Hacker News Reader

Comment by mywittyname | Hacker News Reader

> You've been duped by the dupe that everyone saw coming.

Not only that, this is one of the benevolent aspects of 23&Me that people saw coming. It's only a matter of time before this information trickles to insurance companies.

View on HN

But wait, it gets better. The data is now permanently out there which means it's only a question of time until it leaks to insurance companies and bad actors, but the data is not only about the individual who submitted their DNA but everyone related to them.

I'm sure GP's children will love them for selling out their data to future employers and insurers.

This would be a concern if DNA was something secret like a password, but it isn't, it falls off you all the time in the form of hair and skin cells, so if there was something valuable in your DNA, your employers could get it easily anyway. And if your DNA was useful to insurers you would pay yourself for them to get it, because knowing that your risk of dying from certain disease is higher is also required for preventing that.

In general trying to keep DNA secret to prevent discrimination is a losing game, a better strategy is preventing discrimination itself, which we already have to do for DNA variations that have visible manifestation. Moreover if the number of people who need protection from discrimination increases, we'll get better at preventing it, which would be useful for the people who are being discriminated now.

> your employers could get it easily anyway

I really hope that would be illegal here in the EU. It being physically possible (or even easy) doesn't make it okay. Not having the dataset easily available is one safety layer to prevent discrimination. No, it sadly doesn't help in all cases. Its unlikely there will ever be something that can, unless maybe you believe in perfectly implemented government policy reeducating us or controlling our behavior.

I'm curious what "bad actors" you imagine with a DNA dataset. Targeted viral agents to hunt and kill only shadowgovt's? If someone wanted to do that, raiding my trash for a half-eaten sandwich is a lot easier way to get the data they want then hoping I upload it to 23andme.

I think they were probably referring to the more mundane use of insurance companies buying the data and raising premiums for people with genetic risk factors. Which IMO seems very plausible.

It's not impossible, but if it happens, it'll be a hell of a lawsuit. That scenario is specifically carved out as unacceptable in US law.

And we know that no law going against the citizen's own interests ever passed.

Absolutism doesn't really help in crafting good policy. The threat that bad things could possibly, maybe happen isn't a good reason to stop chasing disease cures.

If we knew the ways vaccination programs would be abused, should we have refrained from inoculating so much of the world against polio?

It absolutely is and it's also the reason the FDA has a process you have to follow before doing human testing before potentially killing people with a new treatment you're trying to develop.

Yes, exactly. There's a process to follow to minimize risk in human testing. Human testing isn't categorically banned.

Correct, because we thought about the cost and risk of early human trials. Which isn't the case here. You're happy to forego any protection of the people involved.

I think the case is that people have put quite a bit of thought into costs and risks of big-data aggregation of DNA and come to different conclusions on what risks are realistic and what the consequences of those risks are.

They clearly haven't since they didn't even bother asking their users.

It would be hard for them to be more clear about it.

https://www.23andme.com/about/consent/

"Which of my personal information is used for research?"

"Your genetic data and any other personal information you enter into the website, except for your Registration Information (name, contact information, and credit card information), may be analyzed in the research."

It really seems people are complaining because 23andme didn't demand they sign a consent for something they had already explicitly signed a consent to. I, for one, assumed large third-party pharmaceutical companies would have access to the data when I volunteered it. Is there significant risk people misunderstood that? How?

https://www.youtube.com/watch?v=HKQDSgBHPfY

DEF CON 25 - John Sotos

"Genetic Diseases to Guide Digital Hacks of the Human Genome"

US health insurers cannot even possess genetic information for underwriting purposes.

https://en.m.wikipedia.org/wiki/Genetic_Information_Nondiscr...

You have no idea how many ways there are to adhere to the letter of that law while ignoring the intent. There are entire multinational businesses built specifically to facilitate these kinds of data exchanges while keeping it technically legal.

The health insurer doesn't need the genome. It just needs a number from 1 to 10 from a 'de-identified' source to multiply their scores by.

Fair, but they still can't rate my plan with that number.

ACA plan premiums can only be set based on 5 factors: age, location, tobacco use, individual vs. family enrollment, and plan.

Sure, for now. We would all be naiive to believe that insurance companies wouldn't lobby to be able to use other such information continually if they had it until they can use it to charge you more.

Such a strange concept that we say that insurance can't be rated according to significant risk factors.

The state of health insurance in the US would be better described as a "private social health benefit program".

Insurance is effective at protecting people from uncertain financial risks, but the demands of the public have gradually changed the function of health insurance to include many things outside of that.

The question was never "what functions do insurance companies do efficiently?", the question has always been "what health benefits do people deserve?". Unfortunately, these questions have different answers.

Life insurance, disability insurance and long-term care insurance providers can use genetic information to deny coverage[1].

[1] https://www.npr.org/sections/health-shots/2018/08/07/6360262...

Yes, there are saying information want to be free. These data should eventually be public anyway, yes including to insurance company. The solution should be even more transparency, rather than privacy. The sooner we embrace and adapt, the better.

Reply on news.ycombinator.com