DNA of every baby born in California is stored. Who has access to it?
cbsnews.com
cbsnews.com
I think this program is utterly disgusting. It's a terrible violation of privacy. The DNA of every baby (born in an actual medical institution) is collected, tested for whatever, and then stored indefinitely. There is no opt-in or opt-out as far as I'm aware, just that you can later have the sample destroyed if you happen to hear about this program and go to the effort of finding out how to do it. This is some disgusting Orwellian BS.
Of course, it's just as likely, this already being a government program and a massive overreach at that, that your identifying data is stored in plain text. I just wanted to throw out it's possible it's not.
Think about the inputs of the mechanism you just described though. Presumably the goal of the "secure hash" is to prevent government workers from grabbing samples of specific people to do whatever with, so let's break it down. To calculate this hash you apparently need:
1. The name. If you're going after a specific persons sample, you already know this.
2. The date of birth. I don't know when this program started, but if you're alive today you definitely aren't more than 43,830 days old (365.25 * 120).
3. The hospital. I have no idea how many hospitals exist or have existed in California, but lets say there's been 100,000.
So the total number of possible hashes given only the name is 4,383,000,000. Sure, you could salt it as well, but the people we're trying to defend from have access to the DB and thus the salt, so we gain nothing from that. Here's some hashcat benchmarks: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...
Looks like 1000MH/s is a reasonable rate to be able to process sha-512 hashes, so according to that benchmark you should be able to generate the complete rainbow table in about...4 seconds.
It's probably longer given drive speeds and such, I've never actually tried to do what I'm describing, but it does seem like a less-than-one-work-shift process to calculate the hash of a specific person on commodity hardware if that's the only three inputs required. If that's the case, hashing it hasn't made it anonymous.
Possible, but unlikely, given that this is the government we're talking about.
Also, even if they were hashed like that, I just gave them that identifying information as part of the destruction request.
Their mom probably wouldn't remember if you asked her. She's not really a good person to ask. You should be asking the partner who was there for the birth, since we're the one that actually sees it happen (they were still stitching up my wife when the test was done).
For the second kid (because I was just in a daze for the first kid), being the paranoid security person that I am, I asked what happens to the sample and what kind of controls are placed on the sample. I also asked if I could opt out. I was told that I could not opt out and that the sample becomes the property of the State and there is nothing I could do about it.
This article was the first I learned that I could request it be destroyed. It is also the first time I'm learning it could be used for research (but I kind of assumed that was why they kept it in the first place, other than to add to a database for matching with potential criminal activity).
So thanks for posting this, now I have to figure out how to request the samples. I'm going to see if I can actually the spots back.
the antivaxer comment is about opting out for something that is immediately beneficial (disease screening) and long term (research) in lieu of paranoia (in case of a working government) or privacy (in case of a broken government as it is now, according to the article).
the right course of action is not to deny your children of the proven benefits, but to force the government to respect the individual and its own processes/institutions.
Having to opt out instead of in is already bad enough.
Not being able to opt out is way beyond "slippery slope".
That is so disgusting. For all the talk about individuality and liberalism, it's amazing how liberal societies are so authoritarian and controlling.
If you don't own your DNA, then what do you own? But I guess big brother knows what's best for us.
Personally, I don't see DNA as that intrinsic or important as others do. It's just a piece of information about the composition of my body. Sure, if they could completely clone my brain and the essence of what I am, then I could get behind something like this. But as is, I'd just be peeved that someone gets to "use" my DNA. Same way I get peeved that Google/Facebook "use" my browsing habits to train their ML algorithms.
Just like before the ACA it was society at large that didn't worry too much about people being dropped from insurance. Sure, people moralize about how awful it is, but then they take the policy with the lower rate instead of the better underwriting.
If true this is incredibly depressing. I don't know very much about patient privacy laws but have some follow up questions for those more knowledgeable:
1) I assume this quote refers to California state law and not Federal law?
2) Is there a state that has a track record of taking privacy more seriously?
Despite caring deeply about my privacy I've let it steadily erode with the rise of "customers are the product" type services. Between this and Cambridge Analytica it seems that the US is surprisingly bad at protecting citizens' privacy. I'd like to know if it's possible to live in the US without essentially waiving my right to keep personal information personal.
[1] https://en.wikipedia.org/wiki/Moore_v._Regents_of_the_Univer...
I think what you really mean is that people or organizations with money seem to have more rights. Obviously because they have the resources to fight for those rights.
The fact is, for some things (like tissue samples with DNA), it's important to recognize that non-owners can have a stake in is done with something. The originator of a tissue sample cannot entirely severe their connection with that tissue, and that means that the new owner shouldn't be able to claim unrestricted ownership. The legality should recognize ways in which the non-owner can be affected by the owner's interactions with the sample.
(Aside: GDPR works by essentially doing the same thing with data. The "Rights of the Data Subject" stipulate that a non-owner of the data is still a stakeholder in that data.)
[1] Although, ironically, that actually makes property law well-suited to addressing the situation. In Common Law, the idea of 'ownership' is understood as 'a bundle of rights,' which can be un-bundled. A framework for addressing the situation is to enumerate separable rights for tissue samples, and stipulate different rules for delegating those rights.
You do have the right to ask the biobank to destroy the leftovers after the fact, though the agency's website states it "may not be able to comply with your request."
Following the link, I saw no evidence that parents can request destruction of the sample. Instead, this is what I saw:
You have a right to ask the Newborn Screening Program not to use or share your or your newborn’s information and/or specimen in the ways listed in this notice. However, we may not be able to comply with your request.
https://www.cdph.ca.gov/Programs/CFH/DGDS/Pages/nbs/nbsnpp.a...
I also haven't been able to find information on the process a parent can follow to get the sample destroyed.
Not using a sample is not the same thing as destroying it. What am I missing?
Shouldn't this be the default?
So I'm fairly positive on this program...
https://www.mayoclinic.org/diseases-conditions/cystic-fibros...
I totally agree that there's a more privacy-respecting solution. I was asking why people were downvoting this comment.
Nobody objects to testing newborns for diseases. That’s awesome. Keep doing it. We all support that program, so there’s not much point in telling us how good it is.
Almost entirely unrelated to that is the storage of samples after they’re taken. That’s the actual problem, and solving it has not effect on the first issue there.
Down voting a comment like the parents is, at best, insulting the very premise of good HN discussions.
In this case I'm pretty disappointed by the replies I got to my question.
It's the quintessential example of authoritarianism defense. One instance of good justifies authoritarianism and violation of individual liberties and freedom.
The archival is Machiavellian.
There is a middle ground between "we don't test for diseases" and "your kid's DNA is now public knowledge".
Please explain how keeping your daughter blood sample forever and selling it helped in any way ?
Running a detection test is what helped your daughter and is not the issue at hands, it's keeping samples indefinitely and selling them that's problematic.
"I want to say no" he said. "But I'm not ready to say no because I know how humans can be sometimes." “””
To me that just reads like he knows the answer is yes and is just trying to soft-pedal the truth. Moreover, since he’s literally the person selling the dna, it strains my credulity to believe that he hasn’t already known this, and if he had already taken steps to prevent it from happening, I’m betting he would’ve mentioned them specifically.
“”” "De-identified DNA" However, Lorey stressed that the blood spots cards, stored in the state biobank, are "de-identified." There is no name or medical information on the card, just the blood spots and a number. “””
Is he trying to sell me on the idea that my dna can’t be used to personally identify me?
That was a pathetic defense.
However, officials who have access to the registry could obviously look you up. Hopefully there are controls in place to keep those same officials from having samples tested, but 8 doubt it.
It said the studies have to be approved by a review board and that the researchers have to agree to destroy or return the samples when they're done.
I don't think we should cynically assume "he knows the answer is yes." He may be hedging simply because he knows it relies on the word of the researchers.
But biomedical researchers have been sensitized to issues of research ethics much longer than internet/data science practitioners. There can be significant penalties for procedural violations and in my experience people do not tend to play fast and loose with the rules.
How ironic that this began right after 1983.
https://www.mja.com.au/journal/2011/194/6/newborn-screening-...
and this
"19.16 In 1999, the Senate Legal and Constitutional Legislation Committee referred to newborn screening card collections as ‘inadvertent DNA sample banks’, noting that identified blood samples containing genetic material from almost all people under the age of 28 are currently stored in most States and Territories."
https://www.alrc.gov.au/publications/19-human-tissue-collect...
As far as I understand, access to this data is generally restricted [2].
"If illnesses occur later, which can be clarified via tests on this sample, the responsible physician can request it from [Children's Hospital Zurich]. Part of the remaining material may also be used by the screening laboratory during quality control measures and for the development of new research methods. In this case, the samples will be anonymous, having undergone a procedure to make them unidentifiable." [3]
[1] https://www.zh.ch/bin/ktzh/rrb/beschluss.pdf?rrbNr=1053&name... [2] https://www.admin.ch/opc/en/classified-compilation/20011087/... [3] http://www.neoscreening.ch/display.cfm/id/100489/disp_type/d...
Then we're really going to have some interesting privacy concerns.
My flippant answer, before reading the article: Basically everyone, probably through a web site where the requestor simply uploads a document (any document) then checks an electronic checkmark next to the words "I pinky swear that I will only use this for good and pure and light-giving purposes."
> Who has access to it?
After reading the article: Yep, law enforcement and "third party researchers" (in quotes because, as the article points out, that term is supposed to mean scientists operating under a code of ethics but, yeah).
I dunno, folks, it sure seems like nobody really gives a damn about private information unless it's being used to link them to a scandal and then they really care.
While rapidly getting cheaper (probably between 1 and 3 thousand USD all inc) this would still be an expensive exercise.
"And to be clear, he stressed, there is also no genome database. The state does not sequence or extract the DNA from the blood spots collected"
And the previous paragraph explains that researchers do not have access to the name registry.
No, California did not seek any kind of test or diagnostic results (or anything like this). It was never mentioned and this is the first I have ever heard of it.
[1] https://sverigesradio.se/sida/artikel.aspx?programid=2054&ar...
The doctors at Kaiser were totally useless when I asked about this: they'd go from "gee, I never heard about this" to "shrug, it's an official state program", and then they piled on the guilt trip about how urgent it is once my kid was born and I was sleep deprived. Bastards.
So you have to research it yourself and get a pediatrician to order the test from Mayo before your child is born, so it's all arranged once you're in labor. Then make sure they use that test, and you opt out of the state test. (Or better yet, if your state claims it's mandatory, refuse the test and if they do it anyway you've got casus belli for a constitutional challenge)
This almost feels like a scene taken right out of the movie Gattica.
Gattaca took real world and extrapolated a little to give us a glimpse in the future so we know what to expect and not let it happen.
Also, do we know if this actually results in lower mortality?
This is exactly the same thing, but done for newborns who are much more fragile and vulnerable to make sure they get care while already in the hospital, especially for any potentially severe or immediate issues.
What are the other 12 states?
Looks like there is not an easy way out.
It seems the best the U.S. political system can come up with right now is "GDPR for X" where X represents only a few specific industries, because of strong entrenched special interests, lobbying and legalized bribery, which means strong gridlock and disagreement for a more "universal" law. Because the more industries the law would affect, the more billion-dollar corporations would fight against it with TV ads, lobbying and vote buying (sorry, I mean "campaign donations").
GDPR generally applies to all personal data of a citizen. The best I've seen from the U.S. government so far is the Consent Act, which applies only to online services only. It doesn't apply to ISPs, network providers, medical data, or a ton of other things it should apply to.
The more people realize that this "single issue" of taking money out of politics and drastically reducing or eliminating a corporations' influence on political decisions affects every other issue they care about, the better.
https://en.wikipedia.org/wiki/United_Kingdom_National_DNA_Da...
I dimly remember some private schools using school laptops to take naked photos of their underage students.
It was pretty bad. Especially because an intern raised concerns beforehand, and those concerns were dismissed as alarmist.
Innocent people get arrested. Sometimes, folks are accidentally guilty. Bag of drugs in your back seat, dropped by that workmate you drove to lunch? It is your problem now. Not to mention the way the system is run in the US, innocent people wind up convicted. Some folks convict themselves voluntarily because getting arrested and waiting in jail for a trial can do some major life damage.
As I understand it the process is quite opaque and there have been cases where some police forces have revealed that they are unable to (or simply refuse to) comply with the requirement to delete samples so they keep everything.
https://www.telegraph.co.uk/news/uknews/law-and-order/786353...
>Research found South Yorkshire was most likely to remove a DNA profile while Cambridgeshire, Gloucestershire and Nottingham refused to remove any profiles.
Some senior police officers interpret the rules in a way that suits them, some people say the law as written is ambiguous.
I mostly interpret "Unable" in this context to mean it would require too many man-hours to clean up the database because it has been allowed to grow too large and disorganised. I can't back that up with evidence, it's just something I recall hearing. There are no doubt other reasons and this applies to the overall picture rather than individual requests for removal.
In the case of an individual request I could still imagine that the system is so badly designed that it isn't actually possible to locate all parts of a sample, all references to an individual in the (various) database(s). I've seen environments like that in the corporate world, I assume the government is capable of creating them as well.
- Every sample is kept in the screening lab and destroyed after 5 years.
- year 1 is used to (double checking) of the test results
- following years the sample is used for anonymized research
- explicit approval is needed from parents for non-anonomized research with the blood samples.
- every parent has the option to opt out of 4 years research; the sample will be destroyed after the first year if opted for.
Idk why, was just curious.
You don't need to select for depression and addiction explicitly, companies implicitly do this by forcing normal working hours on their employees.
Insurance is a stochastic tax on the young and healthy to benefit the old and unhealthy. If it's decoupled from employment I don't see why an employer would care. Also, why shouldn't we use all information to predict costs and risk?
This whole medical data hoarding might be a "what if" scenario on AI and immortality.