>
Could the research have been legitimate?I assume yes.
> How is this research normally done?
You fill a lot of paperwork and get a lot of authorizations.
> Would that University of Michigan laboratory have the necessary biosafety level or no?
Perhaps. That is part of the details that go in the paperwork, and anyway not every request is aprobed because so some things are too risky.