Addressing the concerns of the lacks family

Abstract

The rapid progress in human-genome sequencing is leading to a high availability of genomic data. This data is notoriously very sensitive and stable in time. It is also highly correlated among relatives. A growing number of genomes are becoming accessible online (e.g., because of leakage, or after their posting on genome-sharing websites). What are then the implications for kin genomic privacy? We formalize the problem and detail an efficient reconstruction attack based on graphical models and belief propagation. With this approach, an attacker can infer the genomes of the relatives of an individual whose genome is observed, relying notably on Mendel's Laws and statistical relationships between the nucleotides (on the DNA sequence). Then, to quantify the level of genomic privacy as a result of the proposed inference attack, we discuss possible definitions of genomic privacy metrics. Genomic data reveals Mendelian diseases and the likelihood of developing degenerative diseases such as Alzheimer's. We also introduce the quantification of health privacy, specifically the measure of how well the predisposition to a disease is concealed from an attacker. We evaluate our approach on actual genomic data from a pedigree and show the threat extent by combining data gathered from a genome-sharing website and from an online social network.

Routes for breaching and protecting genetic privacy

“…He then exploits this information to estimate genetic predispositions for relatives whose genetic information is inaccessible. A recent study demonstrated the feasibility of this attack by taking advantage of self-identified genetic datasets from OpenSNP.org, an internet platform for public sharing of genetic information 79 . Using Facebook searches, the research team was able to find relatives of the individuals that self-identified their genetic datasets.…”

Evaluating the Strength of Genomic Privacy Metrics

“…Because the genome of a somatic human cell is diploid, that is, it is comprised of two sets of chromosomes -one set inherited from the father, and the other set inherited from the mother -each SNP is present in two copies. Therefore, a given SNP can be encoded as 0, 1, or 2 corresponding to the combinations AA, Aa, and aa [Humbert et al 2013]. Population-wide frequencies of alleles A and a can be estimated from a sample of human genomes; this has been done in the 1000 Genomes project 1 .…”

“…Broadly, privacy metrics measure characteristics of privacy enhancing technologies and quantify how much privacy a technology offers [Clauß and Schiffner 2006], for example, the adversary's probability to break a user's anonymity [Serjantov and Danezis 2002], or the maximum amount of bits of private information an adversary can infer [Diaz et al 2003]. In the context of genomic privacy, most research applies existing privacy metrics to genomic privacy scenarios Humbert et al 2013;Samani et al 2015]. Some researchers also propose new metrics specific to genomic privacy Humbert et al 2013].…”

“…We assume that the adversary uses an inference attack to compute a probability distribution for each variation in the target genome. This is a reasonable assumption, because several inference attacks have already been described, for example exploiting linkage disequilibrium ], exploiting information from kin genomes [Humbert et al 2013;Humbert et al 2014], exploiting systematic execution of genomic tests [Goodrich 2009], and using statistics to infer whether an individual participated in a genome-wide association study [Homer et al 2008;Wang et al 2009].…”

On genomics, kin, and privacy

“…For example, owners of some genomes uploaded to openSNP can be de-anonymised using their Facebook profiles. For 6 individuals who publicly revealed the names of some of their relatives on Facebook, 29 familial relationships could be identified 9 . ( B ) Decrease in genomic privacy of the target person (circled in red) when the genomes of his family members are gradually revealed.…”