Breach exposed more than one million DNA profiles on a major genealogy database

https://www.buzzfeednews.com/article/peteraldhous/hackers-gedmatch-dna-privacy

by pseudolus • 6 years ago

698 396 6 years ago

For those who are annoyed about the name of the site not being in the title: GEDMatch was phised a few days ago, then yesterday phishing led to the data exfiltration from the Israeli DNA site MyHeritage.

https://www.myheritage.com/

markdown• 6 years ago

I thought myheritage was owned by the Mormons.

hangonhn2• 6 years ago

Just out of curiosity, is there a reason for Mormons to especially care about their genealogy?

throwawayForMe2• 6 years ago

FamilySearch is the Mormon site.

hpoe• 6 years ago

Nope, you're thinking of Family Search that is owned and operated by the Church of Jesus Christ of Latter Day Saints.

KMag3• 6 years ago

What does the GED stand for? Genetic ??? Database?

To someone who grew up in the U.S., GEDmatch sounds like a dating site for people who took a test in lue of completing secondary education.

pbhjpbhj• 6 years ago

One use of GED is for GEnealogical Data[base], or Genealogy Data.

GED files have been used for decades in genealogical circles at least. So I think that's what they're referring to?

https://en.m.wikipedia.org/wiki/GEDCOM, for example.

staticautomatic• 6 years ago

I upvoted you and FYI the word you’re looking for is “lieu”.

GnarfGnarf2• 6 years ago

"GED" is the first three letters of the genealogy data interchange format called GEDCOM (GEnealogy Data COMmmunication).

pricci• 6 years ago

I think it was like this:

Millions of GEDMatch accounts where opted in to share info with the police, without consent. Also, user emails where leaked, which lead to a phishing attack targeting MyHeritage users. 16 of them fell for it and they passwords were stolen.

loughnane• 6 years ago

This is why I’ve been putting off getting my genome sequenced. One breach and it’s out there forever.

I’ve heard good things about nebula[0] as a way to get an anonymous genome but have yet to be motivated enough to take the plunge

[0] https://nebula.org/whole-genome-sequencing/

vmception• 6 years ago

surely enough of your cousins did that it doesn't matter

est313• 6 years ago

It's kinda sad that the genome sequencing machines need to be fed loads of genomes in order to offer cheap prices for customers. You can't just buy one for home then use it a couple of times to sequence your family. That'd be most privacy preserving, but the fabled 1k whole genome prices are (currently) only available in high throghput machines. OTOH it's also better because that reduces the nonconsensual sequencing.

HenryKissinger• 6 years ago

The federal government could maintain a central database containing the DNA of every citizen. Submitting a sample might be incentivized by barring people from, say, receiving social security, disability, government backed mortgages and student loans, food stamps, tax refunds, and other federal benefits if someone doesn't comply.

The National Institutes of Health, the Centers for Disease Control, the Central Intelligence Agency, the National Security Agency, the FBI, DEA (Drug Enforcement Agency), ATF (Alcohol, Tobacco, and Firearms), ICE, CBP, and DHS (Department of Homeland Security) could then mine the database for insights into disease, epidemics, crime, intelligence, and so many other purposes. Just imagine the possibilities.

KMag3• 6 years ago

Pseudononymously getting yourself sequenced is the way to go, but if enough relatives have their genes leaked under their real names, piecing together family trees isn't difficult.

One half-hearted option is to order a kit "as a gift" from one of the major sites and register it under a pseudonym. You're taking a risk that they're not keeping track of which kit serial number is shipped to which shipping address, and hoping the timing of the order can't be too easily correlated with the serial number.

anderspitman• 6 years ago

Nebula is definitely an interesting entry into the market. There's also Dante Labs[0], which often offers 30x whole genome in the 200-300USD range. You can download all your raw data (including FASTQs, h37-aligned BAMs, and VCFs) from AWS. There are some quality concerns (and they use BGI instead of Illumina sequencers), but at that price it's tempting to do Dante and Nebula as a check on each other.

Dante also has what seems like a pretty good privacy policy, including an option to destroy your saliva sample and delete all your data[1]. Obviously you still have to trust them, but it's a step in the right direction.

There's a good Facebook group for customers of both Dante and Nebula[2].

[0] https://www.dantelabs.com/

[1] https://us.dantelabs.com/pages/privacy-policy

[2] https://www.facebook.com/groups/373644229897409/

kbenson• 6 years ago

including an option to destroy your saliva sample

Until I read that sentence, it honestly never occurred to me they would keep that around. The data, sure. Biological samples? I just assumed they would be disposed of after use.

bredren• 6 years ago

Is it strange to suggest discussing anything on Facebook, given how little privacy is afforded to users?

I find it just a bit weird that products that customers recognize require privacy as a core tenant would also just head on over to Facebook to add new, targeted meta to their verified Facebook profile.

divbzero• 6 years ago

About a decade ago I thought about volunteering for one of the public genome projects but then realized that (1) the legal protections didn’t exist yet and (2) the privacy question should be considered not only by me but also by my family.

ars• 6 years ago

One of the biggest of those: https://www.joinallofus.org/

I've considered joining it.

pixl97• 6 years ago

Is there any law/rule stopping me from getting your DNA and getting it sequenced? Other than most people wouldn't want to pay to get that done? Collecting your DNA would be the hardest part of that, I guess.

jrumbut3• 6 years ago

Regardless of their policies, they still want to store it themselves and put it on the Internet.

I am hoping that someday there will be a sequencing company that will mail me a drive containing the only copy and destroy the sample.

I'm not worried about a sophisticated attack on my individual sequence but I suspect most of these services are or will be targeted by advanced and persistent attackers.

Call me paranoid but I don't want my genome in an internet connected database (though I am very curious to see it).

lukaa• 6 years ago

And you should trust that company or government based on what?

njovin• 6 years ago

This is not meant to be confrontational in any way: what are the risks of having your genome exposed?

mirimir5• 6 years ago

I wonder if there's some way to do testing on a walk-in basis, in a way that would allow transparency re the lack of sample and data retention.

So a customer walks in, provides a sample, and walks out with data on a thumb drive. And perhaps also with the module that was used for the analysis.

all_blue_chucks14• 6 years ago

What is the impact of having your DNA known? As far as I can tell the worst case scenarios are finding out you have to pay child support or getting placed at the scene of a crime.

If those risks don't apply to you, who cares?

dfee• 6 years ago

If you’ve got nothing to hide... then make it all public. Let’s start with your finances.

nickff• 6 years ago

This is a variant of “the honest have nothing to hide” argument, which is just wrong.

Polylactic_acid• 6 years ago

What are the benefits of you knowing? Seems like the only reason is mild curiosity.

austhrow7432• 6 years ago

Getting placed at the scene of a crime applies to everyone.

Remember that once you do it, it’s out there forever. So you can’t just rely on “I haven’t and won’t break any laws that exist in my country right now”.

Having certain characteristics that show up in your test could be illegal in 20 years time. You don’t know.

cortic2• 6 years ago

I was just wondering if this one leak would spur a hike in organ thefts. Or a spike in abusive husbands and fathers, pedophiles and rapists tracking down the victims that escaped them.

Even if this doesn't happen, the future is a devious thing; I think we will eventually get to a stage of gene oppression; We have went through periods of oppressing and persecuting religion and ethnicity. DNA seems even more vulnerable to this kind of prejudice. And even if we can secure some legal protection, to the million peoples families, that won't matter now.

I don't know what will happen in the future, but i can imagine how much smoother the holocaust would have went if DNA were public.

pavel_lishin2• 6 years ago

If those risks don't apply to you, who cares?

Others have mentioned that that's a bad argument, so I won't rehash that.

getting placed at the scene of a crime

That's a pretty damn bad "worst case scenario", but here's a few I'm going to toss out without too much thought:

1. Health insurance companies can deny you coverage. In America, that can be a literal death sentence. (Yes, GINA 2008 was passed, no, I don't want to bet my future health care coverage on it not being repealed, mangled, or bypassed in some other way.)

2. International risks. A lot of discussion here is largely focused on American law. But many of us aren't American, or aren't just American. Look at my username; I have ties to another country, and I frankly have no idea what sort of risk I might get exposed to there. Getting placed at the scene of a crime in some jurisdictions is much more serious than you make it out to be; being identified as being a relative of someone else could also have dire consequences.

3. You know those scams where Grandpa Joe gets a frantic call from his distraught granddaughter Jane, and she's in Mexico being held up on a bogus charge, but if he wires their police department $500 ($5000?) the whole thing goes away? This becomes much easier if you can look up family histories.

4. You cannot predict the future. You have no idea what's coming down the pipeline.

theCodeStig• 6 years ago

According to their own FAQ, Nebula uses a lab in HK. In current times, that may be of concern.

leafboi3• 6 years ago

From an ethics standpoint their's something to talk about here...

From an individual standpoint I really don't care about someone out in the public knowing my genome. It's not like I store my passwords on my genome, how is this information going to be used against me?

anitil• 6 years ago

One example might be the BRCA gene mutation. It gives you a higher chance of breast cancer and is typically associated with Ashkenazi Jews.

I'm sure your insurer would be interested to know if you have it, and that potentially your children are at an elevated risk.

Unfortunately there might be people interested in the ethnic association as well.

cblconfederate• 6 years ago

If you were putting off 23andme in 2009 you would miss out on their health reports (they have banned since).

If you were putting off whole genome sequencing last year, it will be banned by next year.

I m afraid it works the opposite: early adopters take risks and reap some rewards , late adopters are being played by regulators, spying govts and scammers.

kobbad• 6 years ago

I'm the founder and CEO of Nebula. I think in the not too distant future, everyone will get whole genome sequencing as standard of care. We think it's important to set up the privacy frameworks today around storing and sharing access to DNA. It's interesting because all of the risks of having your DNA data out there are not fully understood yet. And, as a consequence, legislation hasn't caught up to the technology. Should life insurance companies be able to use your DNA? Should schools be able to use it as an admittance criteria? Well, right now the law isn't stopping them from doing so. This hasn't been a huge problem today because, if you're really concerned about DNA privacy, you just won't buy a DNA test. But, sooner than later, you'll need genetic testing to get the right medicines, optimal treatments, best diagnostics, etc. Once whole genome sequencing makes the transition from consumer use cases to clinical ones, many users will be faced with choosing between their health and their privacy. We don't think that's a fair choice and think we need to start working on mitigating the privacy risks today.

est313• 6 years ago

Not saying that building databases of DNA is a good idea, but DNA is basically public information. Everyone whose hands you shake (nowadays quite rare) gets copies of it. The Amazon package you get has genes of every human who touched it. If you send it back, you are sending Amazon your genes. The only issue is the sequencing and the consent to use it for purposes like "improving our services" aka improving the ads targeting or insurances (once the DNA company is bought by an insurance). Consent is arguably less of an issue for hackers.

ivalm2• 6 years ago

It is a bit like face recognition databases. In principle, the data is already public-enough. In practice, building these databases enables qualitatively higher levels of surveillance.

est313• 6 years ago

Definitely agree. The point I'm trying to make is that DNA is a bit more "private" than your face, as there is a nontrivial cost to sequence it, but in general it's the same level. One day we'll be able to read thoughts and I'm pretty sure that some folks will build thought databases and people might even share their thoughts with the public... and ad companies will love it because they love checking the reactions of people to ads.

jeffbee2• 6 years ago

How, exactly? It's not like I can use wide-area instrumentation to locate you via your genome. You can imagine how to do it with cameras and faces, but I just don't see the method for DNA.

subhro• 6 years ago

This was bound to happen at some point of time. I have been having repeated "conversations" with my dad about why he and I should NOT send a cheek swab to 23andme (or any similar services). Today I think I will be able to drive the final nail in that coffin.

tossmeout3• 6 years ago

There should be fines big enough to bankrupt the companies who fail to secure data this kind of data. Is there some other way to convince them to take the issue more seriously?

MattGaiser4• 6 years ago

That just pushes them offshore.

I would rather that there be greater security training in software development programs/bootcamps.

I’m a software engineer. I know a lot of software engineers. None of us have ever been trained in security.

Any “best practices” are usually picked up in Stack Overflow conversations.

tossmeout3• 6 years ago

Software engineers don't run these companies, executives do. Even if you have security training, that won't do you much good if leadership doesn't value security. If your company stores highly-sensitive data, you need teams dedicated to security, you need regular audits, and you need your entire company trained to handle phishing attacks.

harimau777• 6 years ago

It seems to me that the way to deal with offshoring would be to bring back a modern version of outlawery. The US could basically declare: "Until this corporation pays their fines the US will not prosecute or extradite any individual or corporation who hacks them, steals their physical or intellectual property, declares debts to them canceled, or violates contracts with them."

jhart99• 6 years ago

Verogen might very well be in trouble because of CCPA violations either from state fines or from consumer suits.

tzs2• 6 years ago

There should be fines big enough to bankrupt the companies who fail to secure data this kind of data

...and then when their assets are broken up and sold off in bankruptcy, your sensitive data ends up scattered to random companies you never heard of.

thephyber7• 6 years ago

As someone who works in cybersecurity, it's always hard for me to interpret PR language like "orchestrated through a sophisticated attack". This could be aimed towards non-savvy readers meaning basically anything or it could be accurate and describe a nation-state (although I don't get the feeling of a sophisticated nation-state actor here).

The DoJ used similar wording when prosecuting Aaron Schwartz for using Python scripts to glue together "curl" calls.

zitterbewegung• 6 years ago

Just wait until Krebs on Security talks about it.

dayjobpork• 6 years ago

Krebs on Doxxing

game_the0ry2• 6 years ago

I think you interpreted this dishonest PR spin just fine.

IncRnd• 6 years ago

Often, security bulletins will use the word sophisticated when describing multi-step attacks.

Zircom• 6 years ago

Step 1: Type in stolen username

Step 2: Type in stolen password

Step 3: Click log in button

Step 4: ( •_• ) ( •_• )>⌐■-■ ( ⌐■_■)

Step 5: I'm in

One example of a "sophisticated" attack

hunter2_• 6 years ago

I think the metaphor of "orchestration" refers to, as an analogy to actually composing/arranging music for an orchestra, getting lots of other entities to do what one entity specifies that they do. Amplification of control. Not "basically anything."

"Sophisticated" I suppose means above-average in complexity, which indeed could be "basically anything."

dwd• 6 years ago

Unless they come out with details of a convoluted deeper infiltration, escalation of privilege, and careful exfiltration of data over a period of time to escape detection I wouldn't buy the PR bs.

all_blue_chucks14• 6 years ago

As someone who works in cybersecurity, it is perfectly clear to me that victims of attacks don't want to sound inept in their announcements so they ALWAYS say attacks are "sophisticated," "orchestrated," or "advanced." Nobody is going to say "we were hacked because we lack even basic security precautions." Instead, everything is an "APT."

mauvehaus• 6 years ago

Point of order: the victims of the attack are the million or so people reading about it in the news.

The targets of the attack are doing their level best to control the narrative by spinning their attackers as extremely sophisticated so they don’t end up with a million or so people holding torches and pitchforks outside their offices.

tricolon• 6 years ago

By the way, it's Swartz

ddod• 6 years ago

Speaking of misleading cybersecurity language, note how you used the term "nation-state", which is a word that indicates a specific subset of countries and is not just a fancy synonym for "country".

thephyber7• 6 years ago

That's an existing problem that hasn't been solved in geopolitical meatspace. I don't expect it to be solved in cybersecurity first.

That said, for my understanding: which political bodies are countries but not nation-states? Is this a reference to places like Singapore and the Vatican, which are probably more accurately labeled city-states?

Balgair• 6 years ago

To be fair, curl is a nightmare of pedantry without something like postman to deal with it all for you. BTW, when did postman come out anyway?

Godel_unicode2• 6 years ago

If by which you mean it adheres to the specs and does what you tell it to, then sure?

thephyber7• 6 years ago

Postman is nice and ergonomic!

curl is great if you already have the command crafted. My suspicion is that the Python script scraping a web page for URLs/IDs which then ran a curl shell command which saved the resulting document to the file system.

AviationAtom• 6 years ago

On the subject of nation-states, they want the data to help out spies

aahhahahaaa• 6 years ago

So they sent an email to their users that states:

We can assure you that your DNA information was not compromised, as GEDmatch does not store raw DNA files on the site. When you upload your data, the information is encoded, and the raw file deleted. This is one of the ways we protect our users’ most sensitive information.

This is kind of BS right? It's encoded... not encrypted.

Shared404• 6 years ago

Presumably. However, if it was a PR drone who wrote that, it may or may not be accurate as to whether or not it was encoded/encrypted.

I would just assume that it has in fact been compromised though.

neltnerb• 6 years ago

Or at least a summary version of it with all the data they felt was relevant to keep... so everything we currently know to be important.

aasasd• 6 years ago

I would hope that it means, “some data is extracted to a format that can be used for particular operations that the service is doing, but not others that are possible with the full DNA”. Sort of an index.

Of course, it would still mean stolen data could be used for the same operations (and some others) if someone figures out the encoding, or data can be copy-pasted where it doesn't belong.

nelaboras• 6 years ago

This seems very odd. These sites add features over time when new patterns are discovered, so I'd doubt that they delete any parts not used today because they might be useful in the future...

slg5• 6 years ago

Can someone explain the potential short to medium term fears of one's DNA leaking? My initial assumption is that it would be less of a problem compared to nearly any other personal data leaking. Like it certainly sounds creepy, but credit card or other financial data being stolen presents a huge headache and creates a lot of work.

I understand that in specific instances, for example when paternity is in question or if a person is hiding from someone this information getting out could be catastrophic, but that applies to such a tiny portion of the population. So for most people, what is the downside to some random individual knowing the country of origin one's ancestors are from or that they might have a genetic predisposition to heart disease? It isn't like any reputable company is going to be able to use this information against us.

Plus in the long term there are likely going to be ways to get this information directly and almost instantaneously from any personal interaction you make since we can't really stop ourselves from shedding our DNA wherever we go.

philmcc• 6 years ago

My hunch is that if this information is used against you, you'd never know.

First scenario that comes to mind: The insurance company that gives you an extremely high quote because you come back as "high risk" from a 3rd party company that they use to vet applications, and that 3rd party company uses your genetic predisposition for a condition.

mej10• 6 years ago

For what it's worth, that is illegal in the USA at least. Genetic Information Nondiscrimination Act passed in 2008.

slg5• 6 years ago

This requires the insurance company to be doing something illegal and for it to really cause damage all their competitors have to be doing it as well. If this ever becomes widespread, it would be quickly obvious when a large number of ostensibly healthy people are given quotes that match their genetic profile but not their medical history. I'm just not sure that is a reasonable fear.

MattGaiser4• 6 years ago

I may be one of the people who lost DNA in this breach.

I am not currently worried about anything, but I also know that I don’t know everything DNA can be used for. My greatest concern consists of things some smart crook might think of doing.

While a reputable company might not use the DNA for fear of getting sued, they might use a crappy contractor who does not care.

Banks care about information security and take it seriously. They use a crappy contractor called Equifax which doesn’t.

soulofmischief• 6 years ago

Think bigger. Insurance. Loans. Financial predation. The right to bear arms. Social stigma created by incumbent politicians wishing to divide their people over meaningless differences.

andrewem3• 6 years ago

This is a side note about your example, but you say "Banks care about information security and take it seriously. They use a crappy contractor called Equifax which doesn’t." If banks send important information to a contractor which they're unable to verify takes information security seriously, then it's hard to see how the banks can be said to be taking it seriously.

bagacrap• 6 years ago

this presentation outlines the kind of terrible attacks that could be based on your DNA in the near future https://youtu.be/HKQDSgBHPfY

tldr, CRISPR allows targeting bioweapons at specific individuals.

slg5• 6 years ago

Thanks for the link to that video. I don't have the time to watch it now, but I will come back to it later. Although on the surface, specifically targeted bio-engineered weapons seems like a silly fear for most us when bullets are so cheap. If someone wants me dead, I don't think any difficulty accessing my genome is going to be what stops them.

kilo_bravo_3• 6 years ago

Nothing.

Absolutely nothing.

The DNA records aren't the type that can be used to clone you, or frame you with some kind of non-existent DNA copying machine.

They are autosomal records. (or similar genealogical, or non-medical, types)

The people spinning fantastic fairytales about how the jackbooted thug of big brother is going to crush your throat probably don't even know what autosomal means and no amount of eduction will convince them.

I encourage everyone to submit their Autosomal DNA to public databases. You may bring closure to someone who has been or known a victim of a horrific crime and there is no risk to you.

You have at least one reply about insurance companies using this information to screw you.

1. This type of information is practically useless, actuarially, and

2. It has been illegal for them to do so for many years.

thephyber7• 6 years ago

or frame you with some kind of non-existent DNA copying machine

I can imagine the hacker swaps your name + account metadata on the data warehouse website with the DNA content of a murderer. Then you get a visit from the police just like you were being SWATted.

The mismatch is only found if the police bother to verify by doing a fresh DNA comparison (which they might, but only if they can't convince you to admit guilt first).

thephyber7• 6 years ago

there is no risk to you.

There is always risk. You probably don't see it yet just like only privacy-forward folks thought Facebook's encouragement to "share everything" publicly (circa 2007) foresaw the problems that would commit 10+ years later.

The small benefit of closure to a stranger who has already dealt with the grief of loss is not worth it for me. It depends on your personal value system.

It has been illegal for them to do so for many years.

Laws can change. Just like I always assume a company can screw me after I agree to a ToS (eg. through a pivot, an M&A, or a bankruptcy), I assume any law can change with enough societal acclimation.

Also, laws are relative to where you are. If you try to visit another country, expect that they might have access to your leaked data. Hopefully you never want to work as a spy in the future.

eddyg• 6 years ago

Sorry you're being downvoted for raising excellent points.

Watching The Genetic Detective[0] series has really shown what a great resource a searchable DNA database can be for people like CeCe in helping to solve violent crimes... even when they have been "cold cases" for so long.

[0] https://abc.com/shows/the-genetic-detective

mLuby• 6 years ago

Well, as a non-criminal thinking about it for a few seconds, various types of blackmail come to mind:

- you are the biological parent of this person who's looking for you, and if you want to stay anonymous…

- your husband isn't the father of his children, and if you don't want him to find out… (follow-up: both parents know but don't want the kids to.)

- you've been living under someone else's identity or a fake name…

- your ancestor was a slave-owner or Nazi or something and if you don't want the people you care about to know…

- your sibling isn't actually a blood relative, and so now the inheritance is in question…

These are all probably extremely rare cases, and were likely already known before or immediately after the test, but it's cheap to spam out the emails to see who's still trying to hide it. In a large enough population, it's still a worthwhile criminal enterprise. And their rarity makes them all the more vulnerable to blackmail. Where before it would have taken real legwork to find them, now it's just some data processing and emailing.

A similar concept is like those annoying ads for semi-legal websites where you can look up someone's criminal history, there could be a similar thing to look up someone's biological records. There might be a dating app in there too: filter for infertility or rare diseases?

There are plenty of other things, from the mundane to the exotic:

- having your medical care made more expensive or being denied insurance.

- being wrongly accused (and even convicted) because crime scene DNA was close to yours or a relative's.

- hiring based on genetic factors as in Gattaca.

- individually targeted attacks like the peach allergy from Parasite.

And again, that's off the top of my head; criminals are much more creative.

The key point that makes DNA (and other biometrics) even worse of a breach than credit cards or bank statements is it cannot be "reset."

drusepth• 6 years ago

Is there a list somewhere of who exactly was exposed? It's difficult to remember which sites I've given DNA to and which I haven't.

acwan933• 6 years ago

I’ve always wondered if this were a worthy business proposition, cause I would definitely buy a product like this:

Basically all of the features of 23AndMe/Ancestry/etc, but done offline. You’re given an app to download online, provided all of the hardware needed to spit in a tube, and get the same results.

No data stored on a cloud server, and no centralized database of everyone’s DNA. That’s probably where the real business model is though.

eloff• 6 years ago

I think you're missing the part where you have to send the tube to a lab to do the actual sequencing. At that point they have your data, and even if there were to be a provider that says they don't keep it, that's about as credible as all the VPNs which "don't keep logs" where we later discover, whoops, they lied...

acwan933• 6 years ago

Right, maybe this is where I’m being ignorant, but would there be a way to do the actual sequencing down to a consumer device?

I presume the machines used are pretty complex.

ClumsyPilot• 6 years ago

Well, you could sue for breach of contract and have penalties in the contract. After all, you rely on other people to do their jobs in other critical aspects of your life

parishill• 6 years ago

Yikes... Now I'm glad I have been telling all my friends who are considering using genealogy database services to use fake names.

cinquemb• 6 years ago

I'd be only interested in this stuff when we can do our own dna readouts at home and compare it against population level statistics that have been published publicly by researchers

pickledcods• 6 years ago

This is the same level as having a breach of biometric data.

With password/payment/location breaches you have the ability to change what you entered as to invalidate/outdate the data which was stored.

Having your biometric/genome authentication data stolen or made public will be a nightmare.

mirimir5• 6 years ago

No, not really.

There's no practical way to protect our genomes in meatspace. We're constantly shedding DNA into the environment. Hair, skin, saliva, etc. For example, an adversary can just tail us to a coffee shop or restaurant, and take a utensil or straw or napkin that we've used. And then submit the sample using a fake name, as investigators often do.

Edit: Those are excellent comments about scale. But generally, if you don't want to publicize your genomic data, just don't send in a sample.

dave5104• 6 years ago

That's a lot more work, and requires far more dedication and resources, than just picking up the data from a dump on the black market.

clusterfish• 6 years ago

But you can't do that to a million people, only to individual targets. Economic scale matters in a lot of evil plots.

Krasnol• 6 years ago

It could become very interesting for a fascist state.

russdill• 6 years ago

According to GEDMatch, they do not store genomes.

sneak• 6 years ago

This is why I did my DNA sequencing several years ago with a fake name, a sparkling brand new email address, at a unique domain registered for the purpose, with a fake name as the registrant, paid for with a prepaid card, via a VPN. I downloaded the results and let all of it lapse; other than the DNA itself, it is utterly disconnected from the rest of my digital records.

It's a shame that one has to go to such lengths to safely use health-related electronic services.

moltar• 6 years ago

That’s why I bought the tests on Amazon on Father’s Day sale. Then used completely fake info and fake email to register on the testing company site. Totally anonymous as there’s no way to link the purchase to results.

crumpled4• 6 years ago

Eventually that data will become associated with your real identities. How could it not? you're obviously so-and-so's grandfather/first-cousin/whatever, and they gave their names.

jobigoud2• 6 years ago

For 23AndMe you can buy the kit in cash in a store like Target and post the sample. Then use anonymous connection and email to use the website and get the results.

systematical• 6 years ago

1 million and me.

coronadisaster2• 6 years ago

Probably the worst breach in history (so far), because unlike anything else, this information can't be changed

novok• 6 years ago

This is why I want a genetic sequencing lab that will sequence your genome, send it to you encrypted by your own public key and once you confirm receipt and verify it is valid, DELETE IT COMPLETELY. Along with the record you were their customer after the 6 months or whatever required for waiting out chargebacks.

Then you can analyze your DNA with a desktop app that doesn't send out any data.

The deleting part is hard to find.

daave• 6 years ago

Seems unlikely to be a sustainable business.

For GEDMatch, Ancestry.com, 23andMe, etc, most of the value comes from being able to aggregate many people's data. If they had to delete it after collecting, they'd have to charge a lot more, and there's just no market for that.

Perhaps they could anonymize the data (at least, purge foreign key references to account/billing info) after 6 months, but not delete it.

0xy• 6 years ago

Much like you can't anonymize browsing history data, email metadata or financial transactions -- I suspect DNA information also cannot be satisfactorily anonymized.

"Anonymized data" is a marketing term.

conception• 6 years ago

It’s not unstable in anyway. What he’s describing is a lab. Lots of labs will do exactly what he wants.

flir• 6 years ago

There's a massive tension between privacy and utility. Most of the value of having the data is in publishing it so you can match with relations.

Symmetry2• 6 years ago

You can do pretty much that by getting your DNA sequenced by Dante labs and then using Promethease on it.

tafurnace• 6 years ago

I understand the desire to trace one's family history, find/treat diseases, discover murderers, etc. However, any time I read about these types of personal information breach events (DNA and genealogy could arguably be the most personal info of all) I so badly wish we didn't have this tech to begin with and how much present day sucks compared to the past as a direct result of these personal data mining tech companies (thinking social media, surveillance as well). I also wish the general population thought more clearly about the long term consequences of their information being in the hands of others before they so naively and/or willingly divulge it. Worse yet, we often don't have the choice. Nightmare scenarios where some could wield such information to do harm are not too difficult to think up, and if we are really being honest with ourselves, are occurring present day. Personal information data playgrounds like Facebook become precision tools for deception and oppression at best, genocide at the worst (thinking Myanmar). Not to single out Facebook, imagine what a psychopathic genocidal leader could do with 23andme data. With the rampant data collection, the human population has never faced this scale and breadth of societal threat before and we are indirectly feeling the consequences of it in our lives daily. I wish we could go back.

qserasera• 6 years ago

I wonder if we're getting close to being able to synthesize a DNA profile and fool most of the labwork being done.

Most DNA profiles are SNP's and they wont be enough to 'clone' a DNA sample.

qertoip• 6 years ago

Self-hosted genome sequencing when?

jacquesm7• 6 years ago

And half the DNA of all of the siblings and parents of the people that submitted their DNA, a quarter of their grandparents and grandchildren and so on. That's what I really hate about these companies, they get people to submit their DNA and the customers do not realize it isn't a decision that affects just them.

Bobbcatt• 6 years ago

I wouldn't consider DNA to be secret information. Given that you leave them every where you go.

jakear3• 6 years ago

There is a world of difference between

1. Having your DNA already in the database

2. Your DNA being out somewhere on the street where it could only be linked to you by name through a targeted reconnaissance effort

dgellow• 6 years ago

Not secret but I would definitely consider it a PII (personally identifiable information), which makes it subject to regulations such as GDPR.

hrktb• 6 years ago

This is the same gap between being seen face to face in a public square and having a high resolution 3D scan of your body.

We're ok with the former since the dawn of times, we're not happy with the later being digitally shared around the world.

dcgudeman• 6 years ago

So I should get the consent of my entire extended family before I ever submit my DNA to a service for analysis?

phoe-krk2• 6 years ago

I think so, yes. Otherwise you're sending large portions of their personally identifiable information to some sort of database without their consent.

Random_ernest• 6 years ago

With likely very dire results, yes I think you should. If your mothers insurance rate goes up, since you got one of these dna tests for Christmas, she should be involved in the decision to publish this data in the first place.

jlg23• 6 years ago

No, but for having the results stored at some company.

sbassi• 6 years ago

Your data, your rules. I put my 23andme raw data in github (https://github.com/sbassi/MiGenomaSbassi) for the world to see and use without asking anybody in my family.

jlnthws• 6 years ago

Do they not realize? It's just served as a convenience for family trees and cure together services. Same mechanism with any "social app" that asks access to all your phone contacts to "easy friends discovery": you may have never used Tiktok or Facebook but they already know quite a few things about you thanks to an acquaintance. I know DNA stuff seems scarier in the long run but data from an address book are more easily exploitable.

ransom1538• 6 years ago

Ignorant question here. How is this not regulated through HIPAA? Shouldn't these board members of this company face prison? DNA, a prosecutor could argue is a unique health identifier.

"Access to equipment containing health information should be carefully controlled and monitored."

https://en.wikipedia.org/wiki/Health_Insurance_Portability_a...

chii• 6 years ago

if they construe their DNA data as not health information, but instead information like finger prints?

alistairSH• 6 years ago

HIPPA only applies to a specific list of covered entities... health providers, insurance, etc.

DNA services are not currently considered covered entities.

They should be, IMO, but I believe Congress would have to act.

astura5• 6 years ago

People think of HIPAA as a generic cover-all medical privacy law for some reason.

It's not, not even close, It's a law that very narrowly applies mainly to insurance companies and healthcare entities that accept medical insurance.

As a general rule - if insurance is never involved HIPAA doesn't apply.

If you got a DNA test prescribed by your doctor for a diagnosis or even for genetic counseling then HIPAA applies. It's not the nature of the data, it's the nature of the organization dealing with the data.

I have no idea where this mass misunderstanding came from

mmm_grayons• 6 years ago

It's not covered. The ones at which we should be most angry are law enforcement officers using this information. This is simply a first step to the state collecting DNA on all citizens (see what it's done with fingerprints as an example.)

ig14• 6 years ago

In terms of medical data the amount of leakage is somewhat limited by the nature of DNA, e.g because you get a random mix you can't conclude anything about parents, etc medical status.

By far the biggest practical knock-on effect is if you match someone who's doesn't know their parentage (adoption/illegitimate children/etc) who can figure out their parentage as a result of that match.

Familial DNA crime searches are probably the next biggest, but they're still very rare at the moment and many of the DNA platforms don't allow them (GEDMatch was one of the few that do).

haihaibye• 6 years ago

If a child has 2 copies of a variant you know both parents have at least 1 copy.

You know what parent a male's X and Y came from.

You can use phasing and linkage to reconstruct parental haplotypes.

dwighttk• 6 years ago

and many of the DNA platforms don't allow them

I’m assuming that the stolen information doesn’t have this limitation.

stepstop• 6 years ago

It’s not only medical data that’s of concern, but also nation states Could try to use the data to identify embedded foreign agents/spies implanted in their country. Those are the ones without diplomatic cover

Dumblydorr• 6 years ago

What would insurance companies do with the data though? If they knew you were predisposed to obesity and cancer due to this data, would they be kind enough to ignore that info?

bencollier49• 6 years ago

Here's a thought:

"This is a GDPR erasure request. Your site contains my PII by way of that of my father. Please erase this information and indicate that you have complied within 30 days."

Shall I try it?

Sebb767• 6 years ago

Yes, please!

moisto2• 6 years ago

I remember hearing about some dude in his 80's , arrested out of the blue, for a murder he committed ~30 years ago.

The police used the crime scene's partial DNA and compared it to somebody's 23andMe sample.

Thanks a lot, grandson!

dewey• 6 years ago

That's probably the story you are referring to: https://www.sciencemag.org/news/2018/10/we-will-find-you-dna...

snarf21• 6 years ago

Yeah, that was my biggest fear with these services. How do I stop my family members from falling for it? In the end, I can't and just have to live with their mistake (if they used these services).

jimmaswell• 6 years ago

Data breaches happen, doesn't mean using a service is a mistake.

uncletammy• 6 years ago

This is exactly how I feel about my friends/family having Facebook apps on their phone. I didn't consent to giving my contact info to Facebook. I wasn't given a choice.

jacquesm7• 6 years ago

Agreed. But at least I don't leak their data in return. I figure Facebook must have 99%+ coverage of the world's social graph by now, including all the holdouts. You may not have an account, but they know you exist, what you look like, what your phone number is and probably where you are just by observing the nodes that are still 'blank'. Shadow profiles should be assumed to be just as detailed as the rest. It's one reason why there are very few photographs of me online (or elsewhere). I'd like the option to go rogue one day to be open to me ;)

jpz• 6 years ago

It is impossible to have an "expectation of privacy" over the DNA of your relatives. You need to live with it, and resolve your feelings to the reality of that situation.

You don't get a choice if your uncle, grandmother, aunt, niece or son share their DNA with law enforcement.

dahinds• 6 years ago

This is really another example of a claim of "genetic exceptionalism", that genetic information has a special status among other sorts of personal information, that mostly is not true. Your personal information, broadly, is informative about your relatives, your friends, etc. This includes your personal health information, your personal financial information, your online habits, etc. Any time you share personal data, you are disclosing information about people associated with you, without their consent, that might be used against them. And often these other classes of personal data are more informative than genetic information.

mleonhard2• 6 years ago

Bringing criminals to justice is a positive outcome.

Negative outcomes include:

1. Racist people persecuting people based on their ancestry, as determined from DNA data.

1. Police performing incorrect DNA database searches and falsely accusing people of crimes. Example: https://www.pbs.org/newshour/show/a-father-took-an-at-home-d...

1. Police misconstruing DNA evidence and falsely accusing people of crimes. For example, a person's DNA can appear at a crime scene if they rode in a Lyft before a perpetrator.

1. Criminals extorting parents of sperm-donor children: Pay us or we'll reveal to your kids that he's not their dad.

1. Criminals extorting unfaithful parents: Pay us or we'll tell him that the kid isn't his. Pay us or we'll tell her about the child born from your affair. Pay us or we'll tell your religious group about your child born not to your spouse.

1. Criminals extorting people about their expected health outcomes: Pay us or we'll tell the shareholders about your 50% chance of getting disease X in the next 5 years. Pay us or we'll tell her that you're likely infertile. Pay us or we'll tell your kid that they will probably die by age 30.

1. Criminals extorting folks who have changed their identities: asylees, stalking victims, protected witnesses, etc.

1. Oppressive governments persecuting relatives of escaped asylees: Your brother who disappeared actually went to country X. We can't punish him so we're punishing you.

jacquesm7• 6 years ago

That's an argument from utility, which is not how you should approach matters of ethics.

baby• 6 years ago

One thing I’m thinking about: this is probably an inevitable future. That we like it or not technology is going to be more and more intrusive. If not our generation, the next one, or the one after.

We’ve seen that short-sighted laws have caused more harm than good on the long-term. Like the war on drugs.

Knowing this, is there a future where we can lose privacy but still live a good life? And what can we do to get there?

xiler• 6 years ago

https://en.wikipedia.org/wiki/Homomorphic_encryption

alecco• 6 years ago

The cost of that is prohibitive except for very particular cases. On the other hand, even tiny devices have powerful computers nowadays. We don't need 3rd party cloud.

causality0• 6 years ago

Amazing we don't have a law granting each individual copyright of their own genome.

smolder• 6 years ago

Why? Who is going to grease politicians to write that law?

zeepzeep• 6 years ago

I waited for this. Sorry to all that are affected, but maybe this is a sign for others, not to give their DNA to a random company.

Traster• 6 years ago

And also not to be related to someone who gave their DNA to a random company.

raxxorrax3• 6 years ago

Yeah, just like people stopped using their real identities on the net where there is absolutely nobody with an axe to grind for trivial issues.

Sorry for the cynicism. What is even worse, people actually using these services create expectations towards everyone smart enough not to do that. Of course, that would mean your near relatives have to be smart enough not to use these services either...

Now any health insurer could use this data to identify high risk genetic defects...

immawizard• 6 years ago

Isn’t it illegal to use DNA data for purposes of health insurance? How would insurance company be able to use it? Companies like kaiser run both hospitals and insurance, yet they can’t use your full medical history when determining your insurance risk.

The bigger issue imho is companies using biometrics as a secure authentication, but at least in USA that’s going to be no worse than SSN mess.

1001101• 6 years ago

Good way to identify people using cover. That's got some value to people that can perform these sorts of exfiltrations.

GoblinSlayer3• 6 years ago

Rather why such companies are even allowed? They are literally privacy invasion, even if by ignorance.

concordDance• 6 years ago

Why should they care aboit it being released though?

Kiro3• 6 years ago

My DNA is in this breach and I couldn't care less.

maltelandwehr• 6 years ago

Is there any way to get my DNA analysed anonymously? Like, with just a throwaway email and payment via some service that anonymises?

eitland• 6 years ago

At least it was possible for one person to send two identical samples under two different names a few years ago to one company, but if everyone has closed that loophole yet - I don't know.

Alternatively (a business idea for someone here who has already registered?) you could send in other peoples samples in tour name and then request deletion via GDPR or something. Do things that do not scale and all that ;-)

thelittleone2• 6 years ago

I consider myself a fairly optimistic person. Yet here we are deeply immersed in a world of technology that trades privacy for conveniences (that we did fine without before) and week after week these mega data stores are compromised and we just move on. The optimist in me hopes its merely incompetence and greed, but then it seems almost programmatic.

Sudophysics• 6 years ago

Perfect, so I, a hypothetical nation state can build targeted and tuned viral RNA for phenotypes and people I know will definitely cause me the most trouble on the battlefield, diplomats, engineering floors, and economy? Oh, corona has among the largest kilobase count? Hmmmmmm. What a fucking coincidence!

varenc• 6 years ago

“As a result of this breach, all user permissions were reset, making all profiles visible to all users”

This seems like the opposite of how a sensible permissioning data model should work.

0x00000000• 6 years ago

“But A/B testing showed more ‘user engagement’ when you default to public”

W-_-D• 6 years ago

Who are you quoting there?

isbvhodnvemrwvn3• 6 years ago

I think it's an older issue. Before it was sold, GEDmatch was ran by several part-time developers. It was running some old PHP 5 version the last time I checked. In general I advise to be very sceptical of amateur-ran genealogy sites - I know of at least 3 search engines with obvious SQL injection issues (which allow me to run better queries, but still). All of the major commercial sites had some sort of leaks as well (I'm not sure about FamilySearch).

marsrover• 6 years ago

I thought the exact same thing when I got the email. I would have much preferred a permission reset resulting in profiles being locked down tightly.

StreamBright• 6 years ago

Where do I reset my DNA?

Neph• 6 years ago

Let the Clone Wars begin!

On a more serious note, is their any way to have your DNA analyzed confidentially ?

oliv__• 6 years ago

Like this wasn't just waiting to happen.

You voluntarily hand over your DNA to a private company. What could possible go wrong?

wiz21c• 6 years ago

Well, I'd add : You voluntarily hand over your DNA to a private or public company. Makes no difference. The bigger the trove, the finer the hackers.

dontcare1• 6 years ago

This quote by John Young of Cryptome sums up the dark truth of the state of cybersecurity:

" Wonder how long it will take to reveal cybersecurity is a Ponzi racket.

Profits from commercial harvesting data of online users now exceeds the total funding of all the global spy agencies, with a healthy chunk of the steal bought by official spies and law enforcement which ignore the violation. Edu, orgs and NGOs part of the rotten racket."

Essentially, every major data breach is planned by the "good guys" having a stake in criminal ops.

jdright• 6 years ago

Did not take long: https://mittr-frontend-prod.herokuapp.com/s/614642/dna-datab...

game_the0ry2• 6 years ago

That url is atrocious. It looks like the MIT tech review doesn't pay for its Heroku account.

bacondude3• 6 years ago

This is the correct URL: https://www.technologyreview.com/2019/10/30/132142/dna-datab...

GnarfGnarf2• 6 years ago

The human genome is about 3.4B base pairs (G-C, A-T). The specific DNA used for genealogical matching is 700K base pairs. So the testing companies are only using 0.02% of your DNA, hardly enough to compromise you.

Furthermore, the matching process is based on SNPs (Single Nucleotide Polymorphism) and STRs (Short Tandem Repeat) in the "junk" DNA section, which constitute 92% of your DNA, and is distinct from the coding DNA that contains health traits, among others.

So, not much to worry about.

auganov• 6 years ago

The way GEDmatch works you can enter any "kit number" and get a long list of matching people which has their kit number, name, email and some other basic information.

It sounds to me like hackers just managed to traverse the entire database to hunt for emails. Which is not exactly hard given how the site works.

Most kit numbers seem to be a letter and 6 numbers so not exactly hard to brute force either. You don't even have to get that many right as for any hit you might get a list of 1000+ people and use their kit numbers to get even more.

You might say that's a terrible design security-wise but that's what makes GEDmatch great for researching who you're related to. They'll either have to degrade the experience or be really stringent about rate limits and so forth.

tschwimmer• 6 years ago

I can’t believe this is a website. It’s essentially a rolling data breach.

musicale• 6 years ago

Well that's completely unsurprising.

troynabed• 6 years ago

Aliens absconded with the DNA records obviously. Connect the dots people!

kzrdude3• 6 years ago

Is there a download available? It could be an exciting time to do some bootleg research

Breach exposed more than one million DNA profiles on a major genealogy database

Related Stories