April 2007 issue

Rear View Mirror
Ian Grant

A mistaken understanding of what genetic information reveals is making us address the wrong infosecurity questions. DNA may give you 20-20 rear-view vision, but it is no crystal ball.

In a recent review of events since the British government's 2003 White Paper on genetics, Baroness Helena Kennedy, chair of the Human Genetics Council, said "The White Paper gave an over-optimistic assessment of the place of genetics in current health care delivery and a too-eager and insufficiently critical anticipation of future developments."

She went on to say the National Health Service (NHS) is geared to delivering treatment rather than prevention, but that genetics research is all about identifying potential health risks so that those concerned can mitigate them.
She added that the security-driven need for instant biotechnology test results means genetic tests on the GP's desk are fast becoming a reality. "If this technology is transferred to a healthcare setting, it will have an impact on how and where genetic testing and counselling is delivered."

Referring to the NHS's national programme for IT, she said, "We have concerns about the technical and consent problems of record linkage across families and whether the system will be able to address the practical, ethical and confidentiality issues this raises."

The bottom line

Advances in genomics, technology and statistics will provide deeper insights into future possibilities, but actual outcomes are still likely to remain hostage to the random events of life.

This is bad news for interested parties including politicians, law enforcers, social reformers, insurance companies and even food and drug makers. It is good news for the man in the street and lawyers.

When Watson and Crick announced in 1953 that they had modelled the key of life, they liberated hopes that genetic engineering would let mankind control life, death and all in between. Those hopes die hard.

To date, practical experience shows that DNA provides a highly reliable record of events from prehistory to yesterday. It also reveals the probability of a future event, typically an inherited illness, happening to an individual. But an understanding of the actual trigger for such events is imperfect. And where some hoped that genetic differences might explain or predict individual and group behaviours, DNA has proved close to useless.

This failure as a predictive tool means that much of the hoop-la that surrounds the collection, storage and use of genetic information, is misplaced. However, an individual's genetic "fingerprint" has value to individuals, to firms and to society. What we need is a better way to express that value. This would allow everyone to address genetic infosecurity cost-effectively.

A good encryption tool

DNA is staggeringly efficient at encrypting and storing data. David Goodsell, a microbiologist at the Scripps Research Institute, says each human cell contains about 1.5 gigabytes of data that make up the genome, the "blueprint" or program, to make a human. "The DNA double helix is designed to be read. It simply bristles with information," he says.

Those data represent some six billion nucleotides, called for convenience A, C, G and T, with A bonding only to T, and C bonding only to G to form base pairs. These base pairs are arranged into 46 chromosomes that contain genes that influence a particular characteristic in an organism through heredity. Chromosome 1, the final chromosome to be spelled out, in May 2006, contains 3,141 genes - nearly twice as many as the other chromosomes. Humans have between 20,000 and 25,000 genes, 98% of which we share with chimpanzees.

Humans differ by only 0.2% or one in 500 base pairs. But that is enough to give each of the world's six billion people a unique identity, thanks to a complicated chemical process that allows DNA to copy itself when cells divide. This process is very reliable but not infallible. True copying gives rise to long-lived traits that pass from parent to child, such as the gene for brown eyes or Alzheimer's. Its fallibility leads to changes as fast-acting as cancers, but also to subtle variations that over eons make an organism more or less successful in its environment, what Darwin called the origin of species.

Immortal DNA

Not only is the genetic information for an individual perpetuated through copying and storage in each of the body's 100 trillion cells, but it lasts long after the body is dead or gone. With current technology, a DNA match from a single cell can identify a unique whole individual with a certainty of one in 50 billion. Such accuracy and insight into a person's physical identity has lead to profound moral and ethical issues that society is still grappling with.

Security issues

Genomics produces two basic information security issues. The first has to do with scientific discovery and hence ownership and use of intellectual property. Knowing how to turn a gene on or off could stop a person from developing a hereditary disease or perhaps reduce the chance of them developing cancer from smoking. Such knowledge is worth billions to someone like a drug manufacturer, and hence, is worth protecting. For individuals, it might be life-saving, and thus even more valuable.

The second is the use of genetic information in non-research circumstances. Government, law enforcement, employers and insurance companies are just some of those with a corporate interest in DNA to associate an individual with a place, event or identity. Civil libertarians fear such knowledge has been used to discriminate against people on political, social and financial grounds.

Most governments have passed laws to govern the collection and use of genetic material. Most such law depends on the value the state gives a person's privacy. US judge Thomas McIntyre Cooley first defined this as "the right to be let alone". A US Supreme Court judge, William O Douglas, confirmed privacy is "indeed the beginning of all freedoms". Other jurisdictions may take a less liberal view, but the right to privacy is high up in many national and international constitutions - along with the presumption of innocence.

Data protection

Where they exist, data protection laws help give effect to the constitution's aim to defend privacy. Doctor-patient privilege rules may precede and extend them. But genetic technology is developing so fast that the legislation is falling behind. A 2002 report by the California HealthCare Foundation found that the US has no coherent national policy to cover the storage and protection of genetic information. Even though the 1996 Health Insurance Portability and Accountability Act (HIPAA) covers healthcare workers and health plans, it doesn't place the same privacy onus on others who have access to that information. These include employers, drug firms, life assurance companies, and researchers. However, this many change if Congress passes new HIPAA provisions this year.

Helen Wallace, deputy director of GeneWatch, an industry watchdog, reckons the UK's Data Protection Act is important but not strong enough regarding the use of genetic data. "The police and security agencies do not need consent or to inform suspects to collect and use such data," she says. Nor does it protect information that is released. "If it leaks, there is a free-for-all," she adds.
" We would like to see some specific safeguards for genetic privacy and dissemination," she says. "There have been discussions but not much political will to get them into law."

One idea is to give individuals property rights, something like a trade secret, over their genetic information. US lawyers Mary Hildebrand, Jacqueline Klosek and Walter Krzastek argue that "through property rights, an individual could have a series of rights regarding the control, possession and transferability of genetic information that are unavailable through privacy legislation".

Corporate interests are unlikely to welcome this. UK Biobank's executive director Tim Peakman warns it could raise costs if researchers had to pay for samples. The lawyers counter that it could encourage people to provide samples if they stood to benefit directly. It could also ensure that individuals monitor who is doing what with their data, thus putting the primary responsibility for infosecurity on them. Who indeed has a greater vested interest?

Back to features index