A Survey on Interdependent Privacy <s> Genomic Data <s> DNA analysis is increasingly used in forensics, where it is being pushed as the holy grail of identification. But we are approaching a dramatic "phase change" as we move from genetics to genomics: when sequencing the entire genome of a person becomes sufficiently cheap as to become a routine operation, as is likely to happen in the coming decades, then each DNA examination will expose a wealth of very sensitive personal information about the examined individual, as well as her relatives. In this interdisciplinary discussion paper we highlight the complexity of DNA-related privacy issues as we move into the genomic (as opposed to genetic) era: the "driftnet" approach of comparing scene-of-crime samples against the DNA of the whole population rather than just against that of chosen suspects; the potential for errors in forensic DNA analysis and the consequences on security and privacy; the civil liberties implications of the interaction between medical and forensic applications of genomics. For example, your kin can provide valuable information in a database matching procedure against you even if you don't; and being able to read the whole of a sampled genome, rather than just 13 specific markers from it, provides information about the medical and physical characteristics of the individual. Our aim is to offer a simple but thought-provoking and technically accurate summary of the many issues involved, hoping to stimulate an informed public debate on the statutes by which DNA collection, storage and processing should be regulated. <s> BIB001 </s> A Survey on Interdependent Privacy <s> Genomic Data <s> David Craig and colleagues recently reported methods allowing detection of individual genotypes from summary data of high-density SNP arrays. Eran Halperin and colleagues now report analyses of the statistical power of these methods, employing likelihood ratio statistics to provide an upper-bound to the limits of detection. <s> BIB002 </s> A Survey on Interdependent Privacy <s> Genomic Data <s> Factorial vignette studies combine survey methodologies with an experimental research design, and allow researchers to examine subjects’ reactions to hypothetical scenarios (vignettes) while controlling for variables within the scenarios. Slightly different versions of the vignettes are randomly assigned to respondents. This chapter guides readers through the necessary steps to craft, administer, and analyze a factorial survey. After first assessing the suitability of a factorial vignette design to the topic, researcher should settle on the number of variables according to budget constraints, and then craft realistic vignettes with multiple versions according to the number of variables. This chapter provides guidelines as to programming the survey, sampling populations, and administration of the survey. Finally, it examines the presentation of findings and the typical limitations of a factorial study. <s> BIB003 </s> A Survey on Interdependent Privacy <s> Genomic Data <s> The rapid progress in human-genome sequencing is leading to a high availability of genomic data. This data is notoriously very sensitive and stable in time. It is also highly correlated among relatives. A growing number of genomes are becoming accessible online (e.g., because of leakage, or after their posting on genome-sharing websites). What are then the implications for kin genomic privacy? We formalize the problem and detail an efficient reconstruction attack based on graphical models and belief propagation. With this approach, an attacker can infer the genomes of the relatives of an individual whose genome is observed, relying notably on Mendel's Laws and statistical relationships between the nucleotides (on the DNA sequence). Then, to quantify the level of genomic privacy as a result of the proposed inference attack, we discuss possible definitions of genomic privacy metrics. Genomic data reveals Mendelian diseases and the likelihood of developing degenerative diseases such as Alzheimer's. We also introduce the quantification of health privacy, specifically the measure of how well the predisposition to a disease is concealed from an attacker. We evaluate our approach on actual genomic data from a pedigree and show the threat extent by combining data gathered from a genome-sharing website and from an online social network. <s> BIB004 </s> A Survey on Interdependent Privacy <s> Genomic Data <s> Progress in Whole Genome Sequencing (WGS) will soon allow a large number of individuals to have their genome fully sequenced. This lays the foundations to improve modern healthcare, enabling a new era of personalized medicine where diagnosis and treatment is tailored to the patient's genetic makeup. It also allows individuals motivated by personal curiosity to have access to their genetic information, and use it, e.g., to trace their ancestry. However, the very same progress also amplifies a number of ethical and privacy concerns, that stem from the unprecedented sensitivity of genomic information and that are not well studied. This paper presents an exploratory ethnographic study of users' perception of privacy and ethical issues with WGS, as well as their attitude toward different WGS programs. We report on a series of semi-structured interviews, involving 16 participants, and analyze the results both quantitatively and qualitatively. Our analysis shows that users exhibit common trust concerns and fear of discrimination, and demand to retain strict control over their genetic information. Finally, we highlight the need for further research in the area and follow-up studies that build on our initial findings. <s> BIB005 </s> A Survey on Interdependent Privacy <s> Genomic Data <s> The human genetics community needs robust protocols that enable secure sharing of genomic data from participants in genetic research. Beacons are web servers that answer allele-presence queries—such as “Do you have a genome that has a specific nucleotide (e.g., A) at a specific genomic position (e.g., position 11,272 on chromosome 1)?”—with either “yes” or “no.” Here, we show that individuals in a beacon are susceptible to re-identification even if the only data shared include presence or absence information about alleles in a beacon. Specifically, we propose a likelihood-ratio test of whether a given individual is present in a given genetic beacon. Our test is not dependent on allele frequencies and is the most powerful test for a specified false-positive rate. Through simulations, we showed that in a beacon with 1,000 individuals, re-identification is possible with just 5,000 queries. Relatives can also be identified in the beacon. Re-identification is possible even in the presence of sequencing errors and variant-calling differences. In a beacon constructed with 65 European individuals from the 1000 Genomes Project, we demonstrated that it is possible to detect membership in the beacon with just 250 SNPs. With just 1,000 SNP queries, we were able to detect the presence of an individual genome from the Personal Genome Project in an existing beacon. Our results show that beacons can disclose membership and implied phenotypic information about participants and do not protect privacy a priori. We discuss risk mitigation through policies and standards such as not allowing anonymous pings of genetic beacons and requiring minimum beacon sizes. <s> BIB006 </s> A Survey on Interdependent Privacy <s> Genomic Data <s> Individuals (and their family members) share (partial) genomic data on public platforms. However, using special characteristics of genomic data, background knowledge that can be obtained from the Web, and family relationship between the individuals, it is possible to infer the hidden parts of shared (and unshared) genomes. Existing work in this field considers simple correlations in the genome (as well as Mendel’s law and partial genomes of a victim and his family members). In this paper, we improve the existing work on inference attacks on genomic privacy. We mainly consider complex correlations in the genome by using an observable Markov model and recombination model between the haplotypes. We also utilize the phenotype information about the victims. We propose an efficient message passing algorithm to consider all aforementioned background information for the inference. We show that the proposed framework improves inference with significantly less information compared to existing work. <s> BIB007 </s> A Survey on Interdependent Privacy <s> Genomic Data <s> Genetics and genetic data have been the subject of recent scholarly work, with significant attention paid towards understanding consent practices for the acquisition and usage of genetic data as well as genetic data security. Attitudes and perceptions concerning the trustworthiness of governmental institutions receiving test-taker data have been explored, with varied findings, but no robust models or deterministic relationships have been established that account for these differences. These results also do not explore in detail the perceptions regarding other types of organizations (e.g., private corporations). Further, considerations of privacy interdependence arising from blood relative relationships have been absent from the conversation regarding the sharing of genetic data. This paper reports the results from a factorial vignette survey study in which we investigate how variables of ethnicity, age, genetic markers, and association of data with the individual's name affect the likelihood of sharing data with different types of organizations. We also investigate elements of personal and interdependent privacy concerns. We document the significant role these factors have in the decision to share or not share genetic data. We support our findings with a series of regression analyses. <s> BIB008
Context. The genetic information of a human being (i.e., their genome) is encoded as a sequence of around 3 billion nucleotides pairs [Klug et al. 2003 ]. In each pair of nucleotides, one nucleotide is inherited from their mother, taken at random from the mother's corresponding nucleotide pair during the production of one of her reproductive cells, and the other one from their father, also taken at random during the production of his reproductive cells. As a consequence of genetic inheritance, the genomic data of an individual is correlated with those of their parents and children but also, by extension, with those of their family members at large. Recent advances in genomics have enabled the development of direct-to-consumer genetic sequencing services (e.g., 23andme 18 ) that enable individuals to obtain their genomic data from a biological sample (typically saliva). Genetic data collected this way is sometimes shared on online platforms (e.g., openSNP 19 ) for various purposes, including finding relatives, learning about family history, or advancing research. Therefore, such data becomes available to different entities, beyond the sequencing services, such as online platform operators or even the public. Not only is the genome of an individual immutable but it reveals very sensitive information about the individual, including their physical appearance and their predisposition to diseases (e.g., Alzheimer's). Such information can be used for all sorts of discrimination, for instance when setting (health) insurance premiums. Risks. Humbert et al. were the first to formalize the problem of interdependent privacy risks with genomic data between family members BIB004 , also known as the kin genomic privacy problem (a concept introduced in BIB001 ). They rely on factor graphs, a particular type of PGMs (see Section 3.1), to model the statistical relationships between the genomic data of family members. They conduct inference by using the belief propagation algorithm and by quantifying privacy based on the output of the inference. To validate their model and assess the magnitude of the risk, they conduct data-driven simulations based on a CEPH/Utah Pedigree, a dataset consisting of the (partial) genomes of N = 17 family members (4 grandparents, 2 parents, and 11 children). Their results show that the genome of an individual can be inferred to a large extent from those of their family members: In the considered dataset, the genomic privacy of the father (quantified as the inference error) is decreased by around 90% when the genomes of his parents, his wife, and four of his children are known. In their follow-up work, Humbert et al. further improve the inference attack by using a generic Bayesian network (see Section 3.1) and by taking into account phenotypic information (e.g., diseases or physical traits), hence showing that the risks are even more serious ]. Deznabi et al. improve the model of Humbert et al. by considering phenotypic information and high-order correlations between the genomic variants BIB007 . 20 The authors run extensive experiments and demonstrate that high-order correlations can significantly improve inference, hence damage privacy, even with very few relative(s) sharing their genomic data. In a follow-up work, Humbert et al. propose an algorithm for evaluating kin genomic privacy in a data-less fashion, i.e., they rely only on the family tree and on the list of family members whose genomes are known to the adversary (not the genomic data itself) ]. To do so, they rely on Bayesian networks and consider, for each position in the genome, all possible combinations of nucleotides for the sequenced family members. The authors provide an online tool, in the form of a web application, that enables users to build their family trees and to evaluate the genomic privacy of their relatives (including themselves). 21 Backes et al. study the impact of such genetic interdependencies at scale with the (synthetic) genotypes of N = 1,000 individuals over five generations ]. These genotypes were generated through simulations. They evaluate to which extent the sharing of genomic data of a fraction of individuals in this population influences the privacy of others. They observe that the global genomic privacy decreases super-linearly w.r.t. the sharing rate. Berrang et al. generalize this probabilistic approach and propose a Bayesian network model that encompasses three dimensions of dependencies: (i) between relatives, (ii) between data at different points in time, and (iii) between different biomedical data types ]. More precisely, the authors rely on a dataset containing the genomic and epigenomic (DNA methylation) data of mother-child pairs, and at two or three different time points for some of the individuals. Unlike in previous work, the structure of the Bayesian network and its parameters are not fully known to the adversary; instead, they are learnt from training data by relying on maximum likelihood estimation (MLE) The results show that, by knowing the methylation data of the child and genomic data of the mother, the estimation error on the mother's methylation data is reduced to 0.1 or less for 60% of the positions, compared to 10% of the positions when using only population statistics. Ayday and Humbert survey the various inference attacks and possible solutions in kin genomic privacy . In addition to (some of) the aforementioned literature, they cover the works on membership inference in genomic databases. Membership inference consists in determining whether a target is part of a database by knowing some of their raw (genomic) data and comparing it to aggregate statistics. In this context, Sankararaman et al. show that it is possible to infer the membership of a first-degree relative (i.e., parents, children, or siblings) of the target with the same success as inferring the target's membership by having access to four times more 20 A genomic variant denotes a position in the human genome where the nucleotides differ in the population (i.e., not all human beings have the same nucleotide at this position). In the biomedical community, this is more precisely referred to as single-nucleotide variant (SNV). 21 https://santeperso.unil.ch/privacy/?survey, last visited: June 2019. of genomic variants BIB002 ]. Shringarpure and Bustamante present a novel membership inference attack against genetic data-sharing beacons BIB006 . A beacon is a web server that replies to queries about the presence of a given nucleotide at a certain position (in the genome) in its database with binary answers ("yes"/"no"). In this context, the authors study the power of membership inference for various degrees of relatedness and show that it is possible to achieve high success for first-degree relatives by having access to 40k variants. This specific membership inference risk was recently put under the spotlight with the Golden State Killer case, where distant relatives of one of the suspects (whose DNA was found on the crime scene) were identified using the GEDmatch database, 22 which eventually enabled the police to uniquely identify the culprit   . Note that, in this survey, we focus only on membership inference attacks that affect individuals because of correlations. Concerns. Weidman et al. perform a vignette survey study BIB003 ] to explore the impact of key factors, such as demographic characteristics, on trust, personal and interdependent privacy, and on genetic data-sharing intentions BIB008 . Specifically, the authors design two vignettes: (i) They ask the respondent to answer questions regarding the sharing of their own genomic data, and (ii) they ask the respondent to answer questions assuming friends or siblings seek advice about sharing their genomic data. The survey (N = 524 Amazon mechanical turk (MTurk) users) notably shows that if the genomic data is not anonymized (i.e., linked to an identity in the real world through a name), it is less likely that the owner of the genome shares this data or advises others to share their data. Furthermore, it shows that concerns for a relative's privacy is significantly influenced by the entity requesting the data (government research group, private medical group, or academic research group) in the first vignette, and by the age of the advisor in the second vignette. In the same vein, De Cristofaro studies users' perception of privacy and related ethical issues in an interview-based study involving N = 16 participants BIB005 . In particular, this study demonstrates that, for 14 out of the 16 respondents, the case where siblings share their genomes for research induces less discomfort than the case of sharing labor or health insurance discrimination or of hacked genome.