8 ms·

Dear Google, am I pregnant?

131 points by cstross 13y ago

deleted 13y ago
[deleted]
casca 13y ago
Their Data Protection Register submission confirms that "When this is needed information may be transferred to countries or territories around the world". For those not familiar with the UK Information Commissioners Office (ICO) process, when submitting you can choose between transferring data just within the UK, within the EEA and worldwide. http://ico.org.uk/ESDWebPages/DoSearch?reg=440927 http://ico.org.uk/ESDWebPages/DoSearch?reg=440927 http://ico.org.uk/ESDWebPages/DoSearch?reg=251239 http://ico.org.uk/ESDWebPages/DoSearch?reg=251239
oalders 13y ago
On a vaguely related note, I recently discovered that "am i pregnant" seems to be a popular search term on Google: https://twitter.com/wundercounter/status/430175442432053248 https://twitter.com/wundercounter/status/430175442432053248
- deleted 13y ago
  [deleted]
patio11 13y ago
Side note: In the USA, doing this would be a federal offence under Title II of HIPAA. It would probably depend on whether the consultancy got a BAA signed by Google. That would obligate Big Daddy G to a host of security and privacy requirements, but would extinguish the HIPAA liability for the consultancy with regards to the data while it was in Google's care. You can think of it sort of like cert-chaining -- the government wants to see a chain of BAAs linking all subcontractors that data stops at from the original covered entity (e.g. a hospital). Source: I have signed a few and gotten a few signed. Talk to a lawyer if you need implementation advice on this, though.
- JunkDNA 13y ago
  There is another loophole that is admittedly unlikely (and the post doesn't go into any details on what the actual records contain). If these records were somehow scrubbed of HIPAA identifiers, then it would in fact not be a HIPAA violation in the US. For example: a dataset of randomly assigned ID's tied to diagnosis codes. You could uniquely ID an individual within the dataset but not know who they were in the real world. I hear all the privacy folks lighting their torches and sharpening the pitchforks. So, for the record, yes, there are all sorts of methods and studies that show you can potentially re-identify people from all sorts of data that seems at first blush to be not that identifiable [1] and isn't part of the list of HIPAA identifiers. However, in the US, in actual practice, when you talk to compliance people, they often take a very narrow view of what "identifiable" is. The standard is often that it has to be more or less trivial to do. For example, matching on easily accessible public records. I encounter this all the time in my capacity as a biomedical researcher and have discovered that my "geek intuition" on what is identifiable does me no good in this space. The most crazy one is your DNA sequence. I'm having trouble finding the original document now, but Health and Human Services went out of their way to not make this a formal HIPAA identifier (except in very narrow cases relating to insurance companies) when they had the opportunity to do so during some recent rule-making. Which you would think it would clearly be because HIPAA allows for "other biometric identifiers" and what could be a better biometric than your DNA? But I digress... One of the problems with HIPAA is that it leaves a lot to the eye of the beholder, and many beholders have wildly differing vision. This, as you state, is why you need a lawyer who can make sure your vision doesn't lead to decisions with a high probability of business-ending bankruptcy and going to jail. [1] http://arstechnica.com/tech-policy/2009/09/your-secrets-live-online-in-databases-of-ruin/ http://arstechnica.com/tech-policy/2009/09/your-secrets-live...
  - enjo 13y ago
    From the article: "And what they uploaded was the entire shooting match—full personal medical records indexed by NHS patient number—with enough additional data (post code, address, date of birth, gender) to make de-anonymizing the records trivial." So I'm guessing that they are not properly scrubbed.
artumi-richard 13y ago
The document where PA consulting announce their use of Google tools[1] ends that section with "For more information please email healthcare@paconsulting.com" Just sayin' 1: https://www.google.co.uk/url?sa=t&source=web&rct=j&ei=oOwTU9qXCcOVhQfzm4DACQ&url=http://www.paconsulting.com/EasySiteWeb/GatewayLink.aspx%3FalId%3D32982&cd=5&ved=0CDkQFjAE&usg=AFQjCNH4YTWcDErZp2ZJn-iXUNfSLLzIaw&sig2=gDp0bEwLRH4i0xV2B5CUSQ https://www.google.co.uk/url?sa=t&source=web&rct=j&ei=oOwTU9...
UK-AL 13y ago
I fairly the Data Protection act says it's ok to move data outside the UK, as long the country your moving to has similar data protection laws.
- summerdown2 13y ago
  That's only one of the data protection principles (principle 8). The others still apply, such as principle 7: > Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data. ... which I would say has pretty clearly not been followed in this case. It's probably a breach of many of the other principles, too. For example, principle 3: > Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed. ... it's hard to see how the data used was not excessive for the purpose in question. http://ico.org.uk/for_organisations/data_protection/the_guide/principle_7 http://ico.org.uk/for_organisations/data_protection/the_guid... http://ico.org.uk/for_organisations/data_protection/the_guide/information_standards/principle_3 http://ico.org.uk/for_organisations/data_protection/the_guid...
fixermark 13y ago
While I agree with the overall thrust of the article, I have to take issue with the author's ostensibly-BigData-access-enabled disaster scenarios. Because let's be honest... From which source would the data be more likely to be stolen to enable the author's scenarios? Google's infrastructure (post-hardening against intrusion by---among other entities---GCHQ)? Or the NHS's system (which has been proven to---among other things---hand data on every NHS patient in England and Wales out to contractors on 27 unauditable, non-remotely-deletable DVDs)?
- mercurial 13y ago
  While I agree with your overall point that Google security is pretty big, I have no reason to think they did anything else than copy the data to Google, and that the original data is not still hosted in their infrastructure.
- vidarh 13y ago
  See the update to the post - apparently the data was made publicly accessible. It's not about Google per se. It's about what this says about the consultancy's laissez faire attitude to dealing with this data.
  - notahacker 13y ago
    The addendum to the post appears to be a totally unrelated NHS security breach, which actually strengthens the point made by the poster-above-but-one. Further down the page still, in the comments section, I saw this: To quote from the report where PA admitted this is what they had done: " ...upload it to the cloud using tools such as Google Storage and use BigQuery to extract data from it. As PA has an existing relationship with Google, we pursued this route (with appropriate approval). This showed that it is possible to get even sensitive data in the cloud and apply proper safeguards." So they are claiming that they (a) had permission to do this and (b) steps were taken to secure it. It may also be that PA via partnership with Google have access to a more secure version of BigData. Don't get me wrong, I've sold proprietary data to big-name management consultants before and know they don't always respect licensing restrictions, but at the moment the suggestion that PA have actually done anything wrong here is pure conjecture
michaelfeathers 13y ago
Definitely bad behavior but I wonder how much of it is attributable to the cloud story that companies have been selling - that all storage and analysis belong in the cloud.
jhspaybar 13y ago
Does "big data" mean anything? I feel like we are long past this phrase losing all meaning. How is 125GB "big"? This is still well within "keep it all in memory" sizes of data. Surely the indexes for this data could be kept in memory by commodity hardware with something as simple as MySQL as the storage engine.
- bad_user 13y ago
  Nowhere in the article did I see "big data", or "big" for that matter.
- kitd 13y ago
  125Gb "after compression". Not sure what format the data was in, but it could be much bigger in raw form.
jcampbell1 13y ago
I have never understood the reason medical records are extremely private. I'd be much more worried about my email/search history/SMS/etc. being published. My medical history I don't really care much about. I understand that we don't want companies using our medical history to make decisions, but is HIPAA just a hangover of HIV/AIDS? My instinct is that HIPAA has cost many lives by locking up data that could be used to help doctors be better doctors. If my kids were allergic to bee stings, I wish this information would show up as the first result of a Google search.
- simias 13y ago
  You lack imagination. There are many people whose medical records contain much more sensitive information than "allergic to bee stings".
- Jare 13y ago
  Your medical records are a proxy to your current health. Thanks to big data, they are a proxy to your future health and that of your relatives too (and by extension, theirs to yours). Health factors can impact every relationship you have with anything or anyone, as well as your ability to perform any activity, and many of them are not reversible in the way that debts can be repaid or ideology can change. Therefore, if you believe in any need for privacy at all, then health is the most important privacy of all.
- mynewwork 13y ago
  Medical information can be the most private information about people. There are plenty of situations with obvious stigmas - STDs, abortion, mental health as well as a near infinite list of things which could cause embarrassment or that people would want to keep private, from acne to miscarriage. The last thing we want is for millions of people to stop going to the doctor because they're scared their classmates, coworkers and neighbors are going to know about their [rash, lump, depression, diarrhea, anxiety, psoriasis, pregnancy, etc].
  - jcampbell1 13y ago
    You make a good point about people not seeking medical attention due to privacy concerns. I certainly don't think medical records should be public. It is the extreme privacy that I take issue with. I mean, why the hell can't my doctor email me my blood work even if I ask? How do we know we have struck the right balance?
Shivetya 13y ago
Funny thing is, Target or another retailer might know because of your purchase history and would that be a violation under some laws currently on the books?
- bertil 13y ago
  Charlie Stross being male, and the Target story being massively advertised, I’m assuming that was something he initially wanted to point at. Purchase history is by far the worst offender in that aspect: you can predict diabetes, risky behaviour, alcoholism, pregnancy, emotional state (and marriage stability), intention to move (via DIY equipment), even religion and ethnicity, that carry a similar moral and legal burden in Europe. As far as I can read, all legal documents mention: asking, collecting, processing explicit data. None seem to cover the case of a high factor between “has bough unscented skin cream” and “Recommend cribs, nappies and milk bottles”. What was interesting in the NYT piece about Target was how even with that knowledge, being too explicit was considered horrible and an invasive practice. Based on anecdotal reaction to ‘People who bought that’ from Amazon from more than a decade ago (and the general sucky obviousity of most of their suggestion) I’m assuming that a lot of the crunchy cases (say: blue books, box wine, dark chocolate and dildos) are censored to avoid public scandal, and a corresponding regulation. Based on experts’ mobility and the strength of statistical trends in general, I guess the Target Data scientist who was fired after the NYT was not guilty of spelling the beans, or revealing that Hadoop was the right choice (duh) to competitors like WalMart and CostCo, but letting the public know.
- fr0sty 13y ago
  Funny you should mention that: http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/ http://www.forbes.com/sites/kashmirhill/2012/02/16/how-targe...
jcampbell1 13y ago
The title is ironic, since Google certainly knows if you are pregnant based on your search history. Target knows if you are pregnant based on purchases of prenatal vitamins, and does special marketing: http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/ http://www.forbes.com/sites/kashmirhill/2012/02/16/how-targe...
- ithkuil 13y ago
  Perhaps my sister is pregnant and she uses our family computer with a shared account?
- rmrfrmrf 13y ago
  Ugh this specific example has been used time and time again and it irritates the crap out of me. This is not some accomplishment of big data or even beyond trivial to figure out. Example Google searches: > 1 month before conception best days to conceive conception calculator free best iphone conception reminder best pregnancy tester what to do when planning to concieve planning for baby > 1 month later signs that youre pregnant how many days after missed period should i check if i'm pregnant best pregnancy test 2014 reliable pregnancy tests 2014 > 2 days later best prenatal vitamins 2014 obgyn in <city> <state> what to eat when pregnant can i eat eggs while pregnant medicine safe while pregnant when to tell family pregnant when to tell friends pregnant I mean, come on! That's not an accomplishment of statistical analysis or big data. For Target, it's even easier considering that making a purchase is considered the holy grail of all of the Internet's efforts. I mean, when else are you going to be buying pregnancy tests and then prenatal vitamins within months of each other? Not to mention the other things like baby name books, What To Expect..., etc. that a future parent would buy at Target. How about a real challenge like determining paternity via search histories?
protomyth 13y ago
"considerably stronger than the implicit privacy rights acknowledged in the US, which are not enumerated directly by the US constitution" The Constitution was meant to enumerate the powers of the government, not the people. Sadly, our courts have let us down and now we must rely on the enumeration even if the 10th amendment says "The powers not delegated to the United States by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people." Privacy was historically understood and thought to need no additional enumerations. Check the writings of the founding fathers and British common law at the time.
grecy 13y ago
Should be - "Dear US Govt. am I pregnant?" It's entirely likely some three letter agency intercepted that upload and has all the data for itself.

131 points by cstross 13y ago

deleted 13y ago

[deleted]

casca 13y ago

Their Data Protection Register submission confirms that "When this is needed information may be transferred to countries or territories around the world". For those not familiar with the UK Information Commissioners Office (ICO) process, when submitting you can choose between transferring data just within the UK, within the EEA and worldwide. http://ico.org.uk/ESDWebPages/DoSearch?reg=440927 http://ico.org.uk/ESDWebPages/DoSearch?reg=440927 http://ico.org.uk/ESDWebPages/DoSearch?reg=251239 http://ico.org.uk/ESDWebPages/DoSearch?reg=251239

oalders 13y ago

On a vaguely related note, I recently discovered that "am i pregnant" seems to be a popular search term on Google: https://twitter.com/wundercounter/status/430175442432053248 https://twitter.com/wundercounter/status/430175442432053248

deleted 13y ago
[deleted]

patio11 13y ago

Side note: In the USA, doing this would be a federal offence under Title II of HIPAA. It would probably depend on whether the consultancy got a BAA signed by Google. That would obligate Big Daddy G to a host of security and privacy requirements, but would extinguish the HIPAA liability for the consultancy with regards to the data while it was in Google's care. You can think of it sort of like cert-chaining -- the government wants to see a chain of BAAs linking all subcontractors that data stops at from the original covered entity (e.g. a hospital). Source: I have signed a few and gotten a few signed. Talk to a lawyer if you need implementation advice on this, though.

JunkDNA 13y ago
There is another loophole that is admittedly unlikely (and the post doesn't go into any details on what the actual records contain). If these records were somehow scrubbed of HIPAA identifiers, then it would in fact not be a HIPAA violation in the US. For example: a dataset of randomly assigned ID's tied to diagnosis codes. You could uniquely ID an individual within the dataset but not know who they were in the real world. I hear all the privacy folks lighting their torches and sharpening the pitchforks. So, for the record, yes, there are all sorts of methods and studies that show you can potentially re-identify people from all sorts of data that seems at first blush to be not that identifiable [1] and isn't part of the list of HIPAA identifiers. However, in the US, in actual practice, when you talk to compliance people, they often take a very narrow view of what "identifiable" is. The standard is often that it has to be more or less trivial to do. For example, matching on easily accessible public records. I encounter this all the time in my capacity as a biomedical researcher and have discovered that my "geek intuition" on what is identifiable does me no good in this space. The most crazy one is your DNA sequence. I'm having trouble finding the original document now, but Health and Human Services went out of their way to not make this a formal HIPAA identifier (except in very narrow cases relating to insurance companies) when they had the opportunity to do so during some recent rule-making. Which you would think it would clearly be because HIPAA allows for "other biometric identifiers" and what could be a better biometric than your DNA? But I digress... One of the problems with HIPAA is that it leaves a lot to the eye of the beholder, and many beholders have wildly differing vision. This, as you state, is why you need a lawyer who can make sure your vision doesn't lead to decisions with a high probability of business-ending bankruptcy and going to jail. [1] http://arstechnica.com/tech-policy/2009/09/your-secrets-live-online-in-databases-of-ruin/ http://arstechnica.com/tech-policy/2009/09/your-secrets-live...
- enjo 13y ago
  From the article: "And what they uploaded was the entire shooting match—full personal medical records indexed by NHS patient number—with enough additional data (post code, address, date of birth, gender) to make de-anonymizing the records trivial." So I'm guessing that they are not properly scrubbed.

artumi-richard 13y ago

The document where PA consulting announce their use of Google tools[1] ends that section with "For more information please email healthcare@paconsulting.com" Just sayin' 1: https://www.google.co.uk/url?sa=t&source=web&rct=j&ei=oOwTU9qXCcOVhQfzm4DACQ&url=http://www.paconsulting.com/EasySiteWeb/GatewayLink.aspx%3FalId%3D32982&cd=5&ved=0CDkQFjAE&usg=AFQjCNH4YTWcDErZp2ZJn-iXUNfSLLzIaw&sig2=gDp0bEwLRH4i0xV2B5CUSQ https://www.google.co.uk/url?sa=t&source=web&rct=j&ei=oOwTU9...

UK-AL 13y ago

I fairly the Data Protection act says it's ok to move data outside the UK, as long the country your moving to has similar data protection laws.

summerdown2 13y ago
That's only one of the data protection principles (principle 8). The others still apply, such as principle 7: > Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data. ... which I would say has pretty clearly not been followed in this case. It's probably a breach of many of the other principles, too. For example, principle 3: > Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed. ... it's hard to see how the data used was not excessive for the purpose in question. http://ico.org.uk/for_organisations/data_protection/the_guide/principle_7 http://ico.org.uk/for_organisations/data_protection/the_guid... http://ico.org.uk/for_organisations/data_protection/the_guide/information_standards/principle_3 http://ico.org.uk/for_organisations/data_protection/the_guid...

fixermark 13y ago

While I agree with the overall thrust of the article, I have to take issue with the author's ostensibly-BigData-access-enabled disaster scenarios. Because let's be honest... From which source would the data be more likely to be stolen to enable the author's scenarios? Google's infrastructure (post-hardening against intrusion by---among other entities---GCHQ)? Or the NHS's system (which has been proven to---among other things---hand data on every NHS patient in England and Wales out to contractors on 27 unauditable, non-remotely-deletable DVDs)?

mercurial 13y ago
While I agree with your overall point that Google security is pretty big, I have no reason to think they did anything else than copy the data to Google, and that the original data is not still hosted in their infrastructure.
vidarh 13y ago
See the update to the post - apparently the data was made publicly accessible. It's not about Google per se. It's about what this says about the consultancy's laissez faire attitude to dealing with this data.
- notahacker 13y ago
  The addendum to the post appears to be a totally unrelated NHS security breach, which actually strengthens the point made by the poster-above-but-one. Further down the page still, in the comments section, I saw this: To quote from the report where PA admitted this is what they had done: " ...upload it to the cloud using tools such as Google Storage and use BigQuery to extract data from it. As PA has an existing relationship with Google, we pursued this route (with appropriate approval). This showed that it is possible to get even sensitive data in the cloud and apply proper safeguards." So they are claiming that they (a) had permission to do this and (b) steps were taken to secure it. It may also be that PA via partnership with Google have access to a more secure version of BigData. Don't get me wrong, I've sold proprietary data to big-name management consultants before and know they don't always respect licensing restrictions, but at the moment the suggestion that PA have actually done anything wrong here is pure conjecture

michaelfeathers 13y ago

Definitely bad behavior but I wonder how much of it is attributable to the cloud story that companies have been selling - that all storage and analysis belong in the cloud.

jhspaybar 13y ago

Does "big data" mean anything? I feel like we are long past this phrase losing all meaning. How is 125GB "big"? This is still well within "keep it all in memory" sizes of data. Surely the indexes for this data could be kept in memory by commodity hardware with something as simple as MySQL as the storage engine.

bad_user 13y ago
Nowhere in the article did I see "big data", or "big" for that matter.
kitd 13y ago
125Gb "after compression". Not sure what format the data was in, but it could be much bigger in raw form.

jcampbell1 13y ago

I have never understood the reason medical records are extremely private. I'd be much more worried about my email/search history/SMS/etc. being published. My medical history I don't really care much about. I understand that we don't want companies using our medical history to make decisions, but is HIPAA just a hangover of HIV/AIDS? My instinct is that HIPAA has cost many lives by locking up data that could be used to help doctors be better doctors. If my kids were allergic to bee stings, I wish this information would show up as the first result of a Google search.

simias 13y ago
You lack imagination. There are many people whose medical records contain much more sensitive information than "allergic to bee stings".
Jare 13y ago
Your medical records are a proxy to your current health. Thanks to big data, they are a proxy to your future health and that of your relatives too (and by extension, theirs to yours). Health factors can impact every relationship you have with anything or anyone, as well as your ability to perform any activity, and many of them are not reversible in the way that debts can be repaid or ideology can change. Therefore, if you believe in any need for privacy at all, then health is the most important privacy of all.
mynewwork 13y ago
Medical information can be the most private information about people. There are plenty of situations with obvious stigmas - STDs, abortion, mental health as well as a near infinite list of things which could cause embarrassment or that people would want to keep private, from acne to miscarriage. The last thing we want is for millions of people to stop going to the doctor because they're scared their classmates, coworkers and neighbors are going to know about their [rash, lump, depression, diarrhea, anxiety, psoriasis, pregnancy, etc].
- jcampbell1 13y ago
  You make a good point about people not seeking medical attention due to privacy concerns. I certainly don't think medical records should be public. It is the extreme privacy that I take issue with. I mean, why the hell can't my doctor email me my blood work even if I ask? How do we know we have struck the right balance?

Shivetya 13y ago

Funny thing is, Target or another retailer might know because of your purchase history and would that be a violation under some laws currently on the books?

bertil 13y ago
Charlie Stross being male, and the Target story being massively advertised, I’m assuming that was something he initially wanted to point at. Purchase history is by far the worst offender in that aspect: you can predict diabetes, risky behaviour, alcoholism, pregnancy, emotional state (and marriage stability), intention to move (via DIY equipment), even religion and ethnicity, that carry a similar moral and legal burden in Europe. As far as I can read, all legal documents mention: asking, collecting, processing explicit data. None seem to cover the case of a high factor between “has bough unscented skin cream” and “Recommend cribs, nappies and milk bottles”. What was interesting in the NYT piece about Target was how even with that knowledge, being too explicit was considered horrible and an invasive practice. Based on anecdotal reaction to ‘People who bought that’ from Amazon from more than a decade ago (and the general sucky obviousity of most of their suggestion) I’m assuming that a lot of the crunchy cases (say: blue books, box wine, dark chocolate and dildos) are censored to avoid public scandal, and a corresponding regulation. Based on experts’ mobility and the strength of statistical trends in general, I guess the Target Data scientist who was fired after the NYT was not guilty of spelling the beans, or revealing that Hadoop was the right choice (duh) to competitors like WalMart and CostCo, but letting the public know.
fr0sty 13y ago
Funny you should mention that: http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/ http://www.forbes.com/sites/kashmirhill/2012/02/16/how-targe...

jcampbell1 13y ago

The title is ironic, since Google certainly knows if you are pregnant based on your search history. Target knows if you are pregnant based on purchases of prenatal vitamins, and does special marketing: http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/ http://www.forbes.com/sites/kashmirhill/2012/02/16/how-targe...

ithkuil 13y ago
Perhaps my sister is pregnant and she uses our family computer with a shared account?
rmrfrmrf 13y ago
Ugh this specific example has been used time and time again and it irritates the crap out of me. This is not some accomplishment of big data or even beyond trivial to figure out. Example Google searches: > 1 month before conception best days to conceive conception calculator free best iphone conception reminder best pregnancy tester what to do when planning to concieve planning for baby > 1 month later signs that youre pregnant how many days after missed period should i check if i'm pregnant best pregnancy test 2014 reliable pregnancy tests 2014 > 2 days later best prenatal vitamins 2014 obgyn in <city> <state> what to eat when pregnant can i eat eggs while pregnant medicine safe while pregnant when to tell family pregnant when to tell friends pregnant I mean, come on! That's not an accomplishment of statistical analysis or big data. For Target, it's even easier considering that making a purchase is considered the holy grail of all of the Internet's efforts. I mean, when else are you going to be buying pregnancy tests and then prenatal vitamins within months of each other? Not to mention the other things like baby name books, What To Expect..., etc. that a future parent would buy at Target. How about a real challenge like determining paternity via search histories?

protomyth 13y ago

"considerably stronger than the implicit privacy rights acknowledged in the US, which are not enumerated directly by the US constitution" The Constitution was meant to enumerate the powers of the government, not the people. Sadly, our courts have let us down and now we must rely on the enumeration even if the 10th amendment says "The powers not delegated to the United States by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people." Privacy was historically understood and thought to need no additional enumerations. Check the writings of the founding fathers and British common law at the time.

grecy 13y ago

Should be - "Dear US Govt. am I pregnant?" It's entirely likely some three letter agency intercepted that upload and has all the data for itself.