Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Breach exposed more than one million DNA profiles on a major genealogy database

buzzfeednews.com

Post reply on HN
Print view View original

381–390 of 424 posts

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#381

Post by JangoSteve »

jpz wrote: post #374
uncletammy wrote: post #369

Earlier quoted context omitted.

This is exactly how I feel about my friends/family having Facebook apps on their phone. I didn't consent to giving my contact info to Facebook. I wasn't given a choice.

It is impossible to have an "expectation of privacy" over the DNA of your relatives. You need to live with it, and resolve your feelings to the reality of that situation. You don't get a choice if your uncle, grandmother, aunt, niece or son share their DNA with law enforcement.

I'm not sure it's just feelings to be resolved. The problem is that even DNA matching, especially the SNP genotyping which tends to be used by consumer ancestry and heritage services, is not perfect. So your daughter can end up false-positively matching to a crime 20 years from now due to your uncle submitting his own DNA last year without you ever knowing. I'm not sure how anyone sufficiently familiar with the implications can just get over it and accept the reality of the situation. It is by no means an easy problem to solve.

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#383

Post by macintux »

i_cannot_hack wrote: post #351
macintux wrote: post #345

Earlier quoted context omitted.

Your (twin’s) photo is unlikely to be used for: * Identifying future medical risk factors * Solving 30-year-old cold cases where DNA is the only evidence * Identifying parentage in adoption cases

But my (twin's) photos could likely be used used for: * Linking them to the location of a crime using Clearview AI and similar scraping facial recognition services * Creating fake but believable defamatory photos and videos, such as deepfakes * Being scraped and used in fake profiles by spambots and other nefarious actors * Being exploited as a tool in identify theft and identify fraud, via various kinds of social en…

I consider them to be unavoidable, barring some extreme off-the-grid efforts. Your photo is out there. Your DNA doesn’t have to be.

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#384

Post by kube-system »

JangoSteve wrote: post #381
jpz wrote: post #374

Earlier quoted context omitted.

It is impossible to have an "expectation of privacy" over the DNA of your relatives. You need to live with it, and resolve your feelings to the reality of that situation. You don't get a choice if your uncle, grandmother, aunt, niece or son share their DNA with law enforcement.

I'm not sure it's just feelings to be resolved. The problem is that even DNA matching, especially the SNP genotyping which tends to be used by consumer ancestry and heritage services, is not perfect. So your daughter can end up false-positively matching to a crime 20 years from now due to your uncle submitting his own DNA last year without you ever knowing. I'm not sure how anyone sufficiently familiar with the impli…

That’s very true but it’s more of a criminal justice problem than a privacy problem. The same issue could happen (and has) with fingerprints or other biometric data.

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#385

Post by kube-system »

astura wrote: post #352
toomuchtodo wrote: post #343

Earlier quoted context omitted.

Federal law prohibits health insurers from using DNA data for underwriting and pricing.

And if it didn't the insurance companies could just demand a dna test before underwriting any policies.

If we’re hypothetically considering what they could do if they weren’t one of the most regulated industries, they have exponentially better options for limiting their risk than requesting DNA.

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#386

Post by ig1 »

jacquesm wrote: post #356
ig1 wrote: post #324

Earlier quoted context omitted.

Most law enforcement typically use a handful of commercial agencies (like Parabon NanoLabs, etc) for these kind of searches, it seems highly unlikely that any of them would risk using illegally obtained data because it would put their entire business at risk. (obviously if your threat model includes intelligence agencies, etc. then your calculus might be different)

And of course law enforcement has never before used illegally obtained evidence to construct a new trail that was plausible: https://en.wikipedia.org/wiki/Parallel_construction

It's not about law enforcement using the data, it's about the viability of running a business that provides illegal hacking services for law enforcement.

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#387

Post by tschwimmer »

auganov wrote: post #379

The way GEDmatch works you can enter any "kit number" and get a long list of matching people which has their kit number, name, email and some other basic information. It sounds to me like hackers just managed to traverse the entire database to hunt for emails. Which is not exactly hard given how the site works. Most kit numbers seem to be a letter and 6 numbers so not exactly hard to brute force either. You don't eve…

I can’t believe this is a website. It’s essentially a rolling data breach.

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#388

Post by drdeca »

thaumasiotes wrote: post #305
haihaibye wrote: post #287

Earlier quoted context omitted.

If a child has 2 copies of a variant you know both parents have at least 1 copy. You know what parent a male's X and Y came from. You can use phasing and linkage to reconstruct parental haplotypes.

> You know what parent a male's X and Y came from. You can identify which parent any chromosome came from. They're all marked, and the same genetics may do sharply different things depending on whether it was inherited from the father or the mother. Inability to recover this data has nothing to do with "the nature of DNA" -- the data is very much present in the DNA. It's unrecoverable because when we summarize DNA, w…

> You can identify which parent any chromosome came from. They're all marked, and the same genetics may do sharply different things depending on whether it was inherited from the father or the mother.

I did not know this. This sounds interesting! Can you provide any google search terms (or a link) where I can read more about this? (e.g. a name of what they are marked with) This surprises me. I thought that there was a process by which portions of the two copies of a chromosome get switched between the two. Is that right? How does that fit together with these markings?

(If these questions would be answered by searching for whatever search term or reading whatever link you provide, I would consider providing said search term or link to be answering these questions)

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#389

Post by thaumasiotes »

drdeca wrote: post #388
thaumasiotes wrote: post #305

Earlier quoted context omitted.

> You know what parent a male's X and Y came from. You can identify which parent any chromosome came from. They're all marked, and the same genetics may do sharply different things depending on whether it was inherited from the father or the mother. Inability to recover this data has nothing to do with "the nature of DNA" -- the data is very much present in the DNA. It's unrecoverable because when we summarize DNA, w…

> You can identify which parent any chromosome came from. They're all marked, and the same genetics may do sharply different things depending on whether it was inherited from the father or the mother. I did not know this. This sounds interesting! Can you provide any google search terms (or a link) where I can read more about this? (e.g. a name of what they are marked with) This surprises me. I thought that there was…

> Can you provide any google search terms (or a link) where I can read more about this? (e.g. a name of what they are marked with)

The term I know related to this is "methylation". https://en.wikipedia.org/wiki/DNA_methylation . I don't know all that much about it; I would not want to claim that methylation is the only such mechanism, or that this is the only information expressed by DNA methylation.

> I thought that there was a process by which portions of the two copies of a chromosome get switched between the two. Is that right? How does that fit together with these markings?

Yes, that's correct. "Crossing over" does not occur during ordinary cell division ("mitosis"), in which one of your cells divides into two of your cells -- your chromosomes should stay the same (except for new mutations) through your life.

But it does occur during meiosis, the process by which one of your cells divides into four sperm or four eggs (these are "gametes", and in terms of chromosome content they are only half-cells, not full cells). Your children's chromosomes may therefore differ from yours.

So the interaction between parental marking and crossing over would broadly look like:

1. You are going to produce four gametes.

2. Remove the parental marking (indicating the sex of the gamete's grandparent) from the cell undergoing meiosis.

3. Do the crossing over.

4. Apply parental marking indicating your own sex (the gamete's parent, rather than grandparent).

5. Divide into four cells.

I don't actually know where the unmarking and remarking occur in the process; maybe reality is more like 2435, or 3254. But both crossing over and applying correct parental marking are part of meiosis -- since meiosis produces a cell that belongs to your child rather than a cell that belongs to you, it's easy to know what kind of marking should be applied.

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#390

Post by monadic2 »

ig1 wrote: post #324
dwighttk wrote: post #313

Earlier quoted context omitted.

> and many of the DNA platforms don't allow them I’m assuming that the stolen information doesn’t have this limitation.

Most law enforcement typically use a handful of commercial agencies (like Parabon NanoLabs, etc) for these kind of searches, it seems highly unlikely that any of them would risk using illegally obtained data because it would put their entire business at risk. (obviously if your threat model includes intelligence agencies, etc. then your calculus might be different)

Honestly all I see is upside for the business.
Post reply on HN