‘Know your DNA’ databases could fall into the wrong hands. Policymakers should regulate it

In July last year, I went to Poland to learn about the Holocaust. Having Jews amongst my ancestors, I felt obliged to visit Auschwitz, Majdanek, and Sobibor, and visit the POLIN Museum in Warsaw, which tells the 1000-year-long history of Polish Jews.

This visit made me realise not only the sheer scale of the genocide that the Nazis committed but also how easy it is for me, a person of a multicultural background born in the 21st century, to perceive anti-semitism and racism as something historical and too slowly, but on its way out of the world.

In Majdanek and Auschwitz, there were still remains of gas chambers, where one could see the stains of Zyklon-B on the walls and the furnaces that turned the remains of people murdered into fertiliser. The fact that it took around eighteen minutes to kill a person with poisonous gas was terrifying, but the most terrifying was the huge amounts of hair, shoes, and other belongings that were collected from the dead. This was real and uncensored.

I do not know if my decision to take a DNA test and learn about my genetic makeup resulted from learning about the horrors of the Holocaust, but if it was so, the connection took place subconsciously. A month after I visited Poland, I sent a sample of my DNA to a company which broke it down to establish my ancestry.

A couple of weeks later, the company informed me that my results were ready. I logged onto their website and learned that, indeed, I am 13% Ashkenazi Jewish. The test also revealed that I, a Russian passport holder, am actually not much more Russian than I am Jewish – the part of my DNA that originates from various Russian territories (from Dagestan to Murmansk) amounts to a mere 18%. I also learned that 4% of me originates from the Baltic region – either Latvia or Lithuania.

All of that, however, was dwarfed by a massive surprise. In proportionally larger letters than the rest of the information, the website informed me: “65% of your ancestors are Ukrainians from Western Ukraine”. Before the test, I only knew that one of my great-grandparents was born in Odessa.

The company naturally claims that it employs state-of-the-art security measures, but in reality, only a login and password are needed to access the data. Any bank, or even a gaming launcher, has a two-step verification – it sends a text message or requires confirmation in a mobile application to verify a purchase.

What I’m saying is that even with all precautions employed, there is always a chance of getting hacked. Nothing indicates that ancestry DNA databases store personal data in any different place than the information about one’s DNA. Effectively, there is very little reason to believe that websites of this kind would be a challenge for a hacker group, especially one that has backing from organised crime – or a rogue state.

To make things worse, DNA does not belong to one person. Breaking into a gaming site or a bank account can result in significant financial damage, but DNA is shared with all the people one is related to, so those who would mean harm to any of the groups my background consists of would acquire evidence that also puts every person related to me in danger.

The construction of these websites incentivises being truthful – clients share their names so that the service can put them in touch with their unknown relatives. Effectively, stealing data about one person allows hackers and all those behind them to get data about all their relatives who had never taken a test.

This leads me to the big question: if these companies might be used to target particular groups based on their DNA, why aren’t policymakers employing standards that would render it difficult or nearly impossible? One could think of a number of solutions, from database safety requirements to anonymisation of data, so it would be impossible to match a particular person in the world to a DNA sample. For now, it seems, nothing is being done – which is like extending an invitation for history to repeat itself.