Security Breach Exposes More Than One Million DNA Profiles On Major Genealogy Database (buzzfeednews.com) 28
An anonymous reader quotes a report from BuzzFeed News: On July 19, genealogy enthusiasts who use the website GEDmatch to upload their DNA information and find relatives to fill in their family trees got an unpleasant surprise. Suddenly, more than a million DNA profiles that had been hidden from cops using the site to find partial matches to crime scene DNA were available for police to search. The news has undermined efforts by Verogen, the forensic genetics company that purchased GEDmatch last December, to convince users that it would protect their privacy while pursuing a business based on using genetic genealogy to help solve violent crimes.
A second alarm came on July 21, when MyHeritage, a genealogy website based in Israel, announced that some of its users had been subjected to a phishing attack to obtain their log-in details for the site -- apparently targeting email addresses obtained in the attack on GEDmatch just two days before. In a statement emailed to BuzzFeed News and posted on Facebook, Verogen explained that the sudden unmasking of GEDmatch profiles that were supposed to be hidden from law enforcement was "orchestrated through a sophisticated attack on one of our servers via an existing user account." "As a result of this breach, all user permissions were reset, making all profiles visible to all users. This was the case for approximately 3 hours," the statement said. "During this time, users who did not opt in for law enforcement matching were available for law enforcement matching and, conversely, all law enforcement profiles were made visible to GEDmatch users." It's unclear whether any unauthorized profiles were searched by law enforcement.
A second alarm came on July 21, when MyHeritage, a genealogy website based in Israel, announced that some of its users had been subjected to a phishing attack to obtain their log-in details for the site -- apparently targeting email addresses obtained in the attack on GEDmatch just two days before. In a statement emailed to BuzzFeed News and posted on Facebook, Verogen explained that the sudden unmasking of GEDmatch profiles that were supposed to be hidden from law enforcement was "orchestrated through a sophisticated attack on one of our servers via an existing user account." "As a result of this breach, all user permissions were reset, making all profiles visible to all users. This was the case for approximately 3 hours," the statement said. "During this time, users who did not opt in for law enforcement matching were available for law enforcement matching and, conversely, all law enforcement profiles were made visible to GEDmatch users." It's unclear whether any unauthorized profiles were searched by law enforcement.
So they essentially killed their business model? (Score:3, Insightful)
Which was, obviously, selling to the cops, the feds and other unsavory characters.
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Why is this downmodded? The post makes a valid point and is not inflammatory.
Thanks. I will take your comment instead of a positive moderation.
Re: So they essentially killed their business mode (Score:1)
Or they just take it, without paying.
IMO, posting selfies, posting selfies while masked, volunteering your DNA, and any other identifying feature is universally stupid. How do you know in 20 years you wont have to oppose a madman running the government. Whether or not u think trump is that madman is irrelevant. Why did you give up your anonymity? Did 1984 teach you nothing? Did you just buy the cliff notes?
Re: (Score:3)
Or they just take it, without paying.
IMO, posting selfies, posting selfies while masked, volunteering your DNA, and any other identifying feature is universally stupid. How do you know in 20 years you wont have to oppose a madman running the government. Whether or not u think trump is that madman is irrelevant. Why did you give up your anonymity? Did 1984 teach you nothing? Did you just buy the cliff notes?
The important takeaway from the 2016 Presidential election (the Trump election in the same vein as the China virus):
Whether you're pro-Don, Anti-Don, or Agamemnon, you'll be forced to acknowledge it's now clearly possible for the US to elect a President interested in suspending any semblance of democracy to better his personal agenda, right or wrong.
That's all the ingredients necessary for the Republic to slip into something much less palatable. What's left of childhood me occasionally sits there in horro
Re: (Score:2)
Exactly. And while checks and balances still work to a degree, each time such a person gets into office they are weakened. This one now sends goons GeStaPo style into cities that do what in any sane country would be completely illegal arrests, as they basically vanish people. As far as we know everybody arrested still tuned up again later, but "You look for your husband/wive/daughter/son? Sorry, we do not have them." is only a step away. When they kill the first vanished person by accident or "by accident",
Re: (Score:2)
which is why you should be an anti-federalist. What I see is that most anti-trump people are still super federalist. They expect the federal government to just magically solve any and all their problems, even before they try and solve them themselves. They figure these loopholes and powers are ok as long as its not trump. My argument is that its never ok to cede this much power. And if your default move is to look to the government for help every time you stump your toe, they turned you into a sheep. The sc
Re: (Score:2)
Or they just take it, without paying.
IMO, posting selfies, posting selfies while masked, volunteering your DNA, and any other identifying feature is universally stupid. How do you know in 20 years you wont have to oppose a madman running the government. Whether or not u think trump is that madman is irrelevant. Why did you give up your anonymity? Did 1984 teach you nothing? Did you just buy the cliff notes?
Exactly. The 4th Reich will have no trouble identifying anybody they want to get rid of fast. They will have the complete lists ready before they even take over.
Re: (Score:2)
Sorry to tell you this, but the future is here, whether you like it or not. Just like global warming we need to learn to adapt to something that is inevitable (unless we nuke ourselves back to the Middle Ages).
Re: (Score:2)
Sorry to tell you this, but the future is here, whether you like it or not. Just like global warming we need to learn to adapt to something that is inevitable (unless we nuke ourselves back to the Middle Ages).
That tired old nonsense again. Please stop claiming religion-like inevitability for things that everybody can meaningfully influence.
Re: (Score:2)
The police in the UK alone have unfettered access to over 2 million cameras, around half of which record. Some of the facial recognition systems have over a 90% accuracy rate in good conditions and 70% under poor conditions. Tens of thousands of license plate readers are installed nationwide on toll roads, almost all run by private companies that will sell the data to anyone who wants it, and tens of thousands more in private and public locations like parking garages and smart streetlights. It's pretty m
Re: (Score:2)
Well, that is basically because you do not understand the situation. First, of course you have privacy. You do not have privacy _everywhere_, but that has been true since there was more than 1 human being. Second, there have always been limits to what is allowed compared to what is possible.
Do you have a camera in your bathroom and bedroom? No? Even if yes, there are laws that prevent the enemies of privacy from demanding that you install those. On the Internet, they have exactly as much data as _you_ chose
Re: (Score:2)
I suppose it depends on the degree to which you want to inconvenience yourself and everyone you interact with. Still, the idea of being anonymous in public is really a fairly new construct, only possible once cities grew beyond about 50,000 people and populations became voluntarily mobile. Prior to around 1850 everyone knew essentially everyone within their area, and pretty much everything they were up to, there was no privacy outside your bedroom (assuming you even had walls and doors around your bed, wh
Re: (Score:2)
not quite, but I imagine we are maybe 10yrs out. Right now the checks and balances are barely holding everything together. Now if they were to maybe poison a couple more scotus judges and make it look like a heart attack, I'd begin to worry. the most toxic environment we have, believe it or not, is congress. You can pick any hot topic item, any at all, and I can point to exactly how congress was supposed to do something about it but didnt, instead passing the buck.
No big deal! (Score:3)
It's unclear whether any unauthorized profiles were searched by law enforcement.
It's okay that they could have downloaded your info-- just change your....DNA ??? No problem.
Re: (Score:2)
We already know... (Score:1)
Data from breaches end up in law enforcements hands, anyone giving away DNA samples should expect this. Abuses of personal information is to be expected, all we can do is demand laws to punish those who obtain it without a search warrant/without cause/unlawfully.
things that make you go "hmmmmm" (Score:3)
From a Slate article [slate.com] circa 12/2019:
Each decision created controversy. At first, Rogers’ policy was that GEDmatch would only be used to help solve the most egregious violent crimes—like murder and sexual assault. But he changed his mind after Utah law enforcement contacted Rogers for assistance in a 2018 assault case they were investigating. First, he made an exception. Then, a few months later, he codified the change and expanded the definition of “violent crime” to include “murder, nonnegligent manslaughter, aggravated rape, robbery, or aggravated assault.”
(GEDmatch co-founder Curtis Rogers)
Perhaps now that the information has been released into the wild, Mr Roger's moral ambiguity can be laid to rest.
Family (Score:3, Insightful)
Re: (Score:2)
It's not even limited to '23 and me'.
Don't we all have that uncle or brother-in-law who, without fail, fucks up Thanksgiving dinner for the entire family?
Re: (Score:2)
Not searched.... (Score:3)
"It's unclear whether any unauthorized profiles were searched by law enforcement" Maybe they just cloned the whole database in those three hours instead.
All your genes are belong to us... mwahahahahah.
Security Breach Exposes ... Genealogy Database (Score:4, Interesting)
What did you really THINK was going to happen? If you know then EVERYONE can know. Think spearfishing, either logical or physical.
Yeah, let's just all go ahead and get rid of passwords too and use fingerprints; that'll go well. Oh, the data got "copied?" Just use another finger. Repeat x9 more times, and then? We'll just use your DNA, what could go wrong?
Change your finger(print), change your DNA; it's easy enough. That dead guy over there with Corona isn't using his fingers, he won't mind if we swap.
Changing my password is slightly easier and with many less hospital visits than changing my fingerprints or DNA. And what if I don't WANT to authenticate?
Truth stranger than fiction... (Score:2)
Most modern terrorist movie plots go something like they hack some unrelated thing, which forces a lockdown in some super sensitive secure area. The terrorists then use that knowledge to take advantage of some flaw in the process and wreak havoc.
It sounds farfetched, but that's fictional TV/movie plots for you that get written because it makes it exciting and the hole is always there to give the writers the means to continue the story.
Instead, it seems it happens in real life, where a hack causes a lockdown
Your Info Is Already Out There (Score:3)
This is why you don't use these services (Score:2)
Subject pretty much says it all.
This is why I'll NEVER use any of these services, even though I think tracing family trees is an interesting hobby/getting to know your long forgotten relatives.
Once the (DNA) data is out of your hands, it's out of your control, no matter what the companies "terms of serivce" say.