Hacker News Reader

Comment by zaptheimpaler | Hacker News Reader

I wanted to try this, but I looked into Nebula a bit more.

Nebula is facing a class action for apparently disclosing detailed genomic data to Meta, Microsoft & Google. The subreddit is also full of reports of people who never received their results years after sending their kits back. There are also concerns about the quality of sequencing and false positives in all DTC genomics testing. Given what happened with 23andme as well and all of this stuff, I'm wary of sending my genetic data to any private company.

View on HN

I was interested to read this because some time ago I had my genome sequenced by Nebula. If you look at the lawsuit you can see that what Nebula did was use off-the-shelf third-party analytics products on their website, including recording analytics pings when users buy a kit, and pings when users use the Nebula website to browse Nebula's high-level analysis of their traits (leaking that the user has those traits to the analytics provider.)

This behavior represents a contemptible lack of respect for users' privacy, but it's important to distinguish it from Nebula selling access to users' genomes.

https://www.classaction.org/media/portillov-nebula-genomics-...

That's a good clarification. I read through some of that link, and it does look relatively benign - Meta & Google pixels might see when you buy a kit but nothing more, but on page 21 they directly leaked genetic information to Microsoft via their Clarity tracker. Not intentionally maybe, questionable if it can be linked to a person specifically instead of just an advertising ID but they did leak that. I think the lawsuit says that even disclosing whether a person has undergone genetic testing is in violation of GIPA, so the information they sent to all 3 is enough to violate that.

I don't have any evidence they're selling anything but that lawsuit shows pretty sloppy behaviour for a company that should be thinking very deeply about privacy. I guess that's about what you said though :)

The point isn't what they are doing with your data now, but that they retain your data and what might happen in the future. Someone with malicious designs on your DNA might buy Nebula tomorrow and there's nothing you can do about it.

Actually, the main reason I used Nebula was that they advertised a credible-to-me promise that you could download and permanently delete your data upon request. That was some years ago, so I don't know if I would trust them today. But that was their claim, and I have no reason to believe they didn't delete my data.

That's a legal requirement in the EU and many US states. Some of the genetic genealogy companies actually play fast and loose with it though - not the deletion, which I trust, but the data portability and reasons to store PI parts.

Another point is that Wojicki's big idea that all this genetic data would be useful to sell to business, didn't work out so well. For an advertiser, it's a lot more useful to know if you're a smoker, than to know that you have a 40% higher chance of being a smoker.

> There are also concerns about the quality of sequencing and false positives in all DTC genomics testing.

Even when the raw results are accurate there is a cottage industry of consultants and snake-oil sellers pushing bad science based on genetic testing results.

Outside of a few rare mutations, most people find their genetic testing results underwhelming or hard to interpret. Many of the SNPs come with mild correlations like “1.3X more likely to get this rare condition” which is extremely alarming to people who don’t understand that 1.3 times a very small number is still a very small number.

The worst are the consultants and websites that take your files and claim to interpret everything about your life or illness based on a couple SNPs. Usually it’s the famous MTHFR variants, most of which have no actual impact on your life because they’re so common. Yet there are numerous Facebook groups and subreddits telling you to spend $100 on some automated website or consultant who will tell you that your MTHFR and COMT SNPs explain everything about you and your ills, along with which supplements you need to take (through their personal branded supplement web shop or affiliate links, of course).

Yeah, the only way I would ever do DNA sequencing is anonymously...

Because of public family trees potentially linking a genome to a family, no dna is fully anonymous these days.

The DNA itself is not "anonymous", but I would do it without giving my real name, address, etc. They could know who the DNA is related to, but not gain more information than that.

Even better would be to swap identity with someone else who wants to get sequenced...

They would be able to pinpoint your identity (e.g. "this person is the son of both X and Y, and we know who X and Y are").

And what would that gain them? "X and Y had a son"?

They know who X and Y are, and also know the identity of their son (you), so that gains them your unique DNA sequence, identified as yours specifically.

Yeah, I think you're missing the whole point of the "anonymously" part. :-)

How do you plan to do it anonymously, considering what you now know?:

1. There are already multiple database containing both your parents, you, and a linkage between you and them indicating parentage. So, prior knowledge: Alice and Bob are parents of Charlie.

2. If Charlie's parents have taken a DNA test, there already exists a database linking their DNA to their name. So, prior knowledge: Alice's DNA belongs to Alice, Bob's DNA belongs to Bob.

3. If Charlie takes a DNA test totally anonymously and perfectly untraceably, it will still show up as, child of Alice and Bob's DNA. So, knowledge now includes: Charlie's (anonymous) DNA is the son of Alice and Bob's DNA

4. From these pieces of information, it is trivial to de-anonymize Charlie's DNA, linking it to Charlie's identity: the only person it could belong to is the son of Alice and Bob, and the son of Alice and Bob is already known from point 1.

Ah, I see what you're saying!

I think in my case I'm just not that concerned by the hypothetical because my parents haven't done sequencing/genetic screening and also aren't likely to. I guess the main question is how far out in my family tree I have to think about that. (Also has implications for my descendants, I suppose...)

Reply on news.ycombinator.com