Despite President Donald Trump's promises of a vaccine next month and pundits' speculation about how an “October surprise" could upend the presidential campaign, any potential vaccine would have to clear a slew of scientific and bureaucratic hurdles in record time.

In short, it would take a miracle.

We talked to companies, regulators, scientific advisers and analysts and reviewed hundreds of pages of transcripts and study protocols to understand all the steps needed for a coronavirus vaccine to be scientifically validated and cleared for public use. As you'll see, it's a long shot in 38 days.

There are three key milestones that must be met:

1. A clinical trial would need to observe enough infections to demonstrate that the vaccine is better than a placebo. Right now, Pfizer's trial is the furthest along. Pfizer has said it expects results by the end of October, but analysts who follow the company aren't so sure it'll be that soon or whether the results will be conclusive.
2. Pfizer would have to turn its trial data into an application to the Food and Drug Administration. The company could either apply for full approval — a very high bar for proving the vaccine is safe, effective and able to be reliably manufactured by the millions of doses — or for an emergency use authorization, which is more flexible. Pfizer has said it could submit its application almost immediately.
3. The FDA has to review the data and decide whether the vaccine is ready to go to market. That could take several weeks to a month, said Dr. Mark McClellan, who led the FDA from 2002 to 2004.

“All of this put together makes it more likely that it'll be a late 2020 availability," McClellan said.

None of this is to say that Trump couldn't suddenly call a White House press conference to try to grab headlines and declare victory. But knowing all the steps that would have to come first can help the public discern between a true, scientifically validated vaccine and a mere political stunt.

Yes, Pfizer could have trial results by the end of October.

Results from ongoing trials are closely guarded so that researchers (and investors) have no opportunity to mess with them. Under strict trial rules that vaccine makers and the FDA set up in advance, there are only a few predetermined times when a data monitoring board is scheduled to look at the data. The purpose of those check-ins (known as “interim analyses") is to see if there's already enough evidence to conclude that the vaccine either works or doesn't.

According to the trial rules that Pfizer released last week, it has four of these check-ins before the final analysis. The first one occurs when 32 people in the trial get sick with COVID-19.

Yes, that is a tiny number in a study designed to enroll 30,000 participants. But it could be enough to show that the vaccine works if far more of the infections occur in people who took the placebo than in those who got the vaccine, so much so that it's probably not random.

The vaccine “would have to be way, way better to meet an interim stopping boundary," said Frank Harrell Jr., professor of biostatistics at Vanderbilt University.

If six or fewer of the first 32 cases are people who got the vaccine, that suggests the vaccine reduced COVID-19 cases by 76%. Under Pfizer's trial rules, the company can then conclude that its vaccine is effective enough to submit its application to the FDA. If, on the other hand, 15 or more of the first 32 infections are people who got the vaccine, it would mean the vaccine doesn't work and the study ends.

The better the vaccine works, the longer it would take to reach 32 cases, because fewer vaccinated people would get sick and more of the infections would have to occur in the placebo group.

So when exactly will Pfizer get to 32 cases?

Analysts at JPMorgan estimate that this first readout would occur on Oct. 31 if the vaccine is 70% effective, or on Nov. 2 if the vaccine is 80%. Their model also estimates that Pfizer is more than twice as likely to be able to file for approval at 80% effectiveness vs 70% effectiveness.

The JPMorgan analysts' prediction is roughly in line with official public statements from Pfizer, though the company has projected even more confidence. “We have a good chance that we will know if the product works by the end of October," CEO Albert Bourla said Sept. 13 on CBS' “Face the Nation."

The key thing we don't know is how fast people in Pfizer's trial are getting sick. The trial doesn't intentionally expose people to the virus; it waits to see who catches it on their own. Even though the pandemic is far from under control, the coronavirus is not spreading as fast as it was a few months ago. The study started with a baseline assumption that just 1.3% of participants would be infected over the course of a year.

It's possible that the thousands of people who signed up for Pfizer's study could be getting sick faster or slower than that, depending on how bad the outbreak is where they are. If Pfizer's trial infection rate is 1.5 to 2 times faster than publicly reported case counts, then Pfizer's first readout could be Oct. 12-19 with a 70% effective vaccine, or Oct. 14-22 with 80% efficacy, according to JPMorgan's model.

“When the trials started there were a lot more cases in the U.S. at that time," said Dr. Vamil Divan, an analyst at the bank Mizuho. “That's a key unknown. How many of these participants are enrolled in hotter areas versus New York or Boston?"

To protect the integrity of trials like this, the drugmakers running them aren't supposed to know what the data is showing as it comes in. And yet, company executives have led some observers to believe they know how many people have tested positive for COVID-19.

“They're making projections based on how rapidly they're accruing data, and they probably know the total number of events," said Susan Ellenberg, professor of biostatistics at the University of Pennsylvania.

“When they say things like that, first of all, it does some wonders for their stock prices," she added.

In a statement, Pfizer said that it expects results “as early as the end of October" based on current infection rates. The trial, the company said, “was designed to evaluate the safety and efficacy of the vaccine candidate as fast as possible."

“Having said that," the company added, “neither Pfizer nor the FDA can move faster than the data we are generating through our clinical trial."

It's highly unlikely that the next front-runner, Moderna, could have results before the election. The JPMorgan analysts' model suggests that infection rates would have to be four times the publicly reported rate for Moderna to be able to report results before Nov. 3.

Dr. Tal Zaks, Moderna's chief medical officer, told investors on Sept. 17 that “some time in November is sort of a reasonable base case" for the first look at Moderna's results. (ProPublica's board chairman, Paul Sagan, is a member of Moderna's board and a company stockholder.)

Other developers are further behind. AstraZeneca's trial is paused in the U.S. while the company investigates what happened with a participant who had a bad reaction. Johnson & Johnson is just beginning its large-scale, end-stage trial, months behind the other three.

So Pfizer is the only company with a shot at results before the election. And if the company has results to share, it's unlikely to let political implications get in the way. The company has an ethical obligation not to delay a product that is ready to save lives, despite the risk that a vaccine announced on the eve of a contentious election could stoke partisan perceptions.

“Once you have signs of a vaccine's effectiveness, it's very difficult to argue anything is ethical other than making it available to those most at risk," Dr. Mani Foroohar, an analyst with the investment bank SVB Leerink, said. “But it's also very difficult to make the argument that you should do anything that undermines public trust. That's one of the problems when you introduce powerful political pressures into what is meant to be a boring, dry, unemotional process."

Once Pfizer gets results, it's poised to seek the FDA's go-ahead swiftly.

As soon as Pfizer has conclusive data, it will submit an application to the FDA. The application will include data from all previous trials as well as proof that the company can consistently manufacture millions of vaccine doses.

Pfizer's CEO has indicated that the company is ready to turn around its application in a flash, if not on the same day it has results. “We will try to be able to be ready to submit with the speed of light, once we have the results ready," Bourla said at an investor presentation on Sept. 16.

Pfizer has two options when submitting its FDA application. It can apply for an EUA or a full approval, known as a biologics license application, or BLA. An EUA would only allow Pfizer to market its vaccine for the pandemic's duration — during the declared “emergency" period that we are currently in. If the company receives full licensure, on the other hand, its product can remain on the market forever. In its statement, Pfizer said it plans to continue its study after a possible EUA to collect more long-term data.

The bar for an EUA is lower than for full approval. By law, an EUA can be issued so long as “the product may be effective in diagnosing, treating, or preventing" the disease and “the known and potential benefits of the product … outweigh the known and potential risks." In contrast, the standard for a full approval requires a drugmaker to prove not only that the product is safe and effective, but also that the product is pure and can be consistently made, because vaccines are biological products made from living materials.

For the COVID-19 vaccine, the FDA has said that it is going to raise the bar for an EUA, going beyond the usual requirements. Previously, the FDA has said a vaccine should be at least 50% effective. The FDA is reportedly close to announcing new standards to include at least two months of monitoring the health of trial participants after they receive their second shot. That could end up being the biggest hurdle to authorizing a vaccine before the election. Trump said on Wednesday that he might reject the new guidelines, but companies and FDA officials might still choose to observe them.

In a statement, the FDA said that “for a vaccine for which there is adequate manufacturing information," an EUA “may be appropriate once studies have demonstrated the safety and effectiveness of the vaccine but before the manufacturer has submitted and/or the FDA has completed its formal review of the biologics license application."

Pfizer said in a statement that it anticipates providing the agency safety data, including the median of two months safety information after the second dose, on a rolling basis. The trial has enrolled more than 31,000 participants, and 19,000 have received the second dose so far, the company said.

“The standards FDA is reportedly considering for a covid vaccine EUA represent appropriate balance between speed and safety in a crisis," Dr. Scott Gottlieb, who led the FDA earlier in the Trump administration and serves on Pfizer's board, tweeted on Thursday. “Even under EUA; you want higher assurance of safety and benefit for vaccine given to healthy people vs. drug given to those already sick."

“Any political effort to shortcut [the] process or degrade reasonable standards will be [a] Pyrrhic victory if people lack confidence in a vaccine," Gottlieb added.

The FDA will thoroughly review the application, and that'll take a while.

Once the FDA receives a company's submission, the agency's review process consists of several steps which, put together, could take weeks to complete.

The FDA is the only health regulator in the world that asks drugmakers for raw data files and does its own analysis, said Dr. Joshua Sharfstein, the FDA's former principal deputy commissioner from 2009 to 2011. “Now would not be the moment to stop" that practice, he said, despite the urgent need for a vaccine.

Besides reviewing clinical trial data, the FDA also inspects vaccine developers' manufacturing capabilities to ensure that every vaccine batch can be made consistently and that the process is squeaky clean, so that no impurities can make their way into a vial of product. This process involves a lot of paperwork sent from the companies to the agency and also, usually, on-site inspections at manufacturing plants. The agency declined to comment on whether it had already completed on-site inspections for Pfizer and Moderna.

After the FDA finishes its assessment of the company's application, it typically presents the data to an external advisory committee in a public meeting. Dr. Peter Marks, director of the Center for Biologics Evaluation and Research, has said that the agency is committed to holding advisory committee meetings to review individual vaccine candidates.

Those meetings will take time to schedule, but it's an essential step, according to experts both inside and outside the agency.

“How will [the public] know that we're not, like, holding something in and sweeping something under the rug? Well, the way they're going to know that is because any vaccine that we issue an emergency use authorization for will go to a public advisory committee meeting," Marks said in a Sept. 10 webinar hosted by the Duke Margolis Center for Health Policy. “It'll be critical for people to see what's in the briefing packages, they'll be able to see the discussion among an impartial group of advisers, they'll see the committee recommendation and they'll see the public dialogue that will take place at that committee."

Advisory committee members vote on whether they recommend product approval. While the FDA does not have to follow the committee's recommendations, the votes are public.

“It protects against political interference — it's important," Sharfstein said.

We contacted every advisory committee member and interviewed six of them about how they would evaluate an EUA application for a COVID-19 vaccine. These members (speaking for themselves, not for the FDA) indicated they would expect to see a level of evidence that could be tough to meet in the next 38 days.

One factor in their caution is that a premature EUA could make it harder to definitively evaluate an effective vaccine, because subjects in ongoing trials may drop out and new enrollments in trials with placebos would no longer be feasible.

“If an EUA came too soon where we don't have sufficient clinical efficacy data, it would make it very hard to actually complete the study as written," Dr. Paul Spearman, director of infectious diseases at Cincinnati Children's Hospital, said. “You would want to have enough clinical efficacy data by the time of an EUA to be pretty darn certain."

Another committee member is Dr. Archana Chatterjee, dean of the Chicago Medical School at Rosalind Franklin University of Science and Medicine. She also expressed caution about basing a hugely consequential decision on such a small number of cases, like the 32 in Pfizer's first look.

“It's hard for me to say with these small numbers will we have meaningful data to make a decision on," Chatterjee said. “I have not made up my mind on any of this because I need to see and discuss with colleagues what the data are and what the implications might be."

One option would be for the FDA to grant an EUA for a specific group of people, such as health care workers or the elderly, who are more vulnerable to COVID-19.

The data would have to support a specific vaccine use that aligns with a recognized unmet medical need, said Dr. Michael Kurilla, an advisory committee member and the director of the Division of Clinical Innovation at the National Center for Advancing Translational Sciences, part of the National Institutes of Health. For example, it's possible a vaccine could work well in young people but not so well in older people. In that case, it might not be that beneficial, because older people are much more vulnerable to serious disease.

“It's not simply a matter of saying we will EUA this product," Kurilla said. “We have to be very careful to define what it is we're trying to address."

Dr. Paul Offit, director of the vaccine education center at the Children's Hospital of Philadelphia, said he would like to see robust safety data, to make sure there are no neurological side effects, from Pfizer and Moderna. Both companies are developing so-called mRNA vaccines, a type of vaccine technology that has never been approved before. He noted that most people who get vaccines are healthy, so the bar for letting a vaccine go to market is necessarily much higher than for treatments intended for severely ill COVID-19 patients.

Finally, the FDA considers the committee's advice and makes its final decision on whether it will greenlight the product. Normally, the FDA aims to review applications for full approval within 10 months for standard reviews and six months for priority reviews.

It's unclear exactly how quickly an EUA review can be completed for the COVID-19 vaccine. The only other vaccine that has ever received an EUA was an anthrax vaccine, but it's not a useful comparison because the vaccine was already in use and the 2005 authorization was granted to allow the US. Department of Defense to resume giving the shots to military personnel after the mandatory vaccination program had been suspended.

Some steps could potentially be skipped when doing a review for an EUA as compared with a full approval, according to McClellan, the former FDA commissioner. For example, any vaccines needed for this pandemic won't need long-term storage, because they'll all be used quickly, so companies won't need to run tests and demonstrate to the agency that their vaccines can be stored for months on end. But to receive full approval, the agency might require that.

Still, McClellan estimated, the agency's review process from the time it receives an application to issuing an EUA could take up to a month.

All of this is just to get to yes on a vaccine. Getting shots in millions of people's arms is another story. The two vaccine front-runners from Pfizer and Moderna pose additional logistical challenges because they have to be kept frozen.

What could go wrong?

Having read through all these steps, you can start to see the points where the process could break down and how the public might find out about it.

• If a company lowers the bar for efficacy. The first four vaccine contenders have all released their clinical trial rules (Pfizer, Moderna, AstraZeneca and Johnson & Johnson), so the public should be able to assess whether the shots have met the companies' own standards to prove it works. If they unexpectedly change their schedules or the standards, that's concerning.
• If the FDA backtracks on its commitment to consult the independent advisory board, or if the agency's leaders reject the committee's advice, it would be a sign that they're acting under political pressure without scientific support.
• If FDA career scientists get overruled by political appointees, that would also be a major sign of political pressure. The decision on whether or not to authorize a vaccine will fall on Marks, head of the biologics division. FDA Commissioner Stephen Hahn, however, has authority to overrule Marks' decision, and Secretary Alex Azar of the Department of Health and Human Services has the right to further overturn Hahn's call.
• If FDA officials quit. Marks has said he'd resign if the agency authorizes an unproven or unsafe vaccine.

Ultimately, the FDA and everyone involved in vaccine development are seeking the perfect balance between speed and caution: Faced with a deadly virus that's taken the lives of more than 200,000 Americans and upended life, devastating the economy and tearing away the livelihoods of so many, of course there is an imperative not to waste any time and an urgent desire for a vaccine.

Yet a bad vaccine could do more harm than good, and even the perception of a vaccine that is not thoroughly vetted could be just as bad, if the public doesn't feel confident in taking it.

“A vaccine only works if it's safe, effective and administered," meaning people have to be willing to take it, said Bruce Mehlman, a political adviser to companies at the lobbying firm Mehlman Castagnetti Rosen & Thomas. (He doesn't represent any pharmaceutical clients.) “If it becomes another culture war football like masks, it will not help us get past the virus and return to normal."

It's unlikely we'll see a vaccine authorized in October, but to ensure the shot is safe, effective, pure and trustworthy, waiting a little longer with the knowledge that no steps have been skipped may be well worth it.

Do you have access to information about Operation Warp Speed that should be public? Email caroline.chen@propublica.org. Here's how to send tips and documents to ProPublica securely.