Crack Down on Genomic Surveillance

Comment JOHANNES EISELE/AFP/GETTY JOHANNES Police patrol a food market at night in Kashgar in China’s Xinjiang province.

debate, legislation and best practices have emerged in many countries around the use of Crack down on DNA profiling in law enforcement2. (In profiling, several regions across the genome, each con- sisting of tens of nucleotides, are sequenced genomic surveillance to identify a person or their relatives.) Now the stakes are higher for two reasons. First, as technology gets cheaper, many Yves Moreau countries might want to build massive DNA databases. Second, DNA-profiling technology can be used in conjunction with other tools for Corporations selling cross the world, DNA databases biometric identification — and alongside the that could be used for state-level analysis of many other types of personal data, DNA-profiling technology surveillance are steadily growing. including an individual’s posting behaviour are aiding human-rights The most striking case is in China. on social networks. Last year, the Chinese abuses. Governments, Here police are using a national DNA firm Forensic Genomics International (FGI) Adatabase along with other kinds of surveillance announced that it was storing the DNA pro- legislators, researchers, data, such as from video cameras and facial files of more than 100,000 people from across reviewers and publishers scanners, to monitor the minority Muslim China (FGI, known as Shenzhen Huada Forensic Uyghur population in the western province Technology in China, is a subsidiary of the BGI, must act. of Xinjiang. the world’s largest genome-research organiza- Concerns about the potential downsides of tion). It made the information available to the governments being able to interrogate people’s individuals through WeChat, China’s equiva- DNA have been voiced since the early 2000s lent of WhatsApp, using an app accessed by (ref. 1) by activist groups, such as the non-profit facial recognition. organization GeneWatch UK, and some genet- With stringent safeguards and oversight, it icists (myself included) . Partly thanks to such is legitimate for law-enforcement agencies to

use DNA-profiling technology. But these uses DNA TESTING ALL “culture of being influenced by opposition can easily creep towards human-rights abuses. An increasing number of people are having their DNA and protests” (see go.nature.com/337pjce). In October this year, the US Department of analysed by consumer-genomics companies. Restrictions on the use of technologies Homeland Security announced that it would Ancestry 23andMe Others or services provided by corporations are authorize the mandatory collection of DNA 30 currently too weak. Take export controls: samples from immigrants in federal custody either they do not pay due attention to at the US border, including children and those these sensitive technologies, or they have 25 applying for asylum at legal ports of entry. loopholes that often render them useless. The resulting DNA profiles will be available Relatedness means For example, US laws forbid the export of that the genetic 20 through a database called CODIS (Combined privacy of untested fingerprint-recognition technology to some DNA Index System), which includes the pro- people is at risk now destinations or users deemed problematic that firms hold DNA files of convicted offenders and individuals 15 by the US government, such as the Chinese sted (millions) data for ~5% of the arrested for serious offences. Such treatment US population. police. But the United States does not restrict could reinforce debunked claims that immi- the export of more-invasive DNA-profiling 10 eople t e

grants are more prone to criminal behaviour P and facial-recognition technologies. Mean- than the general population. while, the European Union does not regulate A much broader array of stakeholders must 5 the export of fingerprint technology, even engage with the problems that DNA data- though the dominant global suppliers are

. 2019 (HTTPS://GO.NATURE.COM/2MHTJED) . 2019 REV MIT TECH. bases present. In particular, governments, European. 0 policymakers and legislators should tighten 2013 2015 2017 2019 Export controls for biometric technologies

SOURCE: SOURCE: regulation and reduce the likelihood of corpo- could be improved relatively easily. The US rations aiding potential human-rights abuses in DNA-profiling technologies (see ‘Ethical Department of Commerce is currently con- by selling DNA-profiling technology to bad divesting’). sidering revising regulations for emerging actors — knowingly or negligently. Research- US and European corporations are still technologies6, such as Internet censorship ers working on biometric identification tech- the dominant providers of such technolo- and video surveillance, to try to reduce the nologies should consider more deeply how gies. The deployment of DNA-surveillance likelihood of companies doing business with their inventions could be used. And editors, infrastructure in Xinjiang, for example, problematic buyers. Last month, it barred reviewers and publishers must do more to was enabled by the Chinese government Xinjiang police forces and eight Chinese ensure that published research on biometric buying products from — and working with technology companies from buying US prod- identification has been done in an ethical way. — the US company Thermo Fisher Scien- ucts or importing US technology because of tific in Waltham, Massachusetts. The firm their role in the repression of Uyghurs. Government monitoring is currently the global leading supplier of Some regulatory initiatives are promising In Xinjiang in China, police collected biometric DNA-profiling technology in law enforce- and could provide a deterrent if enforced. information (including blood samples, finger- ment. Thermo Fisher Scientific researchers The 2017 EU directive on non-financial prints and eye scans) from nearly 19 million have worked with China’s Ministry of Justice, reporting (named 2014/95) has mandated people in 2017, in a programme called ‘Physicals and with researchers at the People’s Public that large companies listed on stock markets for All’. This was part of a suite of measures that Security University of China, which falls document their social and environmental are being used by the Chinese government to directly under the Ministry of Public Secu- impacts in their annual reports for share- control the Uyghur ethnic group3. rity, to tailor the technology specifically for holders and the public. Since 2017, France’s Other nations are building massive DNA corporate ‘duty of vigilance’ law has required databases or considering doing so. In 2015, all French companies employing more than Kuwait passed a law mandating DNA profiling “Governments keep being 5,000 people in the country to actively of its entire population. Foreigners living in tempted to hoover up their monitor their impacts on human rights, Kuwait and even visitors were to be included. citizens’ DNA.” the environment and so on (see go.nature. In January this year, Kenya passed a law that com/2o8tcvn). would have enabled the government to require In the United States, several human-rights all citizens to submit any biometric informa- use in Tibetan and Uyghur populations5. lawyers have attempted to revive the Alien tion, including DNA profiles, to a national (Thermo Fisher Scientific did not respond to a Tort Statute (28 U.S.C. § 1350) over the past database. request for comment). However, in February, 20 years. Produced in 1789 but never deployed, Both cases have hit obstacles. Kuwait’s after two years of public outcry and intense this law could enable a foreign individual to Constitutional Court overruled the 2015 law pressure from high-profile US senators, the make a civil liability claim against a domestic two years later, because of concerns about company announced that it would stop sell- corporation in US courts. A carefully crafted how the database could be used in violations ing its DNA-profiling technology in Xinjiang. Alien Tort Statute could provide a way to hold of privacy and due process. And, thanks to a Marketing and lobbying by technology sup- companies to the same standards, whether decision taken by Kenya’s High Court in April, pliers is often behind pushes for the broadest they are operating at home or abroad. DNA is now excluded from national efforts to possible use of DNA profiling. In 2016, for Ultimately, international laws must be collect biometric data. instance, a representative of a US lobbying established that clearly stipulate the human- But these and other examples indicate that firm working for Thermo Fisher Scientific rights responsibilities of corporations. For governments keep being tempted to hoover described in a conference presentation the the past decade, a United Nations working up their citizens’ DNA data4. development of universal DNA databases as group has been drafting a treaty to regulate “inevitable”. He noted that the expansion of the activities of transnational corporations Corporate responsibility these to “Western countries or other coun- with regards to human rights and the envi- One way to reduce the likelihood of massive tries with democratic forms of government” ronment (see go.nature.com/35qnehe). If it DNA databases being misused is to change faced “significant hurdles”, such as the “open is not crippled by lobbying, this could even- the behaviour of the companies that invest and public parliamentary process” and the tually become a powerful tool to promote

Comment ethical business practices. Yet companies are Currently, only some consumer-genomics only part of the story when it comes to the companies have willingly shared people’s DNA potential misuse of DNA databases. ETHICAL data with law-enforcement agencies. And in DIVESTING many countries, patients’ data are confidential. Research ethics But to deploy DNA surveillance across a The chain of technology development leads Investors could help to ensure ethical use group of people, you need profiles from only from fundamental to applied research to the of the products of DNA profiling firms. 2–5% of that population, because biological products that enable the abuses. More aca- relationships can be inferred11,12. And as gene- demics working on biometric identification Public outcry can lead to divestment. alogy and medical databases mushroom, law technology should reflect on the potential Since March this year, for example, major enforcers and others are increasingly tempted misuses of their inventions and engage with US funds such as Goldman Sachs have to tap into them13. In 2017 in the Netherlands, society. For instance they can contribute divested all their shares from the Chinese the Ministry of Health drafted a bill that would to mainstream media, participate in public surveillance company Hikvision, because have allowed police to obtain people’s DNA debates or join ethics boards. of concerns about the use of the company’s information from hospitals in some limited Recent events indicate that publishers and products in human-rights breaches. cases. It was abandoned following public scholars might be paying insufficient atten- Investors could even be motivated to outcry. tion to the sources of biometric-identification scrutinize company ethics, thanks to studies And June saw what might be a game changer research. For example, in August last year, over the past five years or so indicating in the United States. The Orlando Police after several Human Rights Watch and media that ‘good’ corporate social responsibility Department obtained a warrant that allowed reports about the surveillance abuses in practices tend to correlate with better it to search the entire DNA database of the Xinjiang, Springer Nature published the pro- financial performance over the long term. GEDMatch genealogy website, based in Lake ceedings of a biometrics conference held in Pressure from investors — and the Worth, Florida. Because consumer-genomics the province. (Springer Nature has been the public in general — might be increasingly companies already hold DNA data for an esti- publisher of the proceedings of the Chinese powerful. Take Thermo Fisher Scientific’s mated 5% of the US population, unfettered Conference on Biometric Recognition for February announcement that it would access to these data by law-enforcement nine years; Nature is editorially independ- stop selling its DNA profiling technology agencies would simply spell the end of genetic ent of its publisher.) One of the conference in Xinjiang, China. Although Chinese privacy in the United States. papers, on technologies for recognizing authorities can easily transport such All of us must beware a world in which our various languages in images, described how technology from elsewhere in the country, behavioural, financial and biometric data, “Uyghur information” (referring to the Uyghur it is significant that a major corporation including our DNA profiles, or even entire language script) could be detected in images publicly acknowledged “the importance of genome sequences, are available to corpora- that might be used to evade Internet censor- considering how [its] products and services tions — and so potentially to law enforcers and ship7. Another paper described how products are used — or may be used — by [its] political parties. Without the changes outlined from Thermo Fisher Scientific and the Chinese customers”. Y.M. here, the use of DNA for state-level surveillance firms Hisign, Megvii and iFlytek are being used could become the norm in many countries. to build a population-scale database for DNA, Han communities, relative to the size of their fingerprint, face and voice information in a populations (unpublished data). Half of the major Chinese city8. studies in my analysis had authors from the The author In July this year, researchers from Imperial police force, military or judiciary. The involve- College London announced the results of an ment of such interests should raise red flags to Yves Moreau is a computational biologist open competition on facial recognition. (The reviewers and editors. specializing in human genetics and professor winners presented their work at a conference In short, the scientific community in of engineering at the Catholic University of in Seoul in October.) Before a reporter from general — and publishers in particular — need Leuven (KU Leuven), Leuven, Belgium. the non-profit news platform Coda pointed to unequivocally affirm that the Declaration e-mail: [email protected] it out, one of the sponsors of the conference of Helsinki (a set of ethical principles regard- 1. Wallace, H. M., Jackson, A. R., Gruber, J. & had been a Chinese artificial-intelligence ing human experimentation, developed for Thibedeau, A. D. Egypt. J. Forensic Sci. 4, 57–63 (2014). start-up called DeepGlint, which in 2018 set the medical community) applies to all biom- 2. Forensic Genetics Policy Initiative. Establishing up a joint research laboratory with the Xinjiang etric identification research (see go.nature. Best Practice for Forensic DNA Databases (Forensic Genetics Policy Initiative, 2017); available at police. The conference organizers removed com/34bypbf). Unethical work that has been http://dnapolicyinitiative.org/report DeepGlint as a sponsor in August. published in this terrain must be retracted. 3. Ramzy, A. & Buckley, C. The New York Times (16 November Over the past eight years, three leading foren- 2019). Privacy concerns 4. Nelkin, D. & Andrews, L. Sociol. Health Illn. 21, 689–706 sic genetics journals — International Journal of (1999). Legal Medicine (published by Springer Nature), DNA databases in local police forces are 5. Wang, Z. et al. Sci. Rep. 6, 31075 (2016). and Forensic Science International and Foren- proliferating, even in countries that have 6. Bureau of Industry and Security. Fed. Regist. 83, 58201–58202 (2018). sic Science International: Genetics Supplement democratic governments and well-estab- 7. Aizezi, Y., Jiamali, A., Abdurixiti, R. & Ubul, K. in Biometric Series (both published by Elsevier) — have published legal protections for citizens’ privacy9. Recognition. CCBR 2018 (eds Zhou, J. et al.). Lecture Notes lished 40 articles co-authored by members By August this year, for instance, the Office in Computer Science 10996, 709–718 (Springer, 2018). 8. Zhu, W. J., Zhuang, C. Z., Liu, J. W. & Huang, M. in of the Chinese police that describe the DNA of the Chief Medical Examiner of New York Biometric Recognition. CCBR 2018 (eds Zhou, J. et al.). profiling of Tibetans and Muslim minorities, City held more than 82,000 genetic profiles. Lecture Notes in Computer Science 10996, 198–205 including people from Xinjiang. I analysed At the same time, there has been a growth (Springer, 2018). 9. Mercer, S. & Gabel, J. D. N.Y.U. Ann. Surv. Am. L. 69, 529 articles on forensic population genetics in in consumer and recreational genomic ser- 639–698 (2014). Chinese populations, published between 2011 vices, such as the US corporations 23andMe 10. Ratner, M. Nature Biotechnol. 36, 484 (2018). and 2018 in these journals and others. By my in Mountain View, California, and Ancestry in 11. Erlich, Y., Shor, T., Pe’er, I. & Carmi, S. Science 362, 690–694 (2018). count, Uyghurs and Tibetans are 30–40 times Lehi, Utah (see ‘DNA testing for all’). Medical 12. Guest, C. Am. U. L. Rev. 68, 1015–1052 (2019). more frequently studied than are people from DNA sequencing is also becoming routine10. 13. O’Doherty, K. C. et al. BMC Med. Ethics 17, 54 (2016).