Hacker News Reader

Comment by cryptozeus | Hacker News Reader

I regret taking 23&me test, I don’t think my dna is in safe hands.

23andme claims the following:

> 23andMe chooses to use all practical legal and administrative resources to resist requests from law enforcement, and we do not share customer data with any public databases, or with entities that may increase the risk of law enforcement access.

See: https://www.23andme.com/law-enforcement-guide/

The GSK (EDIT: their 4th cousin) actually used GEDmatch which is a service that openly cooperates with law enforcement.

At the risk of sounding overly cynical I'm going to sound overly cynical - I don't think that statement is worth the pixels it's activating. They are going to say whatever they need to say to keep the money rolling in. It could be a lie, it could be something that changes tomorrow without notification. They don't care because why should they?

Why would they care about saying it and not care about doing it? Obviously they've identified that their customers value those protections, so if they were demonstrated to be lying about it or changed their policy in the future don't you expect that they'd risk losing the customers who made the choice to use 23andme based on their progressive law enforcement policy?

That's the market-based ethics enforcement. Usually this cause and effect link is too weak to be practical. Business incentives are short-term, leadership changes, companies get bought, business models change, and market transparency is low.

True, prioritizing short-term gains creates incentives to lie. But they've stood by this progressive policy for quite some time now even though scrutiny of law enforcement access to DNA databases is higher than ever. So I'm not convinced they're lying. Believe me, if there is any sign that that's the case then I will be deleting my account as soon as possible.

> GSK actually used GEDmatch

GSK did not actually use GEDmatch, but his 4th cousins did.

The website identified 10 to 20 distant relatives of the Golden State Killer's (sharing the same great-great-great grandparents)

https://en.wikipedia.org/wiki/Golden_State_Killer

If you read that, and think this means they don't cooperate with legal requests, then you've really made a huge mistake.

They "resist". All that means is they ask for a proper legal document, such as a warrant.

Warrants are easy to obtain. Judges give them out like candy, and I'd be incredibly surprised if after the success of the Golden State Killer case, that 23&me doesn't get 100's or 1000's of search requests per month.

Sure, they are probably not ever getting the full dataset, but you don't really think they are actually contesting the legal authority of the government to do this right? 23&me is not your doctor. You have no HIPAA protections.

They also publish transparency reports and have a policy of notifying users whose data was subject to subpoenas. See the full text of the linked page for more details.

It's literally ran by Sergey Brin's wife. Some day your data will be part of Google. I'd say we are still a ways off from connecting DNA to advertising, but I'm sure google will "boldly" take us there.

I guess you missed that Sergey had an affair with a young Google employee and divorced Anne Wojcicki. Since then he's remarried another woman, and they have a child together.

https://www.vanityfair.com/style/2014/04/sergey-brin-amanda-...

Oh god! They divorced in 2015. I am sure if Google had any such plans, it is just as likely with any other CEO up there. Let us worry about real conflict of interest happening elsewhere in Politics, Climate change etc which might dooms us all before these...

>Oh god! They divorced in 2015. I am sure if Google had any such plans, it is just as likely with any other CEO up there.

Any subsequent marital issues or extracurricular activities of the individuals concerned cannot erase the fact that the venture was literally bootstrapped by Sergey Brin and Google.

https://techcrunch.com/2009/06/18/all-in-the-family-sergey-b...

Indeed, and it’s not like a billion dollars in google cash couldn’t paper over any disagreement, no matter how ugly.

Well at least you had a choice. It wasn't like your parents took it.

Some of us had non-tech-savvy siblings take it and only bring it up in casual conversation months later though...

I’m reluctant to take it, but then I wonder if a few of my close relatives have already taken it, isn’t the horse mostly out of the barn already?

Yes, the Golden State Killer never submitted his DNA. He was matched from his relatives' DNA.

I wanted to have it done so badly, but now I'm with you. Anyone have a cost on analyzing your DNA privately? Then the breach is just you+1, and you could use a fake name (I know, I know, that isn't foolproof when DNA is involved)

I literally looked this up last night for personal interest. Allegedly Texas A&M will do it for $800. A whole genome sequence for a human. https://www.txgen.tamu.edu/new-novaseq-pricing-25feb2019/

Your DNA, in isolation, is not very useful to you (other than medical). The idea is to find relatives by matching segments of DNA with other people.

The medical part was the only part I was ever interested in

~ $2000 for whole genome sequencing (WGS). Whole exome sequencing is cheaper but much less precise, ~$700.

For what 23andme does, a couple hundred probably, maybe under 100 if you went in with several people. You could have your whole genome sequenced, the materials and service cost would be in the neighborhood of $7000 commercially.

Data analysis costs vary widely, depending on what you want.

399 euro at DanteLabs: https://www.dantelabs.com/products/whole-genome-sequencing?v...

That's awesome. Do they have a good track record of privacy? I read what they have on their site, but I can't just take them at face value with something as valuable as a whole genome.

For a while Veritas claimed to offer full genome sequencing for $1000, but I believe they've recently reduced the price to $600. Also, in refreshing my memory on this company with some light research, I found this published 40 minutes ago:

https://www.bloomberg.com/news/articles/2019-11-06/breach-at...

Whoops!

You can delete your data fairly easily from their website. Takes about 30 seconds. Of course this assumes your data hasn't been leaked elsewhere, and that they are compliant.

Many systems don't actually delete data; they set a "deleted" flag that often causes the system to behave as if it did from the customer's point of view, but the data stays in the database for perpetuity.

That means in all likelihood it is still there, and may actually still be being served to other users.

> Many systems don't actually delete data; they set a "deleted" flag that often causes the system to behave as if it did from the customer's point of view, but the data stays in the database for perpetuity.

> That means in all likelihood it is still there, and may actually still be being served to other users.

Thank goodness things like CCPA will change this.

Is there some way to take the 23&me test anonymously?

Perhaps a prepaid credit card bought with cash and having the kit mailed to a PO box?

Even if you take it "anonymously", they will be able to link you to your family/relatives/etc. It wouldn't be too hard to track you down. They may not know your legal name, but they would be able to know who your parents, siblings, cousins, etc are.

No. Once someone has your DNA, there is nothing anonymous.

You would need your own home lab kit that can do all of the diagnosis in your home, without being connected to any external networks at all.

Right, but couldn't you just give them a fake name and use a PO box, or am I missing something?

Sure, but you would be giving them your DNA, which can be mapped back to you through other peoples DNA that are in any way related to you. What I am saying is, that once someone else has your DNA, all aspects of anonymity are gone.

To reduce exposing "who" you are, then you would have to ensure that nobody currently related to you, or future offspring, ever get their DNA stored, are never arrested, are never in a medical facility that stores DNA samples, and so on. You would also want to verify that nobody related to you has ever been arrested or provided their DNA willingly or otherwise.

DNA can also be used in conjunction with computer modeling to draw a picture of approximately what you look like. That image can be compared to state ID card data. This was done for a brief period in Japan, using chewing gum stuck to bus stop benches, to show off their software. Here [1] is one example from 2013.

In summary, to remain anonymous, you would need a kit that you operate at home, that does 100% of the diagnosis and reporting in your home, with no DNA and no data leaving your home whatsoever.

[1] - https://www.smithsonianmag.com/science-nature/creepy-or-cool...

If your brother or sister submits their DNA it's going to be immediately obvious you are siblings. Same goes for your parents. There is some ambiguity if it's aunts or cousins, but you might be able to work it out.

Yeah but if your brother filled it out non-anonymously you'd lose your anonymous status.

Reply on news.ycombinator.com