6 ms·

My advice to anyone thinking of doing genetic testing (be it 23andMe or another route) is to consider seriously doing it at as a "John Doe" (ie not using your r

by dotBen 16y ago

My advice to anyone thinking of doing genetic testing (be it 23andMe or another route) is to consider seriously doing it at as a "John Doe" (ie not using your real name and details). Knowing you have a high susceptibility to a significant disease could have all sorts of implications for insurance - medical, life and even car. In general insurance companies require you to disclose any and all information that you have that would be pertinent to them assessing risk. Clearly for medical and life insurance you knowing there is a high chance you will get Parkinsons (for example) is information your insurer would like to know - and presumably will have a negative impact on your coverage costs/availability. Here in the US there are currently laws - such as Genetic Information Nondiscrimination Act (GINA) - to prevent insurance companies demanding this information. However laws can be repealed. The insurance industry is the 'leader' in government lobbying. 23andMe is still subject to US federal subpoenas laws. 23andMe could be aquired by an insurance firm. Also consider laws differ in other countries, where insurance companies might be able to legally demand results. In Canada insurance companies can not only request it, they can demand you get this kind of testing before you can obtain coverage. Consider further that databases can be hacked/stolen (it seems to be happening to every email marketing company right now). Think carefully whether you want your personal legal name and contact details all over the results of a test like this.

treyp 16y ago
if you expect to be truly anonymous with 23andme, you're going to need to anonymize the address the kit is sent to, the payment information, and the connections to other people you have as well. related: http://www.quora.com/Is-it-possible-to-use-23andme-anonymously-under-a-pseudonym-or-otherwise-without-personally-identifying-information http://www.quora.com/Is-it-possible-to-use-23andme-anonymous...
- catshirt 16y ago
  "To date, there is no way to order the service completely anonymously. That said, if you have a trusted friend or relative who would be willing to order a kit for you, his or her address and credit card would be tied to the account, rather than your own, and there would be no way to connect it to you." even if you've ordered under your own name, doesn't this suggest you could just maintain plausible deniability? surely a DNA test can connect it to you- but that would nullify the "john doe" tactic as well, no?
  - seldo 16y ago
    23andMe make clear that they do not assume that the genetic material belongs to you just because you are the account holder -- you can submit several samples under different names for family members, for instance. It seems the simplest step to prevent 23AndMe being forced to give up your genetic data at some future dystopic point has already been taken: they already have no way of knowing if it's actually your data. You can take anyone's DNA and call it yours, or give anyone else's name to your own DNA.
    - deleted 16y ago
      [deleted]
- dotBen 16y ago
  The following is my boiler plate for anything that requires anonymous subscription - 23andme, domain registration, hosting, etc: 1) Mailbox in SF's China Town (a number don't ask for ID even though they're supposed to legally request it). Many also don't speak much English so if anyone comes to investigate good luck to them. 2) Visa/Amex gift card purchased at Walgreens/Safeway in cash - ideally in a different city you happen to be visiting with no connection in. Las Vegas and New York are great choices. 3) Email address created and accessed via TOR within the incognito mode of the browser. Buy the 23andMe subscription/domain/hosting in the same way but making sure you are using a different TOR session.
  - JoachimSchipper 16y ago
    While I approve of you guarding your privacy, you may want to be careful about doing this with domain names - many registrars require that the WHOIS information is up to date, and can theoretically take them back if it isn't. I'd imagine the same holds for domainsbyproxy and the like.
    - jrockway 16y ago
      So what? All you need is the initial email to work, nobody is going to notice fake whois that quickly. No person is going to show up at the address you list to verify that it's actually your address. I've used fake whois records for a while and have never had any problems. I did make my main domain "real" a few years ago to avoid any problems, however.
natch 16y ago
Let's say someone wanted to buy as a John Doe. How would they pay without the risk of revealing their identity?
- dotBen 16y ago
  see http://news.ycombinator.com/item?id=2431482 http://news.ycombinator.com/item?id=2431482
deleted 16y ago
[deleted]
ghshephard 16y ago
I bought my entire family the $99 special on last year's 23andme. The kits are pretty darn anonymous - and they all signed up under initials. Unless you give them your legal name, their is no way to identify who the test was for - address doesn't tell you that.
khomenko 16y ago
If 23andMe is acquired by any company (insurance or otherwise) that wants to change the Terms Of Service and / or Privacy Policy, they will have to notify customers, and those customers who don't agree with the changes would have the right (under the current policy) to download their raw data and delete their 23andMe accounts. Also, the chances of 23andMe getting hacked are much lower than the chances of your friendly neighborhood email marketing company. I know since I built the site.
- dotBen 16y ago
  Is that your aspiration or something you know for a fact? I couldn't see anything that indicates this in their Privacy Policy. In fact https://www.23andme.com/about/privacy/#Full https://www.23andme.com/about/privacy/#Full says: Account Closure and Correction of Personal Information As stated in the applicable Consent Document, however, Genetic Information and/or Self-Reported Information that you have previously provided and for which you have given consent to use in 23andWe Research will not be removed from ongoing or completed studies that use the information. Our contracted genotyping laboratory may also retain your Genetic Information as required by local law and we may retain backup copies for a limited period of time pursuant to our data protection policies. In addition, we retain limited Registration Information related to your order history (e.g., name, contact, and transaction data) for accounting and compliance purposes. Doesn't look like they're interested in totally zero'ing you out of all of their records even if you explicitly request it (acquisition or not).
  - jesseendahl 16y ago
    From the page you cited (https://www.23andme.com/about/privacy/#Full https://www.23andme.com/about/privacy/#Full): Business Transitions In the event that 23andMe goes through a business transition such as a merger, acquisition by another company, or sale of all or a portion of its assets, your Personal Information will likely be among the assets transferred. In such a case, your information would remain subject to the promises made in any pre-existing Privacy Statement. From their current privacy policy (https://www.23andme.com/about/privacy/?version=1.1 https://www.23andme.com/about/privacy/?version=1.1): Business Transitions In the event that 23andMe goes through a business transition such as a merger, acquisition by another company, or sale of all or a portion of its assets, your personal information and non-personal information will likely be among the assets transferred. You will be notified in advance via email and prominent notice on our website of any such change in ownership or control of your personal information. We will require an acquiring company or merger agreement to uphold the material terms of this privacy statement, including honoring requests for account deletion. I think khomenko is correct, with the exception you pointed out (ongoing studies).
exit 16y ago
if the issue is knowing whether you knew about a disease, i don't think there's any way to anonymize oneself. the insurance company could simply acquire a dna sample from you and check whether there is a match in the database?
- Retric 16y ago
  In theory it could have been someone else who sent in your sample.
hyko 16y ago
On the other hand, it presents an opportunity in countries with a moratorium on using genetic testing information for insurance purposes; it creates an information asymmetry in your favour. For example, until 2017 in the UK you can take out as much life insurance as you please with no test-result penalty (with the sole exception of Huntington’s Disease results). http://www.abi.org.uk/Media/Releases/2011/04/Insurance_Genetics_Moratorium_extended_to_2017.aspx http://www.abi.org.uk/Media/Releases/2011/04/Insurance_Genet... Perhaps the insurance companies figure that knowing the results might improve the actual outcome in many cases, because the individual alters their behaviour to mitigate them. That, and the predictive power of most tests is fairly weak at present.
muyuu 16y ago
https://github.com/msporny/dna https://github.com/msporny/dna a hackernews reader: https://github.com/orta/dna https://github.com/orta/dna
curiousepic 16y ago
What's the chance of this kind of thing occurring and simultaneously NOT requiring a new test anyway?

by dotBen 16y ago

treyp 16y ago

if you expect to be truly anonymous with 23andme, you're going to need to anonymize the address the kit is sent to, the payment information, and the connections to other people you have as well. related: http://www.quora.com/Is-it-possible-to-use-23andme-anonymously-under-a-pseudonym-or-otherwise-without-personally-identifying-information http://www.quora.com/Is-it-possible-to-use-23andme-anonymous...

catshirt 16y ago
"To date, there is no way to order the service completely anonymously. That said, if you have a trusted friend or relative who would be willing to order a kit for you, his or her address and credit card would be tied to the account, rather than your own, and there would be no way to connect it to you." even if you've ordered under your own name, doesn't this suggest you could just maintain plausible deniability? surely a DNA test can connect it to you- but that would nullify the "john doe" tactic as well, no?
- seldo 16y ago
  23andMe make clear that they do not assume that the genetic material belongs to you just because you are the account holder -- you can submit several samples under different names for family members, for instance. It seems the simplest step to prevent 23AndMe being forced to give up your genetic data at some future dystopic point has already been taken: they already have no way of knowing if it's actually your data. You can take anyone's DNA and call it yours, or give anyone else's name to your own DNA.
  - deleted 16y ago
    [deleted]
dotBen 16y ago
The following is my boiler plate for anything that requires anonymous subscription - 23andme, domain registration, hosting, etc: 1) Mailbox in SF's China Town (a number don't ask for ID even though they're supposed to legally request it). Many also don't speak much English so if anyone comes to investigate good luck to them. 2) Visa/Amex gift card purchased at Walgreens/Safeway in cash - ideally in a different city you happen to be visiting with no connection in. Las Vegas and New York are great choices. 3) Email address created and accessed via TOR within the incognito mode of the browser. Buy the 23andMe subscription/domain/hosting in the same way but making sure you are using a different TOR session.
- JoachimSchipper 16y ago
  While I approve of you guarding your privacy, you may want to be careful about doing this with domain names - many registrars require that the WHOIS information is up to date, and can theoretically take them back if it isn't. I'd imagine the same holds for domainsbyproxy and the like.
  - jrockway 16y ago
    So what? All you need is the initial email to work, nobody is going to notice fake whois that quickly. No person is going to show up at the address you list to verify that it's actually your address. I've used fake whois records for a while and have never had any problems. I did make my main domain "real" a few years ago to avoid any problems, however.

natch 16y ago

Let's say someone wanted to buy as a John Doe. How would they pay without the risk of revealing their identity?

dotBen 16y ago
see http://news.ycombinator.com/item?id=2431482 http://news.ycombinator.com/item?id=2431482

deleted 16y ago

[deleted]

ghshephard 16y ago

I bought my entire family the $99 special on last year's 23andme. The kits are pretty darn anonymous - and they all signed up under initials. Unless you give them your legal name, their is no way to identify who the test was for - address doesn't tell you that.

khomenko 16y ago

If 23andMe is acquired by any company (insurance or otherwise) that wants to change the Terms Of Service and / or Privacy Policy, they will have to notify customers, and those customers who don't agree with the changes would have the right (under the current policy) to download their raw data and delete their 23andMe accounts. Also, the chances of 23andMe getting hacked are much lower than the chances of your friendly neighborhood email marketing company. I know since I built the site.

dotBen 16y ago
Is that your aspiration or something you know for a fact? I couldn't see anything that indicates this in their Privacy Policy. In fact https://www.23andme.com/about/privacy/#Full https://www.23andme.com/about/privacy/#Full says: Account Closure and Correction of Personal Information As stated in the applicable Consent Document, however, Genetic Information and/or Self-Reported Information that you have previously provided and for which you have given consent to use in 23andWe Research will not be removed from ongoing or completed studies that use the information. Our contracted genotyping laboratory may also retain your Genetic Information as required by local law and we may retain backup copies for a limited period of time pursuant to our data protection policies. In addition, we retain limited Registration Information related to your order history (e.g., name, contact, and transaction data) for accounting and compliance purposes. Doesn't look like they're interested in totally zero'ing you out of all of their records even if you explicitly request it (acquisition or not).
- jesseendahl 16y ago
  From the page you cited (https://www.23andme.com/about/privacy/#Full https://www.23andme.com/about/privacy/#Full): Business Transitions In the event that 23andMe goes through a business transition such as a merger, acquisition by another company, or sale of all or a portion of its assets, your Personal Information will likely be among the assets transferred. In such a case, your information would remain subject to the promises made in any pre-existing Privacy Statement. From their current privacy policy (https://www.23andme.com/about/privacy/?version=1.1 https://www.23andme.com/about/privacy/?version=1.1): Business Transitions In the event that 23andMe goes through a business transition such as a merger, acquisition by another company, or sale of all or a portion of its assets, your personal information and non-personal information will likely be among the assets transferred. You will be notified in advance via email and prominent notice on our website of any such change in ownership or control of your personal information. We will require an acquiring company or merger agreement to uphold the material terms of this privacy statement, including honoring requests for account deletion. I think khomenko is correct, with the exception you pointed out (ongoing studies).

exit 16y ago

if the issue is knowing whether you knew about a disease, i don't think there's any way to anonymize oneself. the insurance company could simply acquire a dna sample from you and check whether there is a match in the database?

Retric 16y ago
In theory it could have been someone else who sent in your sample.

hyko 16y ago

On the other hand, it presents an opportunity in countries with a moratorium on using genetic testing information for insurance purposes; it creates an information asymmetry in your favour. For example, until 2017 in the UK you can take out as much life insurance as you please with no test-result penalty (with the sole exception of Huntington’s Disease results). http://www.abi.org.uk/Media/Releases/2011/04/Insurance_Genetics_Moratorium_extended_to_2017.aspx http://www.abi.org.uk/Media/Releases/2011/04/Insurance_Genet... Perhaps the insurance companies figure that knowing the results might improve the actual outcome in many cases, because the individual alters their behaviour to mitigate them. That, and the predictive power of most tests is fairly weak at present.

muyuu 16y ago

https://github.com/msporny/dna https://github.com/msporny/dna a hackernews reader: https://github.com/orta/dna https://github.com/orta/dna

curiousepic 16y ago

What's the chance of this kind of thing occurring and simultaneously NOT requiring a new test anyway?