I wonder why he cares whether or not people delete their DNA?
I asked them to delete mine (although I'm not optimistic that they did so), and I'm glad that I did for two reasons. First, I don't think they dealt with me transparently and honestly from the start and second, whether or not that data is directly a risk to me, it's yet more data about me that's out there in the world and can be combined with other data to make a potent risk.
The less data about me that exists in any database, even trivial or apparently innocuous data, the better.
> The fact is that if you’re worried about privacy, you should be far, far more concerned about all the data that various companies are hoovering up about you based on your online activity.
This fallacy is oh so common in folks resisting privacy measures. I guess it's psychologically tough for them to realise how bad the situation is, so they have to go to any place they can to resist changing their habits
I love Steven Salzburg, but he's missing the main point here:
23andMe could have been sold to someone that is not based in California which would result in a loss of many protections currently there, such as being able to have the data be deleted.
Sure, the data is not that valuable. Nobody really cares that is doing serious decision making based on good science or following the law.
I think he also ignores a new risk that's developing: bad tests. Current polygenic risk scores are all the rage, but they are very close to junk science, and if not created and applied very very carefully, far more carefully than most machine learning models, they will be junk.
So even if there's nothing in your DNA that could be used to discriminate against you, bad application of the technology could harm (or benefit) you, completely randomly. All because some pointy haired boss demanded that a bad model gets built and applied, whether or not the engineers knew what they were doing or gave proper warning to management.
This isn't just health care, it could be admissions to a private school, or the application for an apartment or NYC housing co-op, or whatever.
That's a serious risk, that some junk company uses the data in completely inappropriate ways, once the data is out in the wild.
Why not delete? There's zero benefit to the consumer to keep the data in 23andMe, at least for this consumer. Others that want to connect with 5th cousins might think differently of course.
But the point is that it's a personal decision and we all have different values and wants.
This commentary attempts to reassure people about staying with 23 and me, but ultimately ends up concluding that there's virtually nothing useful to be gleaned from the data created from the 23 and me process.
Author dismissed privacy concerns in the same way we see others downplay it: you already are giving up your privacy in other parts of your life, why not give it up here, too? Total nonsense, IMO.
The conclusion I came to from this, that I don't believe the author intended, is that you should delete your data from this company because it is pointless.
> The fact is that if you’re worried about privacy, you should be far, far more concerned about all the data that various companies are hoovering up about you based on your online activity.
This tired canard makes me mad. It's not either/or. Be concerned about anyone who is collecting data on you and selling it without your consent.
And in my mind, the reason to delete your data from 23AndMe isn't to protect PII, it's to take an a salable asset away from a company that promised they wouldn't sell it in the first place, then changed their mind.
Data that can be used against my children is another.
My late wife had MS. It took her. Insurance companies would love that data to load against anything my kids do.
There are other issues but the fact is that companies will use DNA and every other data point they can to maximise what they take and minimise with loaded terms what they might, just might, maybe, pay out.
Insurance companies cannot use it. And if insurance companies in the future would be allowed to use it, they would require you to get DNA samples for your policy.
> That’s a tiny percentage: about 0.02% of your genome. So no, they don’t have your genome, but they do have a small sample of it.
What kind of reasoning is that? Fine, they're not doing whole genome sequencing on you (yet), but having a detailed chip profile of several million informative SNPs absolutely can and will be used to profile you.
Very quickly and easily I might add.
Classical linkage analysis has been used quite effectively to profile people since the 80s using only a handful of (polymorphic) markers, because the power of the analysis is driven more by the number of related members than by the number of markers of an individual.
23&Me has a customer base of more than 10 million people(!!)
Of course they don't store your entire genome; 99.9% of that is identical for all humans. That has no value to them at all. It's only the 0.1% that can vary between humans that's of any interest.
(Note that there are very different ways to measure that percentage and they can mean very different things. I'm not intending these percentages to be accurate, but I'm sure you get my point.)
> Fine, they're not doing whole genome sequencing on you (yet).
We do Whole Genome Sequencing, and sometimes we outsource the sequencing. We always get the excess of DNA back, and it is stored in our own freezers. Even in this scenario we can't be 100% sure they don't store the DNA or the files for their own purposes, but that's the risk we assume. The DNA we send is only identified by a number.
I can 100% imagine a company such as 23andMe storing DNA for later sequencing, or even doing WGS to do their side business, while sending you back only the genotype. Did you request your excess of DNA back? No, you didn't, because you didn't even know how much you sent or how much is needed for a genotyping. What you did was linking your DNA with your real name and some extra data, so further data augmenting is trivial.
> but having a detailed chip profile of several million informative SNPs absolutely can and will be used to profile you.
Yes, that was 23andMe's business model. They thought so too. Since they went bankrupt, I think it's safe to say, the commercial utility of such profiles was pretty overrated.
Yes the 0.02% thing is a bit disingenuous because he knows better: the bases the chip covers were specifically picked because they are variable in the human genome. They don't have "your genome", but as most of it is the same for everyone those 640k snps give much more information than 0.02% of the letters of a book would.
This is like saying if you have nothing to hide, you should consent to police searches. What is found only provides more possibly coincidental evidence to use against you (just as DNA provides evidence about your potential health).
"What’s fascinating–and a lot of fun, for some–is that by comparing these scattered landmarks, called SNPs or “snips,” you can get a very accurate picture of how closely related two people are."
This directly contradicts the claim that these samples reveal nothing about your health or disease risk. Maybe it doesn't reveal anything in isolation, but if you know some medical history about some of my relatives and you have their DNA info, then that gives you some significant info about me too.
>The fact is that if you’re worried about privacy, you should be far, far more concerned about all the data that various companies are hoovering up about you based on your online activity.
The risk for privacy is not that one piece of your data is out there, but that companies can recreate a very sophisticated model of you by aggregating many pieces.
The idea that one small breach of privacy is equivalent to the vast amounts of informations 23andme has getting correlated with hundreds of other small pieces, is absurd.
It is a total lie that you should not be concerned about your privacy, because total privacy is impossible. The author also does not understand incognito mode.
Okay but like, I'm not planning on committing a crime and nothing I do now is considered criminal, but let's play out the worst case scenario and a fascist government comes to power and something I do now is considered criminal and they can place me doing it with this DNA that as the author describes can narrow down if it was me pretty easily.
You can tell me I'm paranoid or something, but I can also just not give them my DNA for no effort and be all the more better off if something like this happens OR if I do commit a crime under current laws I haven't given up the ghost immediately.
This feels like short term little gain for catastrophic effects in the worst case scenario.
The author also makes this like a weird dichotomy with online tracking, I ALSO care about being tracked on the internet and my personal privacy is pretty important to me in general.
I want all of my privacy, or better worded I want privacy to be my choice such as here on HN where I use my real name intentionally. :)
Two common points crop up in these kinds of discussions:
- what if you're part of a minority the government wants to disappear, like the Uyghur in China? DNA is indicative of many minorities. You don't have to commit a crime.
- you don't have to share your DNA, some distant cousin sharing theirs is enough to implicate you (as in the Golden State Killer's arrest). You cannot control your far-flung relatives. You may not have a choice in this kind of privacy. That's what makes DNA unique in relation to other kinds of private data: your cousin's browsing history does not implicate you, DNA however may.
I fully agree with your apprehensions, but the question is whether this can be prevented at all.
We shed DNA in useful, analyzable amounts wherever we go. In a decade or so, "collectors" of DNA from the air may sprout up everywhere, aggregating DNA of the passersby and sorting it into buckets using, say, face recognition. Even if such practice was limited to the airports, the databases will grow. People have to prove their identity when boarding flights, so pairing them with their DNA trace is feasible.
And if a country bans this practice, another may not, and their database may be hacked and sold openly, so any person which traveled there will be exposed.
The privacy argument might work in some Western countries, and the corresponding legislation may be enacted there, but once you have to travel to India or China or Dubai profesionally, the cat will be out of the bag.
For those still doubting, this is not a hypothetical case.
In the Netherlands, in the early 30's we had a census. All the good jewish citizens of the good kingdom of the Netherlands filled in their religion. Because, why shouldn't they? Fast forward a couple of years, and those detailed census results are really handy for the occupying nazis.
During WW II, 95% of the jewish in the Netherlands were killed. Compare this with a country that does not have a central register of it's citizens (France), where "only" 25% of the jewish were killed.
Also, when you give up your DNA, you're not just giving it up for you. You're giving it up for your family.
Thing is, a fascist government probably isn't bother to use DNA to make sure they got the right guy. To them, if you look like a useful guy to blame, they'll blame you whether the evidence fits or not. The various "deterrence" effects of punishing wrongdoers don't really rely on the punished actually being guilty, it only relies on people thinking they're guilty.
You can see right now with the mass deportations, evidence and making a watertight case aren't priorities once you get to this point.
So I think the author's point stand, that there's little additional risk in some private company having your SNPs. The question is, is it worth it? I'd say, unless you (or a relative you want to help) are into genealogy, it's not worth it, even if the risk is small.
But genealogy is fun. It's also, I think, something that can be deeply meaningful for almost anyone.
Because, do you have all answers to what's important in life? Probably not, I hope? If you haven't, aren't you interested in what answers your own ancestors implicitly (through the lives they lived) gave to the big questions in life?
It's commonly said, "those who learn nothing from history are doomed to repeat it" etc. Might that not be true on an immediate, personal level too? History is more than grand politics, it's also the lives of normal people. And who could you learn most from, if not the people who are most similar to you?
That's my pitch for doing genealogy as a hobby... Now, it should be said, genetic genealogy is a pretty small part of genealogy, unless you're unfortunate with adoptions etc. in your family. Even for that, I'd say there are better options than 23andMe, I do not see personally have my SNP data there.
Point is, for all things, security is a trade-off, about which risks are worth it and for what gain.
Partial DNA like 23&me does is so cheap to measure now, something like $20 wholesale and even less if you have very large scales, with a one time requirement to collect. In a decade, whole genome will be similarly cheap, it's $100-$200 wholesale now. Such a hypothetical fascist government can make it a mandatory requirement to be a resident in a country or similar and justify it on crime prevention like they usually like to do.
I’m sorry, but the whataboutism argument being made about online data trackers and brokers being “the real bad guys” totally misses the point that insurers are extremely thirsty for data like this, which is a very different buyer than, say, a political campaign fund or marketing agency. But like, both are mutually concerning, too.
You know genomes. But you don't seem to understand how big corporations operate and what the risks to your privacy are when your DNA and/or significant fractions thereof start floating around. It takes ~33 bits to uniquely identify a human. This is 'gods own GUID' and it has far, far more than 33 bits, even in the most limited case.
This a bone headed article… umm we can’t extract anything from it about your health (*now)… so might as well just spread it everywhere?
Like he doesn’t even go into the fact that it could be used by law enforcement wrongfully etc: e.g Unregulated Chinese crime detection startup buys the data, you happen to be in China and get arrested bc they used inadequate algorithms that wrongfully accused you.
> However–and here’s the rub–some 25 years after the human genome was sequenced, and despite huge efforts to link genes and disease, there are almost no SNPs that tell you anything consequential about your health. If you have a genetic disease, you almost certainly already know about it, and if you don’t know, then the 23andMe data just isn’t going to reveal anything.
For someone who “knows genomes”, this is a brain dead take on microarrays. Lots of the content on arrays _is_ directly tied to a phenotype because there’s limited space so we directly test variants that are known to cause problems!
Is he really claiming that BRCA1/2 variants don’t increase risk of breast cancer in a meaningful way? Or that there aren’t tons of people who are XXY who don’t know even though it’s the hidden cause of many infertility problems?
This is just such a bad take it is hard to take anything said here seriously
> That’s a tiny percentage: about 0.02% of your genome. So no, they don’t have your genome, but they do have a small sample of it.
IIRC, 99 percent of the rest is shared by all humans, 95 precent is shared by humans and apes, and some 80 (?) percent is shared by humans and drosophila flies? That's likely the important 0.02%.
I run my genome twice through 23 and me, the V4 and V5 chip.
They’re doing this I found a mutation parentheses (not a polymorphism) in my CVS enzyme that was causing my family to have heart attacks before they were 50.
And I currently diagnosed two people just looking at their genetics one with celiac and the other one with 21 hydroxy deficiency. Just let them impress your doctor for test in proving it was right.
What makes me sad about this is that it’s such a valuable resource that no one’s going to have access to because of corporations and greed. Personalized medicine is the only way to cure diseases and the only way to find out what’s going on in your body.
Even if we accept the author’s contention that the downside risk is very low (and plenty of other comments explain why that is a bad idea), they make no case at all for the benefits. If there is no benefit to keeping it, then there is no downside to deleting it.
Definitely. I mean if you believe in some future public health benefit or whatever (right or wrong) sure. Very weird to hear someone emphatically voice support for a position and articulate no upsides at all. Imagine if somebody ran up to you and said "don't open that letter!" and then calmly explained it was probably junk mail anyways.
Salzberg states several times that one should browse in 'private' or 'incognito' mode to stop 3rd party tracking. This is false.
Incognito mode stops data such as web history and cookies being stored on the computer you are using - it is good (enough) for obscuring what sites you have visited from other people who may have access to your computer. (It may not defeat a deep forensic search, it might save you from family embarrassment).
Incognito mode does not hide any data at all from your ISP, your DNS server, or the web servers you visit - it does not do anything to defeat 3rd party tracking.
An error of this magnitude does make me wonder whether any of his other propositions are true at all.
> it does not do anything to defeat 3rd party tracking
It does reduce the footprint of data able to be correlated across browser restarts, which is not nothing, but is much less than most people assume.
So everything you do on this visit can be correlated, but when you close your browser and then come back, you're a new person not associated with your previous visit.
The arguments boil down to "we're all fucked so letting 23&me fuck us more is no big deal"
> ...this is only a problem because of our disastrous insurance-based, for-profit healthcare system in the U.S.
That is the reality for the subjects of the USA. So it is a problem
>...far more concerned about all the data that various companies are hoovering up about you based on your online activity
No. I take active measures against sneaky surveillance (my browsers cannot be tracked as far as I can tell) and I use my real name lots of places. I am in control. If my siblings, parents, children submit "their" private data to these evil data horders, I am not in control
Deleting your, and yours, data from 23&me will be closing the stable door, I am unconvinced that these sorts of people will actually delete anything (they will remove it from your view and control) but it has performative value
65 comments
[ 5.1 ms ] story [ 83.7 ms ] threadI asked them to delete mine (although I'm not optimistic that they did so), and I'm glad that I did for two reasons. First, I don't think they dealt with me transparently and honestly from the start and second, whether or not that data is directly a risk to me, it's yet more data about me that's out there in the world and can be combined with other data to make a potent risk.
The less data about me that exists in any database, even trivial or apparently innocuous data, the better.
https://rationalwiki.org/wiki/Not_as_bad_as
23andMe could have been sold to someone that is not based in California which would result in a loss of many protections currently there, such as being able to have the data be deleted.
Sure, the data is not that valuable. Nobody really cares that is doing serious decision making based on good science or following the law.
I think he also ignores a new risk that's developing: bad tests. Current polygenic risk scores are all the rage, but they are very close to junk science, and if not created and applied very very carefully, far more carefully than most machine learning models, they will be junk.
So even if there's nothing in your DNA that could be used to discriminate against you, bad application of the technology could harm (or benefit) you, completely randomly. All because some pointy haired boss demanded that a bad model gets built and applied, whether or not the engineers knew what they were doing or gave proper warning to management.
This isn't just health care, it could be admissions to a private school, or the application for an apartment or NYC housing co-op, or whatever.
That's a serious risk, that some junk company uses the data in completely inappropriate ways, once the data is out in the wild.
Why not delete? There's zero benefit to the consumer to keep the data in 23andMe, at least for this consumer. Others that want to connect with 5th cousins might think differently of course.
But the point is that it's a personal decision and we all have different values and wants.
Author dismissed privacy concerns in the same way we see others downplay it: you already are giving up your privacy in other parts of your life, why not give it up here, too? Total nonsense, IMO.
The conclusion I came to from this, that I don't believe the author intended, is that you should delete your data from this company because it is pointless.
This tired canard makes me mad. It's not either/or. Be concerned about anyone who is collecting data on you and selling it without your consent.
And in my mind, the reason to delete your data from 23AndMe isn't to protect PII, it's to take an a salable asset away from a company that promised they wouldn't sell it in the first place, then changed their mind.
Data that can be used against my children is another.
My late wife had MS. It took her. Insurance companies would love that data to load against anything my kids do.
There are other issues but the fact is that companies will use DNA and every other data point they can to maximise what they take and minimise with loaded terms what they might, just might, maybe, pay out.
It's not about the now.
It's about the later.
So it’s pointless in the end
What kind of reasoning is that? Fine, they're not doing whole genome sequencing on you (yet), but having a detailed chip profile of several million informative SNPs absolutely can and will be used to profile you.
Very quickly and easily I might add.
Classical linkage analysis has been used quite effectively to profile people since the 80s using only a handful of (polymorphic) markers, because the power of the analysis is driven more by the number of related members than by the number of markers of an individual.
23&Me has a customer base of more than 10 million people(!!)
(Note that there are very different ways to measure that percentage and they can mean very different things. I'm not intending these percentages to be accurate, but I'm sure you get my point.)
We do Whole Genome Sequencing, and sometimes we outsource the sequencing. We always get the excess of DNA back, and it is stored in our own freezers. Even in this scenario we can't be 100% sure they don't store the DNA or the files for their own purposes, but that's the risk we assume. The DNA we send is only identified by a number.
I can 100% imagine a company such as 23andMe storing DNA for later sequencing, or even doing WGS to do their side business, while sending you back only the genotype. Did you request your excess of DNA back? No, you didn't, because you didn't even know how much you sent or how much is needed for a genotyping. What you did was linking your DNA with your real name and some extra data, so further data augmenting is trivial.
Yes, that was 23andMe's business model. They thought so too. Since they went bankrupt, I think it's safe to say, the commercial utility of such profiles was pretty overrated.
This directly contradicts the claim that these samples reveal nothing about your health or disease risk. Maybe it doesn't reveal anything in isolation, but if you know some medical history about some of my relatives and you have their DNA info, then that gives you some significant info about me too.
I worked in DNA analysis for 6 years.
You should absolutely be worried about the data that various companies are hoovering up. Your DNA is part of it.
The risk for privacy is not that one piece of your data is out there, but that companies can recreate a very sophisticated model of you by aggregating many pieces.
The idea that one small breach of privacy is equivalent to the vast amounts of informations 23andme has getting correlated with hundreds of other small pieces, is absurd.
It is a total lie that you should not be concerned about your privacy, because total privacy is impossible. The author also does not understand incognito mode.
You can tell me I'm paranoid or something, but I can also just not give them my DNA for no effort and be all the more better off if something like this happens OR if I do commit a crime under current laws I haven't given up the ghost immediately.
This feels like short term little gain for catastrophic effects in the worst case scenario.
The author also makes this like a weird dichotomy with online tracking, I ALSO care about being tracked on the internet and my personal privacy is pretty important to me in general.
I want all of my privacy, or better worded I want privacy to be my choice such as here on HN where I use my real name intentionally. :)
- what if you're part of a minority the government wants to disappear, like the Uyghur in China? DNA is indicative of many minorities. You don't have to commit a crime.
- you don't have to share your DNA, some distant cousin sharing theirs is enough to implicate you (as in the Golden State Killer's arrest). You cannot control your far-flung relatives. You may not have a choice in this kind of privacy. That's what makes DNA unique in relation to other kinds of private data: your cousin's browsing history does not implicate you, DNA however may.
We shed DNA in useful, analyzable amounts wherever we go. In a decade or so, "collectors" of DNA from the air may sprout up everywhere, aggregating DNA of the passersby and sorting it into buckets using, say, face recognition. Even if such practice was limited to the airports, the databases will grow. People have to prove their identity when boarding flights, so pairing them with their DNA trace is feasible.
And if a country bans this practice, another may not, and their database may be hacked and sold openly, so any person which traveled there will be exposed.
The privacy argument might work in some Western countries, and the corresponding legislation may be enacted there, but once you have to travel to India or China or Dubai profesionally, the cat will be out of the bag.
In the Netherlands, in the early 30's we had a census. All the good jewish citizens of the good kingdom of the Netherlands filled in their religion. Because, why shouldn't they? Fast forward a couple of years, and those detailed census results are really handy for the occupying nazis.
During WW II, 95% of the jewish in the Netherlands were killed. Compare this with a country that does not have a central register of it's citizens (France), where "only" 25% of the jewish were killed.
Also, when you give up your DNA, you're not just giving it up for you. You're giving it up for your family.
You can see right now with the mass deportations, evidence and making a watertight case aren't priorities once you get to this point.
So I think the author's point stand, that there's little additional risk in some private company having your SNPs. The question is, is it worth it? I'd say, unless you (or a relative you want to help) are into genealogy, it's not worth it, even if the risk is small.
But genealogy is fun. It's also, I think, something that can be deeply meaningful for almost anyone.
Because, do you have all answers to what's important in life? Probably not, I hope? If you haven't, aren't you interested in what answers your own ancestors implicitly (through the lives they lived) gave to the big questions in life?
It's commonly said, "those who learn nothing from history are doomed to repeat it" etc. Might that not be true on an immediate, personal level too? History is more than grand politics, it's also the lives of normal people. And who could you learn most from, if not the people who are most similar to you?
That's my pitch for doing genealogy as a hobby... Now, it should be said, genetic genealogy is a pretty small part of genealogy, unless you're unfortunate with adoptions etc. in your family. Even for that, I'd say there are better options than 23andMe, I do not see personally have my SNP data there.
Point is, for all things, security is a trade-off, about which risks are worth it and for what gain.
Like he doesn’t even go into the fact that it could be used by law enforcement wrongfully etc: e.g Unregulated Chinese crime detection startup buys the data, you happen to be in China and get arrested bc they used inadequate algorithms that wrongfully accused you.
There is absolutely nothing convincing here.
For someone who “knows genomes”, this is a brain dead take on microarrays. Lots of the content on arrays _is_ directly tied to a phenotype because there’s limited space so we directly test variants that are known to cause problems!
Is he really claiming that BRCA1/2 variants don’t increase risk of breast cancer in a meaningful way? Or that there aren’t tons of people who are XXY who don’t know even though it’s the hidden cause of many infertility problems?
This is just such a bad take it is hard to take anything said here seriously
IIRC, 99 percent of the rest is shared by all humans, 95 precent is shared by humans and apes, and some 80 (?) percent is shared by humans and drosophila flies? That's likely the important 0.02%.
They’re doing this I found a mutation parentheses (not a polymorphism) in my CVS enzyme that was causing my family to have heart attacks before they were 50.
And I currently diagnosed two people just looking at their genetics one with celiac and the other one with 21 hydroxy deficiency. Just let them impress your doctor for test in proving it was right.
What makes me sad about this is that it’s such a valuable resource that no one’s going to have access to because of corporations and greed. Personalized medicine is the only way to cure diseases and the only way to find out what’s going on in your body.
It does reduce the footprint of data able to be correlated across browser restarts, which is not nothing, but is much less than most people assume.
So everything you do on this visit can be correlated, but when you close your browser and then come back, you're a new person not associated with your previous visit.
The arguments boil down to "we're all fucked so letting 23&me fuck us more is no big deal"
> ...this is only a problem because of our disastrous insurance-based, for-profit healthcare system in the U.S.
That is the reality for the subjects of the USA. So it is a problem
>...far more concerned about all the data that various companies are hoovering up about you based on your online activity
No. I take active measures against sneaky surveillance (my browsers cannot be tracked as far as I can tell) and I use my real name lots of places. I am in control. If my siblings, parents, children submit "their" private data to these evil data horders, I am not in control
Deleting your, and yours, data from 23&me will be closing the stable door, I am unconvinced that these sorts of people will actually delete anything (they will remove it from your view and control) but it has performative value
Delete the data!