FamilyTreeDNA: It’s Our ‘Moral Responsibility’ to Give FBI Access to Your DNA
gizmodo.com
gizmodo.com
Perhaps they will be less delighted when they are convicted of a crime based off of a false positive, have their DNA shared with Facebook to Improve Their User Experience ™, or have their DNA made public after yet another security breach where it is left on an unsecured server.
Remember that your DNA is very valuable, literally. Those who have noticed recent progress in genomics should realize how valuable it would be to a competent advertising company, allowing them to profile and predict users with significantly higher personal accuracy, even if all they are doing is performing basic GWASs (https://en.wikipedia.org/wiki/Genome-wide_association_study).
Not sure if the ability to sequence DNA yourself is really beneficial to privacy, after all that allows people to sequence the DNA of many people around them.
"The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)." [4]
Finally, it's worth pointing out that some states (e.g, WA) have enacted their own legislation that specifically calls out genetic testing and data as PHI [5]. In addition, there is the GINA act, which provides some protections as well [6]
[1]: https://cphs.berkeley.edu/hipaa/hipaa18.html
[2]: https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hipaa-protect-genetic-information/index.html
[3]: https://www.law.cornell.edu/cfr/text/45/160.103
[4]: https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html
[5]: https://app.leg.wa.gov/billsummary?BillNumber=6284&Initiative=false&Year=1999
[6]: https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrimination_ActYou can probably also get raw SNP calls from a genotyping service. Human SNP genotyping costs about $300 a sample at-cost and can maybe be had for less. Few of these resources are commercialized for the general public, but they are certainly accessible if you just want the raw data.
In other words, the add-on from 23andMe is mostly convenience - they spare you the effort of having to locate these services and engage with them, and they spare you the effort of having to do your own informatic analysis.
Maybe justified in those cases, but if it's abuse you're worried about, nothing but extremely stringent laws have a hope of protecting you. Probably not even that.
[1] https://www.washingtonpost.com/news/true-crime/wp/2018/04/27...
You cannot opt-out but you can request that the samples be destroyed. They'll even send you a letter assuring you that it's been destroyed. How kind of them.
Can I book a vacation to Amsterdam, then demand deletion while on EU soil?
> This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
> (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
> (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
As I understand it, because 23andMe also provides its service within the EU, the GDPR applies.
If they solely offered their service in the US, it's more tricky. Just being in the EU does not _necessarily_ mean the GDPR applies. Consider the following two examples[1]:
> A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR.
BUT:
> An app developer established in Canada with no establishment in the Union monitors the behaviour of data subject in the Union and is therefore subject to the GDPR, as per Article 3(2)b. The developer uses a processor established in the US for the app optimisation and maintenance purposes.
> In relation to this processing, the Canadian controller has the duty to only use appropriate processors and to ensure that its obligations under the GDPR are reflected in the contract or legal act governing the relation with its processor in the US, pursuant to Article 28.
[1] https://edpb.europa.eu/sites/edpb/files/consultation/edpb_gu...
GDPR covers everybody while in the EU, but doesn't cover EU citizens while abroad and everybody all the time when dealing with a EU company.
Also a true positive.
> 23andMe chooses to use all practical legal and administrative resources to resist requests from law enforcement, and we do not share customer data with any public databases, or with entities that may increase the risk of law enforcement access.
https://www.23andme.com/law-enforcement-guide/
And AncestryDNA:
> Contents of communications and any data relating to the DNA of an Ancestry user will be released only pursuant to a valid search warrant from a government agency with proper jurisdiction.
The entire purpose is sharing.
But the purpose of these sites is finding family members. Let's stop being shocked that this means the DNA info voluntarily submitted is public.
> Additionally, FamilyTreeDNA customers have the option to opt out of law enforcement matching entirely. If customers do opt out, they can still see their family matches but are excluded from being seen by law enforcement.
This does not make sense to me. I know that DNA can be taken physically from an individual with a warrant, so ostensibly that would hold with FamilyTree as well.
So: if one opts out, what is one opting out of? FamilyTree can't be suggesting that they'll withhold evidence because a customer opted out, can they?
"law enforcement matching" = LE uploading suspect DNA to the service and looking for family members, who they will then contact for further investigation of relatives, which does not require a warrant.
due to a recent policy change, LE is obligated to identify itself as such before performing the latter type of search. you can ask FTDNA to exclude your information when a LE account looks for family matches.
Opt out, to me, just means that they’ll share your data if issued a subpoena. However, I don’t know if you could get a subpoena to search the entire DNA database of a company.
The issue, of course, is that unlike Facebook you can't just delete your DNA.
The FBI (and a variety of other organizations) can and will use the information for any and all purposes imaginable, and a number that are unimaginable.
As a family member of someone who sends in a FamilyTreeDNA kit, you're powerless to opt out. An implicit, traceable link to your own DNA suddenly enters the system against your will, and you have no recourse. Suddenly you become part of this this experiment in mass surveillance.
The people of rich democracies are way too trusting of their governments and don't read enough history. Saying that this service will be used to " help prevent violent crimes, save lives, or bring closure to families" is naive at best and something monstrous at worst.
Some uses are easy to predict. Genocide, for example. Others, no so much.
- Imagine a Bird-type gig economy in which thousands of cash-strapped people are hired (possibly by FamilyTreeDNA under contract from the FBI) to swab public places and objects for DNA, while the company compiles the results into a massive internet of DNA things. Now imagine that database being linked to a face-recognition system using public cameras.
- Imagine being turned down for a job because someone happened to get a peek at your FamilyTReeDNA profile and noticed a marker for mental illness.
- Imagine being sent to prison because some jackass politician starts believing in criminal DNA markers and you fit the bill.
I'll give credit to Bennett Greenspan for this. He knows how to wrap a massive invasion of privacy in the sweet-smelling blanket of saving us all from the criminal boogeyman.
I'm not so sure Franklin would be upset.
Not sure how that follows, that requires the victims to come forward, be taken serious by the police, and the whole process to progress through the justice system in time for their second crime. Not to mention the first rape wouldn't be avoided anyway, so it's a quite small security it buys.
How many serial rapists can there be, anyway? Of those, how many of them raped multiple people, instead of the same victim several times, who was too traumatized to go to the police? How many are family members?
If anything, I have a feeling that modern hiring goes in exactly the opposite direction, trying to de-bias the process.
It will because it has been used to do just that.
> Genocide, for example
It's not like humans have had difficulty committing genocide in the past without DNA databases. The Rwandan genocide, for example, was done primarily with machetes and coordinated by radio. Similarly the rest of your hypothetical situations can be done without DNA testing if society wished to act in that manner. I don't see much weight in your scenarios at least compared with actual murderers and rapists going to jail.
There should be NO surprise that going to FamilyTreeDNA (or Ancestry.com) results in your records being public to other members.
> Its also striking that were already in an era in which familial searches against publicly accessible SNP databases are feasible for a lot of cases, probably the majority of cases where the suspect has substantial recent ancestry in the US
With sequencing at less than 1k these days, you should be able to do it for sub 3k with the analysis while protecting your privacy.
I admit I chuckled, as someone who finds moral arguments pretty shallow because they tend to depend on what each person thinks is the right thing.
All that's gonna do is flag you for priority analysis!
No need for the FBI to start fishing for everyone's DNA.
Now if you're arrested, not necessarily convicted, you'll have your DNA taken and kept on file for a few years. Note that someone had to take England to the EU court of human rights to get this changed so that people found not guilty, or people not charged, won't have their DNA kept indefinitely.
https://www.gov.uk/government/publications/protection-of-fre...
When they arrest you? When you are convicted? Convicted in the 1st instance? Upper court?
Or we can arrest the guy before he commits another crime.
Men finding out they didn’t father children they thought they did.
I worked at a genetics lab, and day one training was that this happened all the time, and that we absolutely must not let people in medical studies know we’d found a mismatch. (In fact, we actively avoided noticing such things.)
This seems to be the faulty axiom in your logic.
Sometimes it is fun to think about the odds of me getting hit by a meteorite if I leave my underground bunker, but I'm not going to let that dictate my daily life.