> Only authorized researchers should be able to obtain DNA permitting them to assemble pandemic-capable agents.
Imagine this becomes legally mandatory. What happens when they get breached? For example:
* Does it enable denial-of-service attacks by returning false positives hospitals legally can't ignore?
* Does it return false negatives as part of another attack? Example: printing known or novel virii which will be introduced in a specific lab?
* Does the attacker selectively perform these behaviors as part of an action against a specific person or area?
Metadata seems like it would enough to target the physical parts of an attack usefully, even without plaintext.
The best security & privacy approach I've seen in hospitals is keeping critical services on-prem, or at least strictly intranet-only. The latter ends up being forced by physical scale once a medical complex grows large enough to span multiple buildings.
The firmware embedding mentioned on their site seems better than cloud, yet still seems misguided. How will you debug problems, especially if you never have access to the plaintext? Formal methods and verified programs? Provably equivalent encrypted and plain operations?