Breach exposed more than one million DNA profiles on a major genealogy database

Re:Breach exposed more than one million DNA profiles on a ma... by Random_ernest on Thursday July 23, 2020 @03:56AM (#23925162)

With likely very dire results, yes I think you should. If your mothers insurance rate goes up, since you got one of these dna tests for Christmas, she should be involved in the decision to publish this data in the first place.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by jrib on Thursday July 23, 2020 @06:42AM (#23925947)

In the US, Congress has passed a law that explicitly makes that specific practice illegal: https://en.m.wikipedia.org/wiki/Genetic_Information_Nondiscr...

What workarounds insurance companies come up with to circumvent the spirit of the law and how well it can be enforced will be interesting.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by alexpotato on Thursday July 23, 2020 @08:41AM (#23926694)

And George W. Bush, a Republican, signed this into law. I remember thinking that strange at the time because I would have thought insurance companies would want to be able to use DNA information and the Republicans being more of a "big business" party would have supported that.

Also, I found out last time this discussion came up on HN that the law prevents it being used for regular insurance but does not apply to life insurance.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by astura on Thursday July 23, 2020 @09:36AM (#23927205)

And life insurance could just simply demand a dna sample from you before underwriting a policy just like they might demand a physical so the whole "concern" is entirely moot.

Insurance is highly regulated, insurance companies have specific legal ways to underwrite policies, the idea that life insurance companies are going to secretly use stolen data of uncertain provenance in their underwriting instead of just making you submit a dna sample is, quite frankly, silly.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by FerretFred on Thursday July 23, 2020 @07:31AM (#23926200)

What workarounds insurance companies come up with to ... will be interesting

If there's enough money to be made, I'm sure the Usual People will be persuaded to bend the law until it gives way.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by phoe-krk on Thursday July 23, 2020 @03:37AM (#23925060)

I think so, yes. Otherwise you're sending large portions of their personally identifiable information to some sort of database without their consent.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by i_cannot_hack on Thursday July 23, 2020 @03:56AM (#23925158)

Do you also think I should consult my identical twin for permission before uploading photos of myself to the internet? Why / why not?

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by thelittleone on Thursday July 23, 2020 @04:03AM (#23925195)

Hardly a fair comparison. However the few identical twins I know have been very mindful of how their individual behavior affects the other.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by i_cannot_hack on Thursday July 23, 2020 @04:41AM (#23925397)

Of course I realised the comparison would be somewhat controversial, it was actually the point of bringing it up. However, if you have the time I would appreciate it if you tried to articulate why you think the comparison is unfair, instead of just a general dismissal.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by macintux on Thursday July 23, 2020 @08:58AM (#23926845)

Your (twin’s) photo is unlikely to be used for:

* Identifying future medical risk factors

* Solving 30-year-old cold cases where DNA is the only evidence

* Identifying parentage in adoption cases

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by i_cannot_hack on Thursday July 23, 2020 @09:15AM (#23927001)

But my (twin's) photos could likely be used used for:

* Linking them to the location of a crime using Clearview AI and similar scraping facial recognition services

* Creating fake but believable defamatory photos and videos, such as deepfakes

* Being scraped and used in fake profiles by spambots and other nefarious actors

* Being exploited as a tool in identify theft and identify fraud, via various kinds of social engineering.

Do you not consider some of these scenarios worthy of a similar amount of consideration?

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by macintux on Thursday July 23, 2020 @12:12PM (#23928888)

I consider them to be unavoidable, barring some extreme off-the-grid efforts. Your photo is out there. Your DNA doesn’t have to be.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by phoe-krk on Thursday July 23, 2020 @03:58AM (#23925173)

I'd argue not, since a single photography contains much, much less information than a full DNA fingerprint.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by Ultimatt on Thursday July 23, 2020 @04:04AM (#23925201)

Not for identifying or incriminating you it doesn't given the practical risk of how the information can be used.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by i_cannot_hack on Thursday July 23, 2020 @04:22AM (#23925298)

That's a fair point. However, I'm not entirely sure I buy the premise. With the advent of deepfakes and internet scraping facial recognition, I think a public photo collection of your entire likeness could be considered least somewhat at risk for abuse, when compared to the risk that a confidential fingerprint with ~25% of your genes is leaked and then used against you.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by sbassi on Thursday July 23, 2020 @05:42AM (#23925662)

Your data, your rules. I put my 23andme raw data in github (https://github.com/sbassi/MiGenomaSbassi) for the world to see and use without asking anybody in my family.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by berkes on Thursday July 23, 2020 @06:17AM (#23925818)

I strongly disagree. I consider it comparable to something like financial administration. In which an "expense" or "exchange" has two sides. Me, paying you, you receiving the money.

It is not up to me to decide to just release such data. Because it encodes other people's data too. If I were to release my financial records because "it's my data", i'd be exposing a lot of people, organisations and companies who I had interaction with.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by yreg on Thursday July 23, 2020 @06:26AM (#23925861)

But it is up to me to decide to release my financial records. All the parties I've dealt with have to expect the possibility (unless there is some signed agreement that prevents disclosing them).

With DNA I'm not so sure.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by berkes on Monday August 03, 2020 @11:14AM (#24038708)

I'm pretty sure that if <insert ecommerce platform here> were to leak all their financial transactions, that is considered a large data-breach and would be considered a privacy infringement.

I am aware that "an ecommerce platform" is something else than "your personal finance", but the principle is the same: X shouldn't release other people's financial transactions just because those were done with X.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by yummypaint on Thursday July 23, 2020 @08:44AM (#23926716)

The federal Genetic Information Nondiscrimination Act does prohibit insurers from asking for or using your genetic information to make decisions about whether to sell you health insurance or how much to charge you. But those privacy protections don't apply to long-term-care policies, life insurance or disability insurance.

https://www.npr.org/sections/health-shots/2018/08/07/6360262...

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by mellosouls on Thursday July 23, 2020 @08:44AM (#23926722)

The point is, it's not just your data. It's shared with other people who may not want it being publicised to all and sundry.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by isbvhodnvemrwvn on Thursday July 23, 2020 @09:14PM (#23934623)

That's ridiculous. Should I not use my surname because I identify my parents, my brothers and some of my cousins? I think bodily autonomy applies here.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by mellosouls on Friday July 24, 2020 @05:14AM (#23937401)

You are giving far more away with DNA information; it's not remotely the same.

The point is, at the very least it's a grey area, so to dismiss the counter points so airily as you have done on such a serious subject indicates - at best - a lack of reflection and respect for the rights of others.

[ Parent | on HN ]

Re:Breach exposed more than one million DNA profiles on a ma... by jlg23 on Thursday July 23, 2020 @05:38AM (#23925644)

No, but for having the results stored at some company.

[ Parent | on HN ]