Speaker 1: Kilda. I'm Chelsea Daniels and this is the Front Page,
Speaker 1: a daily podcast presented by the New Zealand Herald. Sending
Speaker 1: your DNA to a website to find out your background
Speaker 1: has become a trendy thing to do. But is there
Speaker 1: a hidden cost to this? DNA testing company twenty three
Speaker 1: and meters is in a financial crisis, raising questions about
Speaker 1: what will happen to the data it holds on fifteen
Speaker 1: million customers worldwide. New Zealanders are concerned their genetic information
Speaker 1: could be on sold and used for other purposes, including
Speaker 1: by insurance companies or law enforcement. Today on the Front Page,
Speaker 1: privacy lawyer Rich Shearer joins us to discuss can you
Speaker 1: tell us how these DNA services work? What does it entail?
Speaker 2: What happens is that you usually you spit in a
Speaker 2: little tube and you send it off to them, and
Speaker 2: then they run their DNA sequencing over it to extract
Speaker 2: the DNA sequence from it, and then they store that
Speaker 2: DNA sequence as data on their systems. I think sometimes
Speaker 2: they keep the sample itself, sometimes they get rid of it,
Speaker 2: depends whether they want to keep it for future use
Speaker 2: or whatever they want to do with it. But generally,
Speaker 2: it's that it's not so much the physical sample that
Speaker 2: I'm focused on, it's more the DNA sequence, the data
Speaker 2: that is generated from that and stored by that organization.
Speaker 2: What they then do is make it available to other
Speaker 2: organizations for those organizations to use. They would, in theory
Speaker 2: anonymize all of the DNA so that you have a
Speaker 2: DNA sequence that isn't necessarily labeled with Chelsea Daniels or
Speaker 2: Rick Scherer or anything else, and they put it together
Speaker 2: with thousands of others and provide that to a research
Speaker 2: organization or a drug company or something like that who
Speaker 2: might be using it to say, well, we want to
Speaker 2: assess whether we can detect certain sequences might give rise
Speaker 2: to certain characteristics of a person, and therefore we can
Speaker 2: design drugs, or we can predict disease and so on
Speaker 2: and so forth. So there's a lot of research that
Speaker 2: goes on around it. There's also been potential use by
Speaker 2: law enforcement agencies of some of this material, not necessarily
Speaker 2: because the organizations give it to law enforcement agencies voluntarily,
Speaker 2: but the law enforcement agency might come along, so, look,
Speaker 2: we understand that you've got DNA for a person, we're
Speaker 2: interested in them as potentially as a subject of an investigation,
Speaker 2: or indeed to match up against another person who's DNA.
Speaker 2: We have to determine whether, in fact that is the
Speaker 2: person that we're interested in. So there's a number of
Speaker 2: different uses which are being made at the moment of
Speaker 2: the sort of material.
Speaker 3: I did that too.
Speaker 4: I sent my spirit into one of those websites, and
Speaker 4: it turns out of sixteen percent Irish and ten percent
Speaker 4: Hungarian and the rest is Italian.
Speaker 3: That's me.
Speaker 4: I did it, and I found out, guys, I found
Speaker 4: out I'm seventy five percent French.
Speaker 2: I don't even speak French.
Speaker 3: Well, oh, I sent my name and I found out
Speaker 3: that I am, let's see here, ninety two percent dumbass
Speaker 3: for sending a DNA sample to a random website that
Speaker 3: now has full copyright and unregulated access to my genetic
Speaker 3: code for the rest of time.
Speaker 1: So we're talking about sites like ancestry dot com twenty
Speaker 1: three and MENI family Tree and that kind of thing.
Speaker 2: Right, Yeah, that's right. And I mean, you know, there's
Speaker 2: a huge business worldwide obviously in genealogy, and this is
Speaker 2: part of that in some senses, because the business model
Speaker 2: for these organis these companies is get your information in
Speaker 2: and then they monetize it by making development of others
Speaker 2: at cost. You pay a little bit. I can't remember
Speaker 2: what people pay to actually do to give people these things,
Speaker 2: but it's not very much. And that's not where they
Speaker 2: make a lot of them. They make their money out
Speaker 2: of making it available to other organizations. But from the
Speaker 2: individual's point of view and giving it to these organizations,
Speaker 2: it's you know, obviously it's genealogy is really interesting. You know,
Speaker 2: you might find another family member, or you might find
Speaker 2: some characteristics of your DNA that you weren't aware of,
Speaker 2: so it's very interesting. I can well understand why people
Speaker 2: do it. That's why there are TV programs about people
Speaker 2: trying to find origins that they're always right.
Speaker 1: Quite highly Now, it seems like a fun thing to do. Hey,
Speaker 1: spit in a tube, send it off and find out
Speaker 1: a few weeks later you're sixty three percent Scottish. But
Speaker 1: when you send your DNA into one of these services,
Speaker 1: what kind of privacy laws are you rescinding?
Speaker 2: When you do this, you free to their terms of
Speaker 2: use and to their privacy policies. By and large, these
Speaker 2: organizations are based in the United States, and so whenever
Speaker 2: you agree to give any information to anybody, whether it's
Speaker 2: using Facebook or going online or whatever, you are saying,
Speaker 2: up to privacy policies, I guess that's the first gateway
Speaker 2: that you go through as the privacy policy. Then there
Speaker 2: are laws which might apply over and above the privacy
Speaker 2: policy in the particular jurisdiction or country where the organization
Speaker 2: is based. So in these instances you've got a privacy
Speaker 2: policy which we can read. Unfortunately, as a person who
Speaker 2: drafts these privacy policies, I have a great deal of
Speaker 2: sympathy for people who think they want to try and
Speaker 2: read them, because they're a good bedtime reading, but only
Speaker 2: for lawyers. So you know, reading thirty five pages of
Speaker 2: a privacy policy to try and discern exactly what the
Speaker 2: organization is going to do with my personal information is
Speaker 2: not something that I can recommend to anyone in their alone,
Speaker 2: non lawyers. So there's the privacy policy, then there might
Speaker 2: be the law in this case in the United States. Now,
Speaker 2: the United States, it's the name suggests, but we tend
Speaker 2: to forget, is made up of a lot of states.
Speaker 2: The United States doesn't have an overarching privacy a federal
Speaker 2: privacy law which applies across everybody in the United States
Speaker 2: states that have passed them. Each law is different, so
Speaker 2: some of them would have cover the certain aspects, others won't,
Speaker 2: depending on what the information has been collected, how many
Speaker 2: people they are collecting it from, and what they do
Speaker 2: with it. So it is a very much a patchwork
Speaker 2: of privacy protection. Obviously, as I said, you've got a
Speaker 2: privacy policy. The American way of doing privacy policies is
Speaker 2: very much you give us consent to do X, y
Speaker 2: Z with the information that you're giving to us. And
Speaker 2: so these policies do tend to say we can provide
Speaker 2: your personal information to other people for these purposes, research,
Speaker 2: et cetera. Because it becomes that that database of DNA
Speaker 2: becomes an asset of the organization. They've created the data
Speaker 2: out of your DNA. You have rights in respect of
Speaker 2: your DNA yourself, but the data, the DNA sequence that's
Speaker 2: created is not yours. It is data digital information, which
Speaker 2: is created by the organization, so they own that. And
Speaker 2: so the privacy policies will generally often say, look, in
Speaker 2: the event of a sale of our business, we can
Speaker 2: sell our assets, including that personal information you've given. Now
Speaker 2: there maybe some controls around that, not necessarily the level
Speaker 2: of control that you or I might want to have
Speaker 2: in respect of very personal information like DNA. Twenty three
Speaker 2: and meters on the verge of getting delisted now from
Speaker 2: the Nasdaq.
Speaker 3: Drama has been unfolding this week. It's only set to
Speaker 3: wrap up.
Speaker 4: Twenty three Meters built a multi billion dollar brand off
Speaker 4: of collecting people's spit. The idea was that people could
Speaker 4: take control of their health by learning about their genetics,
Speaker 4: and it took off. But just two years after going public,
Speaker 4: the company went from being valued at six billion dollars
Speaker 4: to treating below one dollar. Now, twenty three and Meter
Speaker 4: is rapidly approaching the November deadline to propose an action
Speaker 4: plan or be delisted from the Nasdaq.
Speaker 1: What are the concerns around twenty three and ME going
Speaker 1: under and what happens to the rights of the DNA
Speaker 1: records that they have on file.
Speaker 2: They haven't gone yet. They're in financial difficulty. Now there
Speaker 2: could be I guess two results of that or three results.
Speaker 2: I suppose they could come out of financial difficulty, they
Speaker 2: could get more investment, and suddenly they take off again,
Speaker 2: so that would be all good. They could decide, look,
Speaker 2: our shareholders are not putting any money more money into us.
Speaker 2: Our share price is going down as it is at
Speaker 2: the moment, and therefore, in order to act in the
Speaker 2: best interests of our shareholders, we should sell our business
Speaker 2: to someone else. In that business will include the assets,
Speaker 2: which will include the DNA data set, So that could
Speaker 2: be a scenario or of West Coast scenario. The company
Speaker 2: can't do that and it can no longer continue and
Speaker 2: it goes bankrupt, and a bankruptcy liquidator that would be
Speaker 2: in New Zealand that is appointed and they then sell
Speaker 2: the assets. Of course, at that stage all bets are off.
Speaker 2: They would sell to whoever they can get the best
Speaker 2: price for those assets, which could be anyone. So in
Speaker 2: any of those scenarios where the assets are sold, we
Speaker 2: don't have any control over who might be the purchaser
Speaker 2: of those assets in what they then might use stand
Speaker 2: information for whether they are bound by the privacy policy
Speaker 2: that is in place is questionable. In most privacy policies
Speaker 2: will say look, we can change this policy whenever we
Speaker 2: like by telling you, and if you don't want to
Speaker 2: use the service after that, then stop using it. But
Speaker 2: if you do continue to use it after we've notified
Speaker 2: you of the change, then you're bound by the new policy.
Speaker 2: So it could be that there's a change in that area.
Speaker 2: Some states in the United States might restrict that, but
Speaker 2: as I say, it's a bit patchwork in the US
Speaker 2: as to how that would apply. You know, West caase scenario.
Speaker 2: This information could end up with a company that wants
Speaker 2: to do something completely different with it, wants to target
Speaker 2: us for some sort of promotional material, you know West
Speaker 2: worst case scenario, it could end up in a jurisdiction
Speaker 2: it has no privacy protection whatsoever. You know, it is
Speaker 2: a great concent and I've always said it's a great
Speaker 2: consent to give these organizations DNA material because you never
Speaker 2: quite know what's going to happen to it. I think
Speaker 2: the real difference I see with DNA compared perhaps some
Speaker 2: other personal information that we might give is if you
Speaker 2: give someone your credit card number or your driver's license
Speaker 2: or whatever, it can be highly damaging for that material
Speaker 2: to get into the wrong hands, whether it's through a
Speaker 2: cybersecurity breach, privacy breach, or because it's sold off to
Speaker 2: someone that you didn't expect it to be sold to.
Speaker 2: But at the end of the day. You can change
Speaker 2: your driver's license, you can change your credit card, you
Speaker 2: can change your passwords and so on. You can't change
Speaker 2: your DNA.
Speaker 1: So essentially these records could just be sold to the
Speaker 1: highest better. Is there an opportunity, do you think because
Speaker 1: you say that they're encrypted, right, so if I sent
Speaker 1: off my spit to one of these companies, it would
Speaker 1: be logged somewhere presumably x y Z female. Is there
Speaker 1: a concern that if these were sold on to somebody
Speaker 1: else that they could decrypt their information.
Speaker 2: If they're sold to someone else, they will be decrypted
Speaker 2: because you can't use the information when it's an encrypted form.
Speaker 2: They're not going to buy a blob of ones and
Speaker 2: zeros that they can't even see what they are. They're
Speaker 2: going to decrypt it. The decryption key would be sold
Speaker 2: along with the information to who revise it, because otherwise
Speaker 2: you can't interact with the data. That's not to say
Speaker 2: that they wouldn't hold it in an encrypted form. But
Speaker 2: encryption is not a binary. Yes it's encrypted, no it's
Speaker 2: not encrypted. Encryption scales along stratum from not encrypted to
Speaker 2: industrial strength. You know it's held in the Pentagon and
Speaker 2: it's encrypted in two and fifty six encryption methods. Having
Speaker 2: said that, technology and computing power is increasing at such
Speaker 2: a rate that what we thought of as very secure
Speaker 2: methods of encryption or of storage ten years ago would
Speaker 2: now be looked at as opensleather. You know, I read
Speaker 2: the other day that Chinese researchers managed to use quantum
Speaker 2: computing to potentially decrypt the most strong encryption that is
Speaker 2: generally used by sites at the moment two for six AES.
Speaker 1: So instead of female x y z, it goes on
Speaker 1: to the new owner, and then that could they could
Speaker 1: decrypt it and be like, oh, this is Chelsea Daniels's DNA.
Speaker 2: Yeah, I mean in theory, there's two things that they
Speaker 2: do to try and protect people's privacy. One is to encrypt,
Speaker 2: and as we've talked about, potentially it can be decrypted. Secondly,
Speaker 2: they anonymize it. So your DNA sequence wouldn't necessarily be
Speaker 2: held with a label that sees Chelsea Daniels. It would
Speaker 2: just be held as subject one two five seven six. Now,
Speaker 2: the other difficulty that we're now facing with anonymization is
Speaker 2: the ability for very strong computing power in the very
Speaker 2: good matching of information, in particular with artificial intelligence to
Speaker 2: match disparate pieces of information together and suddenly come up
Speaker 2: with ay, well, person X was having a red car,
Speaker 2: they logged onto a computer in this place at this time,
Speaker 2: and they bought something with their credit card. Matching up
Speaker 2: those three pieces of information, a person X must be
Speaker 2: that person who owns that red car. Now that's a
Speaker 2: lot more difficult, obviously, with DNA sequences and so on.
Speaker 2: But there's clearly a move towards using high powered computers
Speaker 2: to denonymize people so you can be targeted. So information
Speaker 2: is getting it's getting much more granular in terms of
Speaker 2: the ability to pick out a particular piece of information
Speaker 2: and then link it to reidentify the person.
Speaker 1: What would someone want with my DNA that information? Is
Speaker 1: it all nefarious or is it kind of like a
Speaker 1: pharmaceutical company wanting a great batch of DNA information to
Speaker 1: then come up with a cure of the cancer or something.
Speaker 2: Obviously, having research to produce cures to cancer using massive
Speaker 2: DNA data sets is a good thing, no question about it,
Speaker 2: if it's done in controlled circumstances. But as I said,
Speaker 2: what we don't know who might end up being the
Speaker 2: purchaser of this information, and it may not be someone
Speaker 2: who is quite as ethical as we would all want.
Speaker 2: This is one of the issues always with technology is
Speaker 2: that you don't quite know where it's all going to
Speaker 2: end up.
Speaker 1: Another thing is when you're sending your DNA off to
Speaker 1: one of these companies, you're not only rescinding your rights,
Speaker 1: but in some cases your family's rights as well. Right
Speaker 1: like the Green River killer was probably not too impressed
Speaker 1: that his cousin of a cousin sent in one of
Speaker 1: his dinner because that's how he got caught.
Speaker 2: Right, So you know, other people can be identified. And
Speaker 2: I mean that's the same with any law enforcement issue,
Speaker 2: where you're often faced with the argument when you say
Speaker 2: privacy is very important, you often get a pushback from
Speaker 2: law enforcement people saying, well, if you've got nothing to
Speaker 2: hide while you're worried about well, privacy is a human right.
Speaker 2: Our right to be let alone is a right that
Speaker 2: is important to all of us. We don't walk down
Speaker 2: the road without any clothes on, and that's because there
Speaker 2: are some things that we like to keep private. You know,
Speaker 2: some people are less private than others, but it's all
Speaker 2: a matter of choice. There's also with any technology, there's
Speaker 2: also always the ability for mistakes to be made, false positives,
Speaker 2: false identifications and sign and so forth. So you can
Speaker 2: imagine these data sets being very because it's massive amounts
Speaker 2: of data, you can imagine artificial intelligence being run across it. Now,
Speaker 2: artificial intelligence is great, it's doing fantastic things, but it
Speaker 2: makes mistakes. It's all it's doing is statistically predicting what
Speaker 2: you expect to hear from it under an l l M,
Speaker 2: so allow of the large language model, it's responding in
Speaker 2: the way that it thinks you want based on the
Speaker 2: prompt that you put in. And we don't know how
Speaker 2: the artificial intelligence algorithms might be applied to these sorts
Speaker 2: of things. So, you know, to take my health insurance example,
Speaker 2: we don't know whether the algorithm that might be applied
Speaker 2: across a huge data set would actually deliver the right result.
Speaker 2: It may be that they've missed that it's misinterpreted the
Speaker 2: gene sequencing and therefore, instead of giving me a clean
Speaker 2: bill of health, has said, well, no, we think that
Speaker 2: the algorithm thinks that you might be more likely because
Speaker 2: of your DNA to have heart disease. That may be
Speaker 2: completely wrong. So there are all sorts of difficulties. That's
Speaker 2: not a function of the DNA, It's just a function
Speaker 2: of how it works in the way and watch these
Speaker 2: sorts of data sets may well will be used in
Speaker 2: the future.
Speaker 1: And one last question. If someone from your family turned
Speaker 1: around and said they wanted to find out who your
Speaker 1: ancestors were and they were going to use one of
Speaker 1: these sides, what would you say to them? Don't just
Speaker 1: straight up, no explanation, just no.
Speaker 2: I've always said that. I mean, it's a choice, right,
Speaker 2: it's I think the main thing is for people to
Speaker 2: understand the potential downsides of doing it and then to
Speaker 2: balance that against well, is that potential downside worth it
Speaker 2: for the buzz that I'm going to get out of
Speaker 2: finding that I have sixty percent Scottish ancestry. I don't
Speaker 2: think it is. There are perhaps other ways of doing
Speaker 2: that then using a DNA. And as I've said, the
Speaker 2: thing that always strikes me as different about DNA and
Speaker 2: the giving of DNA to other people is that you
Speaker 2: cannot change it. But the other issue, of course is
Speaker 2: that with any databases that there are in the world,
Speaker 2: they are all susceptible to privacy breach, cybersecurity attack and
Speaker 2: any organization that says, oh, I do you don't need
Speaker 2: to worry about that, we are fully protected and we
Speaker 2: have the best security in the world is absolutely telling porkies,
Speaker 2: because all of the organizations that have been hacked all
Speaker 2: said that right at the start. And as I say,
Speaker 2: with computing power, with artificial intelligence, the people who are
Speaker 2: obviously at the forefront of using that are criminals today.
Speaker 5: Growing questions after a first of its kind data breach
Speaker 5: targeting Jenny, how do you cite twenty three and me
Speaker 5: twenty three and me confirm profile information whilst taken that
Speaker 5: includes user names, passwords, gender, photo relatives in common and
Speaker 5: the percentage of DNA you share with them.
Speaker 2: So we can expect and we're all experiencing much more
Speaker 2: sophisticated attacks on people's systems from hackers and criminals. And
Speaker 2: what better pot of gold than a huge database of DNA.
Speaker 1: Thanks for joining us, Rick. That's it for this episode
Speaker 1: of The Front Page. You can read more about today's
Speaker 1: stories and extensive news coverage at enzed Herald dot co
Speaker 1: dot nz. The Front Page is produced by Ethan Seales.
Speaker 1: Dan Goodwin is the sound engineer. I'm Chelsea Daniels. Subscribe
Speaker 1: to the front page on iHeartRadio or wherever you get
Speaker 1: your podcasts, and tune in tomorrow for another look behind
Speaker 1: the headlines.