Gene Swipe: Few DNA Labs Know Whether Chromosomes Are Yours or If You Stole Them
Private detective Rocky Pipkin is a DNA thief and proud of it. Someone was sending bomb threats to one of his clients, a big manufacturing company in Fresno, Calif. But Pipkin soon figured out how to break the case. He took the mailed threat and brought it to a DNA lab, which discovered that the culprit had accidentally sneezed on one of the letters.
But that was only one piece of the puzzle. Pipkin needed more. Believing the threats to be an inside job, Pipkin invited a bunch of the company’s security guards to a meeting at his office, supplying them soda to drink there.
After the meeting concluded, Pipkin fished out the soda cans from the trash and sent them to the same lab, which identified a DNA match from the saliva in the cans to the sneezed-on letter. The discovery eventually led Pipkin to put two and two together: A guard employed by the manufacturing company was sending bomb threats in hopes of gaining overtime pay.
“We decided that it was perfectly legal and no invasion of privacy to seize those cans from the trash, even though the suspects had no idea we were collecting their DNA,” says Pipkin.
As scientists around the world continue to make breakthrough discoveries identifying and analyzing the approximately 25,000 genes in human DNA, the field has also given us something else: gene thieves.
Pipkin’s ruse to steal the DNA of individuals in the interest of solving a mystery is among the least troublesome forms of DNA theft. In other instances, gene robbing has sparked an international outcry.
For example, among the many uncomfortable truths revealed last November when WikiLeaks published classified diplomatic cables was that in 2009 the U.S. State Department had instructed its employees around the globe to gather DNA from key foreign civilian and military officials surreptitiously.
The cables didn’t explain exactly why the State Department wanted such biometric information, but genetics experts believe these covert collections are intended for use in profiling the foreign leaders in novel, cutting-edge detail—for example, determining what disease dispositions these foreign leaders might have. In the future, DNA testing might reveal what makes these leaders disposed to emotions such as happiness or grief, among other possibilities.
However, according to many legal experts, even if the DNA had been collected on U.S. soil from U.S. citizens, that doesn’t make it clearly illegal. Such surreptitious gathering of DNA—or outright theft, depending on your point of view—is a “bit of a legal mess right now,” says Dan Vorhaus, an attorney at Robinson Bradshaw & Hinson in Charlotte, N.C., and editor of the Genomics Law Report, an online publication. “There is no federal law that makes it a clear violation.”
“We leave our DNA everywhere,” says Jules Epstein, law professor at Widener University and co-chair of the Future of Evidence Committee of the ABA’s Section of Science & Technology Law. “If you smoke a cigarette and drop it or if you go to the barbershop and your hair is cut, you are leaving your DNA behind. To the extent that DNA has been abandoned, there is no invasion of privacy if others collect it.”
As the genetics era unfolds, experts wonder how governments around the world are going to begin regulating the use of someone else’s DNA without their consent. The coming legal and ethical debates will affect not only governments and law enforcement but practically everyone tempted by the possibilities of opening a Pandora’s box of secrets of both friends and foes alike.
“Should private individuals,” asks Vorhaus, “be permitted to conduct surreptitious genetic testing in certain circumstances, like to confirm paternity, but not others, like shadowing a politician or celebrity?”
In recent months, lawyers, medical practitioners and politicians have begun to discuss these questions. Already, some groups have put forward ambitious policy proposals that would revolutionize humanity’s relationship with its own genetic bearings.
Rocky Pipkin: “We decided it was perfectly legal and no invasion of privacy” to grab suspects’ DNA.
RARELY A CRIME
In studying state statutes pertaining to the permitted use of someone else’s genetic material, Duke University’s Sara Katsanis learned that in most states it is legal to collect and test someone else’s DNA without their consent. “The laws are all very sparse and random,” says Katsanis, a research associate at the Duke Institute for Genome Sciences & Policy.
According to Katsanis’ research, only about a dozen states have laws against DNA theft. Alaska has the toughest statute, prohibiting individuals from collecting DNA, performing an analysis, retaining a sample, or disclosing the results of an analysis without first obtaining the written consent of a person.
Other states don’t go quite so far, but they make informed consent a part of the DNA analysis process. Only five states—Alaska, Florida, New Jersey, New York and Oregon—characterize DNA theft as a criminal act, and the penalties for violations are very minor, mostly misdemeanors with fines up to $5,000.
So far, according to experts, there have been no prosecutions for violations of these laws and only a handful of lawsuits. Among them is a class action in Minnesota brought by parents of 25 children against the state department of health for sharing blood samples of their newborns, collected to screen for hereditable diseases but then handed over without consent to private research institutions. A state court dismissed the lawsuit, and the Minnesota Supreme Court heard oral arguments of an appeal in March. A decision is pending.
Besides laws against nonconsensual collecting and testing of DNA, there are also a variety of other statutes over improper use of DNA material—the most prominent being the 2008 Genetic Information Nondiscrimination Act, a federal statute that prohibits genetic profiling by some employers and health insurance companies. But there are enough exceptions and loopholes to GINA and state statutes to keep a science fiction writer up at night dreaming of dramatic what-ifs.
Perhaps it’s not surprising then to see some of the toughest proposed legislation coming from the New England hotbed of genetics research, specifically in Massachusetts and Vermont, where some bold politicians and health policy think tanks introduced in January a Genetic Bill of Rights for citizens, proposing that individuals should have property rights over their own DNA.
Their legislative proposals would go even further than Alaska’s statute. They would not only mandate consent for the collection and use of DNA but also spell out that individuals have a right to privacy with respect to their genetic information. They would also prohibit entities like auto insurers and money lenders from misusing DNA info. The statute recognizes that DNA has “a fair market value” and carves out only limited exceptions for violating someone else’s DNA property rights: those working under judicial order, such as police investigators. Intentional violations of the statute would carry both prison time and civil fines.
“This is a largely uncharted area, but we have to put up barriers to protect people from all these scary scenarios,” says Democratic Massachusetts state Sen. Harriette Chandler, a co-sponsor of the legislation.
Chandler adds that she looks at discarded cigarette butts, licked postage stamps and used glasses of beer more suspiciously than she did a few years ago. She’s not alone.
WAFFLE ALERT
Katsanis initiated her own research about DNA thievery a few years ago after reading about a half-eaten waffle from President Barack Obama that found its way to being for sale on eBay.
Before the online auction site took down the item, Katsanis and other members of the medical community began wondering what would happen if an Obama political opponent had purchased the half-eaten waffle with the intention of analyzing his DNA. Suppose, for example, a “birther,” who doubts Obama’s birth certificate, wishes to run an ancestry trace on the president’s saliva. “This could be harmful to society,” Katsanis says.
Elizabeth Joh, a law professor at the University of California at Davis, imagined a few scenarios in a paper released in January in the Boston University Law Review. For example: a professional sports team that wants to analyze the genetic information of a prospective player before offering a multimillion-dollar contract; fans of celebrities who might pay high prices to uncover their idols’ secrets; an individual’s personal enemy who wishes to find out about a target’s likelihood of becoming an alcoholic, a criminal or obese; or a person in a romantic relationship who wants to find out whether the other partner carries the gene for male pattern baldness or persistent miscarriage.
Widener’s Epstein hypothesizes that the police may come to your home to investigate a found Kleenex from a burglar. They ask a resident to submit his DNA, and the resident consents. The question, he says, is: “Am I consenting to testing my DNA just against the Kleenex or can police keep it for their files and share it with other agencies for other purposes?” Some believe consent is narrow, whereas others believe that everyone knows that if you turn over something to the police, they have it—end of story. This is an unresolved issue in the courts, Epstein says.
Others have also raised scary scenarios. What if a financial institution decides to use somebody’s DNA to better inform whether to lend that person money? What if a newspaper reporter decided to publish a story detailing whether certain politicians running for office were disposed to Alzheimer’s?
The United Kingdom was spurred to pass tougher legislation against DNA theft upon word of a 2002 plot to steal hair from Prince Harry to determine whether he was the genetic child of someone other than Prince Charles.
Then an article appearing after the 2008 election in The New England Journal of Medicine predicted a high chance of “genetic McCarthyism” for the 2012 presidential election should someone get their hands on a candidate’s DNA “from loose hairs, coffee cups, discarded utensils or even a handshake.”
Meanwhile, in the years since DNA pioneer Craig Venter announced in a White House ceremony right before President Bill Clinton left office that the human genome’s 3 billion base pairs of DNA had been mapped, the number of DNA testing companies catering to consumers has flourished. In the last decade, scores of companies have set up shop on the Internet, inviting people to send in DNA material for screening, diagnostic, educational or predictive purposes.
“People think these scenarios are far-fetched, but that’s before they realize how easy it is these days to collect someone’s DNA and take it to a lab,” Joh says.
A POPULAR APPROACH
One of the more noteworthy companies to come along is 23andMe. With an investment from Google, the company operates a website that might be described as Facebook-meets-genomics, in which users get to share their genetic profiles with each other.
The company’s stated goal is to be the “world’s trusted source of personal genetic information.” Thousands of individuals have purchased a 23andMe kit, spit into a tube, mailed in the sample, and six to eight weeks later gotten the opportunity to learn about their genetic profile online, including predispositions to baldness, muscle performance and 97 different diseases.
And what keeps individuals from sending in someone else’s DNA? According to Ashley Gould, general counsel for 23andMe, the Mountain View, Calif., company has enacted a consent procedure whereby consumers accept terms of service, including validating who they say they are. In some instances, the lab will run spot checks to verify at the very least that a male consumer is submitting male DNA or a female consumer is submitting female DNA, but Gould admits there’s “no 100 percent guarantee” to ensure a consumer’s honesty.
Other direct-to-consumer DNA labs aren’t even trying to dissuade surreptitious testing. For example, one outfit called DNA Solutions, based in Miami (Florida is one of the states where DNA theft is criminalized), offers consumers a “secret paternity test” costing $338 and advising customers on how to discreetly collect from others’ used toothbrushes, Q-tips, bandages and combs.
“We understand that often people want to know the results of a paternity test before they unnecessarily alarm or upset other persons,” says the company’s website. (DNA Solutions did not respond to requests for comment.)
“There has been a tremendous revolution that has led to the rise in direct-to-consumer testing,” says Mark Frankel, a staff officer at the National Conference of Lawyers and Scientists, a joint project between the ABA and the American Association for the Advancement of Science.
“More and more people have access to genetic technology to learn about themselves. There’s no reason to think that people who pick up cigarette butts and napkins and send them in to direct-to-consumer labs can’t take advantage of this. The potential for DNA theft will increase.”
Overall, Frankel says, it’s a good thing that people are getting a chance to learn about their own genealogy. And he thinks it would be tough to enforce laws under which DNA labs become “gatekeepers” for proper behavior.
But he’s also very concerned about DNA fabrication and cloning and thinks it’s ripe for abuse, particularly in the criminal law context. “They should have some procedures in place to authenticate the identity and source of DNA,” Frankel says, suggesting that new technology is on its way to do just that.
Last year, the U.S. Government Accountability Office issued a startling report that detailed the findings of an investigation into the market for direct-to-consumer DNA testing. Besides uncovering the fact that many companies were making misleading genetics claims, the GAO also had volunteers posing as consumers make undercover calls seeking advice.
One such call went this way:
Fictitious consumer: I thought it would be an awesome gift to give my fiance his DNA tested with mine.
Company representative: Oh yeah, that would be great!
Fictitious consumer: And I was planning on submitting it for him and surprising him—is that OK?
Company representative: You could surprise him and let him know that it’s the ancestry test and then surprise him with the health information too. …
Fictitious consumer: OK, so as long as I can get the vial of saliva somehow, I can send it in and you can test it for me.
Company representative: Absolutely … yeah, we have people we just don’t know that that’s what they’re doing. People will purchase something, send it in and get the results.
Some brokers in the DNA testing industry say they aren’t surprised by this at all. Dr. Robert Wenk, medical director at BRT Laboratories in Baltimore, says the industry is beset with “systemic fraud.” Examining some of the submissions to his own lab recently, Wenk uncovered how a number of people from Ghana were traveling to the U.S., collecting DNA, and then submitting pairs of DNA samples in order to gain documentation of familial relationships. The goal of these individuals, says Wenk, was to fool the U.S. government into rubber-stamping applications for citizenship.
Part of the blame for abuse in the system—and one of the big reasons there are no worthwhile checks against DNA theft currently—is that many direct-to-consumer forensic labs are unregulated. Few states require government accreditation of any kind, leaving the industry to police itself. And thanks to a booming market, the rules by which DNA labs take samples have become more lax.
For example, Wenk says that the AABB (formerly the American Association of Blood Banks), a standards organization that accredits many DNA labs around the world, once prohibited individuals from sending testing material through postal mail.
“But now, because this has become such an important market, labs can take samples in the mail, and the only requirement is you can’t mention this on the same website marketing the private testing services you offer for official, legal purposes,” says Wenk. “The [AABB] rules are certainly not as stringent as they were 15 years ago.”
The AABB didn’t respond to requests for comment.
In the past few months, a number of advocates have started to argue for stricter measures that would criminalize DNA theft, prohibit financial institutions and other organizations from using DNA material for decision-making purposes, and place a greater onus on DNA labs to be the gatekeepers to ensure that malevolent activity doesn’t occur.
“We see a coming storm and view this as a civil rights issue for a new era,” says Steve May, president of the Forum on Genetic Equity, whose not-for-profit group based in Hull, Mass., was instrumental in first proposing the Massachusetts and Vermont statutes. “It’s critically important to us to balance the needs of researchers and labs to innovate while, at the same time, making commonsense road signs for the future.”
Some DNA organizations and less-government activists may fight extensive regulation as bureaucratic red tape that potentially interferes with progress in the medical community. Nobody wants legislation that, for example, impedes the discovery of a cure for cancer.
Others in the medical community say DNA theft is a real problem; they are open-minded to new rules, but hope the solutions are reasonable.
“I guess I wouldn’t be opposed to a requirement that identity of DNA samples be firmly established from consensual custody, but I do worry that it’s going to cost a lot to implement in some situations, whereas the harm occurs in an extremely small percentage of cases,” says Joe Gorman, general counsel of the Paternity Testing Corp. in Columbia, Mo.
If the new laws do come, several leaders in the DNA lab community would prefer it happen at the federal level.
“A single national standard would go a long way to making it easier to understand the cost of regulation, which now happens mostly on a state-to-state basis,” says 23andMe’s Gould, who participated in discussions with the Food and Drug Administration in March regarding a rule the agency is currently considering that would require a DNA test to be ordered by a medical professional.
Of course, there’s always the possibility that no matter what regulations are in place, surreptitious DNA collection and testing might be inevitable. One of the distinguishing features of DNA, after all, is the fact that every individual shares genetic material with others—namely, family members. Even if new laws confer personal property rights to individuals over their own DNA, they may not go far enough to protect an individual’s family members from unwittingly sharing that person’s genetic secrets.
As an example, in 2008, when police in Los Angeles were hunting for a serial killer known as “the Grim Sleeper,” who had left some of his DNA at a crime scene, they began testing prison inmates to see whether a family relationship to the killer could be spotted. One prisoner tested as a close relative to the serial killer. Using this information, police constructed a family tree and then surreptitiously obtained a discarded pizza slice from the convict’s father. A DNA match came back.
“The familial implications are ripe for more discussion,” says Rich Williams, a policy associate at the Denver-based National Conference of State Legislatures’ Criminal Justice Program. Williams, who is in charge of keeping the organization’s DNA Laws Database, asks, “Should privacy rights extend that far?”
Like many observers who have one foot in science and another foot in law, Frankel of the National Conference of Lawyers and Scientists is unsure about where to go from here. On the one hand, he finds it problematic that someone can steal someone else’s DNA and profile him or her genetically. “We, as humans, have an expectation of privacy that’s coming into conflict with these new revelations.”
On the other hand, he doesn’t want to foreclose avenues of research or stop people from having access to important insights about their own genetic upbringing. “There might not be a one-size-fits-all approach,” he concludes.
Gould says 23andMe tells its customers in its privacy policy to be mindful and respectful of family members, but she isn’t sure what the organization would do if a family member of one of its customers contacted the company with demands to pull down a customer’s genetic profile.
But she does have one prediction:
“It’s not a stretch to imagine that [once parents start opting into genetics databases], there will come a time when babies will be fully sequenced in,” she says. “This is something we all have to get our arms around. Ultimately, it’ll be the individual’s responsibility to be mindful of what’s out there.”
Eriq Gardner is a freelance writer in New York City.
