Hacker News Reader

Comment by swixmix | Hacker News Reader

How can my DNA be anonymized? It's a unique identifier to me and leaks traceable information about my family.

Great question! I am working on a method to anonymize DNA, applying cryptography at the molecular level [0].

Regarding the statement in the article about anonymization, you are correct. These data are not anonymized, your name is just removed from the file. This does not truly anonymize the data, for reasons you outlined.

Interesting quote from Linda Avey, the co-founder of 23andMe: “It’s a fallacy to think that genomic data can be fully anonymized”[1]. I disagree, and think that eventually we will be able to anonymize your genome in a test-tube, so that the data is secure before it ever touches a computer.

0: https://geneinfosec.com 1: https://undark.org/article/dna-ancestry-sharing-privacy-23an...

Because it impractical to tie the information found in the DNA back to you as an individual (e.g. name, social security number, etc). It is therefore impractical for companies to use that information to target you.

Even if it is impractical now, is there any objective reason to believe it will remain so in the future?

The sequenced DNA exists without any identifying information linking it to an individual. If they re-sequenced you and matched the two, they've gained nothing (since they had to re-sequence anyway), if they didn't re-sequence then they have no way of associating the two.

So now, tomorrow, or into the far future the two piece of information cannot be re-associated because there's nothing to map them. The information about the link is lost.

It is like asking "Can a lossy MP3 be restored to the lossless version if technology improves enough?" Nope. The information is simply gone. Same is true here, the associated link is just gone.

This is a common misconception, but you are incorrect. These data can be used to identify you, therefore they are not anonymous. If a name is removed from a file that contains zip-code, age and gender, that data is nevertheless sufficient to re-identify most people. Removing a name from a data-base does not necessarily anonymize that data-base.

DNA can be used to uncover your last name and ethnicity, estimate your height, hair color, eye color and more, so anonymization is not as simple as removing a name.

> DNA can be used to uncover your last name and ethnicity, estimate your height, hair color, eye color and more, so anonymization is not as simple as removing a name.

It cannot be used to uncover your last name without sampling from several generational family members (and for them to be de-anonymised). Simply having a range of heights, hair color, eye color, is not enough to identify a unique individual.

The mechanism you're claiming could exist seems to be based on already having de-anonymised sequenced DNA for most of the population. But if you had that you could infer someone's DNA profile without having to actually sequence (or more to the point, de-anonymised it) making the entire activity pointless.

Essentially your entire argument is: If we already have your sequenced DNA (or could easily infer it) then de-anonymising you is easy. Which is both true but completely pointless.

I think there are degrees to the extent of tying / linking / re-associated (you use all these). If my DNA is present in some database and at a latter point in time I am sequenced again, all "metadata" (time, geography, etc...) associated with the circumstances of the first sequence getting into that DB immediately applies. In addition all genetic relatives (known or unknown to me) whose DNA is present in the DB may be affected by the circumstances of the second sequencing.

The entire discussion is predicated on 23AndMe or Ancestry

* not pivoting their business model and selling the unanonymized data to the highest bidder.

* not being forced to reveal the unanonymized data to the authorities.

* not revealing unanonymized data to hackers

Reply on news.ycombinator.com