Computer Security Risks of Distant Relative Matching in Consumer Genetic Databases
This addresses security vulnerabilities in consumer genetic databases that could affect millions of users, with potential real-world harms like fraud and blackmail, though it is incremental in systematizing known risks and proposing existing solutions.
The paper tackles the computer security and privacy risks of relative matching in consumer genetic databases, revealing that manipulated or forged genetic profiles can be used for malicious purposes like misdirecting investigations or defrauding victims, and it discusses mitigation solutions such as digital signatures.
Consumer genetic testing has become immensely popular in recent years and has lead to the creation of large scale genetic databases containing millions of dense autosomal genotype profiles. One of the most used features offered by genetic databases is the ability to find distant relatives using a technique called relative matching (or DNA matching). Recently, novel uses of relative matching were discovered that combined matching results with genealogical information to solve criminal cold cases. New estimates suggest that relative matching, combined with simple demographic information, could be used to re-identify a significant percentage of US Caucasian individuals. In this work we attempt to systematize computer security and privacy risks from relative matching and describe new security problems that can occur if an attacker uploads manipulated or forged genetic profiles. For example, forged profiles can be used by criminals to misdirect investigations, con-artists to defraud victims, or political operatives to blackmail opponents. We discuss solutions to mitigate these threats, including existing proposals to use digital signatures, and encourage the consumer genetics community to consider the broader security implications of relative matching now that it is becoming so prominent.