First, let’s address the fact that hackers recently accessed the personal data of about 14,000 23andMe customers. Because of how 23andMe works—it has a “DNA Relatives” feature that lets users find people they are probably related to—this breach created 6.9 million “other users” who had data stolen in the breach, according to reporting by TechCrunch. This data included people’s names, birth year, relationships, percentage of DNA shared with other 23andMe users, and ancestry reports.
Getting your DNA or your loved ones’ DNA sequenced means you are potentially putting people who are related to those people at risk in ways that are easily predictable, but also in ways we cannot yet predict because these databases are still relatively new. I am writing this article right now because of the hack, but my stance on this issue has been the same for years, for reasons outside of the hack.
In 2016, I moderated a panel at SXSW called “Is Your Biological Data Safe?,” which was broadly about the privacy implications of companies and other entities creating gigantic databases of people’s genetic code. This panel’s experts included a 23andMe executive as well as an FBI field agent. Everyone on the panel and everyone in the industry agrees that genetic information is potentially very sensitive, and the use of DNA to solve crimes is obviously well established.
At the time, many of the possible dangers of providing your genome to a DNA sequencing company were hypothetical. Since then, many of the hypothetical issues we discussed have become a reality in one way or another. For example, on that panel, we discussed the work of an artist who was turning lost strands of hair, wads of chewing gum, and other found DNA into visual genetic “portraits” of people. Last year, the Edmonton Police Service, using a company called Parabon, used a similar process to create 3D images of crime suspects using DNA from the case. The police had no idea if the portrait they generated actually looked like the suspect they wanted, and the practice is incredibly concerning.
To its credit, 23andMe itself has steadfastly resisted law enforcement requests for information, but other large databases of genetic information have been used to solve crimes. Both 23andMe and Ancestry are regularly the recipients of law enforcement requests for data, meaning police do see these companies as potentially valuable data mines.