Research notes: When did the US learn about the Wuhan outbreak?

Abstract

These notes aim to clarify how US intelligence first learnt of an outbreak in Wuhan in the second week of November 2019, and how that intelligence progressed from a 'situation report' to a 'formal assessment' before reaching a range of military and civilian consumers in December 2019, with a intermediate disclosure to key military partners at the end of November.

Full text

research notes:
When did the US learn about the Wuhan outbreak?
author: Gilles Demaneuf (DRASTIC), gilles@demaneuf.com
These notes greatly benefited from the judicious comments of Milton Leitenberg, Senior Research Associate
at the Center for International and Security Studies at the University of Maryland (CISSM), and from others
who prefer to remain anonymous.
1. Official timeline on Covid-19.
According to China the onset date of the first official confirmed Covid-19 patient is 8th December
20191and some cases started arriving at hospitals around the 15th December, at first rather
unnoticed.
On the 30th December Ai Fen, the head of the emergency department of the Wuhan Central
Hospital, received the test results of that earliest official onset patient. He had transferred to her
department on the 27th after spending 10 days in a Jiangxia hospital without improving. She
diligently communicated the test diagnostic of a coronavirus (wrongly identified as SARS) to the
doctors in her hospital.
One of them, Li Wenliang, forwards it to his university class group of doctors the same day. His
message goes viral, forcing the first official disclosure of the outbreak on the 31st Dec. From that
time the news of a novel coronavirus outbreak in Wuhan circled the world.
2. The NCMI reports
a. About the NCMI:
The NCMI is part of the Defense Intelligence Agency (DIA). It is tasked with tracking potential
health and related threats to US military personnel overseas and has 100 epidemiologists,
virologists, toxicologists, military medical experts and others based at the US Army Medical
Institute of Infectious Diseases (USAMRIID) in Fort Detrick, Maryland2. Its “Infectious Disease
Division” is in charge of tracking outbreaks and evaluating their pandemic potential.
2See https://www.nbcnews.com/health/health-news/spying-coronavirus-little-known-u-s-intel-outfit-has-its-n1
157296 for an introduction to NCMI work.
1That date itself is in question. The person that this case is supposed to refer to, a Mr Chen who lived in
Zhifang (a sub-district of Jiangxia) - the residential district closest to the WIV Zhengdian site - had actually
an onset date of the 16th Dec, as confirmed by his medical notes and interviews in the Chinese press. This is
one of the many contradictions about the earliest official case - possibly the result of an unexplained case
mix-up.
See https://www.washingtonpost.com/world/asia_pacific/covid-wuhan-outbreak-who/2021/07/15/51e7e8a6-e
2c6-11eb-88c5-4fd6382c47cb_story.html.
Gilles DEMANEUF DRASTIC p.1/7

The consumers of its intel are not just the US Military, but also the White House, Department of
State, Homeland Security, and other domestic customers and foreign partners3- as is reflected in
its renaming in 2008 from ‘Armed Forces Medical Intelligence Center’ (AFMIC) to ‘National Center
for Medical Intelligence’ (NCMI).
Of all the US intelligence agencies, the NCMI is the most likely to detect an early outbreak in
China thanks to its systematic surveillance of ‘patterns of life’ at hospitals and other medical
institutions in China. It uses the usual tools, such as COMINT (Communications Intel), SIGINT
(Signal Intel), IMINT (Imagery Intel) and HUMINT (Human Intel). In particular the NCMI has some
cooperation in place with the NSA (National Security Agency) under which it has direct access to
some of its raw data.4,5
NCMI collaborates on strategic bio-surveillance with the US CDC, the Department of Homeland
Security (DHS) and other federal agencies to share data and analyses regarding possible
biological events that could threaten national security.6
Incidentally, the NCMI was reported to have been the agency that was the most positive about a
research related accident being responsible for the Covid-19 outbreak - with a moderate
confidence - in the intelligence review ordered by President Biden which was released in August
2021.
b. Outbreak detection in November - Situation Report
From some US articles, we know that there were communication and image intelligence data
points collected by the NCMI in November 19 that pointed to an outbreak in Wuhan.
ABC news [9th Apr 20]:
"The report was the result of analysis of wire and computer intercepts, coupled with
satellite images."
NBC news [10th apr 20]:
"The intelligence came in the form of communications intercepts and overhead images
showing increased activity at health facilities, the officials said".
This information was collated in a 'situation report' that was circulated in that form, before it could
make it to a formal intelligence assessment. A situation report essentially describes the data points
but stops short of an interpretation or assessment of what those data points mean, or what they
may imply in terms of the security of the US and its partners.
6See https://www.afio.com/publications/CLEMENTE%20Pages%20from%20INTEL_FALLWINTER2013_Vol2
0_No2.pdf.
5The access of MCSI to SIGINT and IMINT seems to have been reinforced further in 2020:
https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/642001p.pdf?ver=2020-09-08-125038-99
0
4See Snowden archive
https://theintercept.com/snowden-sidtoday/3008431-dia-swimming-upstream-in-the-sigint-system/ and the
Intercept article
https://theintercept.com/2016/08/10/how-the-u-s-spies-on-medical-nonprofits-and-health-defenses-worldwid
e/
3Typically NATO and the key foreign members of the ‘5 eyes’ (UK, Canada, and Australia).
Gilles DEMANEUF DRASTIC p.2/7

The likely time point at which the NCMI became aware of a situation in Wuhan is given as the 2nd
week of November in an article in the Times of Israel:
Times of Israel [17th Apr 20]:
According to Channel 12 news, the US intelligence community became aware of the
emerging disease in Wuhan in the second week of that month and drew up a classified
document.
That article adds:
Information on the disease outbreak was not in the public domain at that stage — and was
known only apparently to the Chinese government.
The conclusion that the outbreak was known to the Chinese government would presumably be
deduced from communication intercepts, which is one form of intelligence that the NCMI gathered.
In an apparent contradiction, let’s note that the intelligence report on Covid-19 origins states that:
Finally, the IC assesses China’s officials did not have foreknowledge of the virus before the
initial outbreak of COVID-19 emerged.
That statement may seem incompatible with the NCMI assessment that the outbreak was known
to the Chinese government while not yet public. However that rather vague statement most likely
says something rather bland: that the Chinese government (meaning the central authorities in
Beijing) had no idea that the outbreak pathogen was the specific SARS-CoV-2 virus, before it was
sequenced and identified. It does not mean at all that the central government was not aware of the
outbreak before it became public, and many accidental release scenarios are indeed totally
compatible with the central authorities having at first no precise idea what the pathogen behind the
outbreak may exactly be, while they are trying to contain the outbreak and to keep it under wrap.
Channel 12 News (N12) [16th Apr 20]:
This article written in Hebrew by Nir Dvori ( רינירובד ) ran a very similar story to the Times of Israel,
just one day earlier:
In the second week of November, US intelligence recognized that a disease with new
characteristics was developing in Wuhan, China. They followed its spread, when at that
stage this classified information was not known to the media and did not come out of the
Chinese regime either.
The ‘they followed its spread’ adds a detail which is totally in line with the functions of the NCMI.
Note that the various reports state that SIGINT, COMINT and IMINT came first, which is what we
would expect of NCMI detection capacities. There is no mention of early HUMINT - even in very
general safe terms. It seems that the HUMINT came later, in the form of monitoring in the weeks
after detection and possibly via other sources in the following months.
For instance we have a (safe) mention by Mike Pompeo (Secretary of State at the time) of some
US consular employees in Wuhan actively monitoring the situation:
Gilles DEMANEUF DRASTIC p.3/7

“Remember too, there were 14 American diplomats on the ground in Wuhan at this time,
who were watching and observing what was taking place inside of Wuhan”
c. Intelligence Assessment in December
The information contained in the situation report(s) typically had to be further checked, interpreted
and its possible implications weighted, before it could formally move up the intelligence chain in
December 2019 in the form of an ‘intelligence assessment’.
Once a formal assessment had been written and validated, it could reach the consumers:
policy-makers and decision-makers within the government (likely including the CDC), the National
Security Council in the White House.
NBC news:
But the current and former officials told NBC News that while no formal assessment was
produced in November — and hence no "intelligence product," in the jargon of the spy
agencies — there was intelligence that caught the attention of public health analysts and
fueled formal assessments that were written in December. That material and other
information, including some from news and social media reports, ultimately found its way
into President Donald Trump's intelligence briefing book in January”
ABC news:
“From that warning in November, the sources described repeated briefings through
December for policy-makers and decision-makers across the federal government as well
as the National Security Council at the White House. All of that culminated with a detailed
explanation of the problem that appeared in the President’s Daily Brief of intelligence
matters in early January, the sources said. For something to have appeared in the PDB, it
would have had to go through weeks of vetting and analysis, according to people who
have worked on presidential briefings in both Republican and Democratic administrations.
d. Intermediate takeaway: end of November
By the end of November, while a formal assessment may not have yet moved up the intelligence
chain, the first conclusions were strong enough for the usual consumer of the NCMI intelligence,
the US military7, to be briefed:
ABC news:
"The timeline of the intel side of this may be further back than we’re discussing," a source
said of preliminary reports from Wuhan, the city considered the initial epicenter of the
outbreak in China. "But this was definitely being briefed beginning at the end of
November as something the military needed to take a posture on."
According to the Times of Israel, the US military then alerted NATO and the IDF of the outbreak
precisely at the end of November:
7This would normally be done via the Office of the Secretary of Defense (OSD) and the Joint Staff (JS) of
the Joint Chiefs of Staff (JCS).
Gilles DEMANEUF DRASTIC p.4/7

Times of Israel:
[...] the Americans also decided to update two allies with the classified document: NATO
and Israel, specifically the IDF.
The network said Israeli military officials later in November discussed the possibility of the
spread of the virus to the region and how it would affect Israel and neighboring countries.
e. NCMI director clarification:
Dr. R. Shane Day, the NCMI director denied around the 10th April 2020 that an assessment
existed in November of 2019:
NBC news:
"We can confirm that media reporting about the existence/release of a National Center for
Medical Intelligence (NCMI) Coronavirus-related product/assessment in November of
2019 is NOT correct. No such NCMI product exists."
It is critical to understand that the point made by Dr Shane Day is that no formal assessment was
produced in November. Only ‘situation reports’ based on raw data, with no easily actionable policy
take-away or recommendations, were available in November.
Effectively the intelligence product, and hence the ability for policy and decision-makers to start
acting on the information (beyond the US military and some close allies), was available in
December.
3. Two US scientists remember learning about an outbreak in Wuhan
During December 19, once a former intelligence assessment had been produced, various US
policy and decision makers were informed of the outbreak in Wuhan and of its possible
implications, most likely including the CDC. At the same time, some US civilian experts learnt of
the outbreak, in some cases via contacts in China:
Lawrence Gostin:
In mid-December 2019, Lawrence Gostin, a professor of global health law at Georgetown Law,
had a guest over to dinner who told him:
“I just heard from a friend in Wuhan that there is a novel coronavirus, and it looks very
serious”
Note the specificity of the outbreak: a novel coronavirus.
Ian Lipkin:
Ian Lipkin, professor of epidemiology at Columbia University, declared in a Spike Lee documentary
for HBO:
‘That’s when I hear about this [new outbreak], on December 15th”
Gilles DEMANEUF DRASTIC p.5/7

This is fully consistent with what he told on 28th Mar 2020 during a TWiV podcast:
“I first heard about this outbreak on the 15th of December, from Lu Jiahai who is a
professor at Sun Yat Sen university who runs a large ‘One Health’ program there. We have
our program with professor Lu, it has been funded for about 6 months by the Chinese
government but it does not really have any support in the US.”
Lu Jiahai is the Director of One Health Research Center of the School of Public Health at Sun
Yat-Sen University (Guangzhou), the first One Health research center in China (2014). He worked
on SARS vaccines and therapies.
These two statements only mention an outbreak, it is not clear if Lu Jiahai told Ian Lipkin that the
pathogen was a coronavirus.
In an interview with the BBC dated 26th Jan 2021, Ian Lipkin would also describe his call to George
Gao, the director of the Chinese CDC, on the 31st Dec evening (from his home in the US):
"He had identified the virus. It was a new coronavirus. And it was not highly transmissible.
This didn't really resonate with me because I'd heard that many, many people had been
infected"
It would be interesting to know if that “I’d heard that many, many people had been infected” refers
to what Ian Lipkin learnt on the 15th Dec, or to a later conversation. In any case, it is in line with
Lawrence Gostin's statement that he heard in mid-December that there was a new coronavirus
outbreak that looked very serious.
From an article in the New Yorker dated 1st Mar 2020, we also learn that:
He [Ian Lipkin] first heard about covid-19 from a colleague in Guangzhou, a month before
the rest of the world became aware of it. “He told me, ‘There’s some weird thing going on in
Wuhan,’ ” Lipkin said.
and
“On December 31st, researchers there identified it as a coronavirus but said, ‘It’s not highly
transmissible.’ So much for that assessment!” He went on, “It’s going to be difficult to know
who knew what when.”
The ‘a month before the rest of the world’ would mean early December. It may simply be an
exaggeration, as he mentioned the 15th Dec 4 weeks later in the TWiV podcast.
Gilles DEMANEUF DRASTIC p.6/7

4. Testimony from a PhD student in Wuhan
A PhD student in Wuhan is on record explaining in a rather articulate and detailed way that:
● A pneumonia outbreak started in September in Wuhan.
● That pneumonia outbreak worsened in November as winter started.
● Around 24th Dec it became well known in his students circle that the situation was serious.
At that time it was understood that there was not just a standard pneumonia outbreak, but
clearly some atypical pneumonia cases that were particularly bad. Students start taking
precautions when moving around the city
● Around 1st Jan the atypical pneumonia outbreak is reported in the news (actually 31st Dec)
5. Separating the signal from the noise
There is a distinct possibility that NCMI picked up the first signs of something going wrong by com
intercept (COMINT) of hospitals at the exact time of a worsening pneumonia wave which had
nothing to do with Covid-19, and which started in September 2019 before accelerating in
November 2019.
Sat imaging would not allow us to distinguish between a bad seasonal pneumonia outbreak and
the beginning of a coronavirus outbreak occurring at the same time. It is therefore likely that only
part of the data that NCMI observed, such as communications at specific hospitals, was indeed
linked clearly to something worse than a bad but still standard pneumonia.
That section of the data linked to a coronavirus outbreak may have had an unusual gravity, or be
handled in non-standard channels, which would have triggered red flags at NCMI. So part of the
intelligence data collected may indeed have led to the correct conclusion that a dangerous atypical
pneumonia outbreak was taking place, even when swamped by the noise of a larger typical
seasonal pneumonia outbreak. From there the NCMI would rightly conclude that something wrong
was happening. This would have spurred the DIA (from which NCMI depends) to alert NATO and
the IDF at the end of November 2019 as per its mandate.8
However the actual scale of the most alarming atypical outbreak would have been very difficult to
properly evaluate at the time. While the NCMI would suspect something more than a bad
pneumonia outbreak was at play, separating that signal from the noise of the typical pneumonia
outbreak data would be very difficult. Only later, the finding of strong symptoms of Covid-19 in
three November (or late Oct) hospital cases9would give a first strong indication to the Intelligence
Community that indeed some of these supposed pneumonia cases were most likely actually
Covid-19, and not simply a seasonal pneumonia.
Last, it is also worth noting that the atypical coronavirus outbreak would be able to spread
cryptically in that much larger seasonal pneumonia outbreak, and may even lead to a more
aggressive form by evolving in a patient already weakened by seasonal pneumonia.
9Very possibly via hacking of some standard EHR (Electronic Health Record) system(s), which would deliver
gold standard documentation on these cases.
8One of the DIA functions is military diplomacy with its key partners.
Gilles DEMANEUF DRASTIC p.7/7