Cops Now Using Warrants To Gain Access To DNA Services' Entire Databases

from the one-affidavit-to-rule-them-all dept

Cops have discovered a new source of useful third-party records: DNA databases. Millions of people have voluntarily handed over personal information to a number of services in exchange for info on medical markers or distant family members.

Investigators are submitting DNA samples from cold cases in hopes of tracking down criminals who've managed to evade them for years. It has led to the closing of some cases, which is all agencies need to argue for continued access to DNA samples from millions of users.

Some DNA services are more protective of their customers' privacy than others. Of course, privacy protections in this context generate quite a bit of friction. For DNA databases to be useful, users must allow others to access their DNA info and expect others to do the same thing. Identifying info can be withheld, and definitely should be if users aren't interested in rebuilding a family tree. One company, however, has decided it's an unofficial arm of the law enforcement community and has involuntarily deputized its users.

When cops submit DNA seeking matches, they don't always identify themselves as law enforcement officers. Faux accounts are being used to gather matches with DNA services (and their users) unaware of the government's intrusion. Once investigators have gathered some promising hits, they reveal themselves to issue subpoenas demanding identifying info on the search results.

Things are getting even more troubling in this new Constitutional gray area. Kashmir Hill and Heather Murphy of the New York Times report law enforcement is now using warrants to force DNA services to open up their entire databases for investigators to dig through.

For police officers around the country, the genetic profiles that 20 million people have uploaded to consumer DNA sites represent a tantalizing resource that could be used to solve cases both new and cold. But for years, the vast majority of the data have been off limits to investigators. The two largest sites, Ancestry.com and 23andMe, have long pledged to keep their users’ genetic information private, and a smaller one, GEDmatch, severely restricted police access to its records this year.

Last week, however, a Florida detective announced at a police convention that he had obtained a warrant to penetrate GEDmatch and search its full database of nearly one million users.

Warrants are supposed to be targeted -- seeking evidence from a location or a person clearly defined in the warrant application. When a warrant is used to allow full access to the personal info of one million users, there's clearly no targeting. Investigators may have probable cause to believe they'll find evidence of a crime by searching an entire DNA database, but all the probable cause in the world doesn't allow officers to search a million people until they find the evidence they're looking for. That's what's happening here.

The abuses of warrant power will only get bigger. GEDmatch is small. 23andMe has 10 million users. Ancestry.com has 15 million users. They'll be the next targets of questionable warrants if they haven't already been hit with some.

In response to backlash following the first reports of officers anonymously submitting samples to obtain a list of suspects, DNA/genealogy companies tightened up their rules. Subpoenas now only net personal info of people who've opted into sharing their data with law enforcement. According to this report, only 185,000 of GEDmatch's 1.3 million have made that choice. That didn't sit well with this investigator, who decided he could talk a court into forcing the company to give him what he wanted.

In July, he asked a judge in the Ninth Judicial Circuit Court of Florida to approve a warrant that would let him override the privacy settings of GEDmatch’s users and search the site’s full database of 1.2 million users. After Judge Patricia Strowbridge agreed, Detective [Michael] Fields said in an interview, the site complied within 24 hours. He said that some leads had emerged, but that he had yet to make an arrest. He declined to share the warrant or say how it was worded.

There's a real danger here. If there's no pushback from companies and their users, law enforcement officers will be seeking the same access, effectively turning private DNA databases into law enforcement databases. On the flip side, if this does become the new normal for law enforcement, it runs the risk of burning its own source, so to speak.

Genetic genealogy experts said that until now, the law enforcement community had been deliberately cautious about approaching the consumer sites with court orders: If users get spooked and abandon the sites, they will become much less useful to investigators. Barbara Rae-Venter, a genetic genealogist who works with law enforcement, described the situation as “Don’t rock the boat.”

The boat is already rocking. Detective Fields has shown officers the way to get what they want when private companies decide they're not just going to be field offices for government agencies. Multiple officers and detectives asked for a copy of his warrant following his talk, which means Fields' Fourth Amendment experiment is going to become boilerplate. Customers and users who thought their personal info was shielded from law enforcement probing are now finding out these protections can be undermined by a warrant targeting anyone that matches a certain DNA profile.

Filed Under: 4th amendment, database search, dna, dna databases, police, unsolved crimes, warrant
Companies: 23andme, ancestry.com, gedmatch

DailyDirt: Sleeping In Your Genes

from the urls-we-dig-up dept

Getting enough sleep has different meaning for different people, even though most people need about 7-9 hours a night. The CDC only started looking at how much sleep Americans have been getting since 2009, but the trend seems to be less and less, unfortunately. An estimated 50-70 million Americans have chronic sleep or wakefulness disorders, so figuring out sleep and its genetic components could benefit a lot of people.

• How a person reacts to sleep deprivation has a genetic component, and researchers are zeroing in on the genes that might allow some people to function normally with far less sleep than the rest of us. Sleep deprivation correlates with all kinds of unhealthy problems, and if you can't get more hours in a day, it might be useful to know how much sleep is optimal before anyone tries crazy polyphasic sleep experiments. [url]
• Russian researchers proposed four types of people -- not just "morning people" or "night owls" but also people who are energetic in both the morning and at night and unlucky people who are just lethargic all day. These chronotypes are based on observing test subjects, not genetic studies -- but it probably won't be long before someone points out the genetic cause. [url]
• A study based on 23andMe's genetic database (and a survey asking DNA donors: "Are you a morning person?") suggest that "morning people" could be hardwired in their DNA to prefer waking up early. This data analysis could possibly lead to pharmaceuticals for sleep disorders or just a better understanding of our circadian rhythms. [url]

After you've finished checking out those links, take a look at our Daily Deals for cool gadgets and other awesome stuff.

Filed Under: chronotypes, circadian rhythms, genetics, health, morning people, night owls, polyphasic sleep, sleep, sleep deprivation
Companies: 23andme

Familial DNA Searches May Make You Think Twice About Signing Up With Private Genetic Services

from the running-in-family dept

Using DNA found at the scene of a crime to identify the guilty party is pretty routine these days, but, as Mike discussed many years ago, police have been getting more aggressive in going much further: carrying out "familial" DNA searches on privately-held genetic databases. That link is to a recent Wired article that concerns the case of Michael Usry, who became a suspect in a 1966 1996 murder case because of his father's DNA:

Detectives had focused on Usry after running a familial DNA search, a technique that allows investigators to identify suspects who don’t have DNA in a law enforcement database but whose close relatives have had their genetic profiles cataloged. In Usry's case the crime scene DNA bore numerous similarities to that of Usry’s father, who years earlier had donated a DNA sample to a genealogy project through his Mormon church in Mississippi. That project’s database was later purchased by Ancestry, which made it publicly searchable -- a decision that didn’t take into account the possibility that cops might someday use it to hunt for genetic leads.

Using general similarities as the yardstick rather than more exact matches means that false positives are more likely -- as in this case, when Usry's own DNA proved he had nothing to do with the murder. Those similarities were only found because his father's DNA was in a privately-held genetic database that the police could access. That's unusual, but becoming more common as services like Ancestry.com and 23andMe gather many more DNA samples.

According to an article on Fusion.net, Ancestry now has over 800,000 samples, while 23andMe has a million customers (Ancestry says that a more up-to-date figure is 1.2 million members in its database). Those are significant holdings, and it's only natural that the police would try to use them to solve crimes; both companies confirm that they will turn over information from their databases to law enforcement agencies if served with a suitable court order. A more recent post on Fusion.net notes that 23andMe has produced its first transparency report (direct link, but Techdirt readers outside the US may have to use the Google cache version for reasons that are not clear.) The report shows that a total of four requests were received from the US authorities, concerning five 23andMe customers, and indicates that the company was successful in denying those requests, without giving details.

Although understandable, this kind of access is problematic for people who sign up for these services, for reasons made clear by the Usry case. The DNA that goes into the database affects not only the donor, if a rough match to crime materials is found by the police, but many close relatives whose genetic make-up is necessarily similar. As a result, it's entirely possible that completely innocent people might have to go through the traumatic experience of being a suspect just as Usry did before more precise tests ruled him out.

That's unfortunate, because it adds a complicating factor to the decision about whether to provide DNA to interesting and innovative services like Ancestry.com and 23andMe: doing so means future generations might be put at risk of erroneous police interest. The only way to prove their innocence would be to hand over their DNA to the authorities for detailed testing, which then raises the question of what happens to it afterwards.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: dna, government, law enforcement, surveillance, transparency
Companies: 23andme, ancestry.com

DailyDirt: Super-Human Abilities, Not Just For X-Men

from the urls-we-dig-up dept

Human genetic studies are pointing to more and more interesting information about how our bodies work and develop and ultimately fail. Optimists point to using this knowledge for the improvement of the human condition, but there are some obvious counter-arguments to this viewpoint. So far, though, the technology for genetic therapies or designer babies hasn't been anywhere near perfected, giving us some time to reflect on the possibilities and pitfalls. Unfortunately, our inherent biases in what we're looking at in our genome might prove to be our own undoing.

• Naturally-occurring genetic mutations happen all the time, and some of them could lead to treatments for serious diseases... or better than average abilities. Timothy Dreyer has an unusually high bone density mutation that could help treat osteoporosis, and there are other mutants that could be added to a registered database of mutants (without the help of Professor X). [url]
• Breast size genetics is being studied... to determine if there are any correlations to the incidence of breast cancer. Apparently, at least seven genetic factors are associated with breast size, and three of those are linked to breast cancer. [url]
• People with a condition called aphakia can see in the ultraviolet region of light -- normally invisible to most humans. Most people can distinguish about a million different colors, but others can perceive orders of magnitude more. Certainly, there are limits to human vision, but it's still amazing to think that people can see galaxies millions of light-years away on a clear night with the naked eye. [url]

After you've finished checking out those links, take a look at our Daily Deals for cool gadgets and other awesome stuff.

Filed Under: aphakia, breast cancer, cancer, dna, gattaca, gene therapy, genetics, health, medicine, mutants, timothy dreyer
Companies: 23andme

Why The FDA Ban On Providing Health Reports Based On Personal Genomes Won't Work

from the because-DNA-is-digital-data dept

When the first human genome was sequenced -- that is, when most of the 3 billion base-pairs that go to make up our DNA were elucidated -- as part of the Human Genome Project, around $3 billion was spent. Today, the cost of sequencing is falling even faster than Moore's Law, which means everyone could have their genome sequenced soon, if they wished (and maybe even if they don't....). By analyzing the DNA, and looking at the gene variants found there, it is possible to spot predispositions to certain diseases or medical conditions, potentially allowing lifestyle changes or treatment that reduce the risk. The well-known personal genomics company 23andMe was offering this kind of service, at least on a small scale. But that stopped at the end of last year, as the company explains:

We no longer offer our health-related genetic reports to new customers to comply with the U.S. Food and Drug Administration's directive to discontinue new consumer access during our regulatory review process.

At this time, we do not know the timeline as to which health reports might be available in the future or when they might be available.

According to an article in MIT Technology Review, here's what had happened:

in November 2013, the Food and Drug Administration had cracked down on 23andMe. The direct-to-consumer gene testing company's popular DNA health reports and slick TV ads were illegal, it said, since they'd never been cleared by the agency.

But as that same article goes on to explain in detail, users of 23andMe are having no difficulty in getting around that ban on obtaining health-related analyses of their genomes, using third-party sites like Promethease:

Promethease was created by a tiny, two-man company run as a side project by Greg Lennon, a geneticist based in Maryland, and Mike Cariaso, a computer programmer. It works by comparing a person's DNA data with entries in SNPedia, a sprawling public wiki on human genetics that the pair created eight years ago and run with the help of a few dozen volunteer editors. Lennon says Promethease is being used to build as many as 500 gene reports a day.

That kind of analysis is possible because, once sequenced, DNA is essentially just digital data: very easy to upload and compare against biomedical databases storing information as digital files. Even though they are not currently allowed to analyze it, companies like 23andMe still provide customers with access to the raw genomic data, which can then be sent to services like Promethease for a basic report drawing on its DNA database.

This raises an interesting question: given that the information on SNPedia is drawn from public databases, can the FDA stop people using it to circumvent the ban on 23andMe? According to MIT Technology Review, the FDA believes the answers is "yes", but that just won't work in practice. Even if the FDA manages to shut down all the services like Promethease, it would be easy to write a program that searches the main public biomedical databases for exactly the same kind of information about particular gene variants found in somebody's genome. The software could be shared freely as open source, making it impossible to prevent people from obtaining the program and carrying out such searches independently on their own computers.

It's true that there are good reasons why the FDA might be concerned about members of the public being given medical analyses of their genome in inappropriate ways. For a start, the results are generally probabilistic, rather than definite predictions; that makes them hard for non-experts to interpret. And when it isn't about probabilities -- if it is certain that you will develop a disease, possibly a devastating one -- there's a strong argument that counselling needs to be made available when that information is given to the person affected.

Still, regardless of the extent to which the FDA's actions are understandable, trying to stop people comparing their DNA with publicly-available information is futile. As the copyright industry has learned the hard way, once data is digital, it is essentially uncontrollable. The best thing to do is to accept that fact and move on. In this case, that means the FDA should encourage companies offering analysis to do a good job, not block them completely.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: databases, dna, fda, information, innovation, public health
Companies: 23andme

FDA Drives Medical Innovation Overseas As 23andme Looks Elsewhere To Help People

from the fda-failures dept

Last fall, we noted that the FDA had come down hard on 23andme for offering its inexpensive and easy to use genetic testing without first getting detailed FDA approval. As we noted at the time, this seemed to be a typical FDA overreaction. People aren't using 23andme as the final word on something, but rather as a useful indicator to explore more deeply with medical professionals if they needed to be aware of something, change lifestyles, etc. Furthermore, we noted how stopping 23andme and similar offerings would only delay important innovations that the medical world really needs today.

And, now it appears that all the FDA has really succeeded in doing is driving that innovation overseas, as 23andme focuses on expanding in various countries abroad, rather than the US.

While it awaits the agency's approval, a process that could take years, 23andMe aims to offer partial or full genetic-testing services in one or more countries outside of the United States by the end of the year, with likely contenders including Canada, Australia and the United Kingdom, the source said.

A big part of the problem is that the FDA is simply not designed to actually deal with innovative healthcare products. It was built to handle one thing and one thing only: approving pharmaceuticals. And it has a very hammer-and-nail approach to everything it does. Nearly a decade ago, we wrote about Andy Kessler's book The End of Medicine. While that book is now a little outdated, one thing that was quite clear in that book is how ill-prepared (and ill-interested in ever becoming prepared) the FDA is for technological innovations in the healthcare space. The FDA understands clinical testing for drugs, and has trouble understanding anything that doesn't fit into that paradigm.

Providing more useful information to people about their own genes and makeup is a very useful tool. Yes, there can be false positives, but is it better to keep people totally ignorant, or to better inform them across the board? Sure, perhaps it makes sense to do thorough testing of drugs to make sure they're safe (though, even with that there are plenty of compelling arguments for why the FDA does that wrong too), but when it comes to a service that is about providing more information to people, allowing them to be better informed and do more research to be healthier, you'd hope that the FDA would learn how to enable more innovation, rather than shutting it down... and sending the innovation overseas.

Filed Under: fda, genetics, information, overseas, personal genetics, regulations
Companies: 23andme

FDA Orders 23andMe Off The Market; Apparently Concerned That People Are Too Stupid To Understand Their Own DNA

from the regulatory-overreach? dept

Soon after 23andme launched, there had been regulatory questions about whether it can market its simple DNA test without first getting regulatory approval. There hadn't been much news on that for a few years, so I had been under the assumption that the company had worked through all the regulatory hurdles. However, according to the FDA, the company has actually failed to meet the regulatory hurdles to make the product legal, and they're demanding that the company stop offering its product immediately, and fix problems within 15 working days, or face "regulatory action."

The FDA seems mainly worried that 23andMe's offering may overstate what it can do, and fail to inform people properly of the possibilities of false positives, which could create significant problems:

Some of the uses for which PGS is intended are particularly concerning, such as assessments for BRCA-related genetic risk and drug responses (e.g., warfarin sensitivity, clopidogrel response, and 5-fluorouracil toxicity) because of the potential health consequences that could result from false positive or false negative assessments for high-risk indications such as these. For instance, if the BRCA-related risk assessment for breast or ovarian cancer reports a false positive, it could lead a patient to undergo prophylactic surgery, chemoprevention, intensive screening, or other morbidity-inducing actions, while a false negative could result in a failure to recognize an actual risk that may exist. Assessments for drug responses carry the risks that patients relying on such tests may begin to self-manage their treatments through dose changes or even abandon certain therapies depending on the outcome of the assessment. For example, false genotype results for your warfarin drug response test could have significant unreasonable risk of illness, injury, or death to the patient due to thrombosis or bleeding events that occur from treatment with a drug at a dose that does not provide the appropriately calibrated anticoagulant effect. These risks are typically mitigated by International Normalized Ratio (INR) management under a physician’s care. The risk of serious injury or death is known to be high when patients are either non-compliant or not properly dosed; combined with the risk that a direct-to-consumer test result may be used by a patient to self-manage, serious concerns are raised if test results are not adequately understood by patients or if incorrect test results are reported.

The FDA further notes that it's been talking to the company for quite some time about this, including: "more than 14 face-to-face and teleconference meetings, hundreds of email exchanges, and dozens of written communications" during which it claims to have given the company very specific information and suggestions for how to meet the necessary regulatory hurdles. I certainly recognize the value of the FDA making sure that companies aren't out there promoting quack medicine, which could create very real harms. But there is also something in all of this that suggests a compliance-by-the-numbers approach of trying to fit a square peg into a round hole by the FDA in trying to classify 23andMe as something that it's not. Most people I've known who use 23andMe don't use it as the final word on something, but rather as a simple and cheap way of figuring out where they might want to investigate for a more thorough analysis.

It will be interesting to see how the company responds to the FDA, as this has all the hallmarks of a company doing something unique, new and valuable, where the regulatory systems are simply unable to process. It's entirely possible that there is, in fact, problems with how 23andMe markets its products, but we'll reserve judgment until more details are available. From a basic informational standpoint, however, we have trouble believing that providing individuals with more information about their own genes should be heavily regulated. A more informed populace is a good thing and should be supported. The idea that people are too stupid to understand what information 23andMe provides seems insulting to the public, and it further perpetuates the myth that the public can't be responsible for understanding health and medical issues. Keeping the public less informed and more reliant on traditional (read: insanely expensive) healthcare options seems like the wrong choice. The FDA, if anything, should be encouraging more efforts to better educate the public.

Update: A petition has already been set up, by TechFreedom, asking the FDA not to ban home genomics kits and to reconsider:

We haven’t all used 23andMe yet, but those of us who have know the real problem is that doctors themselves are behind the curve. When 23andMe sent us our results, we followed their advice: we asked our doctor to talk about them. Most doctors didn’t know where to begin. But the more of us ask, the more the medical profession is catching up: brushing up on genomics, taking the time to understand the site, and talking to us about our results and what, if anything, to do about them. By prompting such dialogue, 23andMe has sparked a revolution in how the medical profession uses genetic information.

We urge you not to short-circuit this revolution. Please trust us — and our doctors — to make responsible use of our own genetic information. Instead of banning new technologies, the FDA should focus on educating doctors and patients about the benefits, and limitations, of genetic testing.

Filed Under: fda, genetic testing, genomics, regulations
Companies: 23andme

Why Do You Need A Doctor's Note To Get A Genetic Test?

from the makes-no-sense dept

There have been a bunch of personal genetic testing services popping up over the past couple of years. One of the most well known is 23andMe, who got a PR lift for being founded by Sergey Brin's wife -- and also getting an investment from Google. Typically, the program lets people send in a cheek swab and receive back personal genetic info. These services are still in their early stages, but the few folks I know who have used 23andMe have found it to be an interesting learning process. However, now it's coming out that 23andMe and other personal genetic testing services may actually be breaking California law. California has sent a bunch of these firms cease-and-desist letters demanding they close up shop until certain conditions are met.

Apparently any labs doing the tests need to get both state and federal certification and can only do tests based on a physician's recommendation. The state claims it sent the letters after receiving "multiple consumer complaints about the accuracy and costs of genetic testing advertised on the Internet." This seems quite questionable for a variety of reasons. First, if people have "complaints" about the costs... then the proper response is to simply not buy the test. I have complaints about the price of Ferraris, but I'm not going to complain to the state of California -- and I doubt that the state would send cease and desist letters to Ferrari dealers.

Secondly, it seems quite ridiculous to say that these sorts of tests can only be taken with permission from a physician. There seems no reason not to let those who are willing to pay the associated fees to get a personal genetic test without involving a physician at all. As we move more and more towards more personalized medicine, this problem is only going to come up more and more. Not all medical tests and treatments need to be done under a doctor's care -- and requiring it in all cases seems more like a way to protect physicians' fees rather than citizens' health.

Filed Under: california, cease-and-desist, genetic tests
Companies: 23andme