Hacker News Reader

Comment by chatmasta | Hacker News Reader

...and then the genealogy website provided information to law enforcement by showing profiles of people with similar DNA.

Perhaps that’s the real privacy issue... anyone can find a piece of hair on the sidewalk, send it to a genealogy website, and identify who it might belong to and/or any relatives.

View on HN

I can see it now: "Hi. We're not actually related, but I believe you may be 2nd or 3rd cousins to someone who left a brand new, pink hairbrush at my B&B."

"So can you come pick this hairbrush up and give it to your cousin?"

So after search by phone number or email on Facebook, we will also have search by DNA. For when you want to get in touch with that mysterious stranger on the subway...

You'd first need to pull a hair from that stranger on the subway though.

You would just need to swab anything they touched.. it might be sufficient.

Good point - you would have a better chance with someone who works for a food vendor...

Done

and sequence it

23andme requires quite a bit of saliva. They could definitely up the requirements to decrease the chance of fraud.

Good point, and makes it less likely LEAs just sent in the DNA the 'regular' way ...

I wonder how they submitted the DNA

It's trivial to replicate even very small amounts of DNA. They don't actually need very much DNA, they just ask for that much to ensure it will work.

Wouldn't they have to replicate whatever medium it is in as well? For example, if sending in saliva, you'd have to replicate the saliva as well.

No need to replicate saliva. The DNA extraction chemistry wouldn't depend on saliva components.

>anyone can find a piece of hair on the sidewalk, send it to a genealogy website, and identify who it might belong to and/or any relatives.

Searching for relatives in such sites, CAN be a privacy issue, but I don't see how your particular example works exactly.

What motivation exactly would have anyone that found a piece of hair, on the sidewalk or elsewhere, to know people with DNA from/similar to that hair's?

Consider this creepy altrnative: You have a drink at a bar. Stranger swabs it, or steals the glass, collects DNA, sends it in, now triangulates who you are from your relatives.

I don't know if it's that easy, but something like this may become possible.

>Consider this creepy altrnative: You have a drink at a bar. Stranger swabs it, or steals the glass, collects DNA, sends it in, now triangulates who you are from your relatives.

Sure, but following you would be much easier.

Why go through all the trouble (AND live an online trace).

> an online trace

Maybe in the future leaked DNA sequence databases will be available, downloadable, and searchable by criminals without a third party. If so, this would actually be less likely to create evidence than following them.

If they have your paternal relatives and your maternal relatives, that pretty much just leaves you and your siblings, right?

*Unless there are other marriages between your mom's and dad's families

They've probably got your finger prints too as a bonus.

If you are up against someone or a state that wants this info, you can't really stop them. They could get your credit card info from the bar, follow you home, hack your phone, socially engineer anyone around you to find that out.

So the issue is 23andMe or similar accepting DNA samples without verifying identify beforehand. As in, they should submit some kind of ID or affidavit that they are the provider of the sample before delivering it.

I agree. My understand was that both parties have to agree for the website to connect them. I'm not sure what specific site this is, but I wouldn't trust a site that just connects me to other people without my consent.

Your consent, or even you being on the website, isn't needed. If enough of your relatives consented, the stalker can have at least a list of your relatives, and try to guess you from there (as the police did in this case)

That's assuming again that my relative accept to share. That's not what I'm talking about. I'm talking about the direct result. In this case, the relative of the killer never agreed to share the data with the police.

> the relative of the killer never agreed to share the data with the police

Not with the police, but they let people who find a related DNA to find them (this is a feature of these websites). Once the police have your DNA, then can find your relatives. You can't control whether your relatives are opted in to this feature or not.

The sites have more privacy controls than that.

But I have no say over my uncle’s privacy controls. If someone finds my hair, and my uncle allows himself to be publicly searchable by DNA, then the person who found the hair knows it belongs to someone associated with my uncle. They can then find him on Facebook and commence further analysis.

It’s the same problem we saw with Cambridge Analytica. Incidental data shared by our friends can reveal information about ourselves when analyzed in bulk or supplemented with additional data.

You don't have a reasonable right to privacy of relations. That's all public record.

This in effect makes my DNA a matter of public record based on the decisions of my relatives (behind some hoops, but in practice it doesn’t seem hard). That seems like a breach of privacy.

Well it's technically your uncle's DNA. Limiting what he can or can't do with it because it also matches yours would then infringe on his rights.

Sure, in the same way my neighbors infringe on my rights to blast music at 4am.

Not the same. Your uncles DNA only establishes he is your uncle. Unless your also saying that your uncle is not free to disclose any information that might be contained in his DNA. For example that he is a white male.

You dont own your relative’s genetics. They can do whatever they want with them. There’s no breach of your privacy because nothing of yours was breached.

But my dna can now be matched to me - That is a breach of privacy today, or at least and end run around legislation that attempts to limit the spread of genetic information.

We should think really carefully about this! My uncle’s right to check out who his long lost cousins could put my genetic information in the hands of a potential employer, insurer, or government. That could be really bad.

This is similar to the Facebook scenario, where it’s not just your privacy you are trading away for whatever benefit, but those of people related or near you.

Are you saying that your uncle also can't post his full medical and psychological history online either?

Not the OP, but until not that long ago there was a social pressure thing of not "advertising" your relatives' history of psychological problems (mostly suicide or time spent inside a psychiatric ward) to outside members of your family, lest those outside members would think you had the potential of having the same issues, too. This is sort of similar to the "uncle" from your example not being free to post "his full medical and psychological history online", I mean, had he done that his family would have certainly retaliated by telling him to remove that information from public knowledge.

Btw, I live in Eastern Europe so I'm talking about stuff I've experienced here, maybe in the States or in Western Europe this behavior changed a long time ago and not only recently.

There's a big difference between your own DNA being publicly hosted and identified, and some DNA that is pretty similar to yours but not the same as yours being posted and identified to someone that is not you.

Why should you have a right to block the later from happening? It's not your own personal information.

I think the difference is much smaller than you think. If someone finds male DNA and my uncle has used this service, and a public photo with my eyes and hair clearly visible in the background on his Facebook page, then suddenly it’s almost as if I registered my DNA in a public registry. It’s the metadata problem all over again, it just takes one or two more public data points to deanonymize it entirely.

since DNA is by nature unalterable, that implies that there is no right to privacy of DNA.

You uncle should have a right to rat you out if he pleases. A mother can turn on his murderous child to the police if she wishes so.

I think the debatible point is consent: i dont think anyone ever consented to their dna being able to be used to incriminate them or anyone else without their express consent.

Gattaca!

I had the same thought.

I guess people didn't like that movie. I thought it was great, and a relevant reference.

It needs to be rebooted for modern times.

Reply on news.ycombinator.com