The bugs are everywhere. But biological threats, whether natural like the Ebola virus or potentially wielded as terror weapons like anthrax, have become more dangerous and worrisome. Thus Congress and President Bush made a reasonable choice in approving a law by which private companies will be paid to develop medical treatments and vaccines to protect Americans.

The president signed the bill, crafted over two years by U.S. Sen. Richard Burr of North Carolina, into law last week. Still, the largely positive aspects of the legislation are marred by unfortunate veils of secrecy that are permitted to protect drug companies. That section needs to be revised with congressional oversight of the process in view.

Drug companies largely have abandoned making new vaccines because development costs are high while demand could be spotty. Why spend millions to develop an Ebola vaccine when outbreaks are relatively so rare? Similar dynamics are at work regarding treatments for threats such as bird flu, anthrax and chemical and radiological poisoning, all of which are targets of the law.

Burr's bill encourages public-private partnerships such as those arranged by the military for production of defense-related items that are likely to have a limited use in the marketplace. Locally, the Triangle has a number of pharmaceutical and biotechnology firms, both multinational ones and start-ups. So the new law promises to benefit this region's economy.

The law forbids disclosure of technical and scientific data developed in the course of a company's research if the disclosure would harm national security. That's sensible. The soft spot is that the U.S. Department of Health and Human Services is allowed to determine when a violation has occurred. A stark lesson the nation has learned since 9/11 is that combating terrorism and other national threats requires a strong dose of congressional oversight. Congress itself ought to define when disclosure of research data threatens the nation's security, and make sure the bar is not set so low that practically any disclosure is blocked.