3 ms·

DNA companies should receive the death penalty for getting hacked

62 points by mikece 3y ago

anonymouskimmer 3y ago
Too late? And the companies that pop up to take their place won't have had at least one of their security holes demonstrated so that it can then be plugged. I was under the impression that no DNA data was hacked. That what was hacked is just a bit more than a hacker would get from hacking Ancestry.com's database of family trees.
Animats 3y ago
Why? So you can tell who's descended from who? That's public record info.
- quantified 3y ago
  Can you explain how your questions relate to each other? I don't understand #2. Re public info: Do you mean via birth certificates?
- mikece 3y ago
  Because genetics databases hold the info on how to craft a biological weapon that will affect you and only you.
  - justrealist 3y ago
    This is completely hypothetical and it's not at all clear whether it's biologically practical. Even if vaguely possible it will kill much of your extended family too.
    - sonicanatidae 3y ago
      Racism and bigotry can kill and they are certainly factors with this type of information. I agree with you on biological being the attack vector is very unlikely, at least, at this point.
      - boringuser2 3y ago
        That's a bit of a reach. Also, if someone doesn't like X people enough to randomly murder people, I don't think they're too worried about splicing around DNA. Just silly.
        sonicanatidae 3y ago
        ahh.. then this must be hilarious. https://portal.ct.gov/AG/Press-Releases/2023-Press-Releases/Attorney-General-Tong-Issues-Inquiry-Letter-to-23andMe-Following-Data-Breach https://portal.ct.gov/AG/Press-Releases/2023-Press-Releases/... Excerpt: The threat actor has posted sample data indicating the attack was targeted at account holders with Ashkenazi Jewish and Chinese heritage.
        boringuser2 3y ago
        The problem with this comment is that it presupposes that this information in that regard has any value to anyone, even malicious racists. I'm pretty sure they don't care about your genetic estimation if you're Jewish.
        sonicanatidae 3y ago
        Name + genetic origins = racism targets. Keep in mind, you can't just look at most people and know their religion or racial makeup.
      - arp242 3y ago
        But you hardly need a DNA database for that? Usually the type of identities that are discriminated against are pretty clear from the outset. Even the Nazis and their Rassenkunde bollocks was more post-hoc window-dressing rationale than anything else – they really didn't need that to tell who the Jews, Slavs, Roma, etc. were. This is usually the pattern: "I want to discriminate against $group for $emotional reasons, and I can't really articulate why, so let me find $facts to support my $case". And look, if you want to keep it private then you should of course keep it private, and if 23andme promises to keep it private then you have every right to keep them to their promise. Privacy is fundamentally about choice, and those choices will be different for everyone and I'm not here to judge anyone's choices. But personally, I think the abuse for DNA data is actually quite small, almost non-existent.
- mschuster91 3y ago
  By far not in all countries. The US is pretty unique in its public record laws.
- ggus 3y ago
  DNA analysis can be used to profile you. Health risks, ancestry, genetic conditions. This could be used to deny insurance coverages and employment opportunities due to perceived health risks. DNA analysis is rapidly evolving to extract more information than you might initially assume. We don't know how much or how accurately DNA can be used do infer your preferences, moral instincts, aggressive tendencies, intelligence, propensity to fall victim of a scam, to become addicted, to act violently, etc. DNA also provides insights into the genetic makeup of family members, which can face the same problems.
karaterobot 3y ago
This article seems like a breathless rant. He didn't even take the time to explain what I interpret to be the meaning of his incendiary title, which is that DNA companies who get hacked should be dissolved, or punitively fined to the extent that they can no longer function. Because, of course, you can't literally kill a company. I don't support the death penalty for flesh and blood people, but I'd be fine with it for corporations in certain cases. I'm not sure I agree that it should always happen in the case of a hack; the risk of an intrusion can never be eliminated, only mitigated, so a blanket "off with their heads" rule for any hack seems rather blunt and unnecessary: you'd guillotine any theoretical responsible companies who happened to be targeted by determined actors. Case by case executions perhaps?
- arp242 3y ago
  One thing I'd very much like to see here is transparency. The author of this article seems to assume the worst. I don't know if that's a reasonable assumption, but "assumptions" is all we can go on right now. 23andme claims "re-used passwords". We just have to take them at their word for this. I don't think they're outright lying, but you can misrepresent things without strictly telling falsehoods. But if we take them at their word, there's a huge amount of nuance there too – are we talking about a large and advanced botnet or just ten IPs that accessed those millions of accounts? The first might be very hard to protect against, the second would raise a lot more eyebrows. What kind of security measures do they have? Things like that. Right now, all I can really do is ... shrug. Because I just don't have enough information to judge one way or the other. And it would improve security, because forced airing of your dirty laundry is a good motivation for going to the laundrette. In the end this would benefit everyone, including the companies themselves.
- UncleEntity 3y ago
  > ...or punitively fined to the extent that they can no longer function. In which case their IP (everyone's genetic data) goes on the auction block to pay the exorbitant fines. How could that possibly go wrong?
fairity 3y ago
23andme is a public company and seems to already be headed towards bankruptcy. Their share price has fallen by 93% since going public, and they’re burning something like $400m per year on $240m of revenue. I wonder if this incident will be the nail in the coffin.
- nemacol 3y ago
  Will be interesting to see what ends up buying up their assets.
- andromeduck 3y ago
  Oh man I wish knew sooner & shorted when they IPOed. Their employees are some of the laziest, most incompetent people I've met and I've yet to hear of a positive interaction with them in a businesses/research/engineering capacity.
quantified 3y ago
No company will avoid being hacked. If you don't want your info leaked, don't share it. The more sensitive it is, the more you should think twice. It may be a couple years yet until the big teleheath hacks come out, and you discover all those private disclosures are sold for pennies on the dark market, or just leveraged by adversaries.
- thatguy0900 3y ago
  The ultimate problem with this though is that if your family members do it, they basically have your info too.
  - quantified 3y ago
    That's part of it. I know I'm in there even though I haven't signed up for it. Like Clearview will know me everywhere because somebody's put up photos on FB with me in them somewhere.
- sneak 3y ago
  Your biometrics, including your DNA, are not sensitive or private. You leave your DNA at every restaurant you visit, and you display your biometrics in every public place. They are not remotely secret or private or sensitive.
  - sonicanatidae 3y ago
    While DNA is left behind, I have yet to see a waitress run to the back with a sample, and run it through DNA marker identification. This also assumes it's a clean sample and not contaminated with all the other DNA present, simple dust, residue on the surface of whatever the DNA was pulled from and/or whatever. I'm not saying it's not possible, I'm saying that it's very, very, very unlikely, at least for mortals. Source: I worked in 2 labs, one of which did genetic testing. Note: I'm IT, not science, so I was the person that setup the reporting triggers, output, input, etc. I do know something about taking samples and swiping them from a glass isn't the typical way, for many, many reasons.
  - 3y ago
strict9 3y ago
Can't bring myself to click the article because of the ridiculous headline. But if your information is stored in a database of a large entity, chances are it will spill out at some point. This is especially true in healthcare.
rfrey 3y ago
An entirely predictable outcome of "death sentences" for non-malicious company events is that companies will pull out all the stops to cover them up.
dang 3y ago
Recent and related. Others? 23andMe confirms hackers stole ancestry data on 6.9M users - https://news.ycombinator.com/item?id=38527965 https://news.ycombinator.com/item?id=38527965 - Dec 2023 (297 comments) 23andMe hackers accessed a whole lot of personal data - https://news.ycombinator.com/item?id=38519466 https://news.ycombinator.com/item?id=38519466 - Dec 2023 (36 comments) Hacker leaks millions more 23andMe user records on cybercrime forum - https://news.ycombinator.com/item?id=37931383 https://news.ycombinator.com/item?id=37931383 - Oct 2023 (394 comments) 23andMe Sued over Hack of Genetic Data Affecting Thousands - https://news.ycombinator.com/item?id=37895586 https://news.ycombinator.com/item?id=37895586 - Oct 2023 (20 comments) 23andMe Accounts Hijacked and Data Put Up for Sale on Hacker Forum - https://news.ycombinator.com/item?id=37810755 https://news.ycombinator.com/item?id=37810755 - Oct 2023 (2 comments) 23andMe says user data stolen in credential stuffing attack - https://news.ycombinator.com/item?id=37794379 https://news.ycombinator.com/item?id=37794379 - Oct 2023 (298 comments)
GlibMonkeyDeath 3y ago
Such a ridiculous rant For obvious reasons you don't want your personal financial info publicly known. But can someone explain to me the actual or potential harm done here with DNA information? The only thing remotely potentially harmful could be for denial of life or long-term health insurance (in the US at least.) However, I am unaware of any cases where a relative's genetic test caused denial of coverage. And I am highly doubtful that test results obtained illegally can be used for this purpose. Note that health insurance discrimination (again, in the US, where we have such afflictions) based on the outcome of a genetic test is outlawed https://www.eeoc.gov/laws/guidance/fact-sheet-genetic-information-nondiscrimination-act https://www.eeoc.gov/laws/guidance/fact-sheet-genetic-inform... And we all know you don't need a fancy genetic test to discriminate...

62 points by mikece 3y ago

Too late? And the companies that pop up to take their place won't have had at least one of their security holes demonstrated so that it can then be plugged. I was under the impression that no DNA data was hacked. That what was hacked is just a bit more than a hacker would get from hacking Ancestry.com's database of family trees.

Animats 3y ago

Why? So you can tell who's descended from who? That's public record info.

quantified 3y ago
Can you explain how your questions relate to each other? I don't understand #2. Re public info: Do you mean via birth certificates?
mikece 3y ago
Because genetics databases hold the info on how to craft a biological weapon that will affect you and only you.
- justrealist 3y ago
  This is completely hypothetical and it's not at all clear whether it's biologically practical. Even if vaguely possible it will kill much of your extended family too.
  - sonicanatidae 3y ago
    Racism and bigotry can kill and they are certainly factors with this type of information. I agree with you on biological being the attack vector is very unlikely, at least, at this point.
    - boringuser2 3y ago
      That's a bit of a reach. Also, if someone doesn't like X people enough to randomly murder people, I don't think they're too worried about splicing around DNA. Just silly.
      - sonicanatidae 3y ago
        ahh.. then this must be hilarious. https://portal.ct.gov/AG/Press-Releases/2023-Press-Releases/Attorney-General-Tong-Issues-Inquiry-Letter-to-23andMe-Following-Data-Breach https://portal.ct.gov/AG/Press-Releases/2023-Press-Releases/... Excerpt: The threat actor has posted sample data indicating the attack was targeted at account holders with Ashkenazi Jewish and Chinese heritage.
        boringuser2 3y ago
        The problem with this comment is that it presupposes that this information in that regard has any value to anyone, even malicious racists. I'm pretty sure they don't care about your genetic estimation if you're Jewish.
        sonicanatidae 3y ago
        Name + genetic origins = racism targets. Keep in mind, you can't just look at most people and know their religion or racial makeup.
    - arp242 3y ago
      But you hardly need a DNA database for that? Usually the type of identities that are discriminated against are pretty clear from the outset. Even the Nazis and their Rassenkunde bollocks was more post-hoc window-dressing rationale than anything else – they really didn't need that to tell who the Jews, Slavs, Roma, etc. were. This is usually the pattern: "I want to discriminate against $group for $emotional reasons, and I can't really articulate why, so let me find $facts to support my $case". And look, if you want to keep it private then you should of course keep it private, and if 23andme promises to keep it private then you have every right to keep them to their promise. Privacy is fundamentally about choice, and those choices will be different for everyone and I'm not here to judge anyone's choices. But personally, I think the abuse for DNA data is actually quite small, almost non-existent.
mschuster91 3y ago
By far not in all countries. The US is pretty unique in its public record laws.
ggus 3y ago
DNA analysis can be used to profile you. Health risks, ancestry, genetic conditions. This could be used to deny insurance coverages and employment opportunities due to perceived health risks. DNA analysis is rapidly evolving to extract more information than you might initially assume. We don't know how much or how accurately DNA can be used do infer your preferences, moral instincts, aggressive tendencies, intelligence, propensity to fall victim of a scam, to become addicted, to act violently, etc. DNA also provides insights into the genetic makeup of family members, which can face the same problems.

karaterobot 3y ago

This article seems like a breathless rant. He didn't even take the time to explain what I interpret to be the meaning of his incendiary title, which is that DNA companies who get hacked should be dissolved, or punitively fined to the extent that they can no longer function. Because, of course, you can't literally kill a company. I don't support the death penalty for flesh and blood people, but I'd be fine with it for corporations in certain cases. I'm not sure I agree that it should always happen in the case of a hack; the risk of an intrusion can never be eliminated, only mitigated, so a blanket "off with their heads" rule for any hack seems rather blunt and unnecessary: you'd guillotine any theoretical responsible companies who happened to be targeted by determined actors. Case by case executions perhaps?

arp242 3y ago
One thing I'd very much like to see here is transparency. The author of this article seems to assume the worst. I don't know if that's a reasonable assumption, but "assumptions" is all we can go on right now. 23andme claims "re-used passwords". We just have to take them at their word for this. I don't think they're outright lying, but you can misrepresent things without strictly telling falsehoods. But if we take them at their word, there's a huge amount of nuance there too – are we talking about a large and advanced botnet or just ten IPs that accessed those millions of accounts? The first might be very hard to protect against, the second would raise a lot more eyebrows. What kind of security measures do they have? Things like that. Right now, all I can really do is ... shrug. Because I just don't have enough information to judge one way or the other. And it would improve security, because forced airing of your dirty laundry is a good motivation for going to the laundrette. In the end this would benefit everyone, including the companies themselves.
UncleEntity 3y ago
> ...or punitively fined to the extent that they can no longer function. In which case their IP (everyone's genetic data) goes on the auction block to pay the exorbitant fines. How could that possibly go wrong?

fairity 3y ago

23andme is a public company and seems to already be headed towards bankruptcy. Their share price has fallen by 93% since going public, and they’re burning something like $400m per year on $240m of revenue. I wonder if this incident will be the nail in the coffin.

nemacol 3y ago
Will be interesting to see what ends up buying up their assets.
andromeduck 3y ago
Oh man I wish knew sooner & shorted when they IPOed. Their employees are some of the laziest, most incompetent people I've met and I've yet to hear of a positive interaction with them in a businesses/research/engineering capacity.

quantified 3y ago

No company will avoid being hacked. If you don't want your info leaked, don't share it. The more sensitive it is, the more you should think twice. It may be a couple years yet until the big teleheath hacks come out, and you discover all those private disclosures are sold for pennies on the dark market, or just leveraged by adversaries.

thatguy0900 3y ago
The ultimate problem with this though is that if your family members do it, they basically have your info too.
- quantified 3y ago
  That's part of it. I know I'm in there even though I haven't signed up for it. Like Clearview will know me everywhere because somebody's put up photos on FB with me in them somewhere.
sneak 3y ago
Your biometrics, including your DNA, are not sensitive or private. You leave your DNA at every restaurant you visit, and you display your biometrics in every public place. They are not remotely secret or private or sensitive.
- sonicanatidae 3y ago
  While DNA is left behind, I have yet to see a waitress run to the back with a sample, and run it through DNA marker identification. This also assumes it's a clean sample and not contaminated with all the other DNA present, simple dust, residue on the surface of whatever the DNA was pulled from and/or whatever. I'm not saying it's not possible, I'm saying that it's very, very, very unlikely, at least for mortals. Source: I worked in 2 labs, one of which did genetic testing. Note: I'm IT, not science, so I was the person that setup the reporting triggers, output, input, etc. I do know something about taking samples and swiping them from a glass isn't the typical way, for many, many reasons.
- 3y ago

strict9 3y ago

Can't bring myself to click the article because of the ridiculous headline. But if your information is stored in a database of a large entity, chances are it will spill out at some point. This is especially true in healthcare.

rfrey 3y ago

An entirely predictable outcome of "death sentences" for non-malicious company events is that companies will pull out all the stops to cover them up.

dang 3y ago

Recent and related. Others? 23andMe confirms hackers stole ancestry data on 6.9M users - https://news.ycombinator.com/item?id=38527965 https://news.ycombinator.com/item?id=38527965 - Dec 2023 (297 comments) 23andMe hackers accessed a whole lot of personal data - https://news.ycombinator.com/item?id=38519466 https://news.ycombinator.com/item?id=38519466 - Dec 2023 (36 comments) Hacker leaks millions more 23andMe user records on cybercrime forum - https://news.ycombinator.com/item?id=37931383 https://news.ycombinator.com/item?id=37931383 - Oct 2023 (394 comments) 23andMe Sued over Hack of Genetic Data Affecting Thousands - https://news.ycombinator.com/item?id=37895586 https://news.ycombinator.com/item?id=37895586 - Oct 2023 (20 comments) 23andMe Accounts Hijacked and Data Put Up for Sale on Hacker Forum - https://news.ycombinator.com/item?id=37810755 https://news.ycombinator.com/item?id=37810755 - Oct 2023 (2 comments) 23andMe says user data stolen in credential stuffing attack - https://news.ycombinator.com/item?id=37794379 https://news.ycombinator.com/item?id=37794379 - Oct 2023 (298 comments)

GlibMonkeyDeath 3y ago

Such a ridiculous rant For obvious reasons you don't want your personal financial info publicly known. But can someone explain to me the actual or potential harm done here with DNA information? The only thing remotely potentially harmful could be for denial of life or long-term health insurance (in the US at least.) However, I am unaware of any cases where a relative's genetic test caused denial of coverage. And I am highly doubtful that test results obtained illegally can be used for this purpose. Note that health insurance discrimination (again, in the US, where we have such afflictions) based on the outcome of a genetic test is outlawed https://www.eeoc.gov/laws/guidance/fact-sheet-genetic-information-nondiscrimination-act https://www.eeoc.gov/laws/guidance/fact-sheet-genetic-inform... And we all know you don't need a fancy genetic test to discriminate...