Hacker News Reader

Comment by voidUpdate | Hacker News Reader

IF there was a secure and trustable way that a trusted government could retain DNA information, then I feel like people having a DNA test at birth or on becoming a citizen could be useful, both medically ("your sample indicates you may have a higher risk of dementia") and from a policing standpoint ("we found DNA on this woman's clothes and immediately matched it to this man who hasn't committed a crime before" or "we were able to identify this john doe because their DNA was on record"). However, given that companies and governments are awful, I don't think it could ever actually work in practice :/

View on HN

I don't think it could ever actually work in practice :/

Exactly. I can think of so many bad outcomes. Just the medical point:

both medically ("your sample indicates you may have a higher risk of dementia")

You know how this will end in the modern tech dystopia. In countries where health care insurance is not mandatory or there is a large gap between collectivized and private insurance, DNA would be used to reject or raise the prices for people with 'unlucky DNA'.

A government that could be trusted now is not necessarily trustable in the future. I am pretty sure the orange guy clan would love to lone their pockets by selling such information.

Also, apart from these issues, a lot of people simply do not want to know these things. Suppose that the outcome is "you have a 30% risk of dementia by 60". For most people such kind of information is hard to act on, while it increases worry significantly. I do think it can help for some treatable illnesses, enabling early monitoring.

You could potentially make DNA a 'protected class' of data, implying insuarance companies cannot look at it in their decision making, same as something like race.

We do basically have this, kinda, with not being able to discriminate based on pre-existing conditions.

The law however is only as good as it is being enforced. And if recent events is anything to go by, not having this data is generally the strongest protection.

The US has the Genetic Information Nondiscrimination Act and I'm sure you can find similar laws elsewhere.

The problem is a law can be repealed any time. Might take some heavy lobbying to get there but nothing is impossible.

> IF there was a secure and trustable way that a trusted government could retain DNA information

How long does that government need to stay trusted and secure? For the lifetime of the born person only, or should that requirement also extend to the offspring of said person? Can you point to any current government that has been consistently trusted and secure for the past 100 years? How much are you willing to risk on the theory that a government (your choice, pick one) will stay trusted and secure for the next 100 years?

Right, and that's why it's preposterous to even imagine this happening. In no time you'd have an administration that was providing that DNA evidence to defense contractors for Top Secret clearance, background checks, etc.

"We're sorry your job application was rejected because we found you were 4% less maximally conscientious than the median applicant"

I've had job applications (albeit in secured projects) rejected for similarly vague bullshit ("Insufficiently candid")

Health insurance actuaries would be a concern also.

Indeed. It’s essentially the age-old conundrum: I don’t need to worry about my privacy because I’m not breaking the rules… until someone changes the rules.

In December 2009, then-Google CEO Eric Schmidt famously stated during a CNBC interview, "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place."

I don't close the door when I'm taking a crap because I have something to hide, I do it for privacy.

And whether people are breaking the rules or not, the more someone knows about you the easier it is for them to influence and manipulate you. (This is the basis of the online advertising industry.)

I think people who don't value privacy must not know what it is.

To build on your analogy, one could easily imagine a situation where there was no need to close the toilet door - because there's no-one around, or if there is, no-one cares about you taking a crap, and no-one pays any attention. In this case, 'privacy' is unnecessary.

(You, personally, in 2026 feel the need to close the door for 'privacy' because of some combination of societal programming, learned experience, personal psychology, choice, whatever.)

When I was a kid, I recall police coming to our classrooms to fingerprint us. The whole school got fingerprinted. The idea was to help police if kids went missing.

Whether or not you believe that justification ("Stranger Danger" was a scare at the time), I can promise you those fingerprints were used to put people in jail later.

I think that's a bit safer, because you could deduce very private information from a DNA sample, but you can't really tell anything about a person from their fingerprints, except maybe the size of their fingers. It's a one way match

Identical prints do exist. As with lab contamination of DNA, there is a potential for false accusation when you submit to dragnet biometric databases.

> Identical prints do exist.

Evidence?

It's theoretically possible, but as far as I'm aware, no one has found a matching set.

Not whole sets but individual fingers have turned up duplicates.

Source?

( > Evidence? )

> those fingerprints were used

A detective in a ~150K pop. municipality told me that while they might dust for prints, they rarely use them in court because computer matches are very noisy and actually entering prints as evidence in court requires an expensive expert witness to evaluate and attest to a supposed match. The prosecutor can't afford the fees for every case, so a lot of fingerprint evidence goes unused.

Fingerprints are basically circumstantial evidence (unless it's a high profile case that spares no expense). And even though it's difficult to use them in court, it's perfectly fine to use it for probable cause on a warrant. You still need a latent print expert to attest to a judge that they match but it's much less involved than trying to use them in court.

Perfect enforcement of crimes is a bad thing. If criminal law was perfectly enforced we'd still be in Prohibition and PGP would also be illegal.

It's generally quite hard to get a DNA sample from someone's PGP signature

"This software is for verified downloaders only. Please scan your ID card to start downloading.".

How close does a DNA "match" have to be to get somebody tossed in jail? Do they actually require 100%, or is a "match" something less? What's the false-positive rate? Would a non-twin sibling's DNA "match"?

Yes, I'm aware that, in theory, DNA is unique. As is the theory for finger-prints. But, I'm also aware that theory is rarely reality.

Remember that one still needs proof. My DNA on a victim's clothes does not mean I committed the crime.

In principle.

In reality, juries often hold evidence like this (and also-very-unreliable eye witness testimony) in high regard, based on how it's positioned into the narrative.

In reality, juries often hold evidence like this in high regard, based on how it's positioned on CSI:Some-City television.

Are you willing to trust 12 random schmoes to make that call correctly? Especially in the face of an overzealous prosecutor?

The fake-it-'till-you-make-it crime lab "scientist" is worse: https://en.wikipedia.org/wiki/Joyce_Gilchrist

Exactly. I’ve served on two juries and the experiences left me shaking my head. In one case the judge’s instructions were dismissed by a majority of the jury members with a “yeah, but…”.

The same process we've used for centuries? You got something better? I'm sure you don't. You are also ignoring that the 12 random schmoes are selected by both sides attorneys and given instructions and facts and can still be overruled by a judge (under circumstances) plus the possibility of appeal.

Your response is very uninformed at best.

According to wikipedia, "the theoretical risk of a coincidental match is 1 in 100 billion (100,000,000,000) although the practical risk is actually 1 in 1,000 because monozygotic twins are 0.2% of the human population", so it looks like some twins will cause an issue for DNA-based convictions, but I think a non-twin sibling is probably diverse enough? I have different eye colour, ears, food intolerances to my brothers, so I feel like our DNA is pretty different ("pretty" on a scale of human to human comparisons, since 99.9% of DNA is identical between humans or something like that).

I'd argue that while a DNA match could be a very good starting point for a conviction, other evidence should also be presented, for the reasons you suggest. For example, there is the case of the Phantom of Heillbron (https://en.wikipedia.org/wiki/Phantom_of_Heilbronn), where European police found DNA evidence of a woman being at many diverse crime scenes, but it turned out the cotton swabs used for testing were contaminated by at worker at the factory (The swabs weren't certified for police work)

That is a coincidental match, though! It's the risk of a false positive when you compare exactly two samples.

The problem is that we're proposing a DNA database, so you're now comparing 1 sample found at a crime scene with 300ish million people. That's a 300M in 100B chance, or 1 in 333, of some person having a false positive match.

Now combine that with thousands of samples being tested every day (because let's be honest, why wouldn't you use such a database for literally every single crime?) and you're looking at dozens of false-positives per day. It is only a matter of time before it isn't someone with an airtight alibi at the other side of the country, but someone reasonably-close who was just sitting alone on their couch at home all weekend. How are they going to prove they weren't involved in the crime?

This is why large-scale DNA matching is a horrible starting point for a conviction. It gives you a false sense of security, and it makes the investigators lazy. In most cases it is far better if DNA is used as the final nail in the coffin when you've already got a solid case against a suspect.

Sounds like perfect for rich people, they'll have the resources to argue in court.

Don't forget the reverse. If your DNA's an insufficient match to your children, they take your kids away.

https://womenherald.com/health/the-chimerism-case-how-lydia-...

This is a really interesting article, even though it seems a little biased towards the mother (which, post hoc, if absolutely fair). Would be very cool to see / read this from the position of the judge as the thing unraveled.

I think this video can answer your question: https://www.veritasium.com/videos/2021/9/30/your-dna-is-alre...

I don’t remember the exact details, because I have watched it long time ago, but they don’t need an exact match. Actually it’s more scary - if your distant cousin has DNA “in the system” - you are in it too.

This 1M DNAs may “help” match an order of magnitude more people.

I think you're thinking of genetic genealogy, where some of those DNA testing providers (like 23andme) submit their records to law enforcement, and they can see something like "this DNA sample is likely to be a brother of this existing sample", and can narrow down investigations based on that

A woman's DNA match to a dead baby from before she was born led to the arrest of her grandmother: https://www.cnn.com/2024/12/12/us/baby-garnet-cold-case-mich...

Totally agree; we can't leverage good stuff because we are mess.

There are some sorts of protocols and conventions that might help with this.

For example, not-for profit medical systems can hold certain records , then problems are regionally isolated and have extra layers of protection.

Biosignatures, similarly, we may want to only enabling 'matching, and with a warrant' - so that gov may not procure individuals biometrics, but only require a 3rd party lab to do matching, with oversight, process etc.

That would radically limit concentration of of actual power, likelhihood of problems.

If biometric matching companies were liable for failure to implement protocol (aka delete after test) etc - then that's powerful.

Regulations are never perfect, but they work.

Companies can skirt the law - but 99% of the time it's just normal compliance.

The trick is to make regs that don't encourage breaking compliance, and when it happens, the blast radius is limited.

You've unwittingly demonstrated why it's impossible to have a "trusted government", and why governments are inherently awful even without nefarious motives!

> "we found DNA on this woman's clothes and immediately matched it to this man who hasn't committed a crime before"

You've casually thrown out a use that sounds like it would be valuable, and thus has political appeal - but it actually fails hard to false positives. If you're merely confirming a DNA match, then the small chance of a false positive remains small - you're only comparing against one candidate. But if you do a population-wide search, then that chance of finding false positive multiplies [0] across the whole population! So even with good intentions, you've invented a process that picks random people out of society and harasses them (at best, with the way justice systems actually work this would lead to false convictions).

Life in general would be a lot simpler and nicer in a perfect world with perfect (whatever it means) people in it

Your argument boils down to "if people were 100% just, fair, and good, we could do this", so I'm not sure what the point of it is.

(Entertainingly, if people were 100% just, fair, and good, we wouldn't need this database... or police or militaries for that matter.)

At any rate, even if I could ensure, in perpetuity, that my DNA would not be used inappropriately (where I get to decide what that means), I would still not want it collected and database'd. People deserve to have privacy in their bodies.

People don't have to be 100% for it to work, the system would have to be so that if a human was to be evil, then they couldn't compromise it single handed-ly. I'll admit, I've not figured out implementation details, I just like thinking about nice things

The movie Gattaca deals with this theme and it has a good plot too!

One of the downsides of the movie is the lack of exploration of entertainment - outside 6 finger person piano concerts...

On the downside, millions wrongly killed, imprisoned, fined, families torn apart.

On the upside, think how good that Falsehoods Programmers Believe About DNA article will be.

In some countries, when you go to work there they take full fingerprints (fingers, palm, etc.) plus a blood sample for DNA. Works extremely well in deterring crime.

From a technology perspective, it is really not that hard to keep all this on an air-gapped network and just run comparisons against it "offline" and get a result back with all the info you need when there is a match.

New Jersey "government-ize-ed" this quite a while with a database that's quite abused. But every US hospital does genetics testing for allergies (a few for milk and similar that are nearly a death sentence for the new born).

NJ is just ahead of giving law enforcement access whenever it wants for searches, and renting the data to whoever pays.

That's the issue with granting the government more surveillance powers, you can never trust it will only be used 'properly' and more and more in the US the Supreme Court is tearing down the minor safeguards of independent agencies so more and more it's up to the whims of the current President.

As someone who loves Gattaca, no thanks !

ZK, FHE, MPC is written in Rust/Swift/C(pp) to support proper DNA data management. I assume that there is already done research related to DNA. Any modern phone has enough to crank needed bits. These schemes do not need trust to company nor government.

Remaining is to upgrade old phones of every body.

Why has to be the government if anything could be done by health providers and be guarded by the existing privacy laws that don’t allow the government to indiscriminately access it

so, ultimately, it doesn't matter what the technology, the operative word is always "trusted government" and there isn't like, a replacement to "trusted government"; people who trust fascists will of course tell you they have a "Trusted government".

So it all really just comes back to implementing governance that has the correct leverage on power. America is definitely not that, and this will be abused in all manners if america continues down fascism.

Of course there's always things we just shouldn't store, like logs of password hashes or whatever, but most of reality hinged on "trusted government"

Subhuman zog

A historical reminder: the Nazis were highly effective at persecuting Jews in the Netherlands precisely because of the country's meticulous population registry.

You never know who will be in power tomorrow. The convenience of a centralized system today does not outweigh the catastrophic danger of that system in the wrong hands in the future. Specially nowadays.

There are several European countries that do this from what I understand

Do what, fingerprinting or collecting DNA? Not sure what you're trying to say, if Europe does it, it's fine?

The gist is that this was always done when people were arrested for criminal offences. They're now doing it for civil offences and, like with all the ICE stuff, it seems to be do first, ask questions later. So you can be a citizen but your data might end up in their systems anyway as it's submitted before they find out you are a citizen...

A few things we can know for sure. The Dutch immigration enforcement authority, IND, has a blanket exception for to the GPDR collecting any kind of information on anybody "for the purposes of immigration enforcement".

10 years ago we found out, from a budget proposal that was in dispute, that the police had sent every mental health database in the Netherlands to Palantir. Regular health databases too, but if you're Dutch, Peter Thiel knows exactly what you told the "the law guarantees you can trust me" social worker 20 years ago. Or what you told any Dutch police officer at the border, on the street, ... Everything. That's what the Dutch state used their authority for.

As far as I know the IND only gives the option for a DNA test (voluntary choice), if as a refugee you want to let your family come over to prove that someone is actually your family. This is not great, but faked familial ties have been used in the past to get people into the country.

Also, the DNA test is not done by the IND, but by the NFI (Dutch Forensic Institute), who destroy the material after six months.

sidewndr46 had a pretty grandiose claim (I don't think there are any European countries that do a DNA test at birth and store the data) and you only come with a lot of handwaving that is not even about DNA.

No they just preemptively legally approved IND for to collecting ANY information on both immigrants AND citizens.

The Dutch government must have done that because it comes with a really cool badge ... that's the only explanation possible here.

Slightly biased because I'm a european, but I think a european country is more likely to be trust-able with a country-wide DNA database. Only slightly more though, I still wouldn't trust them to actually do it right

Even if the government remains perpetually trustworthy (good luck with that), it's inevitable that the database will be hacked by a bad actor, if the information is valuable.

> Slightly biased because I'm a european, but I think a european country is more likely to be trust-able with a country-wide DNA database.

There were multiple governments operating pervasive surveillance states and using them to punish dissidents on the western part of European continent well within a human lifetime from today. What makes you think that won't happen again, this time in a completely iron-clad way?

> well within a human lifetime from today

You can just say "at this very moment".

Well, that's true, but it's not as on-the-nose as, say, Francisco Franco did it.

> "Only slightly more though"

Generally, we've seen that that was bad and I would hope that we wouldn't do it again. I did also say that I don't think it would actually work out because governments, in my original comment

Interested in this as I haven't heard of this from an all population point of view, do you know which European countries this is? I know many have a national DNA database but that is limited to those charged with crimes (or suspected of in some cases, in some countries these are removed later).

Iceland have a _geneological_ database, which is something of a sensible precaution against consanguinity in a small gene pool that was isolated before air travel. I don't think anywhere has population-wide genetic databases and I struggle to see how it would be compatible with GDPR?

(France actually ban paternity testing without a court order!)

> I don't think anywhere has population-wide genetic databases and I struggle to see how it would be compatible with GDPR?

Because the GDPR is only concerned with data collection not explicitly required by law. If a government passes a law to set up a genetic database, then that it totally fine with the GDPR.

If you make big claims like this, please tell us what countries store DNA from birth and give sources.

"several" tends to be mean [5-8] or the like. Outside blood type (which is common), name at least 3 countries that DO record (and retain) DNA samples at birth.

Reply on news.ycombinator.com