Hacker News Reader

Comment by nerdjon | Hacker News Reader

23andMe is one of my biggest regrets in my life, I did it before I really started caring about privacy. It was on sale on Amazon and yeah.

It sucks since I have zero trust that they would actually delete my data if I asked them too, and even if they do is that data still living somewhere fed into some model or research or whatever.

I hate to say that there is a part of me that kinda doesn't want to know if my data is a part of this, this just feels different than a credit card or some shopping data leaking.

Even worse since I have not gone to 23andme in a while, I feel like this was likely also before I cared about proper password security so it would not surprise me.

View on HN

It doesn't really matter. The genetic matching models are so primitive that there's really not much of value in the data anyway. Facebook and Google have a far more accurate picture of what can be used to manipulate you. 23andme is little more than a curiosity.

My data is probably in this breach too, and I am not going to waste one second of my life on regret over it.

Stay tuned to find out if you get something from the class action lawsuit. Like the experion hack, you may at least get an interesting coffee table artifact when they mail you a pathetically small check.

What about this? https://www.cbc.ca/news/world/dna-from-genealogy-site-used-t...

Seems like there is at least some value.

There's arguably societal benefit to the broader availability of DNA data but very little of that passes down to me personally and there are risks. I have very few close relatives but it's not hard to imagine the widespread use of this data by law enforcement would pull in some people with more extended families into investigations they'd rather not be involved in.

Doh! Didn't get the fuss over DNA data before but that scenario definitely makes it clear.

Sure , there are several big issues in compromised DNA profiles. See also: https://www.ecseq.com/blog/2019/privacy-implications-of-gene...

But let's wait until it's clear whether raw data was actually leaked.

Isn’t the raw data pretty much guaranteed to be leaked ?

I remember a few years ago there was a button to download raw data.

So if you can log in you can just download.

23andMe shows up to 1500 DNA Relatives for each user (outside of subscription features).

What we know thus far is that the malicious persons who compiled these datasets are scraping user profiles of DNA Relative matches who are related to the accounts which they were able to directly compromise (likely as a result of password reuse). The posters claim to have accessed around ~7M profiles, which means the lower limit for directly compromised accounts is ~4700, although likely much higher (maybe a factor of 10?), given the overlap in match lists, and provided that their boasts are true. So that's potentially ~5000-50000 profiles.

For those directly compromised accounts raw data could be downloaded. For profiles scraped, it would not be feasible to obtain raw data. However it is possible that partial genetic sequences might be assembled for matches. This was at the core of security researchers' investigations into GEDmatch a few years ago [0]. 23andMe does not face the same vulnerability, however with enough compromised accounts it is likely possible to infer a modest proportion of the DNA sequences of profiles which are known to match.

[0] https://www.washington.edu/news/2019/10/29/genetic-genealogy...

This is also my opinion: they stole a really poor social graph, that's all

Knowing who's related to who is a very useful social graph if your goals are unethical.

Or if your goals aren’t unethnical!

> 23andme is little more than a curiosity.

If you call criminal convictions "little more", sure.

Many people consider that a good thing, but I'm not talking about moral valence or vibes - the point is they are an industry supplier of PII that sends people to jail.

What a strange thing to say. If you committed a crime and the genetic information you gave to some company leaks, and someone is able to use that information to prove you're guilty, what sends you to jail is the fact that you committed that crime. The existence of this company and the leak enabled this particular way of proving you guilty, but you were still guilty, so you might have been successfully proven guilty by other means. But most importantly, you're guilty. You're going to jail because of your actions, and for no other reason. It's not like there's someone out there using this information to frame other people of crimes they didn't do.

>It's not like there's someone out there using this information to frame other people of crimes they didn't do.

pretty bold claim -- as with any additional justice element the innocent will be trampled to some degree.

Here's the thing : it doesn't just open up criminals for prosecution, it also opens up the 23andme population to an even larger arrangement of possibilities for self-incrimination and 'incorrect or misdirected pursuits of justice'.

It's nice that a well known murderer was found out, but the reality of the situation is that we likely wouldn't hear very loudly the stories of innocent folks with cases mishandled by a law enforcement bureaus that were enabled by 23andme or similar services. It looks bad on the law enforcement agencies and it looks bad for the corporation.

>pretty bold claim

I don't think so. How would that even work? It's not much different from framing someone of a crime just by knowing their blood type.

>we likely wouldn't hear very loudly the stories of innocent folks with cases mishandled by a law enforcement bureaus that were enabled by 23andme or similar services

Nah. Let's suppose that someone made a typo and Mr. Buttle is accused of committing the crime Mr. Tuttle, who deposited his genetic material, committed. While the Buttle-genome link is a useful piece of evidence, it's on the judge to request a saliva sample from Mr. Buttle to ensure a trustworthy source of information. If he doesn't, well, it sucks for Mr. Buttle that he got a lazy judge, but it's not on the company. The person who wrote down the name could not have known that information would at some later point be misused to lockup an innocent man.

In this case Mr Buttle would just need to get genotyped again to prove his innocence.

This argument can be generalized against anything police or prosecutors use to convict people. Fingerprints can falsely implicate someone in a crime. Witnesses are notoriously unreliable. If we allow prosecutors to present fingerprints or witness testimony as evidence, innocent people will sometimes get convicted. The most effective way to minimize false convictions is to never convict anyone.

Or, you had some connection to the victim or scene of the crime and the presence of your DNA is treated as proof of your involvement, because juries are often swayed by technospeak and irrational arguments.

That jury would have been equally swayed if the sample had come directly from me.

You might not have been a suspect otherwise. If they found DNA of an unknown person at the scene but you hadn't put yours in a database, how would they know who to look for?

If only you hadn't worn that hoodie that made you look exactly like that guy that robbed that convenience store.

Honestly, some of these responses are so strange. It's like these people don't understand that they don't live completely by themselves and that the actions of other people affect them, regardless of what technology exists.

It's not strange. there's abundant evidence the juries are over-reliant on scientific expert witnesses in matters which jury members are not competent to assess themselves, and that this often leads to mistaken outcomes. You probably wouldn't be convicted just because you had a hoodie and jeans on that made you resemble a suspect; the idea that two people dressed in very common clothing might be mistaken for each other is something anyone, even a kid, can understand. But juries are likely to take the opinions of forensic experts very seriously, even when they're not well founded in fact or experience.

https://www.thepmfajournal.com/education/medico-legal-forum/...

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4581010/

Now the chances of your DNA being at the scene of a serious crime and you being convicted a a result of a data breach are fairly remote, more the stuff of crime fiction as entertainment. But strange things do happen:

https://daily.jstor.org/forensic-dna-evidence-can-lead-wrong...

Let's start over. You say that if a genetic database didn't exist you wouldn't have been made a suspect, so I reply with a random example where you could be made a suspect without the assistance of high tech. To keep the hypothetical relevant, in it they take you into custody and take a DNA sample from you to compare against one from the crime scene. Either they get a match and that makes you more of a suspect, or they don't and it doesn't. If they get a match, potentially you'll need to convince a jury that the presence of your DNA at the crime scene doesn't mean you had anything to do with the crime.

I don't see what the existence of the database changes. With or without it there are ways by which you can be linked to a crime you had nothing to do with, and it doesn't seem like it can't be used for anything other than quickly getting a list of people who might have been at a crime scene. The article you linked is not about DNA databases, it's about how DNA evidence is misused by law enforcement. All it says about DNA databases is that black people are over-represented in them.

Sorry your judicial system depends on the savviness of random idiots off the street, but it has nothing to do with whether companies like this one exist.

You seem to have completely missed my point. Of course you could be incorrectly made a suspect without any high tech being involved, it has always been thus. The existence of genetic databases provide additional ways you could incorrectly be made a suspect.

Sorry your judicial system depends on the savviness of random idiots off the street, but it has nothing to do with whether companies like this one exist.

You don't have to opt for a jury trial int he US but most people do. Fascinated to hear which enlightened polity you inhabit that is immune from miscarriages of justice.

You must be quite certain your government will never break bad.

If the argument is "the data controlled by this company could be used by an incompetent judiciary system to punish innocent people, therefore this company shouldn't exist", then you should go live in the wilderness away from society, because there's any number of ways that the illegal actions of those around you could have you accused of a crime you didn't do. Personally, I prefer to recognize that I live with an imperfect system and gamble that I'm more likely to find stability and happiness in spite of that system than completely on my own.

What puts you in jail is the combination of laws and their enforcement mechanism. Having everyone’s DNA makes enforcement of any law (good or bad) a lot easier.

Your argument only makes sense if you believe you are innocent of all present and future crimes, which is an impossible fact to know by the very fact that you do not know the laws in the future.

No, that's wrong. Even if my actions are criminal unknowingly to me, what puts me in jail is those actions. That my actions had consequences that were unknown to me (in this case, breaking the law) doesn't change the fact that they were the trigger of the sequence of events that led to me being in jail. After the sequence started, there could be any number of events outside of my control that could lead either to my very quick prosecution or to it being impossible to ever catch me.

Your last sentence is a counter-argument against excuses for surveillance. "The argument 'you have nothing to worry about if you did nothing wrong' means you think you know what laws in the future will be like." It's inappropriate here because we're not talking about surveillance; we're talking about people who willingly gave out their genetic data to some company. The company did not divulge the data, so this discussion is not about privacy and ethics. Maybe don't tell Facebook everything there is to know about you? Maybe don't send genetic samples to whoever to learn random nonsense that doesn't matter about your ancestry? If you do and it leaks, TS?

Terrorists are buying the data on the black market to get a list of Jews to target, because being Jewish is something that shows up in your genetics.

They are? Source?

https://www.wired.com/story/23andme-credential-stuffing-data...

https://www.nbcnews.com/news/amp/rcna119324

https://www.washingtonpost.com/technology/2023/10/06/23andme...

https://www.jta.org/2023/10/13/health/23andme-sued-after-ash...

As cute as the implication I just read several of the articles and see no specific evidence about the terrorist groups, just the leak. I'll finish the last one but that's a weak association if I've ever seen one.

Endogamy was also historically common in the Jewish diaspora before the Contemporary Period, so on average they will probably see a lot more distantly related people via 23andMe which creates an exponential increase in the amount of data scraped per user account.

You know, I hadn’t considered that as a consequence of endogamy! You’re totally right.

You think terrorists need genetic data to find some Jews to target?? That's certainly not the low hanging fruit ... sounds like an urban myth to me.

> Terrorists are buying the data on the black market to get a list of Jews to target, because being Jewish is something that shows up in your genetics.

There are easier ways to find Jews...

I'm a data hoarder and considered ordering my complete genetic sequence (not from 23, there are others that send you back an HDD with somewhere around several-gigs to 1tb+ of your genome). But I resisted because I would have no idea what to grep for. Without a biotech background it would simply be a waste of my time.

Every time you see an article about how some gene makes people like to eat potatos, or grow toenails really fast or something, you're about a minute of searching away from finding exactly what you need to grep for to see if you're a match.

The one issue is, unlike social data, you’ve not just given up your data, but you’ve condemned your entire future lineage to this leak. All their genetic information can be partially imputed from this info.

Maybe this doesn’t matter today but who knows what it’ll be valued at 50 years from now?

Don’t upload your saliva to the internet folks.

I was really curious too and did one of the major services, that's likely been hacked too by now.

But I registered under a false name, gave the test kit to my dad, and had him test one of my aunts too.

So it wasn't as exact but it was good enough to sate my curiosity.

Everything gets hacked sooner or later. A famous hacker once said that you should assume that everything you say or write will one day be public information.

Edit: And before anyone says "how could you do that to your father", if you knew him you'd understand. He's practically off grid and he's going to die soon, the aunt is already dead.

>that data still living somewhere fed into some model or research or whatever

Do you mean like for drug discovery and other medical research? Why would that be a bad thing?

On paper there is nothing bad with that.

But it still removes my ability to delete my data, especially when 23andMe has proven that they are not properly safeguarding this data.

Also me donating this data to a research organization vs being lured in by 23andMe's marketing are drastically different things.

Oh god, that's made me realise. Does a GDPR right to removal extend to LLM's that have been trained on your data? What probability of retrieval counts as still storing your data?

GDPR recital 26 covers your question.

Excerpt for the second part:

> To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments.

So they don’t call for an exact probability, but if you can prove you did appropriate threat modelling and put controls in place to counter those threats you should be fine. You are literally doing more than most companies if you manage that.

My understanding is you kind of don't even need to screw up on this one, just be related to some one who did and you're more or less in there anyway.

Wait, you didn't ask them to delete it? If you did the hacker probably wouldn't have your data.

Meh, it's just some stuff they extracted from your spit. I wouldn't get bent out of shape over it. Who knows, we might all get a decent payout from a settlement. You certainly won't regret when that happens.

It's also one of my biggest regrets, and I never did it.

My mom did.

She never asked me, or anything. But half my material is right there, in an irrevocable database, now leaked online for the world. And I have no genetic rights or any claim, even though half is explicitly mine.

Hang on can I understand your position? As I read it your (biological) mum took a swab of her own mouth and sent it to 23 and me. And you argue she should have asked your permission before doing so because she would be giving them half of your DNA?

Honestly I am not sure where I stand on that issue. Or rather it's probably to do with society wide regulation not individual rights ...

It's an interesting issue.

If a stranger had asked OPs mom for OPs phone number out of the blue, there are many moms that wouldn't share a PHONE NUMBER without asking the phone number holders permission.

But fewer would ask their relatives if it's ok to stick a decent portion of their DNA into a database.

Wait till they find out that 99% of our genes already got leaked to the public by the Chimpanzees.

Or that you can hit a tree up to get 50% of them.

This is really dismissive.

It should be obvious that, to the OP, the important part is the 1% that is unique, not the 99% which isn't.

What if OP lives with their mom and so when the stranger asked mom for her number, she also revealed OP’s.

Should mom not be allowed to give out her number. She had it first. Or should mom need to clear every use of her data with her kids because it might affect them.

Should OP get mom’s permission before emitting genetic material on a lover because that material is half of mom’s dna?

I think this is not a path that can be exactly logiced out, so I stick with “do what you want with your data.”

There are also a lot of moms out there that would give up a phone number without hesitation if not even suggesting the person should have it without being asked.

We used to have this thing called a phone book! Imagine the dystopian horror!

Even crazier, phone books where I lived had a Do NOT List arrangement with Telco providers that was actually respected and bulk leaks of DNL numbers | addresses names were almost unheard of.

Even stalking LEO ex boyfriends | former husbands mostly left a paper trail if they requested a DNL number.

Should an identical twin be required to get their twin’s consent? That would be 100% of their DNA. What about their twin’s children?

No, and there's no moral ambiguity about it. Separate human, separate decisions.

What is the John Donne quote again? Of course there is moral ambiguity about it. You can live your life pretending your actions don't have consequences for other people, but don't expect people to enjoy living in your wake.

Not sure why you chose this branch of the topic to share your declaration that the whole idea is nonsense, but ok.

And if their father also did it, 100% would be in there.

Except the data is randomized at conception

It was required of my sister to participate in 23andMe for an anthropology class of hers in college. I cringe now at what a violation that was. Even if she had the option to decline (which I am not sure she did), it's hard to say no to your professor when you're 19.

The ethics issues with that assignment would make for an interesting study all by itself.

The actual genetic data was not leaked. Why do people keep saying this?

Because nobody actually links to the leak proper. It ends up that people talk about writing about writings, rather than see what it is. And the prior post I did was auto-dead.. My guess is from the forum link. Cause we're not allowed to talk about breaches? Sheesh. (I edited enough stuff to review, but no direct links to leak documents.)

And digging around the breachforums DOT is/Thread-23andMe-Great-Britain-Originated-4M-Genetic-Dataset , you see stuff like

"The data includes information on all wealthy families serving Zionism. You can see the wealthiest people living in the US and Western Europe on this list."

This link combined with the 2nd one doesnt look good in any stretch of imagination. These are antisemitic leaks intended for harassment and/or hit lists. It definitely looks BAD. But again, it's already in the world now.

-------------------------

Here's the schema of said data ( breachforums DOT is/Thread-DNA-Data-of-Celebrities-1-million-Ashkenazi-REPOST ):

profile_id; account_id; first_name; last_name; sex; birth_year; has_health; ydna; mdna; current_location;region_1;region_2;region_3;region_4;region_5;subregion_1;subregion_2;subregion_3;subregion_4;subregion_5;population_id1;population_id2;population_id3

I don’t know if holding a grudge against the naive parents of the world is productive, although I can understand the frustration.

Anger is better directed at legislators for not regulating these sorts of businesses under HIPPA and similar laws. Your mom’s medical records also contain a bunch of sensitive information about you and yet you probably don’t get mad each time she visits the doctor despite the privacy risk this incurs.

Treating 23andme like a lighthearted way to enhance your genealogy hobby or whatever is actually so fucking wild. This shit is not a game, only a SMALL fraction of the victims are 23andme’s customers. 23andme’s responses to me are proof enough the entire company should be shuttered because they are grossly negligent and don’t understand what business they are in or what they just did or how they fucked up.

> 23andMe is one of my biggest regrets in my life, I did it before I really started caring about privacy. It was on sale on Amazon and yeah.

I've had someone give one as a gift, so glad I didn't do it.

how has 23andme affected you in reality? (not hypothetically)

Even though I'm not a direct customer, it affected me: I now know I have tens or more half siblings throughout the US. It's mildly unsettling but I guess I'm happy that people were able to find my dad, who is also their dad.

I discovered that I have the apoe4/4 gene, which not only explained why keto -despite helping me lose weight- threw my cholesterol to dangerous levels, but also explain some other important things about my family and genetics (some things that weren't even in the results, but they let you download the raw data of your genome so I did some bioinformatics). It helped me with changing my lifestyle and having a clear picture of what the focus on.

Sperm donor. At some point in the future, I'm going to have an entire classroom of people figure out who I am based on suggestions of my relatives in their family tree. I deleted my data years ago, doesn't matter.

They have an option to destroy your data and the original sample you sent in

They could never get my DNA when i tried it. They sent out 2nd test kit that didn't work either. Would they have kept the samples?

Not that i really care, you're not going to find a password or my first pets name in my DNA.

Have you seen Blade Runner?

Reply on news.ycombinator.com