Richard III: We Have A Hunch His DNA Tests Could Affect Us All

DNA evidence just confirmed that a skeleton found under a car park in Leicester is Richard III. That’s exciting historical news, but should this be a concern for living people, perhaps not so regal as the king?

It’s exciting to see these old bones identified positively as someone as historically interesting as the much-hated hunchbacked king of England. But DNA technology could also be used, potentially to track and identify you – perhaps from a DNA sequence posted online.

Andy Green of governance software provider Varonis, has this to say on the subject:

Should we worry about online DNA data?

Biometric data is at the limits of what current personal data privacy laws consider worthy of protection. This type of identifier covers fingerprints, voiceprints, and facial images. While the risk factors are not nearly as threatening to consumers as more traditional personally identifiable information (PII), they do exist.

Until recently, the dangers of biometric identification using DNA were more theoretical than real. That has suddenly changed. A recent article in The New York Times put a spotlight on research that proved the feasibility of identifying a person – getting a specific name and address – all from a DNA sequence posted online.

It’s not that regulators have overlooked biometric identifiers. There is quite a lot of work going on – primarily in the US.

Under the safe harbour rules of the US Health Insurance Portability and Accountability Act (HIPAA),  (HIPAA) for example, the US Department of Health and Human Services has a list of 18 e-PHIs (pieces of protected health information)  that would need to be removed from public medical data for it to be effectively considered de-identified. Along with IP addresses, URLs, email addresses, HHS mentions biometric data, with voiceprints and fingerprints given as the only examples.

Varonis has already written about how the Federal Trade Commission, another key US agency involved in data privacy regulation, has issued new guidelines to companies collecting facial images. Driving the FTC’s suggestions — mostly directed at retailers — are the recent improvements in image recognition technology and the availability of massive amounts of tagged photos on social media sites. Image matching software is now good enough so that a face captured by a store’s mall kiosk can eventually reveal ethnicity, mood, and with good likelihood, an actual name behind the face.

The risk of linking a name to a set of fingerprints is less serious for the general public– unless you have a criminal record. However, after the US Graduate Management Admission Council (or GMAC) began using fingerprints to establish the identity of students taking their “GMATs” for admission to business schools, the testing company realized there could be privacy issues.

GMAC ultimately decided to use palm scans, which are based on digitising vein patterns. Since public databases of hand veins don’t exist, there is currently little possibility of identification.

DNA is like palm scans – or is it?

I would  put DNA into the same category as palm scans: there’s advanced matching technology–available even at the consumer level—but without a public database, there isn’t much of a privacy issue, and therefore DNA is not really a PII.

However, this is not true anymore, and that was the starting point for the researchers mentioned in the Times article. DNA data is actually available online, in two public genealogy databases for tracking down one’s ancestry, Ysearch and SMGF, with a combined 135,000 records of DNA data and covering about 39,000 unique last names.

These genealogy databases simply accept a key—actually a pattern on the Y-chromosome—and then return a surname (along with a confidence level). The idea behind these services is to help subscribers find their ancestors and learn more about family backgrounds.

What will online genealogy sites say?

The New York Times researchers then examined whether they could narrow down their search. They assumed that they had the state of residency of the subject along with a birthdate–both of these, by the way, are not considered PII under current HIPAA rules. With these three data points and public US Census data, they were able to prove that successful DNA matches would lead to just 12 people on average. That’s a stunning end result from starting with just a DNA pattern.

How good is the DNA ‘keyword’ match at finding a last name? The researchers projected a success rate of 12 percent for males—since it’s based on the Y chromosome–with a 5 percent false positive. This is not nearly as accurate as facial scans, but still a cause for concern. They concluded that the risk of this DNA-based last name search will grow in the future, and there are other scientists and experts who are calling for more public discussion.

I decided to check the privacy policy of one of the DNA testing services, and here’s the good news. They’ll only release your DNA data to third parties with your consent; they treat genetic data as personal data (like name and address), and they say that the genetic data is stored on ‘secure servers’. However, thinking purely in term of bytes, folders, and access rights, I’m wondering how truly secure those DNA files are, and whether there are already hackers looking to get that data using the same techniques and exploits they use to snatch credit card numbers.

How good are you at guarding your privacy? Try our quiz!