LOS ANGELES — Scouring information available to anyone with an Internet connection, a team of genetic sleuths deduced the names of dozens of supposedly anonymous people who had their DNA analyzed for scientific and medical research.
The snooping feat, which took advantage of genealogy websites that let people compare their DNA to search for relatives, was in full compliance with federal privacy regulations. Experts said it underscored a stark reality about genetic privacy in the age of social media: Don’t count on it.
“Nobody can promise privacy,” said Mildred Cho, of Stanford University’s Center for Integration of Research on Genetics and Ethics, who wasn’t involved with the study.
Whitehead Institute geneticist Yaniv Erlich and his team, who described their work Thursday in the journal Science, didn’t provide a complete recipe that would help others ferret out the identities of research volunteers. Nor did they divulge the names of the people they were able to unmask.
Since the first draft of the human genome was published in 2000, scientists have scrutinized its 3 billion pairs of DNA letters to try to find variants that cause disease, to understand human physiology, and to unravel the evolutionary history of our species.
Toward that end, academic efforts like the 1000 Genomes Project post complete genomes online for public use. The idea is that providing free access to the data will allow scientists to compare DNA from many people and help them discover connections between genes and traits, eventually leading to the development of personalized, targeted treatments for a wide range of disorders.
Keeping genomic data private has been a concern all along. Worries that health insurers or employers might use information about genetic health risks to drop benefits or discriminate against workers inspired the 2008 Genetic Information Nondiscrimination Act, which provides protection against abuse. Last year, the Presidential Commission for the Study of Bioethical Issues recommended a variety of additional measures to further secure genetic data.
Potentially complicating these efforts are the legions of amateur geneticists who want to learn their risk for diseases or gain clues about their ancestry. As sequencing costs have dropped, these enthusiasts have sent DNA samples to private sequencing companies. Often, they post their test results online.
Erlich has been interested in privacy since he worked as a professional hacker — breaking into corporate networks as a “vulnerability researcher” for a computer security company — to help support himself in college. He started planning the current research after hearing about a 15-year-old who had part of his genome sequenced in 2005 in order to find his biological father, a sperm donor.
To Laura Lyman Rodriguez, a policy specialist at the National Human Genome Research Institute in Bethesda, Md., the bottom line is that research subjects should be told that their genomic data could be breached. “It’s important to be clear,” said Lyman Rodriguez, who co-wrote a commentary that accompanied the report in Science.