I recommend you only send your genetic data to companies if you're willing to have it exposed. Then again I also recommend you make your genetic data public, for the common good. Here's Mine: https://www.openhumans.org/member/iandanforth/
No, that's not possible. 23andMe doesn't do full sequencing, that would be too expensive for their average customer. The main reason people take the test, which they heavily advertise, is that it tells you your supposed ancestry. It's basically a modern, more sophisticated version of race science. Instead of only comparing skin color, skull shapes, noses and such, they now look at specific sequences in specific genes and compare them among many people from around the world. The claim is this can tell you what your "ethnicity" is and where your ancestors came from. Ignoring of course that humans (and the genes they carry) don't necessarily have fixed physical locations and the interpretation, while maybe true, may also be complete bunk. But Americans love it for maybe obvious reasons.
When people talk about existential risk fears, this is without a doubt my fear. All it would take is a small group that is ethnically supremacist and technically capable. How many edge-lords joke that the problem with the world is that there are too many people? Imagine you could drastically reduce overall population while maintaining your own ethnicity. And it could be done slowly, a harsh flu now and again that affects the general population at a much higher percentage while sparing your own kin. It's terrifying to think this could be justified in the minds of some.
Though that's a chilling thought, I am more worried about someone trying to produce such a bioweapon, but just doing an amateur job and killing us all with their buggy alpha release.
If you're from an undersampled population (e.g. Africans), having more public data is useful for improving large scale genetic research. That's how we find things like ghost lineages. Most people's genetic data is significantly less valuable for research without other info (e.g. medical history) though, so I certainly wouldn't consider that universal advice considering the obvious privacy implications for you and your extended family.
Have you never seen an episode of Black Mirror?! But on a serious note, something seems so naive about making that available for anyone. The future is coming fast.
I think the stuff you can do with DNA and genetic testing is wild in how cool and useful it can be. How it can save tons of lives and really accelerate our medical research. But at this time it also seems wildly irresponsible to share your genetic information considering the massive privacy implications and the impossibility of anonymization. Especially considering that PII spills over into your relatives, making the PII leakage often out of your control. I'm not sure how to resolve this tbh. Homomorphic encryption?
> Especially considering that PII spills over into your relatives, making the PII leakage often out of your control
This is the part that gets me. I have young nieces and could conceivably have children someday. Making my DNA public could end up being an invasion of their privacy.
The Golden State killer was actually found due to their third cousin taking a DNA test. Obviously it is not perfect precision, but it reduced 850 suspects to 17[0]. These stories are great in that we found such a killer, but we cannot assume that data will always be used for good and I think history has shown us that it more frequently is used with malice.
For context, third cousin is your great grand aunt/uncle's great grandchild[1]. E.g. your parent's parent's parent's sibling's child's child's, child. I am doubtful most people know their second cousin let alone their third (I'm sure there are those that do though). But this is showing the reach of that information leakage, because it can come from someone you have never met in your entire life and do not even have indirect communication with (given the likelihood of your great grandparent being dead and requiring your grandparent to be in contract with their cousins or your parent to be in contact with their second cousin).
As more DNA is collected this extent might widen as statistical power increases but this is purely conjecture. I'll also note that the precision needed for reduction of suspects like this case is not the same as certain hereditary conditions but not for all. The main point is about how many people your actions affect and vise versa, that we do not live in a world where the consequences are exclusive to your actions (and importantly, where it is becoming less dominated by your actions).
Agreed, serial killers are rare, and it's likely that unsavory forms of discrimination will become commonplace. People will be eager to use genetic profiles aka "all available information" to "inform" all kinds of decisions.
Many of which can also have lots of good intent. I would not blame a doctor for wanting to do genetic testing to look for specific markers. But the whole plot of the movie Gattaca is employers and insurance companies discriminating against people due to risks, even if the risks are small because they can find people without those risks. (Which often creates a self fulfilling prophesy of gene-socioeconomic class status. Scifi not always about future issues...). The problem with cliques is that we get annoyed at them but we do seem to keep forgetting that the road to hell is paved with good intentions. But maybe cliques aren't good because they don't end up reminding us but instead teach us to ignore them and convince ourselves we've learned the lesson because we know the clique.
> The explanation is vague, so we don’t know exactly how many files were accessed
They didn't access "files" on 23andMe's servers; they scraped information that 23andMe was making available through its UI to even the most distant of DNA "relatives." In a way I think that makes 23andMe even more culpable than it would have been if someone were able to break into their servers.
> The company later confirmed the data’s authenticity, saying a hacker most likely used credential stuffing (trying an infinite amount of username/password combinations) to access its systems.
I’ve always found the breathless claims about genetic information being leaked, the shlockiest fear mongering of this data breach.
Seriously. What’s the threat model here? A human clone? Someone hacking a police database to replacing some criminal’s dna record with your record? None of these are plausible.
Even the reporting about compiling a list of people of Jewish ancestry is fear mongering. An antisemitic troll post? Absolutely. An actual novel threat? Well, probably not much more than a regexp and phonebook.
Seriously. Give me a real scenario that has been demonstrated that uses this information in a way that someone with… oh $10 million in resources could do. I’ll wait.
Are you in biomedical research? I feel like the answer is no, because if you were you'd understand how fast paced discovery is in biotech these days. Just because it's not a threat today (I agree, it isn't), doesn't mean it's not a threat in a 10 or 20 year horizon.
I agree. If you asked someone at Bell Labs whether the creation of a computer would cause gaming or digital addiction, the thought or idea wouldn't make sense because they didn't know what we know today.
That's great and all but again no genetic data was ever leaked at 23andme but everyone keeps reporting it like this is the information that was accessed by the attackers
Agreed. But I was responding to johnathankoran about whether leaking / releasing your genetic information would even be a potential threat. I think it very well could be in 10-20 years (and possibly much less). Enough of a concern for me that I wouldn't trust a company with that information.
Immediate threat scenario:
Ad targeting based on genetic data that isn't available through other means. For example, discounted plane tickets to Ireland. Aeromexico did a joke ad about this once.
Alternatively, imagine a genetic "klout" type company that harvests such data and is used like a personality credit score. Your employer, university, landlord can check whether you have the right "personality traits" without directly falling afoul of anti discrimination laws.
Notice that the important thing in both of these scenarios isn't whether genetics is truly useful here, it's that people believe it is regardless of actual efficacy. Phrenology and foot measurements were used for similar things decades ago.
Future threat: individualized, immutable presence identification and tracking from eDNA. We can already do this in marine environments and at a species level elsewhere, but it's a very new capability.
41 comments
[ 2.7 ms ] story [ 91.7 ms ] threadThe only benefit I can imagine* is knowing if I have individual genetic markers for something I should tell my son about.
DEF CON 25 - John Sotos - Genetic Diseases to Guide Digital Hacks of the Human Genome (2017): https://www.youtube.com/watch?v=HKQDSgBHPfY
https://en.wikipedia.org/wiki/Gene_drive
https://en.wikipedia.org/wiki/Nothing_to_hide_argument#Criti...
This is the part that gets me. I have young nieces and could conceivably have children someday. Making my DNA public could end up being an invasion of their privacy.
For context, third cousin is your great grand aunt/uncle's great grandchild[1]. E.g. your parent's parent's parent's sibling's child's child's, child. I am doubtful most people know their second cousin let alone their third (I'm sure there are those that do though). But this is showing the reach of that information leakage, because it can come from someone you have never met in your entire life and do not even have indirect communication with (given the likelihood of your great grandparent being dead and requiring your grandparent to be in contract with their cousins or your parent to be in contact with their second cousin).
As more DNA is collected this extent might widen as statistical power increases but this is purely conjecture. I'll also note that the precision needed for reduction of suspects like this case is not the same as certain hereditary conditions but not for all. The main point is about how many people your actions affect and vise versa, that we do not live in a world where the consequences are exclusive to your actions (and importantly, where it is becoming less dominated by your actions).
[0] https://www.science.org/content/article/we-will-find-you-dna...
[1] https://i.pinimg.com/736x/8a/cc/23/8acc23f05c79faabe0740d656...
[1]https://news.ycombinator.com/item?id=37931383
> The explanation is vague, so we don’t know exactly how many files were accessed
They didn't access "files" on 23andMe's servers; they scraped information that 23andMe was making available through its UI to even the most distant of DNA "relatives." In a way I think that makes 23andMe even more culpable than it would have been if someone were able to break into their servers.
> The company later confirmed the data’s authenticity, saying a hacker most likely used credential stuffing (trying an infinite amount of username/password combinations) to access its systems.
That's not what credential stuffing is.
Seriously. What’s the threat model here? A human clone? Someone hacking a police database to replacing some criminal’s dna record with your record? None of these are plausible.
Even the reporting about compiling a list of people of Jewish ancestry is fear mongering. An antisemitic troll post? Absolutely. An actual novel threat? Well, probably not much more than a regexp and phonebook.
Seriously. Give me a real scenario that has been demonstrated that uses this information in a way that someone with… oh $10 million in resources could do. I’ll wait.
No hacker is running nucleobase query.
“The BMA has warned that the possibility of developing weapons genetically targeted at different ethnic groups could be just five years away.”
Published Jan 30, 1999
https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1114775/
That type of total secrecy only exists in bad movies and conspiracy theories.
Alternatively, imagine a genetic "klout" type company that harvests such data and is used like a personality credit score. Your employer, university, landlord can check whether you have the right "personality traits" without directly falling afoul of anti discrimination laws.
Notice that the important thing in both of these scenarios isn't whether genetics is truly useful here, it's that people believe it is regardless of actual efficacy. Phrenology and foot measurements were used for similar things decades ago.
Future threat: individualized, immutable presence identification and tracking from eDNA. We can already do this in marine environments and at a species level elsewhere, but it's a very new capability.
It's super lame that the company doesn't enforce 2FA.
you just cant trust them.
unfortunately i think my mother has pulled my name into ancestry... not much i can do about that except not re-enforce the link