I'm reminded of parallels between cell phone location privacy and genetic tracking. The average person does not understand that they are creating a record of everywhere they go when they have their cell phone on. The same is true with your DNA - while it's true that you do in fact leave a literal trace of your genes, you don't expect that you could be identified later on simply by the fact that you had lunch.
What we really need is a legislative solution, but unfortunately I have low expectations for Congress, seeing that Carpenter v. United States even had to happen.
I like your analogy, I'd add that DNA search/collection is akin to scanning cell phone records to see who was in the area at the time of the crime. Which typically requires a warrant.
Your location is not private information and never has been. Not sure how you could even legislate to make your DNA protected private information- under HIPPA for instance, considering you leave it everywhere you go. Your fingerprint is not private, your face is not private, and your DNA is not private. I'm not sure how they could be.
Your location isn’t private if you’re observed in a location where you have no expectation of privacy, i.e. outside. But if I’m at a friends house, I absolutely have an expectation that my presence in their home is private to the world at large.
The problem is that dragnet surveillance does not:
1. Handle the subtleties of how we expect privacy to work.
2. Require direct observation of someone in a context where there is no expectation of privacy.
It just works all the time, and contains the ability to unmask private events in the past.
your expectation of privacy is sort of inconsistent here. if you don't have an expectation of privacy when your out in the world, and it's fair game for people to observe you traveling to your friend's house, how can you expect that your presence is private?
> it's fair game for people to observe you traveling to your friend's house
This is true, but if you follow someone consistently enough then it is considered a crime--stalking.
Exemptions for special cases (PIs, bail bondsmen) were put in place with the expectation that those groups would not abuse the system, being "professionals." And of course the police have been allowed to track people under investigation. But private individuals and businesses do not have the right to stalk people.
It's time to put to rest this notion that occasional incidental observation of other people has anything in common with the persistent surveillance enabled by modern tech. One is expected and is fairly low risk, the other is ripe for abuse.
My problem is the scale of the issue, at least when it comes to phones. If I am at my friens the people involved are apt to forget almost everything in a few days. The cellphone tracking system, in theory, will studiously remember exactly where you are till the end of time by a company wit history of give or selling said data to the government in secret.
Well, they have to give your location information to the government. I think it's a bit naive to expect a company to keep your data secret from the Feds. They're just as subject to the law as we are.
If we use electronic devices at all, we're just best advised to operate as if the government has access to anything we say, write, or record on them. That includes our locations. If you're going to see your weed man, or your mistress, you probably want to leave it at home. And no, don't bother buying a "burner" because they can track that too.
All that said, companies should try to keep your location information secret from anyone other than the government. One of the issues right now is that they don't. They make good money using location to target ads for instance.
This is why I included the bit about direct observation. Before dragnet surveillance, you would need to travel near someone who had an active interest in you specifically in order for your location to be marked down. With a dragnet surveillance system every movement you make can be used to unmask your whereabouts after the fact, regardless of whether anyone observed it at the time.
I think we agree then. the classic distinction between public and private space is almost a red herring in this argument. the focus should be on how long are you allowed to store information, or maybe even how widely and indiscriminately are you allowed to collect it in the first place.
My presence in private is a protected right in the United States. Being able to track which office I go into in a complex, tracking which room in a house I am in, etc. These types of things require a warrant based on reasonable suspicion and this has been ruled on numerous times. If you're moving from place to place in public view, sure, that's allowed. The police can also follow you and watch you enter a building, but what is the functional difference between preventing access to my house to watch me move from room to room and using cell phone data to track me. My carrier is someone I contract with. I pay them. They should be working in my favor to the fullest extent of the law. While I sympathize with overburdened police forces and tough crimes there's a reason we have these protections in place, to prevent a police state where the police are more beholden to the state than the public it is expected to be serving.
I can't speak to whether that is inconsistent or not, but in support of HN User'village-idiot', I think it'd be a pretty big bummer for people to find out that any tryst they have with a lover is not private, but public in nature.
Taking your phone or your DNA to any such tryst makes it so apparently.
What's worse, there will likely be a lot of scope creep. It's showing up in criminal court. It's showing up in civil court cases. It's definitely going to be showing up in family court. Etc etc etc.
> I can't speak to whether that is inconsistent or not, but in support of HN User'village-idiot', I think it'd be a pretty big bummer for people to find out that any tryst they have with a lover is not private, but public in nature.
it's a bummer for sure, but it's been this way for a while. it's perfectly legal for your wife to hire a PI to follow you around. the police also don't need a warrant to observe your movements.
the part that's new is that all this surveillance can be done passively without any particular reason to suspect you.
imo, the distinction between public and private spaces is pretty reasonable for targeted investigations and observation by fellow citizens. in my view, the real problem is how long information should be stored, especially when collected passively.
I think in general, people who are aware of DNA used as evidence don't understand that it isn't perfect, that most matches are (somewhat) loose statistical matches.
Lots of people probably aren't aware of it though.
The average person knows that cell phone location tracking can be used as evidence in criminal investigations. It shows up all the time in TV and movies.
I agree with you but there's still this weird disconnect where people believe they can be tracked realtime by their phone, but not historically. They know their phone can be 'triangulated' when the cops are actively looking at them, but everyone I show their phone's location history to freaks out about it.
Imagine if some spy on espionage mission has sex with you and police/intelligence finds your dna in her bedroom or inside her, and now you'll be under investigation and maybe torchered too to reveal something you've no idea about.
I am not sure if it's possible in first world countries but many countries where these companies will soon offer such investigative service to local intelligence/police department have very high chance to do exactly that.
That's the case in France where DNA samples are taken on any person arrested, whether they committed a crime or not, including demonstrators (or bystanders) in a political march.
The national DNA database now includes over 5 percent of the population and it is a great tool for the police since the authors of serious crimes typically have almost always committed petty crimes before. It also means that you can solve small crimes like burglaries with DNA.
It is a bit worrying from a privacy protection point of view though. And I barely see this database ever questioned by the French press.
> That's the case in France where DNA samples are taken on any person arrested, whether they committed a crime or not, including demonstrators (or bystanders) in a political march.
FWIW ~20 US states do the same, this was ruled legal in 2013 (Maryland v. King, DNA collection is part of police booking procedure).
CODIS (the FBI's DNA database) contains more than 17 million non-forensic profiles[0], that's also >5% of the population.
But wait, there's more!
The Department of Defense's own DNA database (DoDSR) has more than 50 million records (collection started in the 80s and every applicant to a uniformed service gets included), and since the 2003 National Defense Authorization Act can be accessed by federal or military investigations for "the purpose of an investigation or prosecution of a felony, or any sexual offense, for which no other source of DNA information is reasonably available". So it can't currently be searched / "wild matched" against an unknown sample but if there's a suspect, a sample and no other DNA source then it's an option.
>The Department of Defense's own DNA database (DoDSR)
The reality of this is that it's just a big ass warehouse deep in the farmland of Virginia which houses unprocessed tubes of DNA. Its like the end of Raiders of the Lost Ark.
Sounds nefarious but it is actually a goldmine for genetics research.
As noted in the original comment, currently DoDSR can only be used for nominative sampling aka you have a name and want a known generic sample (and you have a federal or military judge allowing it). The limitations of the medium / storage means it can't practically be used beyond that.
The issue of false positives and false negatives is glaring in data sets of these sizes.
5% of France is about 3.3 million unique records.
From what I could see online, the false positive rates of various DNA tests are between 0.01%[0] and 40% [1]. Lets call it somewhere inbetween and say 20% are false positives, or 1 of 5 people.
This is just a lead in a case, sure, but that means that 1 out of 5 cases have false leads, wasting a lot of time and resources. I've no idea what the false positive rate for a 'normal' case is like, it could very easily be higher.
Granted, this is today's false positive rate, it should get a lot better over time. But to what percentage, and how long will that take?
Then you have the much more pressing issue of the false negative rate. I did not look too hard, but trying to find that rate wasn't simple. I've no idea what it is. In terms of DNA cases, you could then have a lot of potentially dangerous people falling through cracks in the system. Lets pull a number straight out of nowhere and say that the false negative and false postive rates are the same, about 20%. That would then mean that your odds of getting the 'right' criminal (specificity[2])are at about 80% and your odds of not getting the 'right' criminal (aka clearing people that are actually innocent, aka sensitivity ) are also 80%. Meaning that for any random crinimal case using the DNA database as a lead, you only have about a 64% chance of getting useful information out of the DNA database [3].
Serious crimes with DNA evidence can also triangulate suspects via finding their relatives in the database. Finding two second cousins from different sides of a suspect's family have a guy currently on trial for murder who had never been arrested, but whose DNA was found on a dead woman's body and clothes.
This seems like it would, if the trend continues, have some interesting ramifications for France's law forbidding parentage tests for men who suspect they may not be the father of a woman's child. The government may end up knowing more than the people in cases like these.
DNA should only be used to prove innocence and to corroborate other evidence. Just because someone's DNA is there, doesn't mean they did something. It is too easy to start planting DNA. If there is other evidence and their DNA is there, then yeah. Book 'em Danno!
But there are some cases where there is only DNA. There is a double murder going to trial soon where DNA found via GEDmatch is the only evidence.
My fear is that planting DNA isn't something individuals are likely to do (thought it's not impossible), but something the state or large organizations are likely to have the resources to do properly. Corrupt LEOs. Corrupt politicians. It seems a lot easier than many alternative corrupt practices.
DNA also just ends up all over the place for innocent reasons. If someone gets murdered in a rental car that I rented last month, chances are my dna will be there. DNA evidence often struggles when it comes to temporality, as it can tell you who and where, but it can’t tell you when the evidence was placed there.
Historically there have been some pretty bad abuses in court over the accuracy and reliability of dna evidence, with some convictions that had to later get overturned.
Mixing/pollution of DNA samples in DNA testing labs (or faked DNA tests by unscrupulous labs) can also have some pretty bad consequences and have in the past.
Would you feel differently if your child’s murerer was on trial?
Not trying to be gross, just trying to shine light on the idea that judges are in a difficult situation. They have to consider fairness for all parties involved.
That question is one of the pit falls we have to avoid to preserve any chance of avoiding a police surveillance state. "What would you allow if you were maximally emotionally impacted by a crime" is basically a blank check for 100% surveillance because inevitably any restriction on methods will eventually allow some crime to go unsolved.
Exactly this. At worst, you need to at least taper the emotionally charged question with the counter-point; "Would you feel differently if your child was falsely accused of murder because of genetic comtamination?"
Yep, to see how badly things can go when 'scientific' evidence goes unquestioned look at the mess that is stuff like bite pattern analysis which gets presented as scientific but has really bad actual statistics.
Justice can't just be about catching people it has to also weigh the cost of false positives and the effect that the methods have on society.
It's a constant issue with things like TOR, encryption, and alt currencies like BTC. They can do a lot of good for repressed people but they're also inevitably going to be used by people most people would agree are awful people to protect themselves from justice. If you're developing those tools you have to be ok with that just like we have to decide as a people where we're ok with the balance between preventing crime/catching criminals and personal liberty and privacy.
What if you were accused of a child's murder that you didn't commit? Perhaps it was particularly horrific and the police really want to catch the killer quickly to look good in the media. Your DNA matches the DNA the weapon, but match isn't the correct word - a better word is that it aligns / doesn't conflict.
The situation gets worse once bigotry is added to the mix. I stand by my opinion.
> Would you feel differently if your child’s murerer was on trial?
Why would someone be less concerned with the reliability of the criminal justice system in that case? A low standard means it is easier for the government to let the guilty go free while making a show of punishing someone convenient.
There is a trade off between improving the probability of convicting the correct perpetrator and decreasing the probability of falsely convicting someone who is innocent.
This tradeoff is essentially managed by the threshold required for a conviction.
The legal system is generally not optimized purely for the first part of this trade off.
It makes sense that people who suffered from a crime would emotionally prefer more focus on a correct conviction at the cost of more false positives.
Surely the parent of a murdered child is massively compromised in judgement. Considering what they would think to be fair is like asking a madman what's fair, or rolling a die.
Isn't this Would you feel differently argument goes both ways?
Would you feel differently if you killed someone and the police found you only thanks to such dubious from privacy standpoint practice.
I built a prototype of a Private Set Intersetion using elliptic curve homomorphic encryption method for this very use case: The scenario goes
1) FBI indexes the dna using MASH algorithm (minhash like locality sensitive hashing of genomic sequences) of the person they are searching for. They then use homomorphic encryption and post this encrypted data online with a bounty for anyone to claim.
2)Now, individuals and corporations can try to claim the bounty; they also run MASH on their dna databases and encrypt each mash index using the same homomorphic strategy and submit it back to the FBI.
3)The FBI can now complete the private set intersection algorithm on the encrypted data and will only reveal information iff an assailants genealogy is found. The remaining sequences appear cryptographically random and thus protect the privacy of those persons.
I am currently working in blockchain space. If you want to know more feel free to message me.
Excellent application of homomorphic encryption! Did you design your prototype for SNP data, like that used in GED match? Or for CODIS Core STR data, used by the Rapid DNA identification systems?
PS: Your profile does not contain contact info. Message me if you would like to converse privately.
I've heard it argued that the police and other authorities have the right to know who you are.
Is this really the case? Does a representative of a government have the right to your identity?
If so... is there an extent to which they can know who are you are? The difference here between a vague answer, a trust based assertion, or even a deep proof.
There is a distinction between your identity(who you are) and your legal identity(who the governments papers say you are). Your legal identity is created with your birth certificate and ends with your death certificate.
Legaly you agreed to act under this legal identity when your birth certificate was created but since you where too young to give consent its not legaly binding.
Thats the argument but it would need to go through a judge who wont care about technicality of law as the law itself is a technicality to justify government.
Genetic data affects not just an individual but their family tree as well. Maybe a warrant should have to be issued for all of them to get access to this data.
Some of the oldest professions have a notion of "privilege" with sensitive information. Client-attorney privilege, Physician–patient privilege. While some of these have been eroded at various times, there was a reason for their creation.
These services probably need those levels of privileges as well. Even a warrant shouldn't necessarily compel the yielding of information. Instead a request can go through the organization which immediately responds in the negative, but then behind the scenes asks a client if they want to voluntarily testify against some unknown relative of theirs (I think put in these terms, a lot of people will say no).
The rationale being the same: if the police have easy access to this information, people won't trust the services enough to make optimal use.
But wouldn't this conflict to the (natural?) right of an individual to publish their own data? Do I need a permission from all my family tree to be allowed to publish the contents of my DNA?
If, outside of our control, your password and mine matched except for one character and that near match was public knowledge, would you object to me publishing my password here in cleartext?
There's a big difference between publishing your own thoughts - which may have nothing to do with what your family thinks - and publishing your DNA, which is inextricably tied to that of your family. It's my data, which I have a "natural" right to share as I see fit, but it's also very similar to yours, which you have a right to keep private. These rights are incompatible, one has to give.
A password isn't a good analogy for a DNA, imo. DNA only identifies you-- it doesn't unlock additional information about what you've done in the past like a password might. So a closer analogy would be a username.
Then given my username was found somewhere, with that public knowledge of us being one character off, publishing your username would identify me as that user. And I'm not sure that would be wrong.
It's also illustrative that a username is "public" information you might share with someone while a password is private. And I think that's why I'm of the opinion that DNA isn't private information.
> If, outside of our control, your password and mine matched except for one character and that near match was public knowledge, would you object to me publishing my password here in cleartext?
I would certainly prefer that you not do that, but I don't think I should be able to to compel you not to. this is sort of a weird example because there's no clear benefit to posting your password.
a similar example: you and I both live in the same apartment building. you really hate my best friend and don't want them to know where you live. my best friend already knows that you and I live in the same apartment building. should you be able to prevent me from giving my address to my friend so we can hang out?
Ok how about imagine that friend was stalker. Someone potentially dangerous to me and those around me. They know we live in the same building so yes in that case it would make perfectly sense that I could compel you not to give away your address to that person.
imo that's only reasonable if we're actually roommates. if not, you should pursue a restraining order against this person, not try to restrict me from releasing my own address.
What’s special about DNA here? What about aspects of one’s phenotype? Should I be able to publish that I have a certain condition that is known to be genetic?
What makes you think there is such a right, and what does the expression "their own data" mean, exactly?
A person's genomic sequence isn't something that that person created (it existed before the person did!) so there's no obvious analogy with a poem the person wrote or a set of temperature measurements the person made or anything like that.
Arguably you should not be allowed to publish your genomic sequence if you have any identifiable living close relatives because you would be publishing other people's confidential medical data.
> there's no obvious analogy with (...) a set of temperature measurements the person made or anything like that.
But there is! Due to advances in technology, I can actually sequence my own DNA just as I can measure a few temperatures. The only difference is the price of the equipment. I understand there are other implications, some of them unfavorable, so maybe there are pragmatic reasons for making this publication illegal. But pragmatism is not the only source of law, there are also principles! It seems to me that, as a matter of principle, I have the right to measure my bodily functions and publish the results of said measurements. If other people are damaged by that information, this makes me an asshole, but it shouldn't make me a felon nor a misdemeanant.
I don't understand where this principle "I have the right to measure my bodily functions and publish the results" is supposed to have come from. I'd never heard of it before and I don't see why it should be important: more important than the principle of avoiding harm to other people.
Presumably the principle "I have the right to measure my bodily functions and publish the results" would also allow you to publish anything you see or hear, since sight and vision are bodily functions. I don't see why that principle (which I'd never heard of before today) should override all the sensible rules we have about publishing various kinds of things.
> "I have the right to measure my bodily functions and publish the results"
It seems very natural to me. At least, more natural than being forbidden to do so due to the questionable practices of health insurers.
Let's move to a single bit of information. Do you have the right to publish the fact that you are colorblind? Or wether you suffer from "situs inversus" (your heart is on the right side). Or to disclose your own blood type?
Each of these bits of information reveal information about your genome, one bit at a time, thus they have medical implications to other members of your family. I find it abhorrent that somebody from my family could forbid me to disclose each of these bits of information, that I can measure about myself when alone at home. Thus, if I can disclose each of these bits individually, I can disclose them all (how couldn't it be otherwise?), thus I can disclose my whole genome.
You can't apply that kind of reductio ad absurdum to confidentiality: it goes against common sense and the way the law works today. Telling someone in conversation that you are colourblind does reveal something about your genomic sequence, but it's very different from putting your entire genomic sequence online in a way that it can easily be discovered.
A primary school might put photos of the children with serious allergies on the wall in the cafeteria. They don't put that info on their web site. They certainly don't put it in a genealogical database so that anyone can ask whether X has any relatives with a nut allergy.
> A primary school might put photos of the children with serious allergies on the wall in the cafeteria. They don't put that info on their web site.
Alright. But a schoolteacher can take a photo of herlsef, alone at home, and publish it on her own personal website. This is basic freedom of expression.
Will this action create some problems? Probably yes. A stalker neighbor of the teacher may learn where she works due to this website and attack the school and take hostages, or whatever crazy thing. Does this mean that it is OK to forbid schoolteachers to publish their own photos on their own websites? No. That would be an unacceptable attack on freedom of expression.
I like your example with the photos because, in the end, a photo and your DNA are a similar kind of information. Whatever the consequences, you have the right to publish your own.
I don't think photos and DNA are particularly similar. There's the critical difference that DNA from a person provides a mass of easily applicable information about that person's close relatives, information that is not displayed in public like somebody's face is. If this discussion has a point, that's the whole point of it, but you've missed it or are choosing to deliberately ignore it.
Data scientist here. I'm surprised nobody here has yet mentioned the false-positive issue with trawling a large dataset: even a tiny false positive rate leads to a very high probability of convicting an innocent person if you mine a large enough database.
Many of the comments here seem to assume that the use of DNA tests without the accused's consent is a bad thing. I fail to see why. We use facial features and eyewitness-testimony to ID criminal dependents all the time. No one argues that consent/warrant is needed in order to ID someone using their facial features. More generally speaking, I fail to see the harm that can arise from using DNA to identify suspects, whereas the benefits are so much more compelling.
DNA is only circumstantial. Being a suspect is harmful.
Hence DNA testing could make innocent people suspects and thus harm them.
Since harming innocents is bad, there is a downside to wide usage of DNA tests. Whether tgat downside weighs up against the upside is a debate. But we need to acknowledge there is a debate to be had.
Sure, but I think it's also worth acknowledging that suspects get identified all the time on the basis of circumstantial evidence far flimsier than DNA traces. The "burden of proof" needed for the police to investigate someone as a suspect is extremely low, for good reasons.
Interestingly enough, I recently received a bulk email from GEDMatch.com about exactly this subject.
They changed their TOS so that now users need to explicitly opt in to sharing their data with law enforcement. That's good for user privacy, but it does make me wonder what they were doing before this change.
I think whether you find this useful or dangerous hinges entirely on your perspective on governments and history.
If you are sure governments are mostly a force for good and democracy is suited to keep it that way indefinitly, overpowered permissions like these have no real downside.
As engineers we certainly also ask ourselves how systems fail when something goes wrong, even if all we do is to prevent this. This kind of power is not only a possibility for a state to become more powerful, it is also the perfect ethnic genocide toolkit and therefore something that makes it substancially more dangerous for a state to fail.
Separation of powers, the oversight of the press, limited power and information for the state over the individual without good reason – all these mechanisms are there for a systemic reason. These reasons are sometimes only to make it harder for governments to drift into unlawful and unjust behaviour. Any change to the balance of power between executive, juridicative, legislative ans public should be carefully considered before executed.
So this must really pay off in order to be useful enough to justify the risk that comes with it, including the (in?)effectiveness of punishments and the cost of prevention through other means than harsh punishment.
In broad sense all investigation techniques are privacy invasion: surveillance, search, detention or arrest.
I think we should let law enforcement use DNA sources. But it should be heavily regulated, and under heavy control.
Let’s say anonymous inquiry that just return yes/no and then you need court to reveal identity.
Seems to me the legal question is whether it's a reasonable search. If a court rules in the affirmative that poses a second question: search what, and does that imply that right for police to collect DNA evidence in order to conduct a thorough search?
I'm glad the Original Night Stalker was caught, but I found it very disturbing he was caught based on another family member doing one of those ancestory DNA things.
Also, offtopic, but that dendrogram in the first picture is a very incestual family tree.
DNA has almost no probative value in those cases, since they almost never involve a sample which can be genotyped that has a high probability of being linked to a particular crime.
I think the justice system needs to be reformed to a rehabilitation modal and before it's able to investigate one's genetic family tree for any crime. I've studied neuro science and the philosophy of determinism to realize people don't have any real control for their actions. So right now I think we're failing when it comes to humanity.
What we really need is a legislative solution, but unfortunately I have low expectations for Congress, seeing that Carpenter v. United States even had to happen.