Attackers could reveal most of the genetic information for millions of people whose DNA is held on genetic genealogy databases by exploiting how the websites work.
Michael Edge and Graham Coop at the University of California, Davis, have described three different methods by which DNA data could be compromised. They have serious concerns about the genetic privacy for the more than 5 million users of genetic genealogy services including MyHeritage, GEDmatch, FamilyTreeDNA, LivingDNA and DNA.Land.
These database sites allow people who have had their DNA tested by companies such as 23andMe to upload their genetic data to help them find family members. If portions of their DNA have a strong match with others on the website, they can see a name or email address to contact them.
Advertisement
By manipulating this process, it could be used to reveal most of the genetic data of most people, say Edge and Coop. 鈥淚t depends on the method and on the database, but is potentially quite a lot of [genetic] information,鈥� says Edge.
However, the genetic genealogy firms that spoke to聽快猫短视频聽reject the suggestion that genetic privacy is at risk.
Edge and Coop warned the companies of vulnerabilities and suggested fixes 90 days before publishing a . While they tested the techniques on 872 publicly available genomes, they didn鈥檛 use them on any of the databases.
Gene data fishing
One attack involved uploading many real genetic data sets and monitoring for partial matches with short stretches of people鈥檚 genomes in the database.
A twist on that approach was uploading genetic data that is largely fake, apart from a genuine segment targeting a match for specific genetic variants linked to greater risk of certain conditions, such as Alzheimer鈥檚.
A third way involved trying to trick algorithms by using completely faked data designed to match most people in the databases.
Tests returned more genetic data as the minimum matching segment length reduced. Using the first technique with the shortest segment length returned significant genetic data: about 60 per cent of an average person鈥檚 total alleles 鈥� their variants of a gene 鈥� could be recovered. 鈥淪o we are in fact talking about most of the genetic information of most of the people in our database,鈥� says Edge.
None of the techniques are very complex or difficult to implement, the pair say.
Attackers could end up with a list of names and email addresses associated with a large amount of unique genetic data, revealing much about the individuals鈥� ancestry and allowing predictions about genetic traits for certain conditions. 聽鈥淔or most traits, predictions made from genotypes are not very accurate, but it is quite possible that those predictions will improve with time,鈥� says Edge.
Intrusion detection
Bradley Malin at Vanderbilt University in Tennessee says that even if people harvested only small amounts of data in comparison to the entire genome, that could be of interest. James Watson, co-discoverer of the structure of DNA, for example, thought to be key to Alzheimer鈥檚 risk.
For now, Malin says the risk is more one of principle than practice.聽 鈥淭here are many things that could go wrong, or limit an attack, say through some intrusion detection mechanism.鈥�
Christi Guerrini at the Baylor College of Medicine in Texas says while the risks concern her, they need to be put in the context of other vulnerabilities, such as health information including genetic data being hacked.
鈥淭here are easier ways of compromising someone鈥檚 data,鈥� says Debbie Kennett at University College London, who points out that there is no federal DNA theft law in the US, unlike in the UK.
Most of the database firms told 快猫短视频 they have measures in place to guard against attacks.
Yaniv Erlich at MyHeritage says: 鈥淎s leaders in genetic privacy, we analysed their method and found that the risk for MyHeritage users is minimal.鈥�
Curtis Rogers at GEDmatch says: 鈥淢ost of these kits [uploads] would be filtered out before going on our database as being too irregular.鈥�
David Nicholson at Living DNA says the firm: 鈥淧ut in place numerous safe guards even before the article came out. We are confident that for the way we have our system setup what has been presented has limited impact.鈥�
Paul Maier at FamilyTreeDNA says it employs measures that 鈥渆ffectively prevent the hypothetical problem鈥� presented by the new research.
DNA.land did not respond to a request for comment.
Reference:
