Another Reason Genetic Privacy Will Be Impossible To Maintain

While reading a recent article about genetic testing services a thought occurred to me for another reason why genetic privacy will be impossible to protect: What is to stop someone from sending in a sample of DNA from someone else to a DNA testing service while claiming the sample is their own DNA?

In the past I've argued that the eventual development of cheap miniaturized DNA sequencers will spell the death knell for genetic privacy. Miniaturized sequencers will enable individuals to surreptitiously acquire DNA samples from other people and then secretly test the DNA on their own DNA sequencer machine. Given that microfluidic silicon chips will some day be as cheap as microprocessor and memory chips the idea of DNA sequencers operable by complete amateurs seems inevitable. Granted, such devices will not be offered for sale in the next few years. But 30 years from now (and perhaps much sooner) I'm hard put to see why such machines won't be cheap to build and easy to operate.

However, long before personal DNA sequencers hit the market commercial DNA testing labs will be competing to tell us increasing numbers of insights about our minds and bodies that will be gleanable from DNA testing. Once those services start producing useful information with predictive value about health and physical and mental performance what is to stop any person from impersonating another person and submitting another person's DNA as their own?

Consider that identity theft is a rapidly growing problem. Most cases of identity theft are discovered when someone gets a bill for a product or service they didn't buy. But identity theft for the purpose of getting DNA tested would not necessarily eventually result in the victim ever benig notified that someone else temporarily masqueraded as them. Why? Because when the DNA sample is submitted it would not have to be submitted with the real name of the person the DNA sample was stolen from.

I can envision a DNA testing regulatory regime whereby this method of privacy invasion could be made much harder. To catch such deception everyone in a society would have to be required to donate a tissue sample to a central database. Each sample could be converted to a DNA gel pattern that would be of the sort that law enforcement agencies use to check human tissue samples found at crime scenes. All samples submitted to DNA testing services would be compared against the centralized database to verify the identity of the submitters. If a submitted pattern matched an entry in the central database then the identity supplied with the submitted DNA could be verified against the identity associated with that pattern in the central database. A difference in name, age, or other characteristic could raise a red flag.

The hardest part of the authentication of the identity of the DNA sample submitter would be to verify that the person who submits the sample really is the person whose sample it is. One way to solve that problem would be to require DNA samples be taken from a person in a licensed clinic. Though bribery of clinic workers could defeat such a scheme. Another approach would be to store biometric data in the form of images of irises, fingerprints, and/or other biometric information into the centralized database. Then a person submitting a DNA sample at a clinic could have their eyes or fingers scanned by a remote computer to authenticate their identity during the DNA sample submission process.

I still see such an elaborate regulatory system as fairly easy to defeat. Even if civil libertarians didn't block the creation of a centralized DNA pattern and biometric informaton database and even if the regulatory requirements for sample submission were make rigorous enough to prevent DNA sample submitters from masquerading as someone else such a system would still be defeatable. How? Simply take the tissue sample to another country where the regulations are much more lax and submit the sample for testing in the other country.

Crooked employees of DNA testing labs would be another weak link in a regulatory regime aimed at protecting DNA privacy. Test samples could be tested basically off the books. How to prevent that? Require use of DNA testing machines designed to be unable to operate without being currently hooked via some sort of encrypted link to a larger database that would record all DNA that gets tested.

I do not expect to see such a rigorous regulatory system for DNA testing to be enacted in the next 10 years and probably not for much longer. By the time regulation starts to catch up I'm guessing that personal DNA testers based on microfluidics chips will be on the market and the regulatory regime for large DNA testing facilities which I outline above will therefore become irrelevant.

Currently some DNA testing services accept samples via the mail. Well, this makes cheating incredibly easy. On the other hand, the incentive to get another person's DNA tested is still very low and will remain low until a lot more information about a person can be gleaned from testing their DNA.

I'm still betting on the eventual death of DNA privacy. Incentives to learn about the DNA of others will be too great while regulatory regimes will lag technological advances and will be too easy to defeat. Technological advances, corruptible employees of testing services, the ability to fake identities, and the ability to travel to less regulated jurisdictions will combine to make DNA privacy impossible to protect.

Update: Medical Madhouse Madman points out that a person who lets their doctor or a hospital have a copy of their DNA sequence (or even some subset of that sequence) is also at risk of having their DNA information stolen by a clinic worker.

Personal medical information is protected by law today yet, one’s medical records can easily be accessed by someone working in a medical clinic, a hospital, or a nursing home. In order to obtain someone’s private medical information one would simply bribe a clinic worker, same as the solution suggested in the above entry. The question remains, if the information is not used for the purpose of ultimate profit, of what use it would be?

Might I add that if the hospital is part of a chain with a large central database then the number of people who will be able to get access to that information is even larger.

As for the potential uses of that information: Insurance companies looking to more accurately measure risk are one big obvious set of users. Note that not only medical insurance companies will find DNA sequence information useful. I think it exceedlngly likely that specific genotypes will be found to contribute to dangerous driving habits and slower reflexes. Car insurance companies would therefore find DNA sequence information useful for assessing accident risks.

Companies looking at potential hires would like better measures of mental abilities, level of motivation, ability to handle stress, and other qualities that will be at least partially predictable from DNA sequence information. Companies will also seek to hire employees more resistant to infections, less likely to become drug addicts, and less likely to suffer from other medical problems. Again, DNA sequence information will provide information that will allow companies to reduce the risk of hiring people at greater risk of these and other problems.

DNA sequence information will also be useful in personal relationships. A woman looking for Mr. Goodbar will want to check out the DNA of some guy she meets. She'll looking for both desirable genetic qualities for children and for genetic tendencies for preferred types of behavior in her potential spouse. For example, genetic variations influence the tendency to remain sexually faithful or to cheat. A woman who is looking for a monogamous guy is going to want to steer clear of a guy who has genotypes that code for promiscuity.

Similarly, intelligence agencies and militaries are going to want to know about genetic variations that occur more often in people who become traitors. A genotype does not have to cause a given behavior 100% of the time in order to be useful. If only 1% of the carriers of a genotype engage in a behavior while a mere 0.1% of non-carriers do that fact will have enormous value to businesses, intelligence agencies, law enforcement agencies, and individuals.

Once DNA sequencing costs fall by a few more orders of magnitude scientists will discover functional effects of hundreds of thousands of genetic variations by compariing the behavior and medical records of millions of people. DNA tests will become cheap and then not long after DNA tests will gain considerable predictive value. At that point people will start surreptitiously testing each others' DNA.

By Randall Parker at 2005 April 30 09:27 AM  Biotech Privacy | TrackBack