A new study reveals built-in loopholes in information security in genetic and biometric databases
When Jane, a resident of the state of Utah in the USA, reached the age of 60, she decided to purchase life insurance for her and her husband, to ensure the future of their children. Jane, a perfectly healthy woman, contacted an insurance company, filled out a registration form, and to her surprise received a message a few days later that the company refused to insure her. In contacting other companies, she received similar answers. She was sorry, she tried to find out what the meaning of the refusal to insure her life was, until one of the clerks revealed the secret to her. "We have genetic information about you. There is a high probability that you will get breast cancer soon, so it is not profitable for us to insure your life." The shocked Jane did not understand where the insurance companies obtained personal genetic information, then remembered that 20 years ago she agreed to give a DNA sample for medical research. She turned to the hospital that did the research, but there they rejected her outright, and assured that all their genetic databases are secure and carefully kept, according to all the rules of medical confidentiality. Although this story is fictional, it is far from fictional. A new study published today in the journal Science illustrates that the protection of the information in the research genetic databases is not completely effective, and has built-in loopholes, which allow the personal details of the donors to be traced through visible information, even though their identities are kept completely confidential.
Confidential information, public information
To uncover the loopholes, the researchers from the Whitehead Institute of Genetics at the Massachusetts Institute of Technology (MIT) used research genetic databases whose data are available to the entire scientific community, of course without the identifying information of the donors. It is important to note that such databases are essential tools in medical research, and with their help scientists are constantly discovering new methods for diagnosing diseases and developing new treatments. Only in recent years, Dr. Yaniv Ehrlich's research team at the Whitehead Institute discovered two genes of great medical importance, through the use of such databases.
To identify donors whose details are confidential, the researchers focused on locating genes present on the Y chromosome - a chromosome that only men have. Brief explanation: all of our genetic material, the DNA, is located in the cell nucleus in 46 structures called chromosomes. In fact, these are two identical copies of 22 chromosomes (44 in total), and two more sex chromosomes - XX in a woman and XY in a man. It is therefore relatively easy to trace genes found on the Y chromosome - these traits are always passed from fathers to their sons. This feature is widely used in genealogical databases (researching genealogy), but Ehrlich and his colleagues harnessed it for the genetic detective operation. There are quite a few genealogical databases with DNA sequences on the Internet, and since the last name is a trait that is usually passed down with the Y chromosome, from father to son, the researchers could search these databases for genes they found in the medical research databases, and match them to surnames. A good genetic match led the researchers to a list of surnames. A little more data cross-checking with the details that are allowed to be published in the medical database (such as the age of the donor and the country of residence in the USA) and with sources of information visible on the Internet, etc. The researchers have a list of names and addresses of DNA donors for a genetic database. In an article in Science, Ehrlich and his colleagues present the details of the method that allowed them to identify several such donors, from the state of Utah. As mentioned, our Jane is a fictional character - but the story - is completely possible.
Not just medical information
"We are not saying that we should stop genetic research, or stop allowing free access to genetic databases," says Dr. Ehrlich. "We do try to say that there is a problem here, and we need to think of ways to prevent misuse of the genetic information." However, the danger does not only concern medical databases. The authorities in Israel are working on establishing a biometric database - a computerized database that will contain identifying information on all citizens of the country, including means of identification such as fingerprints. Many experts and organizations oppose the establishment of the database for reasons of principle, and there are also many professionals who warn against the manner of its establishment, fearing that the sensitive data will not be sufficiently secured. In a country where a lot of information including personal details of citizens has been stolen from the Ministry of Interior and leaked to the Internet, these concerns are not far from reality. A leak of medical-genetic information could be dangerous for citizens, especially in the aspect of harming medical confidentiality and privacy. Theft of biometric information such as fingerprints could allow identity theft, which would be an opening for financial fraud and of course there is also a security risk. "There is a danger in biometric databases that the information from them can go to all kinds of places," Ehrlich warns. "In every biometric database one must think carefully about the risks inherent in it compared to the benefits".
Link to the article in Science
One response
What a poor person who has to maintain a genetic pool. He must be very happy to be broken into every now and then, because otherwise he would be very bored.