns About Commission’s Ambitious Schedule 

Within  EMA expert ranks there was widespread concern that  politically-driven  deadlines should not compromise the technical review – particularly  resolution of  the manufacturing quality-assurance issues that also emerged as concerns in the same period: 

“What is new in my view is that she [Von der Leyen] clearly identifies the 2 vaccines that could be approved before the end of the year. There are still issues with both so it needs to be seen if all this can be sorted out in time, whilst not compromising the robustness of the review”, writes one  EMA official in an email on 20 November, 2020 . 

An email dated November 19, 2020 recounted a telephone conversation between EMA officials and a European Union commissioner.  Relates the EMA official to another colleague:  “Atmosphere was rather tense….at times even a bit unpleasant.” The official notes that it “provides a hint on what EMA may expect if the expectations are not being met, irrespective if such expectations are realistic or not”.

The EMA official goes on to suggest that an interval  of even several weeks between an authorisation granted by the FDA & the UK’s Medicines and Healthcare products Regulatory Agency (MHRA); and the EMA will not be acceptable to the European Commission.  It would lead to significant  “the political fall-out,” the EMA official warned. 

“We have to be ready for the worst-case scenario,” writes the same EMA official in the email  dated November 19, 2020”We will be overwhelmed on all fronts and in the middle of a storm. Whose support can we then rely on?” .

According to yet another email dated November 22, the EMA official warned Commission staff: “We are speeding up everything as much as possible, but we also have to make sure that our scientific review is as robust as possible.”

EMA and European Commission Deny Political Interference  

Asked for comment on the political pressures, an EMA  spokesperson replied to us on January 15, 2021 saying:  “Despite this urgency (to make vaccines available), there has always been consensus across the EU not to compromise the high-quality standards and to base any recommendation on the strength of the scientific evidence on a vaccine’s safety, quality and efficacy, and nothing else.”

The European Commission likewise denied any political interference in the regulatory approval process: “The Commission is fully committed to only authorising vaccines that are deemed safe and effective by its independent scientific agency,” Stefan De Keersmaecker, spokesperson for health, food safety and transport, told us in reply to an inquiry.

Only an  hour after responding to the  queries of our investigative team  – which were the first to address this aspect of the email leaks,  European Commission authorities hastily convened  a press conference on the issue. At the press briefing, Keersmaecker, said that the leaked documents had been “manipulated”: 

“The EMA has just published its public statement on the cyberattacks of which they are a victim and they have stressed, it is important that you are all aware of that, that some of the correspondence have been manipulated by the perpetrators prior to the publication in a way that could undermine trust in vaccines. I am saying this just to draw your attention that some of the documents that are out there seem to have been manipulated by perpetrators, and therefore have to be considered with utmost care.”  

PART II: Vaccine Production Quality Assurance  

The EMA’s concerns about quality assurance of the mass production of  the Pfizer/BioNtech vaccine (brand name Comirnaty) was a key technical issue to emerge in the regulatory review, as illuminated by the series of leaked EMA emails from November 2020.

Here, the regulator’s concerns focused mostly on the Pfizer/BioNtech vaccine candidate, which was the very first vaccine in the EMA regulatory approval pipeline.  At the time when the issue arose in November, 2020, some production factories were yet to be inspected, and the regulator was awaiting additional data from Pfizer. 

The key  concern centered around differences in the quality of the vaccine batches produced for clinical trials and batches for commercial production noted by the EMA review experts. 

According to the leaked documents, the concerns arose over differences in the levels of “mRNA integrity” –  an indicator of the purity of the active vaccine drug substance. While the vaccines used in the clinical trials had between 69% – 81% intact mRNA, initial samples of the batches that were destined  to be used in  large scale manufacturing showed only 59% intact mRNA on average, with some batches as low as 51%.      

This concerned the EMA – both in terms of safety as well as efficacy of the vaccine doses.  According to an email between EMA officials on 23 November, 2020, the EMA stated the following: 

“…The potential implications of this RNA integrity loss in commercial batches compared to clinical ones in terms of both safety and efficacy are to be defined. 

“Whether or not the observed compatibility issues could be a blocking point will depend on the relevance of these observations to safety and efficacy and the company will be requested to fully justify the lower %RNA integrity (and other differences noted)

“Point for discussion will be whether the comparability issues can be solved only by quality data (additional functional / in vitro biological data + available non-clinical) or that further clinical data (bridging studies are / will be performed) will be needed. It is difficult to make any projections on this.”

Ultimately, however, those concerns were resolved to the satisfaction of EMA reviewers, the document leaks also show. 

Pfizer offered to make  manufacturing modifications to ensure that mRNA integrity levels in the commercial production process would remain consistent to those of the clinical trials. The email exchanges refer to manufacturing adjustments ensuring mRNA integrity levels remained at around 75% – although the documents don’t explain how those modifications were made.

EMA Responses to Questions About Quality Assurance Review  

On 15 January, in response to our queries about the quality assurance review of production processes, the EMA said  the follow-up data it had received from Pfizer showed “modified forms of mRNA at somewhat higher levels in the batches manufactured with the commercial process as compared to material used in clinical trials.” 

The EMA clarified to us that such modified mRNA forms were not determined to be a safety risk, particularly in light of the low overall dose of mRNA involved – just 30 micrograms of active ingredient (30 μg):  

“The amount of any such proteins, is expected to be too low to elicit an immune response of biological relevance.” stated the EMA response. As a result, the risks of any adverse immunological events occurring in reaction to any modified mRNA forms was deemed to be low. Indeed, considering the low dose of mRNA (30 μg), impurities are not considered a safety issue based on general toxicological principles, the EMA said.

In their response to our queries, the EMA also acknowledged that the leaked emails reflected the discussions that took place. A spokesperson from the EMA said, “The company was able to address these issues and supply the required information and data to allow EMA to move towards a positive recommendation for this vaccine.”

Pfizer, for its part, did not respond to our inquiries on how the company addressed concerns the EMA had raised in November 2020. In a statement in mid-January, the company said: “As the European Medicine Agency’s investigation [of the cyberattack]  is ongoing, we defer to them on any updates.” 

How do mRNA vaccines work?

Coronaviruses are made up of a single-stranded RNA protein, bounded by protein and wrapped in an envelope of lipid molecules The SARS-CoV-2 virus uses the spike proteins covering its surface to bind to ACE2 receptors found in the lung and other organs. It then fuses with the membrane of the host cell and releases its genetic material. Once the virus has overtaken the cell, it hijacks the cell’s internal machinery to make proteins that help it replicate. Most COVID-19 vaccines have targeted the distinctive spike proteins of the SARS-CoV-2 virus – used by the virus to pry its way into the body’s cells. Typically, vaccines involve injecting a weakened,  inactivated or genetically modified form of the pathogen into the body to trigger immune response. However,  mRNA vaccines involve the use of messenger Ribonucleic Acid (mRNA) to carry “instructions” for manufacturing a spike protein into the body.  That, in turn, triggers the  immune response. As described in a Health Policy Watch interview with Moderna’s Chief Medical Officer Tal Zaks from November 2020: “mRNA is a transient copy of the instructions in our genes that instructs the cell’s ribosomes to make protein. ….An mRNA vaccine is not a virus, [or even a weakened virus]. It only gives the cells transit instructions to make that one piece of virus that we want to educate the immune system to recognize. It’s essentially an instruction code. I inject it into the muscle. It gets distributed to the lymph nodes where the immune system works. The messenger RNA encodes for the spike protein and our cells start to make this spike protein.  “Now the immune system sees a new protein it’s never seen before. And it goes, ‘Oh, hold on a second. This looks like a foreign threat. …let me go block it.’ And so the immune system starts to generate antibodies and T cells that recognize that spike protein. It focuses the attention of the immune system, just on that one protein.”

 Independent Expert Confirms – No Vaccine Efficacy or Safety Issue   

We also interviewed Steve Pascolo, a researcher at the University Hospital of Zurich,  an expert on mRNA vaccines, regarding potential impacts of  lower mRNA integrity levels on either safety or efficacy of the Pfizer/BioNTech vaccine.  Pascolo, also a co-founder of CureVac who left the company in 2006, said that he did not see serious issues of safety or efficacy arising:    

 “In the early trials of BioNTech, they had immune responses with just one microgram of RNA.” (the approved mRNA vaccine has 30 micrograms of RNA per dose), said Pascolo, also author of a  recent paper Synthetic Messenger RNA-Based Vaccines: from Scorn to Hype. 

And what about safety? Could a lower mRNA “integrity” level could  impact the vaccine’s safety? Was it possible that the presence of  “truncated” mRNA proteins in the vaccine’s active ingredient – other than the exact target mRNA protein –  could also have unwanted immune impacts?

Said Pascolo: “There is no safety implication of having a shorter mRNA transcript in the vaccine. In fact a shorter transcript will probably not be translated (it misses the functionality important ends) and if it would, may result in production of shorter proteins that may even participate in the overall immune response.” 

PART III – EMA Says Emails Were Manipulated by Hackers To Sow Vaccine Mistrust 

When our team published its first story on the leaked documents in Business Insider Germany (on January 15, 2021), an EMA spokesperson said that the agency “would not verify” the authenticity of the leaked documents because they have been stolen by hackers and placed on the dark web. 

Later on that same day, an EMA  press statement acknowledged that the “unlawfully accessed documents.. Included internal/confidential email correspondence dating from November, relating to evaluation processes for COVID-19 vaccines.”The 15 January statement added that “Some of the correspondence has been manipulated by the perpetrators prior to publication  in a way which could undermine trust in vaccines.” 

Ten days  later, on 25 January,  the EMA issued another statement on the cyberattack that had led to the email leaks, with more details on how the series of email leaks had been manipulated by hackers – to create mistrust around the vaccines themselves. 

“Whilst individual emails are authentic, data from different users were selected and aggregated, screenshots from multiple folders and mailboxes have been created and additional titles were added by the perpetrators in a way which could undermine trust in vaccines”, said the EMA  press statement issued on January 25.

Analysts Suggest EMA Emails Were Hacked by State Entity 

Undoubtedly, the way these documents appeared on the dark web, played into the hands of sensationalism muddying the regulatory reviews. The leaked documents from the EMA were named “BIG DATA SCAM of Pfizer’s vaccines” and “Astonishing fraud Evil Pfizer!!”

 Jean-Michel Doan, an open-source analyst who specialises in cybercrime at Sekoia, an IT security company in France, said, it is likely that the attack was caused by hackers affiliated to a state entity. 

“This kind of hacking tactic with data theft followed by data leaks has already been practiced by Russian agents (Guccifer 2.0/ Democratic National Convention leaks and World Anti-Doping Agency leaks).” 

Cyberattacks focusing on undermining confidence around brands of  the Covid vaccine have also been undertaken  by hacking groups affiliated with China, North Korea, and Iran and Russia, he added.

The team also spoke with Mirko Gatto, CEO of Yarix, an Italian company that works in IT security, on whether anti-vaxxers could have orchestrated such an attack. Gatto said, “All is possible, but if anti-vaxers want to damage someone they go in other places, for example on Twitter. They use open source intelligence (OSINT)  sources. They want to communicate as much as possible and [the] black market is not a place for this kind of strategy.”

Part IV; Balancing Regulatory Processes, Political Pressures & Right To Know 

Clearly, the leaks reveal the kinds of political pressures that have been faced by even the world’s most stringent regulatory agencies in the pandemic era. 

They underline the penultimate importance that politicians need to attach to restraint  – in order to maintain public confidence in regulatory processes – and the vaccines they produce. 

Even so, it appears the EU drug regulator adhered to its due diligence process.  The EMA issued the Pfizer-BioNTech’s vaccine a conditional marketing authorization on December 21, 2020-  a full three weeks after the UK (December 5th) and two weeks after the US FDA actions (December 11th) – suggesting that the EM indeed took time to resolve questions about safety, efficacy and manufacturing quality assurance. .

Still, the leaks provide a cautionary tale about the pressures that regulatory authorities may face  – with implications for other national regulatory agencies as well as the World Health Organization – which has its own emergency use listing process. 

If one of the strictest regulators in the world is subjected to such pressures, it is likely the pressures on other authorities may be even more intense. 

Transparency of Dossier Submissions 

The other lesson learned may be one about the importance of transparent regulatory reviews. 

If the exchanges between the EMA and Pfizer about aspects of quality assurance of production processes had been a transparent matter of record – it might have removed the sting of some of the leaked emails – which ostensibly sought to undermine vaccine confidence. 

Observes Brook Baker, professor of law at Northeastern University in Boston told Health Policy Watch, “Transparency by regulatory authorities and WHO prequalification with respect to COVID-19 vaccines is absolutely critical to vaccine acceptance by medical providers, opinion makers, and ultimately individual patients and the public-at-large.  

Transparency is particularly important when public anxiety is high, product development and clinical trials have been expedited, political pressure has been exerted by public officials, there is global competition in vaccine development, and emergency use permission is granted short of full regulatory approval.  It also certainly hasn’t helped that even stringent regulatory authorities in the U.S., U.K., and Europe have disagreed on what vaccines to approve and conditions and populations of approved use.” 

As a result, adds Baker, ”transparency about dossier submissions, the evidence submitted, independent and supplementary review by expert committees, and the detailed assessments of the regulator is vitally important.  

“This should include transparency around known adverse effects, post-approval pharmacovigilance, efficacy with respect to new variants, and on-going studies and time-lines for full regulatory approval,” he says.  

EMA Not the Only Regulatory Agency Subjected To Pressures 

The EMA experience can be contrasted with the US Food and Drug Administration review process of the same vaccines  – which was subjected to even more overt and intense political pressure from former US President Donald Trump. Those pressures included Trump’s own tweets and statements, as well as backroom approaches from White House emissaries and Trump’s political appointments in the US Centers for Disease Control, the White House COVID task force and the FDA.  

“Fortunately, the scientists and leadership at the FDA resisted these pressures, assured that there would be independent expert input, and reviewed the evidence with care and precision,” said Baker. 

“These internal forces at the FDA were helped by vaccine developers who also made it clear that they wanted there to be rigorous, independent review at the FDA.”

Baker also notes the  “unprecedented transparency with respect to many aspects of the [FDA] approval process,” including not only the portfolio submissions but also live video coverage of the entire FDA review deliberation. 

At the same time even across the Atlantic, “advocates are still pressing for even more transparency about company submissions, including underlying clinical trial data and confidential manufacturing information, and about FDA assessments,” Baker observes.

Going forward, such transparency may be all the more important to both protect regulatory authorities from undue political interference – as well as building public confidence in the process – and thus in the vaccines that they approve. 

Ultimately, FDA transparency may also have helped build public confidence in the FDA approval process – and even stave off hackers’ attacks such as those seen in Europe.  

_________________________

Priti Patnaik is the founding editor of the Geneva Health Files, an independent global health reporting initiative based in Switzerland. Lucien Hordijk is a contributing reporter for the Investigative Desk, a non-profit investigative journalism group that is based in Amsterdam.

Ludovica Jona (Italy), Lise Barnéoud (France), and Hristio Boytchev (Germany) also contributed to this article. 

This article is part of the series #BehindThePledge, a cross border investigation into the money trail of pandemic-related drug and vaccine development and rollout. 

This is the first publication in English-language media about  the EMA leaks. Earlier versions of the story have been published by the team in media in France, The Netherlands, Italy & Germany. The project has received grants from Journalismfund and IJ4EU.  

Image Credits: BioNTech, Twitter, Pfizer, US Centers for Disease Control, Pfizer, White House/D. Myles Cullen.