14 ms·
DNA database that found Golden State Killer is potential national security leak
- GnarfGnarf 7y ago"risk exposing people’s genetic health information..." Genealogy DNA tests only use 0.07% of a person's DNA (that's 0.0007 or seven ten-thousandths). Plus it's in the non-coding or "junk" zone of the chromosomes. Not much opportunity to figure out people's health issues from that little DNA.
- sct202 7y agoPlus, there are issues with false positives with the consumer grade testing. https://www.nature.com/articles/gim201838 https://www.nature.com/articles/gim201838
- eddyg 7y agoCompanies like 23andMe regularly improve their technology and offer upgrades to get improved results. On this page [0], you can scroll down to "23andMe Health Reports by Chip Version" and select "See All" to see the changes. [0] https://customercare.23andme.com/hc/en-us/articles/218392668-Upgrading-to-23andMe-s-Newest-Platform https://customercare.23andme.com/hc/en-us/articles/218392668... (I'm not saying that their aren't false positives, just that improvements are being made as technology improves.)
- mnw21cam 7y agoMy colleague is just bringing out a paper that shows that for variants that are rare in the population, the techniques used by 23&me and similar produce results that are almost exclusively false positives. https://www.biorxiv.org/content/10.1101/696799v1 https://www.biorxiv.org/content/10.1101/696799v1
- searine 7y agoThe thing is, there are so many sites being sampled that any one false positive is buried under a mountain of true positives. False positives only matter when you are trying to be definitive about disease diagnosis. That is why clinicians follow up with more sensitive DNA tests after something like 23 and me detects a deleterious variant. For something like ancestry, the number of true positives is so ridiculously large that a few false positives don't matter.
- kingkawn 7y agoThe idea of “junk” dna has been invalid for about a decade
- searine 7y ago>. Plus it's in the non-coding or "junk" zone of the chromosomes. The site themselves aren't important but they are physically linked to important sites. DNA is a chain, if you which section you are in and roughly what it looks like you can infer someones disease state.
- mauvehaus 7y agoIf you're interested in learning more about the power of genetic genealogy and its real-world applications, I'd highly recommend the New Hampshire Public Radio podcast Bear Brook [0]. It doesn't cover this particular attack, but it does discuss the way databases were used to identify the victims of a murder that took place decades ago. In that case, there was a lot of work done tracking down branches of family trees, and asking living people to submit their DNA to these databases to help fill in the gaps that prevented positive identification of the victims. [0] https://www.bearbrookpodcast.com/ https://www.bearbrookpodcast.com/
- situational87 7y agoI'd imagine the major intelligence agencies have already started their own genetic databases, right? Being able to track down everyone at a genetic level is insanely valuable data from a national security perspective. Given that the intelligence agencies regularly and aggressively hack every telecom and networking company out there, it's pretty likely that they have already hacked the commercial DNA databases, no? Why wouldn't they? I'd like to think there is someone out there trying to protect my data, but it's much more likely they are just aggregating everything into a single genome DB that will inevitably get hacked or leaked.
- walrus01 7y agoShortly prior to its demise, the Stasi was collecting blood and hair samples and storing them in anticipation of future DNA profiling technology becoming available.
- vorpalhex 7y agoOut of personal interest, not doubt - do you have any sources handy?
- tajd 7y agoI found "Stasiland" by Anna Funder a good read if you don't mind reading a more general history of the Stasi. There are a few examples in there I believe.
- at-fates-hands 7y agoI'm not sure about the DNA sampling, but its been widely reported they did have large collections of "scent jars" which were just as powerful as having someone's DNA: The Stasi had a whole range of methods and means to try to track down people who said or did anything critical of the East German communist regime. Collecting scent samples was used to try to identify those, for example, who had distributed flyers or who wrote critical graffiti. When they found a piece of graffiti or a flyer then they took a dust cloth, which was usually yellow, and left it for a while lying next to the flyers covered by a protective piece of aluminum foil and then they had their sample. The cloth was then sealed in a pickling jar and stored. If the Stasi later came across a suspect in the process of the investigation, they tried to get a sample from this person as well -- of course, secretly. A trained dog was given the two smells, and if they matched, the Stasi had a concrete name. https://www.dw.com/en/the-stasi-had-a-giant-smell-register-of-dissidents/a-2555053 https://www.dw.com/en/the-stasi-had-a-giant-smell-register-o... Apparently back in 2007, German authorities were using this same method to track activists trying to disrupt the G8 Summit: In a reminder of methods used by the East German Stasi secret police, German authorities are collecting human scents to trace activists they believe may try to violently disrupt the G8 summit in June. It's proving highly controversial, and there's no scientific evidence that the method is infallible. https://www.spiegel.de/international/germany/stasi-methods-used-to-track-g8-opponents-the-scent-of-terror-a-484561.html https://www.spiegel.de/international/germany/stasi-methods-u...
- turk73 7y agoIt's great now all this tech that looks into our lives and deeply alters the fabric of society is all well and good when governments wield it, but the minute "national security" is somehow at risk, well Katy bar the door! Here's what we're all going to find out together: To be included in the upper echelons of society, you have to be in the club. The be in the club, you have to do some absolutely awful things. The more awful and unspeakable things you do, the higher you may rise. When it comes out what all the unspeakable acts were, every normal man is going to pick up a gun, axe, pitchfork, or whatever implement is readily available and they are going to march to DC and lynch every single one of these scum.
- justinclift 7y agoWonder if it could also be used to determine matching likely organ donors, for those needing an organ transplant? If so, it potentially opens a world of other crappy possibilities too. :(
- blitmap 7y agoFor basic stuff, how about blackmailing those who gave up children for adoption?
- telesilla 7y agoThat's less and less of a concern: firstly, there are far far fewer adoptions this century due to both acceptance of being a single parent and because of access to abortion and birth control. Secondly, it won't be long before every adopted child learns about DNS testing in school and as soon as they are of age (or can fake ID) they will find relatives [Source: have volunteered in the field]. This will lead very quickly to no more anonymous adoptions. I'm in favour of open adoption as studies have shown it's healthier for the child but that's my own personal bias outside of the technology. Edit : DNA testing...
- djmips 7y agoWhat if some adversary wanted to create a tailor made biological weapon that only affected people with a certain genetic profile?
- Nasrudith 7y agoIt would be an even shittier weapon than most biological warfare agents?
- jonlucc 7y agoIt's an interesting idea, but for a whole bunch of biological reasons, I suspect it would be exceedingly difficult if not impossible. First, we don't actually have the ability (as far as I'm aware) to use a particular genetic sequence to activate some drug that would work systemically. Second, we don't have the ability (as far as I'm aware) to recognize an identifying sequence, then do DNA damage elsewhere in a life-sustaining gene. Lastly, it takes so long to identify the output of a gene (protein, siRNA, rRNA, or whatever) and make a drug targeting that output that even if you were able to target a coding region, it would be far faster to kill them by more traditional means.
- jamesrcole 7y agoI took the question to include the future. Will it become possible? How soon could it become possible?
- logfromblammo 7y agoOnce the cat's out of the bag, it will be an arms race between biological attack and biological defense. Rich people and politically connected people will be vaccinated against the murder-viruses. And those are the only ones worth spending more than a brick of ammo to kill. It's far easier to take an already-deadly disease that kills indiscriminately, modify it to have shorter incubation time and higher kill rate (so it burns itself out before going pandemic) and shoot it at a target on a spitball or with a Bulgarian umbrella, while they're on their way to meet with everyone else you want to kill. Either way, that's still leaving biological evidence all over the crime scene, and has the potential to kill a lot of people you weren't specifically targeting. So the preferred methods of assassination will likely continue to be poisons, firearms, and explosives for a long time to come.
- cryptozeus 7y agoI regret taking 23&me test, I don’t think my dna is in safe hands.
- therealx 7y agoI wanted to have it done so badly, but now I'm with you. Anyone have a cost on analyzing your DNA privately? Then the breach is just you+1, and you could use a fake name (I know, I know, that isn't foolproof when DNA is involved)
- jklehm 7y ago~ $2000 for whole genome sequencing (WGS). Whole exome sequencing is cheaper but much less precise, ~$700.
- GnarfGnarf 7y agoYour DNA, in isolation, is not very useful to you (other than medical). The idea is to find relatives by matching segments of DNA with other people.
- IggleSniggle 7y agoThe medical part was the only part I was ever interested in
- virusduck 7y agoFor what 23andme does, a couple hundred probably, maybe under 100 if you went in with several people. You could have your whole genome sequenced, the materials and service cost would be in the neighborhood of $7000 commercially. Data analysis costs vary widely, depending on what you want.
- enceladus_ice 7y agoFor a while Veritas claimed to offer full genome sequencing for $1000, but I believe they've recently reduced the price to $600. Also, in refreshing my memory on this company with some light research, I found this published 40 minutes ago: https://www.bloomberg.com/news/articles/2019-11-06/breach-at-dna-test-firm-veritas-exposed-customer-information https://www.bloomberg.com/news/articles/2019-11-06/breach-at... Whoops!
- Nasrudith 7y agoHow is it a national security leak? Bad certainly but wolf has been cried so many times around "national security" that replacing it with "because reasons" or similiar would cause no loss of meaning.
- Loughla 7y ago>wolf has been cried so many times I'm not sure this is the analogy you want to use. The wolf ended up eating the boy in the end of that story, didn't it?
- SamBam 7y agoSo that's exactly the analogy they wanted to use. The point is that "national security threats" can be a serious danger, but if you claim something small is a "national security threat" too many times then it starts to lose its meaning and urgency.
- DataWorker 7y agoWhat if the threats are all very real but human nature is to grow fatigued by warnings and become ever more complacent even when the wolf is at the door?
- SamBam 7y agocf. climate change.
- PhaseLockk 7y agoIt seems the concern is that if a foreign power is suspicious that someone might be a spy, they can collect their DNA and run it against this database. If the spy's relatives are in the database, they will be flagged, and likely make it easy to deduce the true identity of the spy. This could then leave the spy in a compromised situation.
- nickthemagicman 7y agoWhat can be done with this data?
- stef25 7y agoSay you arrested someone and wanted to establish family ties like find their brother, determine if they belong to a certain clan etc. If those ties were in that DB, you could find them with that data.
- nickthemagicman 7y agoI see. Rubber Hose decryption on a family member type stuff. That's terrifying.
- kwshs 7y agoThe end justifies the means
- stef25 7y agohttps://www.gedmatch.com/login1.php https://www.gedmatch.com/login1.php That url smells like amateurism, hopefully I'm wrong EDIT login1.php does a POST to login2.php and site still runs php5. I'd imagine this site's already been hit with every scanner under the sun.
- e40 7y agoListened to a podcast that featured the founder of gedmatch.com. He definitely didn't seem that tech savvy, and from the discussion about the company/site, it seems plausible that it is.
- 40four 7y agoOh no... that's the website !? PHP 5.6 has been end of life for going on a year now. I mean I get it. It's a small team of volunteers. They don't have the resources to manage something like this. The attitude of the founder is very concerning. He doesn't seem to grasp how serious managing over a million DNA records is, even after experts and researchers try to tell him. The should temporarily pull the site down, or at least disable the search until work can be done, as Mr. Ney suggested to them. The site isn't a money maker, what would be the harm?
- MuffinFlavored 7y agoDoes this mean a serial killer basically did 23AndMe and that's how he got caught?
- stef25 7y agoNo, a relative of his did. Police matched the killer's DNA with one of his relatives' DNA in the DB, started digging in his family and found someone matching the profile of the killer. Police then watched him and got his DNA from a can he threw away to give them the exact DNA match.
- acomjean 7y agoIt doesn't matter, with family searches. The "grim sleeper" was caught because his son committed a crime and they put his dna into a database. Searching the database they matched a relative, then did some sleuthing. https://en.wikipedia.org/wiki/Grim_Sleeper https://en.wikipedia.org/wiki/Grim_Sleeper
- deleted 7y ago[deleted]
- Merrill 7y agoIt should be very valuable for counterintelligence to check the legends of enemy agents. If the DNA of the suspected agent identifies relatives that are implausible given the provided back story, further investigation may reveal that the legend is false. It should also be valuable for screening candidates for security clearances. Are the relatives named by the candidate related to the candidates DNA relatives? If not, further investigation is warranted.
- greedo 7y agoThen it would just be a matter of subverting the DNA entries (in the database). Either in the public sources, or in opposition's database. Replace the true DNA data with your agents actual data.
- rogerkirkness 7y agoWas just thinking this. Have someone else spit in the tube, don't do it yourself.
- Merrill 7y agoBut like other things, such as social media, big data, and blockchain, it makes it harder to establish secure fake identities. Inhibiting the creation of fake identities inhibits both criminal activity and covert operations of law enforcement and national security.
- buckminster 7y agoYou're an American agent in Moscow. They can easily get a real sample of your DNA and run a match. Now they know your real relatives. How do you fake this? Even if the CIA create a complete web of fake identities in the DNA database, how do you stop a real relative uploading their DNA?
- giancarlostoro 7y ago> Are the relatives named by the candidate related to the candidates DNA relatives? Might find cases of infidelity more than anything. Talk about awkward.
- habnds 7y agoAn interesting example of technology and the tech that defeats it evolving together, a friend with leukemia who received a bone marrow transplant was told that a DNA test using a blood sample would identify him as a woman, the person who donated the marrow.
- onychomys 7y agoHey, a free pass to go become a serial killer!
- frandroid 7y ago> called the new security research a large-scale demonstration of weaknesses already known to enthusiasts. "Already known". So when the hell are they going to take their service down until they find a way to secure it??
- ascotan 7y agoI don't understand how this isn't a violation of HIPAA. Comparing a DNA upload against the medical records of other people without their express written consent seems to me to be wrong. I think there is a legal issue here around wether uploading your medical data to a 3rd party service allows that service to take ownership of your medical data and allows them to do what they please with it. DNA absolutely falls under PII (personally identifiable information). I can't understand how a company to collect and use this information without (it appears) any rules or regulations. Not only is it a security risk and a privacy violation but it has implications for every aspect of your life and the lives of your children and immediate relatives. I can't understand how this can be run out of someone's house with a part time volunteer staff with no security. Mind Blown.
- inetknght 7y ago> I can't understand how this can be run out of someone's house with a part time volunteer staff with no security. But that's the promise of software and the internet. The ability to compete globally with minimal effort.
- streb-lo 7y agoBy creating a profile and uploading your DNA -- you're giving consent for your DNA to be indexed. Whether or not you should be requiring the consent of all people with similar DNA is the real question -- but given Americans' obsession with individual rights I don't see it changing. In their eyes, why shouldn't they be permitted to upload and share their own DNA?
- shadowgovt 7y agoYeah, that's the tricky thing. Individual ownership of information as a principle doesn't cover the set of all things people care about when information is shared between individuals (or infer-able about another individual based on information of a sharing party).
- LadyCailin 7y agoI know it was a rhetorical question, but because of negative externalities. Same reason I can’t dump pollution in the river that runs through my property, because that polluted your property downstream.
- jacquesm 7y agoThe word 'potential' superfluous in the title.
- neonate 7y agohttp://archive.is/wn2Gu http://archive.is/wn2Gu
- rootusrootus 7y agoSo what I'm getting is that the ship has sailed, it's too late to prevent the spread of DNA information, and what we should focus on now is risk mitigation, legal and otherwise.
- burneraccount12 7y agoThis will be an unpopular opinion but we should index the DNA of every citizen. The two objections are 1) exposing genetic health info 2) foreign countries can identify our spies. For #1, I have news for you: insurance companies already build risk profiles of you, DNA profiles are not going to tip the balance of your premiums against what they already know. This ship has sailed. (and TBH if they didn't insurance would likely be even more unaffordable and out-of-reach than it already is) For #2, I can't say. But think of the benefits: how many more crimes would be solved? How many LESS innocent people would go to prison for crimes they didn't commit? Plastic straws, browsing history and DNA indexing are white people problems, IMHO. Look at what it's like to be black in America in 2019: Botham Jean was sitting in his own apartment, eating ice cream, watching a ball game when a white off-duty Dallas police officer broke in and murdered him for no reason. She'll be out of prison in 5 years. The rise of body cams has the last 10 years has shown these types of incidents happen more frequently than we ever wanted to admit. How many people are hurt in real life by things like DNA indexing? Please. It must be nice to be so rich to worry about frivolous non-problems like these. A national DNA index could keep a lot of innocent (mostly minority) people out of prison but oh no god forbid a white person be revealed to have a genetic marker for Alzheimers and their insurance premiums go up. The horror.
- deleted 7y ago[deleted]
- TurkishPoptart 7y agoHeh, nice try, FBI.
- opwieurposiu 7y agoDNA can be synthesized for $2 a gene. DNA tests as used in crime labs only check dozens/hundreds of genes to make a match. With a database of everyone's DNA, anyone can be framed for anything. https://www.chemistryworld.com/news/synthetic-gene-cost-slashed-to-2/3008491.article https://www.chemistryworld.com/news/synthetic-gene-cost-slas...
- krick 7y ago
- DoctorOetker 7y agoso ... every nation state is in a race to sponsor full DNA sequencing of adversary populations... free DNA sequencing for all!
- Railsify 7y agoSeems like this database plus a sufficiently advanced version of the CRISPR process would allow nation state or companies to manufacture DNA that collided with the DNA of real people, very scary.