When James Watson, the famed Nobel laureate, decided to make his genome public, he had one condition: He was willing to share his genetic blueprint, but he wanted one part redacted, like black lines on a sensitive FBI document. He did not want others to know — did not want to know himself, in fact — whether his genome contained variations of a certain gene linked to Alzheimer’s disease. His grandmother had suffered from the illness, and there is no prevention or cure.
Watson made his genome freely available in the GenBank National Center for Biotechnology Information Archive in 2007. It isn’t the only place for genome sharing. Another place, the Personal Genome Project, based at Harvard University Medical School, is working to establish a freely shared genetic database of 100,000 people. The idea is to gather as many genomes as possible, along with the personal history of their donors, as a way to cross match for ties between genes, specific traits, and diseases. Founder George Church, a genetics professor at Harvard, has likened it to a Wikipedia for genomes. But it really works more like a genomic Airbnb, allowing researchers to search for just those locations that suit their interests.
Sequencing an entire human blueprint, which once took more than a decade of laboratory time and cost almost $3 billion, has become so quick and relatively cheap that hundreds of thousands of us now have portions of our genomes in hand. They have been obtained by people who want to further scientific knowledge, get insight on disease risk, or find long-lost branches of the family tree. Given this easy access, researchers are hoping more people will be willing to upload their genomes for science, even anonymously.
At the same time, many experts are wondering whether genomes floating around cyberspace — and the easy ability to plant them there — can promise any real semblance of privacy. Even the experts have discovered the risks. Although James Watson, who helped discover the chemical structure of DNA, wanted his Alzheimer’s risk hidden, a team of Australian researchers was able to figure it out anyway. (They kept the information to themselves, however.) In one often-cited scenario, you discard a coffee cup, and a bystander could wipe your saliva off the lip and sequence your DNA. Maybe your genome wouldn’t be worth the effort, but that of a presidential candidate, or Taylor Swift, could be ripe for the taking. One New York performance artist recently gathered DNA left on discarded cigarette butts and stray hairs, and claimed to have re-created the faces of strangers.
While the portraits were billed as “general likenesses,” the technology to extract personal information from DNA is only getting more refined. Still, how much information can be obtained from a genome and what anyone might gain from a privacy breach are subject to debate. Unlike stealing your Social Security number or medical record, the theft of your genome doesn’t clearly offer immediate payoffs. “There are much simpler ways to learn sensitive information about someone,” says Laura Lyman Rodriguez, director of the Division of Policy, Communications, and Education at the National Human Genome Research Institute (NHGRI).
Even if the dangers aren’t yet known, more safeguards might help reassure a wary public that is being courted by geneticists needing to crowdsource their research inventory. But the demarcation between public sharing and privacy protection isn’t clear. “If we establish our policies to restrict and minimize the risk to privacy as much as we can, we will restrict data sharing,” she says. “This is what we are struggling with as a community. How do we advance the two societal goods?”
In general, the American legal system is progressing more slowly than technology. In the United Kingdom, laws prohibit someone from sequencing your DNA without your consent. The United States has no similar protection under federal law, except for one law that prohibits law enforcement officers and companies with a certain number of employees from forcing you to provide your DNA sequencing without good reason, says Amanda Farahany, an Atlanta-based attorney who this summer argued the first case to go to trial under the Genetic Information Nondiscrimination Act. (See “The Devious Defecator,” page 39.) Passed in 2008, the law also prohibits your boss and health insurance provider from basing decisions on your genetic makeup. But it doesn’t cover other situations, like life insurance or long-term care, and there’s nothing in this law or in any other privacy laws that protect you against a stranger who has obtained the information.
Too Much Information
For now, though, the biggest genomic trail is the one you leave yourself. With the rise of “genetic genealogy,” consumers wanting to investigate their pedigrees are entering part of their genomes online. (Ancestry.com alone boasts more than 400,000 members.) While the information is uncoupled from names, it creates a library of clues that can lead to you, especially when people begin to cross match other databases.
The consequences can be unexpected. In 2014, an author who identified himself only as George, a stem cell and reproductive biologist, described his experience in an article titled, “With Genetic Testing, I Gave My Parents the Gift of Divorce” on Vox.com. He submitted a sample for testing to 23andMe, a company that will provide basic information about your genetic code if you provide a saliva sample and $199. He’d gotten kits for his parents as well, writing, “I thought it would be a cool gift.” The company has a feature that allows you to find long-lost relatives. Some clicks later, he discovered a half brother he had never known. The brother had been adopted and was searching for his birth parents. Unknowingly, George had exposed a painful family secret.
Genetic information on the Internet has also enabled the children of sperm donors to find half siblings, or even their biological fathers. “The donors wanted to be completely anonymous,” says Sheldon Krimsky of Tufts University, “but clever people have been able to identify other individuals that were born with that same sperm.” The Donor Sibling Registry, founded in 2000 by a mother and her son, who was conceived through donated sperm, exists for this very purpose. When he was 15 years old, the son managed to identify his donor father by combing through genealogy databases and other public sites.
One of the most high profile gene privacy stings occurred in 2013, when scientists from the Massachusetts Institute of Technology (MIT) set out to obtain the identities of people who had anonymously (or so they thought) donated their genomes to research projects. The scientists’ purpose was to find weaknesses in the system that would allow someone — someone with less-than-scientific motives — to penetrate the system. In the journal Science, the MIT team reported that by cross-referencing the genetic information with public databases, they were able to identify about 50 participants who thought they were hidden.
In another instance that same year, Latanya Sweeney, who is director of the Data Privacy Lab at Harvard, staged a privacy hacking on the registrants of the Personal Genome Project who were trying to shield their identities (though some do not). At the time, 579 people had provided their zip code, date of birth, and gender. Using public records, she and her students were able to identify more than 40 percent of them.
These cases and others highlight the difficulty of maintaining total anonymity. While experts want serious consideration of privacy, no one says it can be guaranteed. That said, the repercussions of privacy breakdowns, other than the feeling of intrusion, are still emerging. The Personal Genome Project consent form, all 24 pages of it, reads like a Worrier’s Guide to Worst-Case Scenarios: Someone could synthesize your DNA and plant it at a crime scene. You could find out you’re related to a notorious criminal. Your cells might be cloned.
For the time being, however, the risk of genome privacy breaches are probably overstated, compared to the likelihood of occurrence and perhaps even to the magnitude of the harm, says Michelle Meyer, assistant professor and director of bioethics policy at the Union Graduate College-Icahn School of Medicine at Mount Sinai. That’s not to minimize the dignity violation, she says. “It can affect the way people view you,” she says. Suppose it becomes public you carry genes that predispose you for diabetes. If you then have an extra cupcake at lunch, would your co-workers judge you to be irresponsible?
Given the difficulty of maintaining privacy, there are those who say that we shouldn’t even try. Speaking at a technology conference in 2015, the CEO of Google Ventures Bill Maris dismissed the issue altogether. According to a story in Bloomberg News, he said the issue was not worth worrying about, since “your genome isn’t really secret,” because we leave it all over the place in public.
In the end, privacy may come down to whatever you are comfortable with. If you don’t want anyone to know anything about your genome, then don’t get it sequenced if there isn’t a compelling reason to. But if the benefits to science, or a fascination about your genetic makeup, outweigh the risks, then sequence on.
Rodriguez, of the NHGRI, likens it to Instagram or Facebook. Some people post every thought and emotion (and meal), while others don’t sign up at all. “My tolerance to share something on social media is going to be greater than someone else’s,” she says. “There’s a similarity there in the risks that we’re taking with your genome. We all have different tolerances.”
And remember, no matter how much someone knows about your genome, it’s only one part of a complex puzzle. We are more than the sum of our base pairs. They don’t account for the influence of environment, and genes alone won’t reveal what kind of person you are, what kind of food you like, and what music you listen to.
While it is important to have discussions and find protection, for now, a genome just isn’t useful in medical decisions for the vast majority of people. But when our genomes are pooled together with health and other data, they hold the promise of allowing us to better understand disease. To a stranger interested in inspecting your old coffee cups, however, “your genome is just not that interesting,” Meyer says.
“It’s true that we leave our DNA everywhere, and if someone is dead set on sequencing you, they can,” she says. “But for the most part, nobody cares.”