8 ms·

My mother innocently used this service, and filled out the form identifying all relatives by name. The results she received were entirely unenlightening, 50% o

My mother innocently used this service, and filled out the form identifying all relatives by name. The results she received were entirely unenlightening, 50% of my DNA is now in their sketchy database, and I have no way to opt-out of anything. I truly despise this organization.

hsbauauvhabzb 3y ago
I fully agree with everything you say, but until legislation is enforced you can hardly blame a company for capitalizing on the lack of privacy laws (you can still hate them). Point is, start demanding legislation around data privacy and security to anyone who will listen.
- marginalia_nu 3y ago
  You can absolutely blame a company for unethical but legal actions.
  - hsbauauvhabzb 3y ago
    Exactly what will that achieve?
    - marginalia_nu 3y ago
      If you drink a cup of coffee and say "this is too hot for me!", what will that accomplish? Nothing, as it's a judgement and not an action. We may act on a judgement though, let the coffee cool down, or avoid dealing with the unethical company.
      - hsbauauvhabzb 3y ago
        But you avoiding the company doesn’t prevent the company from infringing on your dna privacy if a family member submits theirs. My point is, until legislation changes, it will get worse before it gets better and misdirected anger won’t achieve a valuable outcome.
- consumer451 3y ago
  I feel like I can blame the humans involved with 23andMe specifically, as they are the specific humans who allowed unknown 3rd parties to have enough of my DNA to profile my family and myself. However, I entirely agree with your last statement. I would like to call upon anyone who appreciates privacy to get behind a neural bill of rights. While it sounds a bit "tin foil hat" at the moment, non-invasive brain–computer interfaces are coming very soon. Especially using infrared techniques. Today, TSA scans your face, soon enough it will be your brain. This is not a joke. If the USA misses the boat on regulating neural interfaces, we will sail through the final frontier of personal privacy, and even agency. I highly recommend that everyone listens to, or reads the transcript of Sean Carroll's podcast with Nina Farahany on the topic. It is dense with legal and technical information. "Nita Farahany on Ethics, Law, and Neurotechnology" https://www.preposterousuniverse.com/podcast/2023/03/13/229-nita-farahany-on-ethics-law-and-neurotechnology/ https://www.preposterousuniverse.com/podcast/2023/03/13/229-...
  - gorgoiler 3y ago
    By “unknown third parties” do you mean the hackers? The breach was bad but not that bad — it didn’t include your genetic material. > The stolen data included the person’s name, birth year, relationship labels, the percentage of DNA shared with relatives, ancestry reports and self-reported location. https://techcrunch.com/2023/12/04/23andme-confirms-hackers-stole-ancestry-data-on-6-9-million-users/ https://techcrunch.com/2023/12/04/23andme-confirms-hackers-s...
    - consumer451 3y ago
      I meant 23andMe partners, and yes, also the hack, and future hacks. This DB is a goldmine and I take an extremely pessimistic view on infosec. Information wants to be "free" after all. Look at the KSA agents who were implanted at Twitter as an example. I would have to assume that nation state actors would also implant employees at 23andMe. The publicized hack is the one we, and 23andMe, know about. It's just too juicy a target to keep safely guarded in perpetuity. Simply by compiling this information, you are more or less guaranteeing it falling into the wrong hands eventually. This is an example of information which never should have been compiled.
- thrtythreeforty 3y ago
  There's no law against being a dirtbag but I am definitely still going to blame you for being a dirtbag. You could always choose... not to be a dirtbag. I would rephrase your point, "don't be surprised when a company capitalizes on lack of laws" -- this I agree with. It's virtually a force of nature.
dudul 3y ago
What does "innocently" mean in this context?
- jen20 3y ago
  I'd assume: "with the understanding of a layman who believes the marketing claims they make without understanding the problems inherent".
- deleted 3y ago
  [deleted]
- consumer451 3y ago
  Meaning that she was over 70, and just wanted to learn some ambiguously defined information about her family history. There were some unknowns as far as where her great-grandparents came from. Maybe "naively" would be a better term. We are all law abiding citizens, what do we have to hide, right? Well, she did not read the T&C as far as how this information would be shared, and did not consider the implications of how she was making a choice for the people who she named on the family form, and did not consider the inevitable infosec implications which we are now all enjoying.
  - deleted 3y ago
    [deleted]
pokstad 3y ago
Sue your mother
anon35 3y ago
This 2021 New Yorker article: How Your Family Tree Could Catch a Killer (https://www.newyorker.com/magazine/2021/11/22/how-your-family-tree-could-catch-a-killer https://www.newyorker.com/magazine/2021/11/22/how-your-famil...) was incredibly illuminating and changed my perspective on our sense of privacy. With a surprisingly small fraction of the world's population sequenced, we can still match a sample to a person whose sequence we don't have. To quote the article: "Genetic genealogy, it turned out, could function as an all-purpose de-anonymizer". So perhaps be less upset that Mom signed up; our DNA really isn't ours in the same way the documents on our hard drive. You were never going to be able to opt-out.
- throwoutway 3y ago
  And now a nation state hacker can use the same database to identify U.S. citizen descendants (to what generation?). Good luck with "illegals" style espionage
  - CuriousCosmic 3y ago
    Or you know just a normal hacker (see this incident when a DB identifying 1 million people with Ashkenazi jewish ancestry from 23andMe data was leaked: https://www.bleepingcomputer.com/news/security/genetics-firm-23andme-says-user-data-stolen-in-credential-stuffing-attack/ https://www.bleepingcomputer.com/news/security/genetics-firm...)
    - jacquesm 3y ago
      They just had to have that data eh? Idiots. This is criminally irresponsible. This makes me so angry it is hard to describe.
- consumer451 3y ago
  This feels like a "think of the children" type of appeal. I personally don't have any murderous history to hide. But there are unintended consequences with all of these losses of privacy. As a peer comment has rightly pointed out, nation state adversaries now have these same profiles. Maybe they can find a common DNA profile for an efficient bio-weapon. Oops. I escaped an authoritarian regime as a child, thanks to the same mother. I hold no ill will towards her, but I am deeply aware of the issues that bad actors can create with by compiling huge databases of otherwise unnecessary information.
epistasis 3y ago
23andMe claims that no DNA information was revealed, and I'm having trouble finding a primary source that claims that the SNP info was taken. From a more detailed article: > ... which exposed sensitive personal information that included things relevant to ancestry trees, birthdays and general geographic locations. In some cases, the company said that the hack could have exposed the pictures and display names of affiliated family members also using the company’s services through the accounts that were primarily breached. 23andMe insists that no actual genetic material or DNA records were exposed > ... A 23andMe spokesperson told Engadget that hackers accessed the DNAR profiles of roughly 5.5 million customers this way, plus Family Tree profile information from 1.4 million DNA Relative participants. >DNAR Profiles contain sensitive details including self-reported information like display names and locations, as well as shared DNA percentages for DNA Relatives matches, family names, predicted relationships and ancestry reports. Family Tree profiles contain display names and relationship labels, plus other information that a user may choose to add, including birth year and location. When the breach was first revealed in October, the company said its investigation “found that no genetic testing results have been leaked.” https://www.engadget.com/23andme-hack-now-estimated-to-affect-over-half-of-customers-165314743.html https://www.engadget.com/23andme-hack-now-estimated-to-affec... Presumably the journalist at Stackdiary translated "DNAR profile" into "genetic profile," which is a term with no standard definition, but if it had one, I would have guessed it would mean at least some DNA info. 23andMe could be lying or ignorant of what happened, but that would also mean that there would also be another news cycle when further disclosure was mandated.
lsllc 3y ago
Perhaps you can file a DMCA takedown with 23andMe for the illegal copying of your proprietary code (instigated by your mother!).
blindriver 3y ago
To make you feel better, it doesn't have to be your mother to identify you. If a cousin were to have done it, you would still be easily identifiable. Basically anyone in your blood line using any of the services would make you easily identifiable.
m463 3y ago
Maybe you CAN ask for deletion.
vintermann 3y ago
The worst is the classic social media tactic of using user-submitted data to attract others. Imagine there came a responsible DNA service tomorrow, which used differential cryptography or something, so that you could share DNA and look for relatives with some semblance of privacy. They wouldn't get off the ground, because your relatives? They're on this service, or Ancestry or MyHeritage or FamilyTreeDNA, which are every inch as sleazy, US or Israeli megacorporations which you can trust as far as you can throw them (which isn't an inch).

hsbauauvhabzb 3y ago

I fully agree with everything you say, but until legislation is enforced you can hardly blame a company for capitalizing on the lack of privacy laws (you can still hate them). Point is, start demanding legislation around data privacy and security to anyone who will listen.

marginalia_nu 3y ago
You can absolutely blame a company for unethical but legal actions.
- hsbauauvhabzb 3y ago
  Exactly what will that achieve?
  - marginalia_nu 3y ago
    If you drink a cup of coffee and say "this is too hot for me!", what will that accomplish? Nothing, as it's a judgement and not an action. We may act on a judgement though, let the coffee cool down, or avoid dealing with the unethical company.
    - hsbauauvhabzb 3y ago
      But you avoiding the company doesn’t prevent the company from infringing on your dna privacy if a family member submits theirs. My point is, until legislation changes, it will get worse before it gets better and misdirected anger won’t achieve a valuable outcome.
consumer451 3y ago
I feel like I can blame the humans involved with 23andMe specifically, as they are the specific humans who allowed unknown 3rd parties to have enough of my DNA to profile my family and myself. However, I entirely agree with your last statement. I would like to call upon anyone who appreciates privacy to get behind a neural bill of rights. While it sounds a bit "tin foil hat" at the moment, non-invasive brain–computer interfaces are coming very soon. Especially using infrared techniques. Today, TSA scans your face, soon enough it will be your brain. This is not a joke. If the USA misses the boat on regulating neural interfaces, we will sail through the final frontier of personal privacy, and even agency. I highly recommend that everyone listens to, or reads the transcript of Sean Carroll's podcast with Nina Farahany on the topic. It is dense with legal and technical information. "Nita Farahany on Ethics, Law, and Neurotechnology" https://www.preposterousuniverse.com/podcast/2023/03/13/229-nita-farahany-on-ethics-law-and-neurotechnology/ https://www.preposterousuniverse.com/podcast/2023/03/13/229-...
- gorgoiler 3y ago
  By “unknown third parties” do you mean the hackers? The breach was bad but not that bad — it didn’t include your genetic material. > The stolen data included the person’s name, birth year, relationship labels, the percentage of DNA shared with relatives, ancestry reports and self-reported location. https://techcrunch.com/2023/12/04/23andme-confirms-hackers-stole-ancestry-data-on-6-9-million-users/ https://techcrunch.com/2023/12/04/23andme-confirms-hackers-s...
  - consumer451 3y ago
    I meant 23andMe partners, and yes, also the hack, and future hacks. This DB is a goldmine and I take an extremely pessimistic view on infosec. Information wants to be "free" after all. Look at the KSA agents who were implanted at Twitter as an example. I would have to assume that nation state actors would also implant employees at 23andMe. The publicized hack is the one we, and 23andMe, know about. It's just too juicy a target to keep safely guarded in perpetuity. Simply by compiling this information, you are more or less guaranteeing it falling into the wrong hands eventually. This is an example of information which never should have been compiled.
thrtythreeforty 3y ago
There's no law against being a dirtbag but I am definitely still going to blame you for being a dirtbag. You could always choose... not to be a dirtbag. I would rephrase your point, "don't be surprised when a company capitalizes on lack of laws" -- this I agree with. It's virtually a force of nature.

dudul 3y ago

What does "innocently" mean in this context?

jen20 3y ago
I'd assume: "with the understanding of a layman who believes the marketing claims they make without understanding the problems inherent".
deleted 3y ago
[deleted]
consumer451 3y ago
Meaning that she was over 70, and just wanted to learn some ambiguously defined information about her family history. There were some unknowns as far as where her great-grandparents came from. Maybe "naively" would be a better term. We are all law abiding citizens, what do we have to hide, right? Well, she did not read the T&C as far as how this information would be shared, and did not consider the implications of how she was making a choice for the people who she named on the family form, and did not consider the inevitable infosec implications which we are now all enjoying.
- deleted 3y ago
  [deleted]

pokstad 3y ago

Sue your mother

anon35 3y ago

This 2021 New Yorker article: How Your Family Tree Could Catch a Killer (https://www.newyorker.com/magazine/2021/11/22/how-your-family-tree-could-catch-a-killer https://www.newyorker.com/magazine/2021/11/22/how-your-famil...) was incredibly illuminating and changed my perspective on our sense of privacy. With a surprisingly small fraction of the world's population sequenced, we can still match a sample to a person whose sequence we don't have. To quote the article: "Genetic genealogy, it turned out, could function as an all-purpose de-anonymizer". So perhaps be less upset that Mom signed up; our DNA really isn't ours in the same way the documents on our hard drive. You were never going to be able to opt-out.

throwoutway 3y ago
And now a nation state hacker can use the same database to identify U.S. citizen descendants (to what generation?). Good luck with "illegals" style espionage
- CuriousCosmic 3y ago
  Or you know just a normal hacker (see this incident when a DB identifying 1 million people with Ashkenazi jewish ancestry from 23andMe data was leaked: https://www.bleepingcomputer.com/news/security/genetics-firm-23andme-says-user-data-stolen-in-credential-stuffing-attack/ https://www.bleepingcomputer.com/news/security/genetics-firm...)
  - jacquesm 3y ago
    They just had to have that data eh? Idiots. This is criminally irresponsible. This makes me so angry it is hard to describe.
consumer451 3y ago
This feels like a "think of the children" type of appeal. I personally don't have any murderous history to hide. But there are unintended consequences with all of these losses of privacy. As a peer comment has rightly pointed out, nation state adversaries now have these same profiles. Maybe they can find a common DNA profile for an efficient bio-weapon. Oops. I escaped an authoritarian regime as a child, thanks to the same mother. I hold no ill will towards her, but I am deeply aware of the issues that bad actors can create with by compiling huge databases of otherwise unnecessary information.

epistasis 3y ago

23andMe claims that no DNA information was revealed, and I'm having trouble finding a primary source that claims that the SNP info was taken. From a more detailed article: > ... which exposed sensitive personal information that included things relevant to ancestry trees, birthdays and general geographic locations. In some cases, the company said that the hack could have exposed the pictures and display names of affiliated family members also using the company’s services through the accounts that were primarily breached. 23andMe insists that no actual genetic material or DNA records were exposed > ... A 23andMe spokesperson told Engadget that hackers accessed the DNAR profiles of roughly 5.5 million customers this way, plus Family Tree profile information from 1.4 million DNA Relative participants. >DNAR Profiles contain sensitive details including self-reported information like display names and locations, as well as shared DNA percentages for DNA Relatives matches, family names, predicted relationships and ancestry reports. Family Tree profiles contain display names and relationship labels, plus other information that a user may choose to add, including birth year and location. When the breach was first revealed in October, the company said its investigation “found that no genetic testing results have been leaked.” https://www.engadget.com/23andme-hack-now-estimated-to-affect-over-half-of-customers-165314743.html https://www.engadget.com/23andme-hack-now-estimated-to-affec... Presumably the journalist at Stackdiary translated "DNAR profile" into "genetic profile," which is a term with no standard definition, but if it had one, I would have guessed it would mean at least some DNA info. 23andMe could be lying or ignorant of what happened, but that would also mean that there would also be another news cycle when further disclosure was mandated.

lsllc 3y ago

Perhaps you can file a DMCA takedown with 23andMe for the illegal copying of your proprietary code (instigated by your mother!).

blindriver 3y ago

To make you feel better, it doesn't have to be your mother to identify you. If a cousin were to have done it, you would still be easily identifiable. Basically anyone in your blood line using any of the services would make you easily identifiable.

m463 3y ago

Maybe you CAN ask for deletion.

vintermann 3y ago

The worst is the classic social media tactic of using user-submitted data to attract others. Imagine there came a responsible DNA service tomorrow, which used differential cryptography or something, so that you could share DNA and look for relatives with some semblance of privacy. They wouldn't get off the ground, because your relatives? They're on this service, or Ancestry or MyHeritage or FamilyTreeDNA, which are every inch as sleazy, US or Israeli megacorporations which you can trust as far as you can throw them (which isn't an inch).