FamilyTreeDNA Deputizes Itself, Starts Pitching DNA Matching Services To Law Enforcement

from the FamilyIndictmentDNA dept

One DNA-matching company has decided it's going to corner an under-served market: US law enforcement. FamilyTreeDNA -- last seen here opening up its database to the FBI without informing its users first -- is actively pitching its services to law enforcement.

The television spot, to air in San Diego first, asks anyone who has had a direct-to-consumer DNA test from another company, like 23andMe or Ancestry.com, to upload a copy so that law enforcement can spot any connections to DNA found at crime scenes.

The advertisement features Ed Smart, father of Elizabeth Smart, a Salt Lake City teen who was abducted in 2002 but later found alive. “If you are one of the millions of people who have taken a DNA test, your help can provide the missing link,” he says in the spot.

Welcome to FamilyTreeDNA's cooperating witness program -- one it profits from by selling information customers give it to law enforcement. The tug at the heartstrings is a nice touch. FamilyTreeDNA is finally being upfront with users about its intentions for their DNA samples. This is due to its founder deciding -- without consulting his customers -- that they're all as willing as he is to convert your DNA samples into public goods.

Bennett Greenspan, the firm’s founder, said he had decided he had a moral obligation to help solve old murders and rapes. Now he thinks that customers will agree and make their DNA available specifically to help out.

FamilyTreeDNA sounds like it's finally going to seek consent from its customers, but only after having abused their trust once and under the assumption they're all going to play ball. While some DNA companies like 23andMe are insisting on at least a subpoena before handing over access to DNA database search results, other companies are staying quiet about law enforcement access or specifically targeting law enforcement agencies with ads promising to help them work through their cold case files.

Consent is great, but it's never going to be complete consent, no matter how FamilyTreeDNA shapes the argument. As Elizabeth Joh points out at Slate, there's a whole lot of people involved who will never be asked for their consent once a customer agrees to allow DNA-matching sites to hand over their samples to law enforcement.

[W]hen you volunteer your DNA sample, you’re volunteering your genetic family tree, without having asked your parents, siblings, cousins, and distant cousins if they agree. That upends the usual way we think about providing information to law enforcement. You can’t give the police lawful consent to search your third cousin’s house, even if your third cousin (who you may never have met) is suspected of having been involved in a serious crime. Why are we allowing a distant relative to grant police permission to your DNA?

There's no informed consent happening here. Customers are being treated as data points law enforcement can peruse at its leisure. A customer who agrees to be a good citizen (by clicking OK on a submission box on a private company's website) may learn later their sample was used to lock up a close relative. Some people will be fine with this outcome. Others may regret being the critical piece of evidence used to incarcerate one of their relatives.

Whatever the case is, very few companies are being upfront about the effects of opening up database access to law enforcement. FamilyTreeDNA is using a crime victim's parent and the founder's Team Blue sympathies to hustle its customers towards compliance. Users who don't like this turn of events will likely find it far more difficult to remove their DNA from FamilyTreeDNA's database than simply hold their nose and become an willing part of this partnership.

Filed Under: dna, law enforcement, privacy
Companies: familytreedna

DNA-Matching Company Decides To Open Its Doors To The FBI Without Bothering To Inform Its Users

from the thanks-for-the-heads-up,-tools dept

Your DNA may seem like a personal thing, but a number of companies specializing in DNA testing are ensuring it's anything but. Whether you're looking for markers identifying health risks or simply want to see who you're related to, you're giving these companies permission to create a pool of DNA samples almost anyone else can access.

Law enforcement has taken note of these developments, creating fake accounts to submit samples from crime scenes in an effort to close out cases. Whether or not we agree with law enforcement's misrepresentation, there's very little standing in the way of the government accessing your DNA sample via a third party. The thing that makes people unique becomes little more than a third party record -- only a subpoena away from being in the government's possession.

But even subpoenas aren't necessary if DNA companies decided to partner up with law enforcement by giving agencies access to their databases. That's what's happening with Family Tree, a company specializing in in-home DNA testing kits, as Salvador Hernandez reports for BuzzFeed.

Family Tree DNA, one of the largest private genetic testing companies whose home-testing kits enable people to trace their ancestry and locate relatives, is working with the FBI and allowing agents to search its vast genealogy database in an effort to solve violent crime cases, BuzzFeed News has learned.

Federal and local law enforcement have used public genealogy databases for more than two years to solve cold cases, including the landmark capture of the suspected Golden State Killer, but the cooperation with Family Tree DNA and the FBI marks the first time a private firm has agreed to voluntarily allow law enforcement access to its database.

The company says the FBI cannot freely browse its databases, but this partnership suggests its not asking the FBI to run anything past a court before running a search. The company feels the potential PR hit is worth it because it's "helping" the FBI "solve violent crimes." This is a bit discouraging. We're used to government agencies excusing incursions into people's privacy with statements about "violent crime" or "terrorism" or "the War on…" or whatever. It's disheartening when a private company does it, thinking it's somehow serving the public better by turning their DNA samples into investigation fodder.

Here's the full extent of the program so far, at least according to Family DNA:

While Family Tree does not have a contract with the FBI, the firm has agreed to test DNA samples and upload the profiles to its database on a case-by-case basis since last fall, a company spokesperson told BuzzFeed News.

This at least spares the FBI the trouble of creating fake profiles to do the same thing. Still, there's little PR or societal value in allowing a government agency to do something it was probably doing already. We see it all the time at the federal level where law enforcement/national security abuses are greeted with codification rather than criticism. Sure, we don't expect all companies to give the government the cold shoulder, but we should at least expect them to demand a bit more from the government when it starts asking for access to millions of DNA records.

There's a way to opt out of the FBI's co-opting if you're a Family Tree customer. Unfortunately, this option makes Family Tree a complete misnomer.

Officials at Family Tree said customers could decide to opt out of any familial matching, which would prevent their profiles from being searchable by the FBI. But by doing so, customers would also be unable to use one of the key features of the service: finding possible relatives through DNA testing.

If someone objects to the FBI's access, the service is useless. And this access was put into place without customers being informed ahead of time or given an option to opt out prior to the government's access. No matter how enthused Family Tree may be about being part of the FBI's posse, this is a terrible way to treat customers who expected their personal info would be given a bit more privacy.

Filed Under: 3rd party doctrine, dna, fbi, home testing kit, privacy
Companies: family tree dna

Study Buried For Four Years Shows Crime Lab DNA Testing Is Severely Flawed

from the doing-what-works-rather-than-doing-it-right dept

DNA is supposed to be the gold standard of evidence. Supposedly so distinct it would be impossible to convict the wrong person, yet DNA evidence has been given far more credit than it's earned.

Part of the problem is that it's indecipherable to laypeople. That has allowed crime lab technicians to testify to a level of certainty that's not backed by the data. Another, much larger problem is the testing itself. It searches for DNA matches in samples covered with unrelated DNA. Contamination is all but assured. In one stunning example of DNA testing's flaws, European law enforcement spent years chasing a nonexistent serial killer whose DNA was scattered across several crime scenes before coming to the realization the DNA officers kept finding belonged to the person packaging the testing swabs used by investigators.

The reputation of DNA testing remains mostly untainted, rose-tinted by the mental imagery of white-coated techs working in spotless labs to deliver justice, surrounded by all sorts of science stuff and high-powered computers. In reality, testing methods vary greatly from crime lab to crime lab, as do the standards for declaring a match. People lose their freedom thanks to inexact science and careless handling of samples. And it happens far more frequently than anyone involved in crime lab testing would like you to believe.

An op-ed about the failures of crime lab DNA testing at the New York Times -- written by Boise State Professor of Biology Greg Hampikian -- discusses this ongoing problem using some science of his own: a recently-released NIST study. (h/t Grits for Breakfast)

Researchers from the National Institute of Standards and Technology gave the same DNA mixture to about 105 American crime laboratories and three Canadian labs and asked them to compare it with DNA from three suspects from a mock bank robbery.

The first two suspects’ DNA was part of the mixture, and most labs correctly matched their DNA to the evidence. However, 74 labs wrongly said the sample included DNA evidence from the third suspect, an “innocent person” who should have been cleared of the hypothetical felony.

This is already a problem. People's lives are literally on the line and crime lab testing is more likely to make the wrong call on evidence than the correct one. What's truly disturbing is this study was completed in 2014, but the report was apparently buried by the scientists it implicated. As Dr. Hampikian states in his op-ed, the study's results may still be unpublished if it weren't for forensic scientists publicly complaining about the burial.

Four years have passed since the study's completion and it appears no improvements have been made. The study notes testing protocols vary widely and very little effort is being made to improve error-prone procedures. In addition, the study [PDF] comes with a disclaimer meant to dissuade litigants from challenging DNA evidence by quoting the study's findings.

The results described in this article provide only a brief snapshot of DNA mixture interpretation as practiced by participating laboratories in 2005 and 2013. Any overall performance assessment is limited to participating laboratories addressing specific questions with provided data based on their knowledge at the time. Given the adversarial nature of the legal system, and the possibility that some might attempt to misuse this article in legal arguments, we wish to emphasize that variation observed in DNA mixture interpretation cannot support any broad claims about “poor performance” across all laboratories involving all DNA mixtures examined in the past.

This certainly doesn't raise the reader's confidence in crime lab DNA testing. Instead, it gives the impression the four-year delay between completion and public release was for wagon-circling purposes as crime lab forensic scientists looked for ways to mute the impact of the study's findings.

But there are also problems with the study itself. The authors of the study appear far too willing to cut crime labs slack for their failures. Rather than point out the problems originating from a lack of standardized processes, the study uses them to excuse the failures, as if unintentionally nailing the wrong person for the crime was somehow worthy of gold stars for effort. Here's Hampikian's take:

It is uncomfortable to read the study’s authors praising labs for their careful work when they get things right, but offering sophomoric excuses for them when they get things wrong. Scientists in crime labs need clear feedback to change entrenched, error-prone methods, and they should be strongly encouraged to re-examine old cases where such methods were used.

The study confirms much of what has been exposed earlier: DNA evidence may be based on hard science, but any small variable -- including the inevitable tainting of DNA samples -- has the ability to throw things off. And when it's used as evidence in criminal trials, it has the potential to destroy lives. This study shows -- at least indirectly -- the labs handling DNA evidence aren't taking it nearly as seriously as they should.

Filed Under: crime lab, dna, evidence, police, study

Cops Aren't Just Submitting DNA Samples To Genealogy Services; They're Also Obtaining Customer Info

from the buyer-beware-etc. dept

Recently, a genealogy service provided law enforcement with the information they needed to locate a murder suspect they'd been hunting for over forty years. GEDMatch admitted it was the service investigators used to find a familial match to DNA samples it had taken from crime scenes. This revelation led people to question how private their DNA data was when shared with genealogy services. The answer is, of course, not very, what with the purpose of these services being the matching of DNA info from thousands or millions of unrelated individuals.

Police created a fake account to submit the sample they had and received matches that allowed them to narrow down the list of suspects. This was combined with lots of other regular police work -- combing public records and obituaries for living relatives near the locations the crimes occurred -- to gradually hone in on Joseph James DeAngelo, who is believed to have murdered twelve people and committed at least 51 rapes.

But there was more to this than the DNA search at GEDMatch. Investigators had also used a service called FamilyTreeDNA to look for possible matches. The public database maintained by the company apparently helped investigators narrow down the list of suspects. Peter Aldhous of Buzzfeed has more details.

From DNA collected from crime scenes, [investigator Paul] Holes knew 67 genetic markers on the killer’s Y chromosome. Every three months or so, he would check in Ysearch for matches. The subpoena was made when a profile containing just 12 genetic markers — including one that’s unusual among men of Western European ancestry — matched with the killer’s sample.

This subpoena demanded customer information for the person who had submitted matching DNA. Investigators were able to obtain payment info which led them to someone researching their family tree. This led to another sample -- and another dead end. The woman's father had a sample taken by investigators but the test cleared him of suspicion.

That subpoenas can be used to pierce the minimum of privacy given to customers by companies should come as no surprise. These have been used for years to demand subscriber info from service providers in both civil and criminal cases.

That being said, people may now approach DNA services a bit more cautiously. While companies may offer some assurances about personal info being protected, the nature of the business is sharing DNA markers and allowing your personal DNA structure to be matched against submissions by complete strangers… which will also include law enforcement investigators.

Any service that requires payment and personal info will be approached by law enforcement. In most cases, a warrant won't be needed. The Third Party Doctrine lowers protections for customers, making warrants mostly unnecessary. While some companies may push back more than others when law enforcement demands info, in most cases the government will get what it's seeking.

Filed Under: dna, genealogy, golden state killer, joseph deangelo, privacy, subpoenas
Companies: familytreedna, gedmatch

Police Use Genealogy Site To Locate Murder Suspect They'd Been Hunting For More Than 30 Years

from the new-tech,-new-tools dept

DNA isn't the perfect forensic tool, but it's slightly preferable to the body of junk science prosecutors use to lock people up. It's ability to pinpoint individuals is overstated, and the possibility of contamination makes it just as easy to lock up innocent people as garbage theories like bite mark matching.

In terms of process of elimination, it's still a go-to for prosecutors. The rise of affordable DNA testing has provided a wealth of evidence to law enforcement. Investigators are no longer limited to samples they've taken from arrestees. Databases full of DNA info are within reach 24 hours a day -- and all law enforcement needs is an account and a few bucks to start tracking down DNA matches from members of the public who've never been arrested.

Investigators used DNA from crime scenes that had been stored all these years and plugged the genetic profile of the suspected assailant into an online genealogy database. One such service, GEDmatch, said in a statement on Friday that law enforcement officials had used its database to crack the case. Officers found distant relatives of Mr. DeAngelo’s and, despite his years of eluding the authorities, traced their DNA to his front door.

“We found a person that was the right age and lived in this area — and that was Mr. DeAngelo,” said Steve Grippi, the assistant chief in the Sacramento district attorney’s office.

This "search" may possibly close the books on at least ten unsolved murders featuring the same suspect DNA. The process involved, however, raises questions. But customers of companies like GEDmatch and 23andMe probably won't like the answers. Any ethical questions they may have about companies sharing DNA info with law enforcement is likely covered by the terms of service. Customers looking to the Bill of Rights may be disappointed to discover the courts have little positive to say about Fourth Amendment protections for third party records.

Adding your DNA to these databases makes this info publicly-available. If everyone's DNA was siloed off from everyone else's, genealogy services would be completely useless. It's expected your DNA info will be shared with others. If "others" includes law enforcement, the terms of service have that eventuality covered. Even if other uses of your DNA weren't specified, there's nothing illegal about law enforcement agencies creating accounts to submit DNA for matches. If there's a Constitutional challenge, the third party doctrine likely eliminates anything remaining for the court to consider once it gets past the obvious hurdle: DNA-matching services match DNA. Complete strangers are able to "access" DNA info of others without creating privacy issues.

GEDmatch's response to all of this? If you don't want your DNA to end up in the hands of law enforcement, delete your account. This isn't exactly customer-friendly, but it reflects the reality of participating in a service that offers DNA matching. Even if a company refuses to hand over info voluntarily, it probably wouldn't take more than a subpoena to knock it loose. As long as law enforcement is using the system like a customer would -- that is, simply submitting DNA for a match -- the only problems it poses are at the far end of the ethical spectrum. If it's doing anything else -- like asking companies to notify them if certain DNA samples are submitted -- then there are problems. But as long as it's not inserting itself into the supply chain, there's really no privacy invasion occurring.

Filed Under: dna, evidence, garden state killer, joseph deangelo, privacy
Companies: gedmatch

Innocent Man Charged With Murder Because His DNA Was Found On The Fingernails Of Victim, Whom He Had Never Met

from the DNA-is-formidable,-not-infallible dept

The forensic use of DNA is rightly regarded as one of the most reliable ways of establishing the identity of someone who was present at a crime scene. As technology has advanced, it is possible to use extremely small traces of genetic material to identify people. One possibility that has so far received little attention is that the DNA of someone might be transferred accidentally to a murder victim's body, say, even though the former person had absolutely nothing to do with the latter's death, and maybe had never even met him or her. The Marshall Project has a fascinating and important report on just such a case.

Back in 2012, a group of men broke into the Silicon Valley home of a 66-year-old investor, tied him up, blindfolded him, and gagged him with duct tape. The duct tape caused him to suffocate, turning a robbery into a murder. Some DNA found on the victim's fingernails matched that of a homeless man, who was well-known to local police. It seemed an open-and-shut case -- even the alleged murderer, who had memory problems, admitted he might have done it, given this apparently incontrovertible proof. Fortunately, his lawyer was diligent in checking everything about her client in the hope of at least mitigating his punishment. As she examined his medical records, she discovered the following:

The medical records showed that [the accused] Anderson was also a regular in county hospitals. Most recently, he had arrived in an ambulance to Valley Medical Center, where he was declared inebriated nearly to the point of unconsciousness. Blood alcohol tests indicated he had consumed the equivalent of 21 beers. He spent the night detoxing. The next morning he was discharged, somewhat more sober.

That night her client had been in hospital was when the murder had been committed. Further research confirmed that he could not have been on the crime scene, and also that he had never met the victim. The question then became: how had his DNA -- for there was no doubt it was his -- ended up on the fingernails of a murdered man?

The connection was found in the paramedics who had responded to the discovery of the murder victim. It turned out that earlier that day they had taken the innocent man accused of the murder to Valley Medical Center after he had collapsed drunk in a supermarket. Somehow, improbable as it might seem, they had transferred his DNA onto the murder victim, where it was later discovered by the forensic scientists.

The Marshall Project article goes into much more detail about the case and the history of using DNA to solve crimes -- it's well-worth reading. It highlights two crucial facts that need to be taken into account when DNA is used as evidence, especially for serious crimes carrying heavy penalties. One is that we all leave our DNA everywhere:

An average person may shed upward of 50 million skin cells a day. Attorney Erin Murphy, author of "Inside the Cell," a book about forensic DNA, has calculated that in two minutes the average person sheds enough skin cells to cover a football field. We also spew saliva, which is packed with DNA. If we stand still and talk for 30 seconds, our DNA may be found more than a yard away. With a forceful sneeze, it might land on a nearby wall.

To find out the prevalence of DNA in the world, a group of Dutch researchers tested 105 public items -- escalator rails, public toilet door handles, shopping basket handles, coins. Ninety-one percent bore human DNA, sometimes from half a dozen people. Even items intimate to us -- the armpits of our shirts, say -- can bear other people's DNA, they found.

The other fact is that contamination of key DNA samples by those investigating a crime is the rule, not the exception:

A 2016 study by Gill, the British forensic researcher, found DNA on three-quarters of crime scene tools he tested, including cameras, measuring tapes, and gloves. Those items can pick up DNA at one scene and move it to the next.

Once it arrives in the lab, the risk continues: One set of researchers found stray DNA in even the cleanest parts of their lab. Worried that the very case files they worked on could be a source of contamination, they tested 20. Seventy-five percent held the DNA of people who hadn't handled the file.

As the article emphasizes, DNA is indeed an incredibly powerful forensic tool, which has helped convict the guilty, as well as exonerate the innocent. But it is not infallible. The question is: how many other people have been wrongly charged, convicted and punished because of stray DNA?

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+.

Filed Under: contamination, dna, evidence, forensics
Companies: marshall project

Genome Of A Man Born In 1784 Recreated From The DNA Of His Descendants

from the I-am-your-(great-great-great-grand)-father dept

The privacy implications of collecting DNA are wide-ranging, not least because they don't relate solely to the person from whom the sample is taken. Our genome is a direct product of our parents' genetic material, so the DNA strings of siblings from the same mother and father are closely related. Even that of more distant relations has many elements in common, since they derive from common ancestors. Thus a DNA sample contains information not just about the donor, but about many others on the relevant family tree as well. A new paper published in Nature Genetics (behind a paywall, unfortunately) shows how that fact enables the genomes of long-dead ancestors to be reconstructed, using just the DNA of their descendants.

As an article in Futurism explains, the unique circumstances of the individual chosen for the reconstruction, the Icelander Hans Jonatan, aided the research team as they sought to piece together his genome nearly two centuries after his death in 1827. The scientists mainly came from the Icelandic company deCODE Genetics, one of the pioneers in the world of genomics, and highly-familiar with Iceland's unique genetic resources. The following factors were key:

For one, Jonatan was the first Icelandic inhabitant with African heritage. Iceland also boasts an extensive and highly detailed collection of genealogical records. The combination of Jonatan's unique heritage and the country's record-keeping for inhabitants' family trees made this remarkable recreation possible.

For cultural and historical reasons, Iceland has one of the most complete genealogical records of any nation. This allowed the research team to establish with high probability 788 of Jonatan's descendants. Samples were taken from 182 of those individuals and then genotyped -- a kind of DNA screening. The deCODE group picked out those genomes most likely to provide the longest DNA sequences that had been passed down through the generations from Jonatan's mother, by looking for fragments of African-pattern chromosomes amidst the otherwise European genetic material. The full genomes of 20 of those 182 were sequenced, and then the parts derived from Jonatan's African ancestry pieced together to recreate 38% of his mother's DNA. From this, the researchers were able to establish that Jonatan's mother was probably from the African region spanned by Benin, Nigeria and Cameroon.

This kind of large-scale reconstruction in the absence of physical samples has never been achieved before, and is certainly a major triumph of biological and computational technology. An important question is whether this is a one-off, made possible by the unique circumstances of Jonatan's life, or whether it could be applied more widely. According to the Futurism article:

Theoretically, a technique like this could help researchers create "virtual ancient DNA," which would allow scientists to recreate the DNA of historical figures. Agnar Helgason of deCODE stated that "Any historic figure born after 1500 who has known descendants could be reconstructed."

While it's exciting, there are still major hurdles to overcome in terms of the potential future applications. The quantity, scale, and detail of the DNA from living ancestors required to recreate a person's DNA make it impractical for use within most families. Additionally, with each new generation identifiable DNA fragments get smaller and more difficult to work with.

As DNA sequencing becomes cheaper and more accurate, it will be possible to carry out DNA profiling and collection faster and more economically. Similarly, as computational power increases, chromosome fragments can be analyzed and stitched together more easily. In due course, these kinds of genomic reconstructions will probably become more common. Already, deCODE's research confirms how DNA can establish the connections not just between present-day members of a family, but also with those long dead. When unexpected patterns of maternity or paternity are revealed, they will bring with them who knows what social consequences for their descendants.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: dna, genetics, genomes, science

China Is Building The Ultimate Surveillance Tool: A DNA Database Of Every Adult Resident In Troubled Xinjiang Region

from the purely-for-scientific-decision-making,-of-course dept

It's no secret that the two regions most affected by China's strict controls are Tibet and Xinjiang, the vast and troubled Western region where the turkic-speaking Uyghurs form the largest ethnic group. Earlier this year, we wrote about one fairly extreme surveillance technique in Xinjiang: a requirement for every vehicle there to be fitted with a tracking device. Now Human Rights Watch reports that an even more intrusive surveillance measure is being implemented for the region's 24 million inhabitants:

Chinese authorities in Xinjiang are collecting DNA samples, fingerprints, iris scans, and blood types of all residents in the region between the age of 12 and 65, Human Rights Watch said today. This campaign significantly expands authorities' collection of biodata beyond previous government efforts in the region, which only required all passport applicants in Xinjiang to supply biometrics.

For so-called "focus personnel" -- those individuals that the authorities consider a threat to political stability -- the biometrics will be taken from everyone in their family, regardless of age. Here's what all that highly-personal information from the "Population Registration Program" will be used for, according to the Chinese government:

Authorities state that the Population Registration Program is meant for "scientific decision-making" that promotes poverty alleviation, better management, and "social stability." Authorities have offered the annual Physicals for All program since 2016, characterizing it as a benefit for the relatively economically poor region. The program's stated goals are to improve the service delivery of health authorities, to screen and detect for major diseases, and to establish digital health records for all residents. Press reports about Physicals for All include testimonies from participants describing how they received treatments for previously undiagnosed illnesses, and in some cases saving their lives.

Who could possibly object to such a well-intentioned health initiative? But as Human Rights Watch emphasizes:

Coercing people to give blood samples, or taking blood samples without informed consent or justification can violate an individual's privacy, dignity, and right to bodily integrity; it can also in some circumstances constitute degrading treatment. Compelled DNA sampling of an entire region or population for purposes of security maintenance is a serious human rights violation in that it cannot be justified as necessary or proportionate.

It would be naïve to think that the authorities won't use this massive DNA database in order to increase their surveillance of the Uyghur population. DNA is the ultimate identity number. It is present in nearly every cell in the body; it is difficult to change in a non-random way unless you have lots of money and top-flight CRISPR scientists at your disposal -- unlikely in the case of Xinjiang residents; and we leave it everywhere we go, and on everything we touch. DNA also has the virtue -- for the authorities -- that it provides information about related individuals, since they all have some of their genetic code in common. That means it would be possible to determine everyone in the close family of a someone under investigation, by finding related DNA sequences. It's the kind of information that could be abused by the police in multiple ways.

As well as concerns about the human rights of Uyghurs being harmed, another issue is that Xinjiang's Population Registration Program may be used as a trial before rolling out DNA collection to the entire Chinese adult population, just as is happening with a national facial recognition database. Although such a large-scale genetic database would have been infeasible a few years ago, advances in sequencing and dramatic falls in data storage and processing costs mean that it could probably be built now. And if China goes down this route, the fear has to be other countries will follow, just as they are doing in the realm of online surveillance.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: china, dna, dna database, privacy, surveillance, xinjiang

The Ultimate Virus: How Malware Encoded In Synthesized DNA Can Compromise A Computer System

from the digital-code-is-digital-code dept

DNA is a digital code, written not as 0s and 1s (binary) but in the chemical letters A, C, G and T -- a quaternary system. Nature's digital code runs inside the machinery of the cell, which outputs the proteins that are the building blocks of living organisms. The parallels between DNA and computer code are one reason why we speak of computer viruses, since both are sequences of instructions that subvert the hardware meant to run other, more benign programs. Wired reports on new work which brings out those parallels in a rather dramatic fashion:

a group of researchers from the University of Washington has shown for the first time that it's possible to encode malicious software into physical strands of DNA, so that when a gene sequencer analyzes it the resulting data becomes a program that corrupts gene-sequencing software and takes control of the underlying computer.

A certain amount of cheating was involved in order to obtain this undeniably impressive outcome. For example, the researchers took an open source compression utility, and then intentionally added a buffer overflow bug to it. They crafted a specific set of DNA letters such that when it was synthesized, sequenced and processed in the normal way -- which included compressing the raw digital readout -- it exploited the buffer overflow flaw in the compression program. That, in its turn, allowed the researchers to run arbitrary code on the computer system that was being used for the analysis. In other words, the malware encoded in the synthesized DNA had given them control of a physical system.

While they may have added the buffer overflow exploit to the compression program themselves, the researchers pointed out they found three similar flaws in other commonly-used DNA sequencing and analysis software, so their approach is not completely unrealistic. However, even setting up the system to fail in this way, the researchers encountered considerable practical problems. These included a requirement to keep the DNA malware short, maintaining a certain ratio of Gs and Cs to As and Ts for reasons of DNA stability, and avoiding repeated elements, which caused the DNA strand to fold back on itself.

Clearly, then, this is more a proof of concept than a serious security threat. Indeed, the researchers themselves write in their paper (pdf):

Our key finding is that it is possible to encode a computer exploit into synthesized DNA strands.

However, in the longer term, as DNA sequencing becomes routine and widespread, there will be greater scope for novel attacks based on the approach:

If hackers did pull off the trick, the researchers say they could potentially gain access to valuable intellectual property, or possibly taint genetic analysis like criminal DNA testing. Companies could even potentially place malicious code in the DNA of genetically modified products, as a way to protect trade secrets, the researchers suggest.

If nothing else, this first DNA malware hack confirms that there is no unbridgeable gulf between the programs running in our cells, and those running on our computers. Digital code is digital code.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: computers, dna, malware

Kuwait Backtracks On Mandatory DNA Database Of All Citizens And Visitors

from the this-is-why-it's-always-worth-protesting dept

A few weeks ago, we reported on a move by some public-spirited lawyers in Kuwait to challenge an extraordinary new law that would require everyone in the country -- citizens and visitors like -- to provide their DNA for a huge new database. It seemed like a quixotic move, since the Kuwaiti authorities were unlikely to be intimidated by a bunch of lawyers. And yet Kuwait has indeed backed down, as reported by New Scientist:

Kuwait plans to scale down, and may ultimately revoke, a law forcing all its citizens and visitors to provide samples of their DNA.

As well as the legal moves, a request from the country's ruler, the Emir of Kuwait, that the law should be revised in a way that would "safeguard people's privacy" seems to have led to a massive scaling-back of the plans:

The Kuwait parliament has now agreed to change the law so that only suspected criminals will need to give their DNA.

Although taking DNA from "suspected" -- not convicted -- criminals is still problematic, overall, this is welcome news, especially for visitors to the country, who presumably won't now have their DNA sampled. It's also a reminder that public outcry, especially on a global scale, can occasionally succeed in getting really bad laws revoked, which is why it is always worth trying.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: databases, dna, kuwait, privacy, surveillance, tourists