What would even be the right hands in this case? Seems like almost any hands would be the wrong hands.

My ideal would be customers given the option to have it delete sold and profit split with between themselves and 23&me, or anonymised and donated to the human genome project.

There basically aren't any. Almost any entity that would want to buy the company should by definition not be allowed to do so.

The ideal solution would be for all data to be deleted before a sale. If anyone would want to buy 23andMe without the collected data then that's perfectly fine.

Sounds like it's time to send 23andMen a GDPR/CCPA/etc. data deletion request. Here's an easy way to do it: https://yourdigitalrights.org/d/23andme.com

I don't like 23andme, but don't the shadow profiles sorta implicitly exist whenever you're working with DNA data?

If their DNA test can recognise first cousins, then they've got a recognisable DNA profile for each user's parents, grandparents, children and so on.

So does the government and probably ancestors.com … what’s the big problem here?

Your genome can be scavenged from the air. It is not information we are capable of keeping private.

But can it be isolated from the myriad of life floating around?

I doubt that specificity would be economically profitable.

The police did catch the Golden State Killer by scavenging a used coffee cup or somesuch, however.

>The police did catch the Golden State Killer by scavenging a used coffee cup or somesuch, however.

And it required detectives to follow him around until he left whatever it was that was adequately isolated. It's a little different from a database of 7 million.

>I doubt that specificity would be economically profitable.

It's be much easiser to setup a DNA catfish from a Tinder date if someone is that determined to get a decent sample from you. If it's not targeted, a door-to-door salesman can collect dozens over a day for use.

There's so many social engineering tricks to take advanadge of that you'd paralyze yourself trying to keep your DNA to yourself. Better to just petition for regulation at that point.

Anything that can be obtained from your discarded tissue or Starbucks cup isn’t really something you can hope to keep secret.

Often it can. And even in cases where currently it can't the technology will improve, costs will come down.

Yeah, eventually, but it may be a while.

DNA sequencing costs for a full human genome have outpaced Moore's law. I wouldn't bet on it.

Sequencing costs dropped dramatically in a window that started when sequencing was done highly inefficiently. That gave folks the false impression that DNA sequencing would continue to halve in price every ~X years.

The NIH occasionally updates this chart (note: Y axis is log scale)

https://www.genome.gov/about-genomics/fact-sheets/DNA-Sequen...

You can see there was a dramatic reduction in costs from 2008 to 2015, as several vendors released several substantial technology improvements, and a slow improvement from 2015 to now, but it's roughly flatlined, and there isn't much investment in developing new technologies now.

To the surprise of many, having enormous amounts of genomic data hasn't been the clear-cut improvement to human health, although there are some exceptions (especially cancer identification and personalized treatment). If we truly wanted to, we could spend capital and build out the sequencing, compute, and storage infrastructure to sequence every person on the planet at least once at 50X coverage, and store the data in perpetuity.

New adoption perk is ability to avoid DNA based shadow profiling (given no voluntary self sharing of DNA and current ID, of course)

I am not as worried if this data gets out or not.

I think there are negative externalities if the data is sold to insurance firms — who can use the genomic information in litigation and policy rejections — or if the data is sold to some sort of powerful, pro-eugenics political organization. The insurance externalities likely can be mitigated with minimal legislation (protecting consumers in a similar manner to how we protect those with pre-existing conditions) and it is reasonable to assume pro-eugenics political groups wouldn’t be any less dangerous without this genomic data available.

Thus, I struggle to see how this data changing hands would be especially detrimental to society. One could contend a moral dilemma will arise from future developments in cloning, but would it? We already have clones in the form of identical twins, and their existence does not seem to create many, if any, especially problematic moral dilemmas. Maybe people are worried that society will start cloning celebrities and famous intellectuals instead of having babies more naturally — creating a world of designer babies where the diversity of thought and talent shrinks in a “tragedy of the commons”-esque dilemma — but I don’t think this is people’s issue because most people frame their qualms as more of a personal privacy issue. Moreover, designer babies issue I describe would likely become an issue with or without cloning.

There are issues that come to mind regarding genomics in commerce — such as the ethics and market incentives of patenting certain genomic patterns — but again I don’t see how this 23andMe data changing hands make this issue any more pressing than before.

On the other hand, my instinct (which I have learned to never blindly trust) is that making the data more widely available may make it cheaper and easier for researchers to make impactful discoveries. Therefore, my biggest worry with the change of ownership is that the new owners may keep the data behind a bigger wall.

Look at the current political situation in the US. Do you think there's a lot of legislation protecting consumers from insurance firms any time soon?

Fortuantely my state is still pretty good about this, despite the federal administration throwing consumers by the wayside.

I agree with this point to some extent, but insurance before protections for preexisting conditions used acne as a reason to reject cancer treatment claims: obviously fraudulent behavior. If insurance is deregulated and any regulations aren’t going to be enforced regardless — a path we are going down — insurance firms will weasel out of claims with or without this genomic data

I'm a genetic engineer at a large pharma company. Genetic engineering of human model systems is my specialty. If I were a malicious actor, I could not do anything useful with the genome of any one person.

Most peoples genomes are boring and at best sway the predisposition for disease by a modest degree. Exposing infidelity is honestly the best I can come up with.

The problem is you are not a malicious actor so you aren't coming up with good scams or truly malicious ideas.

How about scam emails that open by asking people about their family history of some disease with a genetic marker and promising some miracle treatment?

I can think of even worse outcomes depending on how policy on immigration and naturalization shifts

scam emails are pennies on a dollar, though. it's so easy to just go through any email list ever and blast out thousands at once. It's not really a business that cares about targeted approaches.

>depending on how policy on immigration and naturalization shifts

Birthright citizenship invalidates such profling, but even then: I don't think the government needs DNA to figure out identities of people in the database.

    > It's not really a business that cares about targeted approaches.

It's called open rate and open rates are heavily driven by titles. Spam filters also use reputation to rank senders and open rates are one indicator of sender "quality". They definitely use targeted approaches if they can get their hands on datasets.

    > Birthright citizenship invalidates such profling

Only if you think that matters and the SCOTUS will uphold it. And of course, US isn't the only government; there are lots of other governments around the world.

>They definitely use targeted approaches if they can get their hands on datasets.

Even on a firesale, I doubt it would be cheap enough for the margins they work on. These aren't exactly large scale, sophsticated operations being worked with here.

>Only if you think that matters and the SCOTUS will uphold it.

Maybe I'm overly optimistic, but I think they will. If only because it's an absolute nightmare logistically trying to do it any other way. No country is going to accept a deportation flight of peopel who were not born on their land.

Or perhaps we have an underpopulation crisis decades later which does incentivize that. But that would solve the deportation issue in and of itself, right?

You've gotta think bigger.

How about generic profiling by a future malicious government that only wants certain types of genomes to proceed to the next generation?

The government can just run the tests themselves in that case. I think people will resist coercive sterilization more than coercive genetic testing.

Blood is drawn from basically every infant born in the US and then genetically tested for various diseases. And the health departments retain these cards with the blood draws, although I’m not sure how usable they are decades later.

If you have a baby at home with a lay midwife, the health departments retain will hound you endlessly to get this done, although legally you can choose to decline as a parent. Barely anyone does, since most parents want to know if their newborn will have a serious genetic disorder that can be easily avoided by (for example) avoiding artificial sweeteners.

You'd think so, but the government of California was performing involuntary sterilizations until 2014. An ICE facility in Georgia performed them until at least 2020. It's legal under state law in over half the country.

What's different today that would create a massive outcry that there wasn't 4 years ago?

Sounds complicated. Why not just figure out which genomes are simply correlated with people who don't support you and then pay off a bunch of scientists to write a bunch of garbage so that the medical industry doesn't care for them properly.

You do that kind of stuff across enough axis and the people who ought to be leaving your supporters dangling from the overpass will be too marginalized and preoccupied to do much of anything.

You don't even need "high tech" to do this sort of stuff. Depostic regimes have been doing it for centuries.

It's very amusing that the parent comment, or anyone else for that matter, believes their credentials somehow are enough to quell us about any potential horrific implications.

Parent comment is coming from an ethical person and ethical people often have a hard time imagining how unethical people operate.

Even I think I'm nowhere near unethical enough to maliciously use this dataset, but who would have thought that a social media platform where you scroll posts from your friends and family could be used as a political tool?

> Parent comment is coming from an ethical person and ethical people often have a hard time imagining how unethical people operate.

This is a trait of delusional people as well as those very deep into some "technocratic" ivory tower without any formed code of ethics, too.

I added my credentials to address the "malicious scientist" scenario that some people may associate with leaked genetic information. You dont need an individual's genome to create rather dangerous gentic weaponry.

For example, we now have cell-penetrating prime editor ribonucleoproteins, a derivation of the CRISPR system. These are essentially assembled molecular machines that can be loaded install almost any genetic mutation, such as tumor driver mutations. A picogram of this protein complex is potentially enough to riddle your body with cancer a couple of years after delivery.

Malicious doesn't just have to be biological in nature just because the data here is biological. That data can be used for a variety of non-biological malicious uses.

Faking DNA test results would be sci-fi nightmare come true. You could frame someone before they were arrested which would be ... Frightening. But even worse is invalidation of all DNA evidence because it is now easy to fake.

But that still seems like a minute possibility.

23andme doesn’t check your identity at all, so you could just put in someone else’s name and submit your own saliva, and then.. go on a crime spree?

Whose credit card details are being used in this scenario?

A gift card from the gas station? Long ago we bought gifts for parents/grandparents and all they had to do was redeem a code.

Thank you for saying this.

I’ve done some of these saliva samples and I’ve seen the freak outs about what happens if “they” get my genome. But I cannot for the life of me figure out what they would do with it maliciously? It’s not like it can be used to sign up for a credit card or whatever.

The Genetic Information Nondiscrimination Act gets repealed. Insurers immediately buy their database and drop you because you’re statistically more likely to get an illness.

Luckily most of us live in democracies, where we can just decide whether we want the rules to allow this kind of differentiation.

Yes, that's the middle-school civics ideal.

Then we learn about the perils of "majority rules" setups, of lobbying, of trying to evaluate thousands of different decisions across hundreds or thousands of legislators, etc. and it becomes a lot less simple.

You live in a democracy until you don’t. It can disappear overnight with the stroke of pen from some populist leader who just ignores laws. Never think you are safe just because you’re in a democracy.

If a future totalitarian government wants to save money on medical treatments then they can just euthanize anyone who gets cancer rather than euthanizing anyone whose genes say that they have a 50%+ greater risk than average of getting cancer. Or collect genetic samples themselves and use that to cull the population rather than just do it for people who were 23andMe customers.

You're going from 0 and 1 but there's a lot of time and politicking during which society is in the transition period.

Killing people off after they get cancer saves money but it does nothing for the gene pool if they already reproduced. Individuals who represent high cancer risks can be forced into sterilization and can consider other options for children in the future, such as adoption or raising a genetic alternative child. Totalitarian regimes can take note here.

or revert our diets to 1920 - no need to kill anyone :)

(but I get your point and I agree)

My favorite thriller story idea comes from knowing a character’s SNPs that are also covered by the standard forensic DNA panel. Then the antagonist in the story buys a bunch of oligos that flank the panel targets and spreads them around the crime scene to “frame” the character for murder!

So once the ‘’’bad guys’’’ purchase the 23andme database, the story is complete! They can then frame our protagonist…

It makes entertaining fiction, but in the real world, the ways that can be used to lock you up and discredit you in the public's eye are much more banal. And I doubt they'll get more sophisticated the way things look in the US right now.

With all those sweeping upgrades to artificial generational technologies, a time will come where no one will trust audio-visual clues and evidence collection will be solely focused on DNA fingerprints.

Yeah, this is definitely possible (and I'd bet the CIA et al already have this capability)

...or they just use your Dropbox deamon to dump a bunch of CP on your harddrive and then send in the FBI.

people back then with the same exact mindset: "what could they possibly do with just my fingerprints?"

im just afraid of the unknown. now its useless but how about after another 5/10 years?

Also, genes pass down to your kids, compared to fingerprints which are just cca unique for each of us. What a terrible thing to (unknowingly) do to them. Gattaca and all.

When I first heard about them and similar services, the potential for abuse was the first thing that came to my mind. I am not paranoid in any way and those were easy times compared to now. Still, I prefer not knowing my ancestry than this.

And ancestry for Europeans is not such a hot topic, you just need to look at a bit of history of continent and its civilizations and get the idea.

Sorry, what exactly could (a is) someone doing with my fingerprints?

Sell the entire database to a police state. Identify embarrassing mutations and blackmail people to prevent them from being released publicly. Corner high value individuals / billionaires, find an out of wedlock child, blackmail. ...

Without spoilers, there's an entire chapter of the Three-Body Problem revolving around what can happen if you're a sufficiently high-value target whose genome has leaked.

The outcome for this person is not great :-)

Plus they only have a selective number of SNPs, not the full genome.

But if you were able to somehow combine the information with the medical history of people, then you could use the data for research, and come up with some DL model maybe.

Isn't there possibility of very in depth racial profiling?

I mean ancestry.com data van be used similarly, but genetical info is inobfuscable.

It depends. Credible people claim that 23andme’s racial / ethnic compositions are highly inaccurate.

Even more reason to be concerned

i always thought that its valuable when you have enough data from an insurance pov? is that a myth?

For the vast majority of people lifestyle is much more deterministic than genetics. There are a few exceptions causing relatively deterministic adult onset diseases: Huntington, APOA4 homozygosity, FAP, BRACA mutants. These are rare however.

> For the vast majority of people lifestyle is much more deterministic than genetics.

How much of lifestyle do you think is determined by genetics, if any, and how much of that link do we currently understand?

I feel the concern around genetic data privacy has normally been the risk of unknown future stuff, rather than any current known vectors. I'm not saying it's a legitimate fear, but I don't know if it's one that is placated with "we can't currently do anything bad".

The impact of lifestyle is undeniable and large. Good genes will not protect your body from alcoholism. And if I were a betting man, I would bet against determinism emerging from a better understanding of combinatorial genetics.

I do think over time we will get a clearer picture of risk predisposition based on your entire genetic profile. However, I believe that genetic predisposion will remain a relatively small contributor for most disease states.

That's fair, thanks for the response, appreciated.

I agree that genetic predisposition will remain a small contributor for most disease states. However, I (an idiot who has no authority or experience with anything relating to genetics) feel we're going to learn a lot about how our genetics indirectly influence our behaviour and decision making though.

I think it'll be a boring dystopia: the biggest problem will be that the more complex, distant relationships between genetics and life outcomes are discovered, the more opportunities the bodies responsible for health will have to say "well we have to protect ourselves from the uncertainty, and that's going to cost you/be profitable for us".

If you're worried about this, you also need to be worried about them knowing what zip code you were born in.

That's what 23andMe thought too.

In the US, health insurers are restricted to using the following for pricing insurance, and genetics is not one:

https://www.healthcare.gov/how-plans-set-your-premiums/

All the other types of insurance (life/disability/etc) are free to ask you to provide DNA if they think it would be useful for underwriting. The fact that they do not means the DNA is not providing enough signal to be worth considering in the underwriting process.

Or they already have it, the same way any insurance company can look up how much coverage my policy has.

The people with the most to lose from widespread access to genetic data are those involved in outright crimes, like rape and child sexual abuse. Did you in a younger day get some underage girl pregnant? You're at risk. Or paternity lawsuits without the age restriction.

I wonder if some of those freaking out about the issue have a reason to be concerned.

On the other hand, once the information is out there, any aggrieved party will have plausible access to it, so it could be argued any statute of limitations would kick in.

You are not speaking from a position of a grifter though. I don't think it's a stretch that some YC funded startup could emerge and claim that they can map and predict everyone's entire actions/personalities/characteristics through their genome, heavily misinterpreting PGS/GWAS.

I don't think they would care much for scientific validity in this case. It won't matter to them if the methods used are reliable. All they'll get is appraisal from mainstream media for their revolutionary approach, further ingraining social darwinism.

>It won't matter to them if the methods used are reliable.

the method of being a fortune-teller? I don't see how that would ever be reliable unless we figure out voodoo kinds of tricks attacking the nervous system.

Phrenology thrived and was heavily celebrated only one century ago as well.

In the case of PRS assessment where it's already an established discipline, and not at all as unreliable as fortune-telling, it wouldn't be so hard to weaponize it.

Astrology isn't much farther off, and some still like to believe it to this day. Yes, even some very smart people can fall into absolutely baseless conjecture without peers to course correct.

But there's a difference between forming a cult and trying to convince the minds en masse of something.

Your info is off if you believe PRS assessments are anywhere close to pseudoscience.

And ok, let's agree for the sake of it that it is like astrology. Astrology is unnervingly popular, there are columns of big newspapers HN reveres dedicated to zodiac signs.

A cult consisted of people buying into something very close to eugenics masked as science doesn't sound it would have trouble gaining mainstream appeal in today's American society.

In fact, there's a great example of such discipline having already gained significant traction, even on this website, and it is none other than the field of evolutionary psychology. This field has provided close to zero replicable hypotheses yet it has been successfully weaponized into justifying prejudice and antisocial behavior, especially in the context of racial differences and dating.

Something like advertising reliable prediction of behaviors based on DNA would be cherry on top.

>voodoo kinds of tricks attacking the nervous system.

You mean like the art of advertisement, or more like what the extant system of social conditioning does in general?

Once 23andMe gets sold, all of that data belongs to whoever owns it and they can sell it to whoever they want. Perhaps to the government where they can do a warrantless search to find a relative of someone who may have been at a crime scene. Or to other governments. Or to insurance companies who want to play deny, defend and depose. I get that a lot of genetic information isn't predictive, but not all of it is so questionable.

> Once 23andMe gets sold, all of that data belongs to whoever owns it and they can sell it to whoever they want.

Why would a company being sold mean that the data can be used for a purpose it previously couldn't?

The acquirer could have different policies or legal jurisdictions

The data is an asset. The limitations are contractual. The contract is voided by the bankruptcy.

Doesn't DNA data have additional statutory limitations on top of that?

It has statutory limitations, subject to change, in how it can be used to discriminate against you. But those are tightly defined. It couldn't be used to deny you employment or health insurance, but could be used to deny you housing or life insurance.

> Exposing infidelity is honestly the best I can come up with.

I'm concerned with being put on a list of ashkenazi, and sold to people who work for my death on that basis.

https://www.wired.com/story/23andme-credential-stuffing-data...

I’m much more concerned about Palestinians being targeted since they’ve already been the victims of AI weapons attacking civilians. Imagine if people with Palestinian/semitic DNA were leaked?

Palestinians do not have distinctive DNA that sets them apart from other populations in the Middle East. I'm not aware of movements that target levantine ancestry in general.

I think that the sort of people who would snatch up a DNA database to put people on a list would be willing to accept some collateral damage.

Zionism absolutely targets those with Levantine ancestry. They’ve killed far more people than whoever the op was talking about. Ashkenazis are under no threat.

Perhaps you can explain a bit more because on the one hand you say that genetic data is worthless, but on the other hand, it provides you with an income ...

1. "We found you are the product of infidelity. Pay to find out who." (Paternity tests are banned in France)

2. There is incest in your family. Pay to find out.

3. We have found 4 significant markers of X diseases. Pay to find out. (Against FDA in claims of illness)

4. A lost family member was found in $location. Do you want to identify them and send money? (Likely faked, scam)

5. Surrogate or adopted: we know your birth parents. Pay to find out.

There's just a few unethical and/or illegal business opportunities for malicious actors. And that was just 5 off the top of my head.

If you wanted to be really evil, you combine it with other hacked/leaked/ransomed data sources and turn the screws.

> at best sway the predisposition for disease by a modest degree

If insurance companies use this information to inform coverage decisions, then it's a moot point right? Just because you and I (who am also in this field) understand the limitations of the models and the data, does not mean that powerful entities will not use it to do stupid things.

The most malicious behavior I can directly think of is someone searching the data for a targeted purpose and not caring about false positives, like targeted advertisement for health treatments with non-zero risk of side effects. DNA has always had this air of being infallible proof.

You don't even need real test results. You can just email customer's family members with fake claims and try to extort money, using names and test dates as evidence.

My shocking 23andMe story:

I reached out to a guy on 23andMe that was a DNA relative (2nd cousin) and said hi. Curious how we were related, I gave him some family names going several generations back, and asked if any of them rang a bell in his family history.

He responded quickly and said no, they did not.

Then a few weeks later I get another response. He said that one of the names had faintly rung a bell, and when he dug into it, it turned out that was the name of his mother's boss for much of her career as a secretary. His heart sank when he realized it. He and his siblings did genetic tests and confirmed that he, the youngest, was only a half-sibling. Both of the parents were deceased so there's no way to know what really happened.

After dropping that bomb in the poor guy's lap I stopped using the DNA Relatives feature.

Personally, I'd prefer to find out the truth in these cases.

If 23andMe makes "shadow profiles", it would necessarily be for common ancestors, probably long dead. They can't see "down" into the genetic tree at all - whether great-grandma had 1 child or 13 they'll never know until the descendants take tests. But also, if 23andMe does this, they are short-changing their genealogy customers. One of the main things a genealogy customer would like to know about a match is if they're on the maternal side, paternal, or both (more common than you'd think, and mostly not because your parents are related). 23andMe, from what I read, does not do this - and that suggests that they're not getting much out of those shadow profiles.

> I can only hope at the end of the day their data doesn't end up in the wrong hands.

Narrator: it ended up in the wrong hands