First, letās address the fact that hackers recently accessed the personal data of about 14,000 23andMe customers. Because of how 23andMe worksāit has a āDNA Relativesā feature that lets users find people they are probably related toāthis breach created 6.9 million āother usersā who had data stolen in the breach, according to reporting by TechCrunch. This data included peopleās names, birth year, relationships, percentage of DNA shared with other 23andMe users, and ancestry reports.
Getting your DNA or your loved onesā DNA sequenced means you are potentially putting people who are related to those people at risk in ways that are easily predictable, but also in ways we cannot yet predict because these databases are still relatively new. I am writing this article right now because of the hack, but my stance on this issue has been the same for years, for reasons outside of the hack.
In 2016, IĀ moderated a panel at SXSW calledĀ āIs Your Biological Data Safe?,ā which was broadly about the privacy implications of companies and other entities creating gigantic databases of peopleās genetic code. This panelās experts included a 23andMe executive as well as an FBI field agent. Everyone on the panel and everyone in the industry agrees that genetic information is potentially very sensitive, and the use of DNA to solve crimes is obviously well established.Ā
At the time, many of the possible dangers of providing your genome to a DNA sequencing company were hypothetical. Since then, many of the hypothetical issues we discussed have become a reality in one way or another. For example, on that panel, we discussed the work of an artist who was turning lost strands of hair, wads of chewing gum, and other found DNA into visual genetic āportraitsā of people. Last year, the Edmonton Police Service,Ā using a company called Parabon, used a similar process to create 3D images of crime suspects using DNA from the case. The police had no idea if the portrait they generated actually looked like the suspect they wanted, and the practice is incredibly concerning.
To its credit, 23andMe itselfĀ has steadfastly resisted law enforcement requests for information, but other large databases of genetic information have been used to solve crimes. BothĀ 23andMeĀ andĀ AncestryĀ are regularly the recipients of law enforcement requests for data, meaning police do see these companies as potentially valuable data mines.Ā