Is Your DNA (and your privacy) For Sale Online?
At-home DNA test kits sold online are popular holiday gifts, promising to reveal facts about your family history and susceptibility to various diseases. But could sending in your DNA sample have a negative impact on the privacy of yourself, your family, and your close relatives? Here's what you need to know, especially if you've submitted a DNA sample to Ancestry or 23andMe...
Selling Your Spit: Dangers of DNA Testing
You might not think your relative’s genealogy hobby could bring you an hours-long interrogation by the FBI and a search warrant for your DNA. But that’s what happened to one film maker, and with the growing popularity of online DNA testing services, the odds of it happening to almost anyone are growing by the day.
It’s no secret that federal, state, and local governments share DNA profiles gathered at crime scenes. The DNA of convicted offenders also goes into the CODIS (Combined DNA Index System). The federal government and 28 States have enacted laws permitting the collection of DNA from people who have merely been arrested or charged with crimes; yes, even the “innocent until proven guilty" persons must give up their DNA.
Some local law enforcement agencies have set up “sobriety checkpoints” where every vehicle is stopped and its occupants are pressured to “voluntarily” provide DNA samples by intimidating, uniformed officers. In Windsor, Ontario, police went door to door “requesting” the DNA of everyone in a neighborhood in search of the murderer of a pregnant woman.
But law enforcement can’t collect everyone’s DNA; at least, not as fast as it would like. So now, police are turning to private-sector databases of DNA profiles collected for medical, genealogical, and other purposes that have nothing to do with crime.
Ancestry.com, perhaps the largest genealogical research resource available to the public, owns a DNA database purchased from an LDS Church genealogy project years ago. Incredibly, Ancestry.com made this sensitive data public and searchable! For law enforcement, it was the genetic equivalent of dumb criminals’ self-incriminating public Facebook posts. All they had to do was search Ancestry.com’s free database for a match with crime scene DNA, then get a warrant for the Ancestry.com user’s identity.
What is Familial Searching?
“Familial searching” goes a long step further. It’s based on the premise that one’s relatives have DNA similar to yours. So if a direct search doesn’t turn up a match strong enough to serve as probable cause for a warrant, police may look for partial matches that indicate a relative of the unknown DNA sample. Such a familial match may serve to obtain a warrant for the potential relative’s identity. Then the police go looking for that person’s relatives.
That is exactly what happened to Michael Usry. Years ago, his father donated DNA to that LDS genealogy project, never dreaming it would end up in a commercial, public database searched by the Idaho Falls police. The senior Usry’s DNA profile was an “excellent match” to DNA found at a 1996 murder scene, though still dissimilar enough to rule him out as a suspect. But that was enough for a warrant to obtain Dad’s identity, and the police started going through his family.
What they found is that Michael Usry had “ties” to the Idaho Falls crime scene; two of his sisters attended university 25 miles from it. He’d been on a ski trip near Idaho Falls when he was 19. Oh, and he had Facebook friends in Idaho, too. Also, Michael Usry’s films often feature violence, indicating a “depravity of mind” according to police. This thin soup, and the fuzzy science of familial DNA searching, convinced a judge to issue a search warrant for Michael’s DNA, which was executed by FBI agents in Usry’s current home town of New Orleans. Usry sweated for 33 days before the DNA test results cleared him. (I wonder why they went to all that trouble, since police can secretly collect suspect DNA from a discarded bottle or even trash.)
DNA testing is becoming more popular and less expensive. It’s a very useful tool for identifying potential medical problems before they actually arise. But if DNA databases become fishing holes for law enforcement, people may well shy away from getting tested.
Familial searches of DNA yield a high percentage of false positives, generating numerous fruitless leads in a criminal investigation. In the UK, which has employed familial DNA searches for over 10 years, a 2014 study found that just 17 percent of familial DNA searches “resulted in the identification of a relative of the true offender.” The damage done to the reputation of someone who merely falls under suspicion of a crime may outweigh the utility of unreliable familial DNA searching. Had Michael Usry been a schoolteacher, rumors that he was being investigated for a girl’s murder might have ended his career unjustly.
On the flipside, police in California were able to find and arrest the "Golden State Killer" Joseph DeAngelo, 40 years after his string of murders, rapes and burglaries. They used publicly available DNA information from GEDmatch, to identify a distant relative of the suspect. GEDmatch stores DNA information voluntarily uploaded by people who use DNA testing kits provided 23andMe or Ancestry, to search for family members.
Is DNA Protected By Law?
There is no federal law regulating familial DNA searching. Maryland and Washington D.C. explicitly prohibit it, while the practice is regulated by laws in California, Colorado, Montana, Virginia, and Texas. Police have free rein in all other States. The Idaho Falls police searched Usry Sr.’s family tree for five generations, even though the FBI says familial searching is useful only for identifying suspects among parents or siblings.
When it comes to insurance, there are some protections in place. The Genetic Information Nondiscrimination Act (GINA) is a federal law that prohibits health insurance providers from using genetic information to discriminate regarding health insurance coverage. Specifically, they can't use any genetic test results to deny coverage or charge higher premiums. But there are some loopholes in the GINA law. It does not apply to companies with fewer than 15 employees, nor to disability insurance, long-term care insurance, or life insurance.
Can Anyone Do a DNA Search?
Ancestry.com suspended public access to its DNA database in the wake of the Usry case. However, that does not prevent law enforcement from seeking a search warrant to look through that database for a specific DNA profile, if they can cite probable cause to believe that a useful match is in Ancestry.com’s database. As long as the data exists, it is vulnerable to court orders. Ancestry.com tells users in its terms of service that it will provide their data to law enforcement in response to search warrants or court orders. However, the company is silent on how many warrants, orders, or informal requests it has received, and how many have been fulfilled. They do state that the company "will not share your genetic data with employers, insurance providers or third party marketers without first getting your consent."
23AndMe.com, another DNA testing firm that tests for genetic indicators of medical problems, issues a quarterly transparency report. It shows that since 2015, the company has received only eleven requests from law enforcement agencies for its data, and that no request has been granted in whole or in part, without the explicit consent of any individual identified in a request.
However, that doesn't mean that DNA testing companies aren't *selling* the data they collect.
Both Ancestry and 23andMe do sell (or have sold) your data to drugmakers and other interested parties. In 2018, pharmaceutical giant GlaxoSmithKline paid $300 million for a four-year deal to use 23andMe's genetic data to help them develop new drugs. That deal was renewed in January 2022. 23andMe also has (or has had) data sharing partnerships with P&G Beauty, Alnylam Pharmaceuticals, Biogen, Pfizer, Genentech, and several universities and nonprofit research groups.
Ancestry partnered with Google's Calico subsidiary from 2015 to 2018, to study aging and longevity. Currently, Ancestry only partners with universities and research institutions. Among those are the University of Utah and the American Society of Human Genetics.
The genetic data is anonymized, of course, before sharing. But despite the best efforts to remove personally identifying information from DNA samples, researchers at the Whitehead Institute for Biomedical Research have proved that anonymizing this data is not foolproof. They were able to determine the identities of 50 people who anonymously donated DNA donated for scientific studies.
Add to that, mistakes and data breaches can happen. One must wonder how all those companies, universities and research groups handle the data they receive in all these partnerships. Does the data "leak" out to other parties? We'll never know for sure. On the bright side, Ancestry, 23andMe, and other DNA kit vendors offer choices about sharing your data with third parties. If you missed that when signing up, look for the relevant profile settings, and ask if you can delete your data entirely if desired.
Have you had your DNA tested? Your thoughts on this topic are welcome. Post your comment or question below...
This article was posted by Bob Rankin on 11 Oct 2022
|For Fun: Buy Bob a Snickers.
Faster and Safer Internet? Here's How...
The Top Twenty
Stop Using Microsoft Office - Here's Why...
Post your Comments, Questions or Suggestions
Free Tech Support -- Ask Bob Rankin
Subscribe to AskBobRankin Updates: Free Newsletter
Copyright © 2005 - Bob Rankin - All Rights Reserved
Article information: AskBobRankin -- Is Your DNA (and your privacy) For Sale Online? (Posted: 11 Oct 2022)
Copyright © 2005 - Bob Rankin - All Rights Reserved