Tuesday, 17 December 2019

An update on EU kits at GEDmatch and a message from Curtis Rogers

We learnt last week that GEDmatch has been acquired by the forensics company Verogen. I now have some further information about the handling of European Union users at GEDmatch. When the sale first went through only a small number of EU users were presented with a consent form in order to access the website. We thought at the time that the form was only being shown to those who had an identifiable e-mail address in the EU. I did not have to re-consent when I first tried to log onto GEDmatch, presumably because my e-mail address had a .com suffix and not a .co.uk suffix. That all changed some time last week, and Verogen are now identifying EU users by their IP address. As a result I found that I had to re-consent to use the site. Below are screenshots of the data transfer form which all EU users are now required to sign.


Having signed the form you are then presented with this screen.


You are then given the option to decide on a kit by basis which kits you would like to transfer to Verogen, which kits you would like to delete and which kits you would like to decide about later.

Many people have been reporting that they've lost a lot of matches at GEDmatch and that some of their kits have disappeared. Genetic genealogist Paul Watkins contacted Verogen and he has given me permission to share the contents of the reply he received which explains what has been happening:
While we did have issues with Kits “disappearing” this week from UK users, the main reason that matches are looking like they disappear is that people who are subject to European General Data Privacy Regulations (GDPR) have been pulled out of the database temporarily, as we are legally required to obtain consent to transfer control of users data to Verogen.

Unfortunately, in addition, to known EU users, there are also many users that we do not know their location (we use the IP address of the user when they login to determine the country of origin). This group contains a mix of users from different countries (EU, US, and ex-US users). However, because there is most certainly EU users in this unknown location group, the legal ramification of violating European GDPR is severe, and this has forced us to pull these people out of the database until they log in and consent. 
Users from the EU and those with an unknown location are logging back in, and we expect that these matches will repopulate over time. We are also reaching out proactively to these users to ask them to log in to confirm their location and accept the new terms of service.
The issue of disappearing kits appears to have been resolved and the following notice now appears when you log into GEDmatch.
Meanwhile it has been reported in the official GEDmatch Facebook group that Curtis Rogers will be sending out an e-mail to all GEDmatch users. I've copied the text of the e-mail below for reference:
A MESSAGE FROM GEDMATCH FOUNDER CURTIS ROGERS. THIS MESSAGE WILL BE EMAILED TO ALL USERS. 
To GEDmatch users, 
As you may know, on December 9 we shared the news that GEDmatch has been purchased by Verogen, Inc., a forensic genomics company whose focus is human ID. This sale took place only because I know it is a big step forward for GEDmatch, its users, and the genetic genealogical community. Since the announcement, there has been speculation about a number of things, much of it unfounded. 
There has been concern that law enforcement will have greater access to GEDmatch user information. The opposite is true. Verogen has firmly and repeatedly stated that it will fight all unauthorized law enforcement use and any warrants that may be issued. This is a stronger position than GEDmatch was previously able to implement. 
There has been concern that Verogen will eliminate GEDmatch free tools and raise Tier 1 rates. In fact, Verogen has made it clear that the free tools will remain, and there are no immediate plans to raise Tier 1 rates. 
It has been reported on social media that there is a mass exodus of kits from the GEDmatch database. There has been a temporary drop in the database size only because privacy policies in place in the various countries where our users reside require citizens to specifically approve the transfer of their data to Verogen. As users grant permission, that data will again be visible on the site. We are proactively reaching out to these users to encourage them to consent to the transfer. 
The sale to Verogen will be a tremendous benefit to genealogists. Verogen has pledged to continue the GEDmatch philosophy of providing free services. It recognizes that all information belongs to the users who have placed it on GEDmatch, that this information may be removed by the users at any time, and that strong privacy protections need to be in place. It is to Verogen’s advantage to build the consumer database, meaning more and better matches for users. Verogen recognizes that law enforcement use of genetic genealogy is here to stay and is in a better position to prevent abuses and protect privacy than GEDmatch ever could have done on its own. 
Bottom line: I am thrilled that the ideal company has purchased GEDmatch. The baby I created will now mature for the benefit of all involved. If anyone has any doubts, I may be reached at [email address redacted]. I will do my best to personally respond to all concerns. 
Curtis Rogers
GEDmatch
It will take time for GEDmatch to settle back down after the sale but I would urge everyone to give the new owners the benefit of the doubt and to see how it all works out in the months to come.

Thursday, 12 December 2019

Free uploads to MyHeritage and news of the MyHeritage 2020 conference

MyHeritage have announced that their conference will take place in Tel Aviv in October. I went to their conference this year in Amsterdam and had a fantastic time and will be looking forward to a trip to Israel. You can find further information about this conference in this blog post from MyHeritage.


In other news from MyHeritage they have a special offer on this week for free DNA uploads to their autosomal DNA database. If you have taken an autosomal DNA test at 23andMe, AncestryDNA, FamilyTreeDNA or Living DNA you can transfer your data to the MyHeritage database to find new genetic cousins. There are people in the MyHeritage database who have not tested elsewhere. MyHeritage now have over 3.5 million people in their database, and they have particularly good representation in non-English-speaking countries in Europe.

Anyone who uploads between now and 18th December will benefit from free access to all the advanced features which normally require a one-off payment. You can find further details in this blog post from MyHeritage.

Tuesday, 10 December 2019

GEDmatch has been acquired by the forensic genomics company Verogen

GEDmatch has been acquired by the forensic genomics company Verogen. The acquisition was announced today in a press release from Verogen.
SAN DIEGO, CA (December 9, 2019) — GEDmatch, a pioneer in consumer genealogy, today announced that it has joined with forensic genomics firm Verogen, Inc. in a move that allows the company to ensure ongoing privacy protections and enhance the customer experience for users of its website. 
“I am confident that we have found an ideal partner for GEDmatch,” said founder Curtis Rogers. “Verogen understands our philosophy and shares the vision of GEDmatch, which has always been about using science to connect people,” Rogers said. “Verogen is able to support our growth while staying true to our roots.” 
GEDmatch allows users to upload genetic profiles created by other genealogy sites in order to expand the search for familial links. GEDmatch’s database currently has more than 1.3 million customer profiles and is gaining as many as 1,000 new users every day. 
In the coming months, GEDmatch users will begin to see improvements to the website, such as an enhanced homepage that offers increased functionality, Verogen CEO Brett Williams said. Verogen will also bolster the GEDmatch platform, resulting in increased stability and optimal searchability. These back-end changes won’t disrupt the experience for users and, in fact, will make searching the database easier, Williams said. 
GEDmatch’s terms of service will not change, with respect to the use, purposes of processing, and disclosures of user data, Williams confirmed. The website gives users a choice to opt-in to allow law enforcement to search uploaded files as a tool to solve violent crimes. Among the successes of this technology is work by public safety officials who used GEDMatch to apprehend accused Golden State Killer Joseph DeAngelo, a notorious serial killer who terrorized California and evaded police for decades until his arrest in 2018. 
As many as 70 violent crimes have been solved as a result of genealogy searches. “Never before have we as a society had the opportunity to serve as a molecular eyewitness, enabling law enforcement to solve violent crimes efficiently and with certainty,” Williams said. 
“Still, our users have the absolute right to choose whether they want to share their information with law enforcement by opting in,” Williams said. “We are steadfast in our commitment to protecting users’ privacy and will fight any future attempts to access data of those who have not opted in.” 
Added Rogers: “Our number one priority is our customers. We are and always have been a genealogy site whose goal is to help people find answers they’re looking for about themselves and their families. As we grow, we want to enhance the customer experience by making the site more user-friendly and by ensuring data is protected. Verogen can help us do that.” 
Under terms of the deal, Rogers will retain a key role focused on the primary mission of GEDmatch, which is to provide tools to help amateur and professional researchers and genealogists. 
GEDmatch customers who have questions about the partnership or how their privacy is protected are encouraged to contact customer service at gedmatch@verogen.com
If you have an account on GEDmatch you will now see a notice when you log in to the website informing you of the need to sign up to the new Terms of Service and Privacy Policy which have been introduced "in view of recent events in the genealogical community".
The revised Terms of Service clarify that GEDmatch is now operated by Verogen "following the acquisition by Verogen of the GEDmatch website".


Some European Union users are being asked to fill in an extra consent form before they can access their one-to-many matches. However, despite being in the EU, I have not had to fill in this form. There is speculation that the form is only being shown to those who have e-mail addresses that can be readily identified as being from EU countries.


At the end of the new site policy you are given three options: to accept the new terms of service, to reject the policy and delete your kit or to decide later. You will not be able to enter the site unless you accept the new terms of service.
To see the differences between the old and new privacy policies at GEDmatch see this saved link from DiffChecker.

It will be interesting to see how this all plays out. With the investment from Verogen we are likely to see improved functionality at GEDmatch, a better user interface and improved security measures. However, Verogen will also need to recoup their costs. Will genealogists be put off from using a genealogy database that is owned by a forensics company? I've already seen lots of comments from genealogists on Twitter and Facebook who have indicated that they will now be deleting their kits from GEDmatch. Will Verogen be able to attract enough paying subscribers to the Tier 1 tools to make a profit? Will Verogen introduce new subscription features? Will they charge law enforcement agencies for access to the database? How will Verogen react if they are served with a subpoena or search warrant for access to kits which have not opted in?

GEDmatch is now one of three genetic genealogy databases that can be used by law enforcement agencies. Gene By Gene, the parent company of FamilyTreeDNA, has its own lab where it provides forensic testing. They allow law enforcement agencies access to their genetic genealogy databases but charge a substantial fee to cover the costs of registering the users and processing the paperwork. Controversially, FTDNA now automatically opt in all their customers to law enforcement matching regardless of where they live. Few people read through all the terms and conditions when signing up for a genealogy test and so they will not have given fully informed consent to have their data shared with law enforcement. EU customers were automatically opted out of law enforcement matching prior to March 2019, but customers in all other countries were opted in.

DNA Solves is a new website set up by David Mittelman of Othram. Mittelman was previously the Chief Scientific Officer at Gene by Gene. DNA Solves has not yet been officially launched but is intended as a law enforcement-only database. Few details are currently available about how the site will operate.

It remains to be seen how this will all work out. Time will tell.

Update 10 December 2019
Verogen have sent out the following e-mail to their customers.
To Our Valued Customers:

We are pleased to share news that has far-reaching benefits for our company, our customers, and our scientific and law enforcement partners. Today, Verogen announced its acquisition of GEDmatch, an online genetic genealogy service that has been central to law enforcement solving over 70 cold cases in the U.S.

What this means for you

On a day-to-day basis it is business as usual. Verogen will continue to provide NGS instrumentation, software, reagents and consumables to a global customer base for forensic and biometric based human identification. Meanwhile, we will bring significant technical and scientific resources to build a more expansive GEDmatch platform that will exhibit increased security and ease of use. In the coming months, we will engage you in a conversation about the future of genetic genealogy, and how Verogen will enable the operational forensic laboratory to participate in the exciting revolution.

For more information, you can read the full press release here. 

The Verogen story continues…

Verogen was spun out from Illumina in August 2017 and is the only company solely focused on providing NGS instrumentation, software, reagents and consumables for forensic and biometric based human identification.

Verogen is building an NGS-based forensic ecosystem that is focused on a single platform multi-application strategy with common workflows between the applications. We are developing a compact but powerful range of applications that work in combination to improve and extend forensic analysis of biological traces that will enhance your ability to obtain an individual’s identification.

Today we offer solutions that utilize genomic and mitochondrial DNA that address the most common challenges for casework and missing persons sample analysis. Soon, we will be rolling out new applications as part of our “single platform multi-application strategy” that will enhance and expand your ability to provide a comprehensive human ID.
Update 10th December 2019
The following message to GEDmatch users has been posted by Curtis Rogers. It is visible when you log into your GEDmatch. The full message can also be seen here: https://www.gedmatch.com/curt_msg.htm


Update 11 December 2019
There is now a new Facebook page for the new GEDmatch:

https://www.facebook.com/officialGEDmatch

Update 18 December 2019
See my blog post An update on EU kits at GEDmatch and a message from Curtis Rogers

Further reading

Wednesday, 6 November 2019

Search warrant granted for access to GEDmatch database

A troubling story has been published in the New York Times about a security breach at GEDmatch. Detective Michael Fields from the Orlando Police Department was able to obtain a search warrant which allowed him to over-ride the privacy settings of individual customers at GEDmatch and search for matches in the entire database rather than in the subset of the database which had opted in to law enforcement matching. Fields had previously been able to use GEDmatch in collaboration with Parabon Nanolabs to identify a suspect in the 2001 murder of Christine Franke. He was disappointed when GEDmatch changed their terms of service in May this year which resulted in all users being required to actively opt in to law enforcement matching. This change effectively reset the number of profiles available for law enforcement matching to zero, including many people who had transferred their results to GEDmatch specifically to help with law enforcement cases. Since then a steady trickle of people have opted back in to law enforcement matching but, according to the New York Times article, just 185,000 of GEDmatch's 1.3 million users have done so at the present time. The cold case which resulted in the search warrant relates to a serial rapist who assaulted a number of women several decades ago, though the full details have not been made public. The New York Times reports as follows:
In July, he [Fields] asked a judge in the Ninth Judicial Circuit Court of Florida to approve a warrant that would let him override the privacy settings of GEDmatch’s users and search the site’s full database of 1.2 million users. After Judge Patricia Strowbridge agreed, Detective Fields said in an interview, the site complied within 24 hours. He said that some leads had emerged, but that he had yet to make an arrest. He declined to share the warrant or say how it was worded. 
Detective Fields described his methods at the International Association of Chiefs of Police conference in Chicago last week. Logan Koepke, a policy analyst at Upturn, a nonprofit in Washington that studies how technology affects social issues, was in the audience. After the talk, “multiple other detectives and officers approached him asking for a copy of the warrant,” Mr. Koepke said.
It is difficult to comment on this case without having the full facts available. As this is an active investigation it is not possible to get a copy of the search warrant to find out why the police thought it necessary to over-ride the consents and we don't know the grounds on which the judge granted the warrant. GEDmatch could potentially have resisted the warrant but they are unlikely to have the resources to fight a lengthy legal battle. They are also likely to be sworn to confidentiality so they would not be able to discuss the case and would not have been in a position to warn their users. But if GEDmatch were sworn to confidentiality I wonder why Detective Fields was boasting about his actions at a police conference.

However, the use of a search warrant in this case does provide cause for concern as it potentially sets a precedent. What is to stop the police issuing search warrants to search for matches at the other testing companies? Would these companies be able to defy the warrant and refuse access? It is also troubling from an international perspective. An American judge has made a unilateral decision which affects the privacy and rights of all of GEDmatch's many international users who do not have any legal or governmental representation in the US. Granting access to the opted out profiles of international customers is not only a disproportionate measure, as their family trees are much less likely to be used to solve the crime, but it is also a gross over-reach by the judge who has passed a judgement which affects individuals who live in countries which are outside her jurisdiction.

If you think you might have been affected I suggest that you write to the Orlando Police Department to find out if your name is included in the match lists they are using. If you are an EU citizen you should be protected by the General Data Protection Regulation (GDPR) and you will have the right to have your information removed. If the police refuse to do so you should complain to your data protection regulator in the EU. If you are in the UK you should write to the Information Commissioner's Office. If you are in Ireland you should write to the Data Protection Commission. The ICO have a handy template on their website which you can use if you wish to submit a complaint. I have now written to the Orlando Police Department and I await their response with interest.

If you feel strongly about this judgement you might also like to write to Judge Patricia Strowbridge. She can be contacted via her judicial assistant. I have sent her an e-mail because I think it's important that she understands the international implications of her decision though I am not expecting a response.

Update 7th  November 2019
I have received the following response from Judge Strowbridge's office:

"Judge Strowbridge’s office is in receipt of the email you sent yesterday, November 6, 2019. Unfortunately, the Florida Code of Judicial Conduct strictly prohibits judges from commenting on any pending cases. As such, Judge Strowbridge is unable to respond to your email."

Update 13th November 2019
Someone was able to get a redacted version of the GEDmatch search warrant and they've shared it on Twitter. You can access it here:

https://twitter.com/rot13x2/status/1194325134653435904

I will comment on this in due course.

Update 18th November 2019
Leah Larkin published an analysis of the GEDmatch search warrant.

Further reading
Related blog posts

Sunday, 3 November 2019

Genotype extraction and false relative attacks: potential security risks at third-party genetic genealogy sites

Hot on the heels of a paper published the other week by Michael "Doc" Edge and Graham Coop on the possibility of attacks on genetic privacy via uploads to genealogy databases comes another paper by an independent team of researchers warning of another potential security risk.

The latest paper is written by Peter Ney, Luis Ceze and Tadayoshi Kohno, three researchers at the Paul G. Allen School of Computer Science & Engineering at the University of Washington. They caution about the risks of genotype theft and falsified genetic relations in the GEDmatch database.

I do not feel qualified to comment on the security risks they have identified so I will provide some links and let you make your own judgement.

The authors have provided some FAQs which provide a good starting point:

https://dnasec.cs.washington.edu/genetic-genealogy/

If you want read the full paper you can find it here:

The possible implications are also discussed in this article by Antonio Regalado in MIT Technology Review:


See also this report in the University of Washington News:


GEDmatch were given advance notice of the publication of the paper to allow them time to implement any necessary fixes. I understand that GEDmatch currently have measures in place that would thwart the method described in this paper but, understandably, they are not sharing the specifics. Further measures are also being investigated.

Note that this loophole affects GEDmatch only. The method won't work at AncestryDNA, 23andMe, FamilyTreeDNA, MyHeritage and Living DNA.

Update 4th November 2019
This research was also covered in New Scientist. You need a subscription to access the full article but here are some quotes from the end of the article:
"The study identifies a “clear risk” to the GEDmatch database, according to Graham Coop at the University of California, Davis, who wasn’t involved in the work. “I do worry that [GEDmatch are] not taking these concerns seriously enough. They have over a million people’s genetic data and they have placed these data at risk, which is incredibly concerning.” 
The risks could be easily solved by limiting genetic data uploads to DNA test results that are authenticated or digitally signed, says Ney. Better checks on uploads to detect anomalies, and restrictions on one-to-one comparison searches would help too, he says. His team alerted GEDmatch to the vulnerabilities before publishing and took measures to avoid exposing anyone’s identity. 
Curtis Rogers at GEDmatch says: “We are concerned about security and appreciate they have pointed out vulnerabilities.” He says the site has made several changes to address the vulnerability and is working on others, but didn’t specify what measures.
The article can be found here:

 https://www.newscientist.com/article/2221972-privacy-attack-on-dna-website-reveals-93-per-cent-of-a-persons-data/

Tuesday, 22 October 2019

Attacks on genetic privacy via uploads to genealogical databases

Update 7th January 2020
This paper has now been published in the peer-reviewed open access journal eLIFE. You can read it here.  In the same journal there is also a good commentary article by Shai Carmi "Genealogy: the challenges of maintaining genetic privacy" which you can read here

A new preprint has just been published by Michael "Doc" Edge and Graham Coop from the University of California Davis about some potential security risks in genetic genealogy databases. The paper is concerned with genealogy databases which accept uploads (ie, GEDmatch, FamilyTreeDNA, Living DNA and MyHeritage DNA). AncestryDNA and 23andMe do not accept uploads so they are not affected. Not all of the techniques described in the paper would necessarily work at all the companies. The companies were all given early sight of the paper so they have had the opportunity to make any adjustments. I understand that GEDmatch have already taken some unspecified measures and are considering more. The authors have provided a few suggestions on possible solutions for dealing with the risks they have highlighted and improving security such as using cryptographic signatures on DNA data files.

The authors have written some FAQs about their paper and if you want to understand what it is all about I recommend reading these FAQs first.

If you want to read the full paper it can be found here.

UC Davis have issued a press release which can be found here.

Leah Larkin has written an excellent blog post about the paper explaining the concepts in easy-to-understand terms.

Blaine Bettinger has shared his thoughts in this blog post.

I will update this post with further links if I find any other useful commentaries on the subject.

Update 18th December 2019
An updated copy of the preprint was uploaded to BiorXiv on 18th December and can be seen here.

Thursday, 17 October 2019

Big changes at Living DNA

There have been some major updates at Living DNA. Their long-awaited new website has just been launched, and they have expanded their product range. The website upgrade will allow Living DNA to speed up processing times. By January 2020 they hope to have a system in place to allow them to deliver regular matches and notifications. At the moment the matching database is only re-run every two weeks. Most importantly, the update will allow Living DNA to update the ancestry reports with new regions. Spain and Germany are apparently nearly ready to go, and there are other updates in the pipeline, though anyone waiting for Scotland and Ireland will have to wait a little longer. The ancestry maps page has also been re-designed.

The new website is designed to be more accessible to non-genealogists and will guide the user through all the steps to ensure that they are able to access all the features. There is a simplified activation process which will allow for easier kit management for elderly relatives who do not use a computer. The upgrade process has also been simplified and now includes the ability to upload zip files. You will be able to opt in to relative matching with a single click.

At the time of writing the new website is live but I don't yet have the new "onboarding" experience or the updated ancestry maps. I will update this post with screenshots as and when they are available.

In the meantime here are some screenshots provided by Living DNA showing the new portal experience. (The names are all from a dummy account.) The screenshot below shows the new dashboard.


This is the redesigned ancestry map.



New products
The product range has been revamped and Living DNA are now offering a low-priced taster kit for £49/$49. The starter test includes the following reports:
● Your global ancestry breakdown across continents
● The ability to find people around the world who you share DNA with
● A nutrition report determining if your genetics indicate that you are prone to Vitamin D deficiency
● The type of exercise your muscles respond to best

Starter kit customers can upgrade to the ancestry experience for £49/$49 and the wellbeing experience for £69/$69.

The full ancestry test remains the same as before and is priced at $99/£99.

There is now a new wellbeing test with a full range of fitness and nutrition reports. This kit costs £129/$129. It will include a selection of reports indicating:
● How your body responds to different vitamins
● How your body breaks down foods to which your body may be sensitive to such as gluten or lactose
● How your body responds to different types of fitness.
● How to understand what type of exercise best supports your body. For example, it is claimed that DNA can indicate if you are better suited to running and sprinting or weight and circuit training.

Customers who order at launch will also receive a complimentary 180-day updates package worth £39/$39 that provides new reports as they are released.

Here is a screenshot of a sample wellbeing report.


There is also a bundle priced at £179/$179 which combines the full collection of ancestry, nutrition and fitness reports.

Existing Living DNA customers will have the option to upgrade their accounts in mid-November 2019 to purchase the full wellbeing test for a reduced rate of £49/$49 (normally £69/$69) until 31st December 2019.

This blog post was updated on 17th October to include a photo of the new starter kit and screenshots of the new portal provided by Living DNA.

Wednesday, 16 October 2019

Launch of AncestryHealth® in the US

Ancestry have today announced the launch of AncestryHealth®, a new genetic health testing service. The test is currently only available to customers in the US, but cannot currently be sold to people living in New York, New Jersey and Rhode Island. AncestryHealth® has to be ordered through a doctor and you need to be over 18 to place an order. The test is currently being offered to existing Ancestry members before being rolled out to the general public.

Here is the press release I have received from Ancestry:
Ancestry® Announces Genotype and Next Generation Genetic Sequencing Services 
LEHI, Utah & SAN FRANCISCO - (Oct. 15, 2019) – For more than 30 years, Ancestry®, the global leader in family history and consumer genomics, has built innovative services that empower millions of people to make more meaningful discoveries about themselves and their families. First with family history, then through DNA and today, with the introduction of AncestryHealth®. AncestryHealth is a long-term commitment to making a difference in preventive health through personalized and actionable insights. 
Through a highly supportive and guided experience, AncestryHealth services deliver actionable insights that can empower people to take proactive steps -- in collaboration with their healthcare provider -- to address potential health risks identified in their genes and family health history. In a recent AncestryDNA® customer survey, 83 percent of respondents said they are looking for new ways to improve their health and 89 percent said it is critical for their children to learn about improving their health. 
AncestryHealth is launching with two new services. AncestryHealth Core™, a one-time, array-based service, and AncestryHealth Plus™, a membership service using next generation sequencing (NGS) technology, help people start on the path toward better health for themselves and their families. 
AncestryHealth services include:
  • Physician-ordered tests that were developed and are performed by independent CLIA-certified laboratories
  • Educational information, including access to genetic counseling resources
  • Printable consumer and physician-ready reports that provide guidance for next steps an individual and their healthcare provider can take together
Ancestry has partnered with PWNHealth, an independent network of board-certified physicians and genetic counselors, to offer these services, which are included in both AncestryHealth Core and AncestryHealth Plus. 
“Your genes don’t need to be your destiny. Understanding your familial and inherited health risks can help you take action with your doctor to improve your chances of better health outcomes,” said Margo Georgiadis, chief executive officer of Ancestry. “For more than three decades, Ancestry has empowered journeys of personal discovery to enrich lives. In the same way that knowledge of your family and ethnicity helps you understand your past to inspire your future, knowledge of your genetic health profile and any associated risks can help you be proactive in managing the future for you and your family.” 
AncestryHealth Products and Availability 
AncestryHealth delivers personalized insights so people can take action to better manage their health in collaboration with their healthcare provider. 
  • AncestryHealth Core is a first step on the journey of understanding how family heritage and genetics can impact health and wellness. It covers a set of curated, common ‘need to know’ health conditions and includes printable family health history and lab reports people can share with their healthcare provider. The physician-ordered laboratory test included in AncestryHealth Core uses genotyping array technology to detect genetic differences and deliver personalized reports related to health conditions such as heart disease, hereditary cancers, blood-related disorders, and risks for carrier status of health conditions, such as Tay-Sachs disease. Additionally, there are wellness reports on topics such as nutrition and metabolism. AncestryHealth Core is priced at $149 and includes AncestryDNA. Existing AncestryDNA customers can upgrade to AncestryHealth Core for $49. 
  • AncestryHealth Plus will use next generation sequencing (NGS) technology to deliver more comprehensive screening data, providing both greater coverage of DNA differences for each condition and more risk categories such as those related to potentially developing heart disease, cancers, and disorders related to blood, the nervous system and connective tissues. For new customers, AncestryHealth Plus with NGS technology has a $199 activation fee, which includes the first six months of membership with an additional $49 membership fee every six months. Existing AncestryDNA customers can upgrade to AncestryHealth Plus for an initial payment of $49. The ongoing membership will include quarterly screening updates, more educational resources and enhanced tools for family health history and healthcare provider collaboration.
Both AncestryHealth services include simple, step-by-step guidance to help people track and record their family health history all in one place. Family health history information often holds important clues about an individual’s risk for disease and is an important foundation, along with genetic screening, to proactively identify and address potential health risks. Customers can download and share a printable version of their family health history, along with their test results, with their healthcare provider so they can have the information necessary to personalize their care and take proactive steps where clinically necessary. 
“Genetics play an important role in your health, along with factors such as your family’s health history, lifestyle and diet,” said Catherine Ball, Ph.D., Chief Scientific Officer at Ancestry. “Our job is to make sure our customers are educated, informed and supported throughout their health journey with us. Empowered with the right information, they can take proactive steps now to manage their and their families’ health for years to come.” 
Ancestry is committed to safeguarding customers’ data and privacy. Just like all Ancestry offerings, AncestryHealth gives customers full consent and control over their own data at all times. Ancestry does not share customers’ DNA data with insurers, employers or third-party marketers. 
AncestryHealth services are now available at www.ancestry.com/health.
I note from the website that the AncestryHealth Plus next generation sequencing test is not currently available but is expected to launch in early 2020. I understand that this will be an exome sequencing test and not a whole genome sequence. The exome is the part of your genome containing all the genes.

We've long known that Ancestry have wanted to enter the health testing market. They partnered with Quest Diagnostics in 2016 to provide "wellness" reports. Clearly this new service has been planned very carefully. However, Ancestry face stiff competition from 23andMe who have revitalised their service and are now the only company with FDA approval to sell health reports direct to the consumer. 23andMe offer a much wider range of health and trait reports. Their health reports are available in the US, the UK, Ireland, Canada, Denmark, Sweden and Finland. As I reported in July this year, MyHeritage have also entered the genetic health testing market. The MyHeritage health test is also available direct to the consumer and is sold in nearly all countries of the world but US customers have to order through a doctor.

Further reading

Wednesday, 25 September 2019

US Department of Justice Interim Policy on Forensic Genetic Genealogical DNA Analysis and Searching

The US Department of Justice have issued an Interim Policy on Forensic Genetic Genealogical DNA Analysis and Searching. The press release can be found here:

https://www.justice.gov/opa/pr/department-justice-announces-interim-policy-emerging-method-generate-leads-unsolved-violent

Here is a direct link to the policy statement: https://www.justice.gov/olp/page/file/1204386/download

The announcement was made by Ted Hunt, Senior Advisor to the Attorney General on Forensic Science at the Department of Justice, during a talk given at the International Symposium on Human Identification in Palm Springs, California.

Investigative genetic genealogy or forensic genealogy is a powerful tool which can help to solve crimes and identify missing persons but, as with any such tool, it needs to be used responsibly. Earlier this year I wrote an article for Forensic Science International on Using genetic genealogy databases in missing persons cases and to develop suspect leads in violent crimes. I explain in the article how the methodology works but I also discuss some of the privacy implications and the need for ethical and regulatory oversight. These new guidelines from the DOJ are long overdue and this document will be a good starting point for further debate but there are a number of important issues that have not been addressed and which I will discuss briefly below.

Informed consent
The following sentence in the report is highly misleading: "The FGG [forensic genetic genealogical] profile is... compared by automation against the genetic profiles of individuals who have voluntarily submitted their biological samples or entered their genetic profiles into these GG services (‘service users’).

FamilyTreeDNA changed their terms of service in March this year. All European Union customers who tested prior to the change were automatically opted out of law enforcement matching. Going forwards, all customers, including all EU users, were automatically opted in to law enforcement matching. New settings were introduced so that customers could opt out. Previously if you didn't want to share your results with law enforcement you had to switch off matching altogether, thus losing all the benefits of the genetic genealogy database. While FTDNA customers have voluntarily uploaded their samples for their family history research, because of the automatic opt in they cannot in any way be considered to have given consent to have their profiles matched with law enforcement kits. The DOJ perhaps doesn't realise that FTDNA has an international database. There are international conventions on the transfer of DNA data for people in criminal databases (eg, through Interpol or the Prüm Convention in Europe). Innocent people in genetic genealogy databases should expect similar protections if their data is to be used by law enforcement agencies in foreign countries. I would like to see the DOJ make a requirement that, at the very least, DNA profiles of non-US citizens can only be used if the customers have given explicit informed consent. Ideally they should insist that FTDNA follows the standard convention and adopts an opt in policy for everyone.

GEDmatch customers have voluntarily uploaded their profiles to the database and, following the decision in May this year to require all users to opt in to law enforcement matching, anyone who has exercised this option has given their consent to have their data used for law enforcement investigations.

Proportionality
The DOJ guidelines include the following criteria which must be met before a genetic genealogy search can go ahead:

Before an investigative agency may attempt to use FGGS [forensic genetic genealogical DNA analysis and searching], the forensic profile derived from the candidate forensic sample must have been uploaded to CODIS, and subsequent CODIS searches must have failed to produce a probative and confirmed DNA match.

The investigative agency with jurisdiction of either the crime or the location where the unidentified human remains were discovered (if different) must have pursued reasonable investigative leads to solve the case or to identify the unidentified human remains.

Proportionality is a key concept in the criminal justice system and priority should always be given to the most effective and least intrusive methods. It is notable that in a number of the forensic cases where genetic genealogy databases have been used, the police have failed to use existing and well proven methods.

In some cases, the suspect had already had prior contact with the police or had even been in prison but the police had failed to get a DNA sample. See for example herehere and here. Jerry McFadden was identified through genetic genealogy as the murderer of Anna Marie Hlavka. But McFadden was executed in 1999 without having his DNA taken.

If matches are to be found in the CODIS database then surely it makes sense to ensure that all convicted offenders are in the database. Yet, according to a report from Forensic Magazine in 2017 there is a big backlog of prisoners who have not been tested:
...seven states hold prisoners whose DNA had not been collected, and who were not in CODIS. Most often, these states had no retroactivity conditions in their DNA laws, which were generally enacted in the 1990s and were never extended into the past to include criminals already locked up. But there are other cases where prisoners refused to give samples, or authorities simply didn’t get the testing done for logistical reasons. For others, there were simply collection delays.
There is also a huge backlog of untested sexual assault kits in the US. Astonishingly it's not even possible to determine the size of the backlog but there are probably tens of thousands of kits which still haven't been tested. The End The Backlog website keeps track of the problem.

I cannot understand why these backlogs have been allowed to develop. There must be many victims of crime who have yet to receive justice and potentially many innocent people who could be exonerated if this testing were done.

Familial searching has far fewer privacy implications than genetic genealogy because the people whose DNA is being searched have already committed a crime and can therefore be considered as having forfeited the right to privacy. Familial searching involves a search of the police database to identify people who are first-degree relatives of the suspect (eg, the parent, child or sibling). It works on the basis that crime tends to run in families so, even if the perpetrator himself is not in the database, it's quite possible that he could be identified through a match with another family member.

Some of the cases where genetic genealogy has been used could have been solved much earlier if familial searching had been used. A number of the suspects, including the Golden State Killer, had a brother who already had a criminal record but sadly his DNA was not in the police database.

Familial searching is currently only done in a handful of states such as California, Texas and Colorado. The practice is banned in Maryland and in Washington DC. Familial searching could potentially produce tens of thousands of useful investigative leads. The Florida Department of Law Enforcement have set an excellent example by adopting a policy whereby genetic genealogy is only used if a familial search has produced a negative result. It would be good to see the DOJ updating their policy to follow Florida's example and insist that genetic genealogy should only be used after an unsuccessful familial search.

The National DNA Index System (NDIS), the federal CODIS database, has over 16 million DNA profiles. DNA searches in the national database would probably produce valuable leads in thousands of cases. For some reason the FBI has resisted allowing the use of NDIS for familial searching. However, if the DOJ is happy for genetic genealogy databases to be used then the FBI's position is clearly untenable and familial searching should be introduced as a matter of priority.

Ethical oversight
The policy makes no provision for ethical oversight. Genetic genealogy searches are left to the discretion of the investigative agencies and the prosecutors. Agencies are required only to use companies which "provide explicit notice to their service users and the public that law enforcement may use their service sites". Law enforcement and prosecutors are necessarily going to want to push for the use of genetic genealogy. There is an urgent need for some form of independent oversight to provide balance in the system. Again, Florida is setting an excellent example. Because genetic genealogy is only used in Florida when familial searching has been unsuccessful, all searches must be approved by a Familial Search Review Committee. I would like to see other states follow this example.

Mechanics of genetic genealogy searches
The policy recommends that "The investigative agency shall, if possible, configure service site user settings that control access to FGG profile data and associated account information in a manner that will prevent it from being viewed by other service users." At GEDmatch kits can be uploaded as research kits which means that the user will receive a list of matches but will remain invisible to the people on the match list. At FamilyTreeDNA law enforcement kits appear in the match list of everyone who has not opted out of law enforcement matching. They are not distinguished in any way from those of ordinary users. I understand that some people are trying to encourage FTDNA to adopt a similar system to GEDmatch so that the law enforcement kits cannot be seen. The DOJ missed a big opportunity here and could have insisted that the police only use companies which restrict matching in this way which would put pressure on FTDNA to adopt best practices.

The report discusses the procedures for target testing which is sometimes done when the matches are more distant. Testing someone who is potentially a second cousin to the suspect helps to narrow down the search and confirm that the investigators are pursuing the right line.  The report says that "An investigative agency must seek informed consent from third parties before collecting reference samples that will be used for FGGS". However, they do not discuss the tricky subject of incidental findings, such as the discovery that a target tester is not related to his or her presumed biological family in the expected way.

I am sure that there is much more I could write but I just wanted to set down a few initial thoughts about the areas which I think are the most important.

Further commentary

Sunday, 15 September 2019

New DNA and subscription bundle from Findmypast for UK subscribers

Findmypast are offering a free DNA kit to new UK subscribers for a limited time only. Findmypast have a partnership with Living DNA and the test on offer is the Living DNA test packaged under the FindmypastDNA brand name. Note that the test offered in this bundle is an autosomal test only. If you wish to have the Y-DNA and mtDNA haplogroup reports, which are included with the standard Living DNA test, you would need to upgrade.  

Full details of the offer are included in the following press release from Findmypast which I received on 4th September 2019.  As far as I'm aware this offer is still available. It is restricted to the UK market. I do not know if there are any plans to extend the offer to other countries.
FINDMYPAST ANNOUNCES NEW DNA & SUBSCRIPTION BUNDLE FOR UK MARKET
 
  • While stocks last, all 12 month Pro or Plus subscriptions now come with a free Findmypast DNA kit worth £79
  • New offering allows users to combine cutting-edge science with Findmypast’s archive of more than 9 billion historical records
Leading family history website, Findmypast, has announced that as of today, any UK customer who purchases a 12-month Plus or Pro subscription will receive a Findmypast DNA kit worth £79, completely free of charge whilst stocks last. 
The new bundle combines cutting edge science and traditional family history research methods, allowing family historians to explore their past in more depth than ever before.
Launched in partnership with fellow British brand, Living DNA in November 2018, this first of its kind service uses Living DNA’s unique test employing cutting-edge science to provide a breakdown of 21 regions across Britain and Ireland, connecting family history enthusiasts with the records they need to bring their ancestors’ stories to life. 
Those looking to take advantage of this incredible offer can choose from: 
  • A 12-month Plus subscription priced at £120 – covering all record categories, perfect for expanding your family tree and adding colour to your research
OR
  • 12-month Pro subscription priced at £156  - providing full access to everything Findmypast has to offer, including the largest online collection of British & Irish newspapers
AND…
  • They will receive a Findmypast DNA kit completely FREE plus free delivery (normally £79)
Once you have purchased your Plus or Pro Subscription, or upgraded from a starter sub, simply claim you free kit by visiting /www.findmypast.co.uk/subscribe?dnaoffer=true.  All free kits must be claimed no later than 30 days after the subscription purchase.

Wednesday, 10 July 2019

MyHeritage enters the genetic health testing market


MyHeritage announced the launch of a new Health and Ancestry test on 20th May this year. The launch occurred at a busy time of the year and I've only just got round to investigating it. On doing so, I discovered that the test is on special offer with 40% off the recommended price until 15th July so I decided to take the plunge and order a kit. I already have a MyHeritage DNA account but I have not tested direct at MyHeritage DNA. Instead I transferred my raw data file from AncestryDNA in order to participate in the genetic genealogy matching database. I received various e-mails from MyHeritage about the new health test but none of them mentioned a discount or special introductory offer and the 40% discount does not show up when I log into my existing MyHeritage account. I don't know if this special offer is available to everyone in the UK or if a similar offer exists in other countries so you will need to check for yourself. Make sure you log out of your MyHeritage account first. There was an additional charge of £9 for shipping so the test cost me £114 in total, a saving of £74.


MyHeritage is now using the Illumina Global Screening Array (GSA) for their Health and Ancestry test. This has a different range of markers (SNPs) compared to the AncestryDNA profile I uploaded to my other MyHeritage account. Having two accounts at MyHeritage will allow me to do comparisons to assess the effectiveness of the relationship predictions with the two different chips.

Included with the cost of the test is a free 12-month subscription which will allow me to receive all the new genetic risk and carrier status reports as they are released. The health subscription also includes all of the advanced DNA features for genealogy (such as viewing family trees of DNA matches, viewing shared matches and "ethnicities", and shared ancestral places), all of which previously required a MyHeritage site subscription. The health subscription will normally cost £89. However, I am somewhat concerned that the subscription is automatically renewed at the end of the year. In order to place my order I had to authorise MyHeritage to use my PayPal account for future payments.
I don't like the idea of having subscriptions automatically renewed so I have set myself a reminder to review the situation prior to the renewal. I have also discovered that there is an option buried deep in the settings to switch off the auto-renewal.

If you are ordering a test from MyHeritage there a few things to watch out for from a privacy perspective. As part of the order process you need to provide information about your date of birth. There is of course no requirement that you have to provide the correct date but you need to be aware that with the default privacy settings your "general age" (eg, thirties, forties, fifties) is automatically displayed to other MyHeritage members. MyHeritage also automatically creates a profile for you and by default this is publicly displayed. The default settings are shown in the screenshot below. 



Note that it is not possible to buy a MyHeritage kit as a standalone health test. Also you need to be aware that anyone who orders the Health and Ancestry test is automatically opted in to the relative matching feature and to the sharing of "ethnicity" reports and matching segment data. If you do not wish to opt in to these features you will need to adjust your settings in the My Privacy section under DNA Preferences. MyHeritage probably ought to review some of these default settings for their European Union customers because they are counter to the basic principles of GDPR (General Data Protection Regulation) which requires explicit informed consent.

I recommend checking your MyHeritage settings immediately after placing an order to make sure you are only sharing information that you wish to share.

The MyHeritage Health and Ancestry test currently offers 14 genetic risk reports including reports for haemochromatosis, Alzheimer's, late-onset Parkinson's disease, coeliac disease and hereditary BRCA cancers. There are 13 carrier status reports including cystic fibrosis, sickle cell anaemia and a number of other conditions, most of which I have never heard of. You can see a full list of the health reports here.

There have been concerns about false positive health reports with microarray testing. One study reported a 40% false positive rate though this was based on a small sample of just 49 people and included reports from third-party tools as well as direct-to-consumer genetic testing companies. According to the MyHeritage blog, the company takes additional steps to avoid false positive results and to ensure that the results are accurate. For any condition where a person has a significantly increased genetic risk, MyHeritage will double-check the results with Sanger sequencing.

You can watch the video below for an overview of the new MyHeritage Health and Ancestry test.

If you are in the US you should watch the US version of the video. MyHeritage have partnered with PWN Health, a private American network of doctors and genetic counsellors. US reports are reviewed by a doctor and you are referred, if necessary, to a genetic counsellor. The US price is $199 which works out at about £160 so it appears that American customers are paying a small premium equivalent to about £19 to cover the costs of the medical service. They do not have the option of ordering a test without clinical oversight.

You need to be over 18 to order the MyHeritage Health and Ancestry test. It is available in most countries of the world. It is currently not on sale in the following countries: Israel, France, Germany, Austria, Switzerland, Iran, Libya, Sudan, Somalia, North Korea, Lebanon and Syria. US residents living in the states of Rhode Island, New Jersey and New York are also not able to purchase the test. The price will vary in different countries depending on local taxes and exchange rates.

Direct-to-consumer genetic health tests are also provided by 23andMe, but they only sell their test in a limited number of countries. They are also not able to provide health reports in many of the countries where they sell their test. MyHeritage's entry into this market will now make health reports available to a much wider international consumer base. It will be interesting to see what the take up rate is and if there will be any international regulatory implications. The UK Parliament's Science and Technology Committee has just launched an enquiry into consumer genomics and the effects on the National Health Service. We will need to wait and see what recommendations emerge from this enquiry.

Once I've returned my kit it should take about four to six weeks to get my results and I will report back on what I learn and how the results compare with my 23andMe reports. There are proposals in England to have a paid for NHS genome sequencing service whereby healthy people will serve as "genomic volunteers" who will pay through the NHS for their genome to be sequenced and share the data. In the long run, I am probably likely to get more benefit from a UK-specific service which can be integrated with my health records as part of the NHS Genomic Medicine Service. However, such plans are in their infancy and, even if the service does eventually get off the ground, it will be useful to have data from other sources to serve as a comparison.

For further information about the MyHeritage Health and Ancestry test or to order a kit go to: https://www.myheritage.com/health

Further reading

Thursday, 4 July 2019

Updated genetic communities at AncestryDNA

On 19th June AncestryDNA rolled out over 225 new communities for people with ancestry from Australia, New Zealand, Canada, the United Kingdom and "French North America". These new communities are in addition to the 92 regions in Ireland that were introduced in January this year.  If you have taken a DNA test with AncestryDNA and have ancestry from any of these places you will probably find that your results have been updated and that the regions are now more granular.


I previously had just one genetic community for Southern England with South-East England as a sub-region. I am now in the Central Southern England community and have two sub-regions: (1) Dorset and Somerset; (2) Gloucestershire, Wiltshire and West Oxfordshire. Here is a screenshot of my updated results.


My dad previously had two communities: (1) Southern England with East Anglia and Essex as a sub-region; (2) Wales and the West Midlands. My dad now has three communities: Central Southern England, Devon and Cornwall, and East of England. He does not yet have any sub-regions. Below is a screenshot of his updated results. Note that although Norway and Sweden appear in his "ethnicity" estimate he does not have any documented ancestry from either country in the last 400 years or so. I fully expect Norway and Sweden to disappear from his estimate the next time Ancestry update their reference populations.


My mum was previously in two communities: (1) Southern England with South East England as a sub-region; (2) Wales and the West Midlands. She is now in the Central Southern England community and has Dorset and Somerset has a sub-region. See below for a screenshot of my mum's updated results.


Previously it was possible to access the confidence score for each community/region. I can no longer find a way to do this. I hope this feature will eventually be restored. We also used to have the ability to filter matches by region. This option has now disappeared but I understand that there are plans to restore it.

For my family the results haven't changed too drastically but the new communities do provide a marginal improvement on the previous results and are a good reflection of some of our predominant ancestries. As more people test and more people are added to the genetic networks that form the basis of the communities we can expect the results to change over time. I imagine that it will eventually possible to break the results down into more individual counties.

Have you had some updated communities? What do you think of your results?

Further reading
Related blog posts