The CIA now assesses that four nations - Iraq, North Korea, Russia and, to the surprise of some specialists, France - have undeclared samples of the smallpox virus.