The DNA of 15 Million People Is For Sale

0:03Hello, and welcome to the 404 Media Podcast, where we bring you unparalleled access to hidden worlds, both online and IRL. 404 Media is a journalist-founded company and needs your support. To subscribe, go to 404media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. Gain access to that content at 404media.co. I'm your host, Joseph. And with me, a 404 Media co-founder, Sam Cole. Hello. Emmanuel Mayberg. Hello. And Jason Kebler. happy baseball season everyone opening day tomorrow we're gonna become a sports podcast i think literally the least qualified person on the entire uh planet um well jason we're gonna start with you this is one you wrote um the headline is dna 15 million people for sale in 23andMe bankruptcy.

1:09I mean, that is a nightmare headline. I want to step back first a little bit, and I'm sure many people have heard of 23andMe and some of these similar companies, but for those who don't know, what is, or I guess was, 23andMe? I mean, it was a direct-to-consumer genetic sequencing company. Still is. It's still operational. I think probably most people know what it is right now because it's become such a popular Christmas gift for people to do a DNA test and see what percentage of North Ireland you're from. A lot of that. There was a period where it was a very hot Christmas gift. And this is something that I have been railing about for years because I actually went on a panel at South by Southwest in like 2016, possibly, about genetic data privacy.

2:14And on that panel, someone from 23andMe was there, someone from the FBI was there, and then a genetic artist was there. And we're sort of talking about like what can happen if your genetic data is in one of these really massive databases. There's been some interesting art projects over the years where people would make portraits of people based on DNA that they had harvested from them. They would take a strand of hair, sequence the DNA, and then make a portrait of it. And that started off as an art project. But over the years, there have been companies that have made tools for cops, for example, that would make genetic profiles of people like genetic mugshots, I guess you'd call them.

3:05And then very famously, there was this case where the Golden State Killer, who is a serial killer, was identified based on a genetic database. I believe it's called GDMatch, like GEDMatch. and it wasn't his DNA that was in the database. It was his family's DNA that was in the database and they were able to identify him. And I think that it's one of those things where we often talk about really extreme cases when we talk about privacy. It's like when you talk about Apple and iPhone encryption, the cases where the FBI says like, hey, we want access to this encrypted data. It's like a terrorism case or like a child abuse case, something like that.

3:58And there have been a series of cases that have been solved using data from genetic databases, broadly speaking. And these are often like serial rapists, serial killers, really like awful situations and that is like quite an interesting development for law enforcement and it's like it's pretty like an interesting thing like an interesting technology but it's based on you and your loved ones and people you know submitting genetic data to these gigantic databases and 23andMe is one of the biggest ones ancestry is obviously another huge one and basically you know there's now 15 million people in the 23andme database and the company is bankrupt and so yeah all of that is is up for sale right now in like a bankruptcy auction more or less yeah and um it's basically the cops are turning to um either these tools have been developed as you say for law enforcement or Ancestry or whatever, they're basically commercial databases that they can then send a legal demand to to be like, hey, turn over this information.

5:19And I mean, it's almost in the same sort of way. It's just like Google collects all of this data and then the FBI or whoever are like, we're going to give you a court order, a search warrant or whatever legal mechanism is appropriate or that we like and we're going to demand that data. It's like that. but for genetic information, basically. And you can't change your genetic information, really. It's kind of one and done. So you can see why it would be so valuable to law enforcement. I'm just curious, and maybe you can't remember, but what did the FBI person say on that panel? The benefits of it to them?

5:57Yeah, I mean, so that's a really interesting thing. One, yes, law enforcement can subpoena this data from a company like 23andMe or from Ancestry, which is now owned by BlackRock, by the way, which is like this massive private equity firm. But other genetic database companies have started sort of like proactively offering tools to law enforcement where they don't need to subpoena it. They don't need to get a warrant. They don't need to go like make a specific legal demand. They're just making law enforcement tools, meaning like search, like search features, but also these like genetic mugshot things that I mentioned earlier, where they will take a DNA sequence and then they'll run it through essentially like an AI that generates what they believe a person to look like based on their genetic information.

6:50And then they'll be like, oh, we can run this through a facial recognition database or something like that and try to identify someone. And there's all sorts of problems with this. One, One, it's like your genetics don't fully make up what you might look like. And so there's been cases where people are misidentified. There's just all sorts of potential problems here. I think that still to this day, even though we've been talking about the potential for this for a long time, it's still pretty early. uh like there's not widespread use of genetic databases to research crimes i have filed a bunch of public records requests with a few different states because florida for example has spun up like a genetic database law enforcement division and trying to get documents from them Virginia has a very similar thing but it's like it's pretty early on for police to be like actively trying to get this information um except for in the highest profile of cases but we know that there's some companies that have begun to develop tools and so uh you know I've written a few articles over the years where I'm like don't submit your genetic information to these companies because you don't know the chain of command or what is going to happen to these companies.

8:20And I think that's what this bankruptcy shows. It's like, there was a company called, I believe GEDmatch. I think it was them. There's a few different ones. But yeah, so GEDmatch was formed as a nonprofit. Like this one dude started it and it was a nonprofit and they're like, oh, submit your information. We'll do some genealogy. We'll do some ancestry. Maybe you can learn a little bit about your potential proclivities for specific genetic diseases and things like that. Well, one day the person who founded that was like, oh, I don't want to be a nonprofit anymore. So he sold the company. Yeah, he sold the company to this other company called Verogen, which had these contracts with the FBI.

9:11and then Verogen itself sold to a Dutch multinational conglomerate that was like a pharmaceutical company, a surveillance company, like a bunch of different things. And so, like you said, you can't change your genetic information. And so if you submitted this to this like, oh, small little nonprofit project like 10 years ago, well, now it's owned by like a Dutch multinational with both pharmaceutical contracts and also law enforcement contracts. And so that's the thing about 23andMe is that it's this project that started out as, oh, fun, you can learn what percent from what country you are. And then it sort of expanded into, we'll be able to tell you if you have markers for specific genetic diseases.

10:03They started offering some personalized medicine stuff. And then 23andMe launched these partnerships with pharmaceutical companies to do research on their databases and then to develop drugs. And it's like, that is also kind of interesting. If you put the privacy stuff aside, like personalized medicine, there's a lot of potential there. But this is not necessarily why people initially submitted their DNA to the company. And then it's like the company goes through some financial hardships and suddenly now it's bankrupt. And it's like, oh shit, we're like out of money. We need a different revenue source.

10:42We need to figure out like a different mechanism for making money. And now it's for sale and who knows who is going to buy it. Like it could be an international company. It could be a company that works with law enforcement. It could be that it's bought out of bankruptcy by the founder of the company, who is Anne Wojcicki. How do you say this? I don't know. She's the sister of Susan Wojcicki, who was the CEO of YouTube. But as part of this, she said she stepped down as the CEO and has said that she's going to try to buy back the company. But there's any number of potential outcomes here, and they're all kind of like, well, if you have your DNA in this database, it's like it's all up in the air.

11:32You don't know what's going to happen. Yeah, or even as we saw with the recent selling of the Pokemon Go company to a company funded basically by the Saudi state, right? I'm not saying that's going to happen here, but I don't know. There's a chance that could happen, right? um so you went through the bankruptcy documents i'm not sure how detailed they were um we have some experience going through bankruptcy documents coming from vice they can be very very interesting um was there anything noteworthy in them at this time or is it more more is going to come out like what did you learn looking those actual documents yeah so we actually haven't talked about why 23andMe filed for bankruptcy, which is really important and goes back to privacy as well, and is all throughout the bankruptcy documents, which is 23andMe got hacked at the end of 2023.

12:30And it was basically like a credential stuffing hack where 23andMe itself, like its database wasn't compromised, but there was basically like millions of customers whose passwords were reused and uh essentially they like lock like hackers logged into those downloaded their information sold it on breach forums i believe which is is breach forums dark web or is it just uh it's clear web now they don't even care about the dark web or you just google it and you find it that's what it's like nowadays yeah yeah so it was basically they were selling people's genetic information and sort of like different connections that were made by 23andme on this hacker forum.

13:16And specifically, they were selling information about Ashkenazi Jew users, people who had that sort of DNA in their profiles, and then also Chinese DNA. So it was like a kind of fucked up, targeted sale of information. And this was during the early days of Israel bombing Palestine. And so there was like this, that was like part of the sort of undercurrent of what was happening there. And as a result of this, 7 million people had their information leaked. And now there's been more than 50 class action lawsuits all over the country. There's also been 35 ,000 different arbitration demands from people who had their information leaked.

14:08And so basically 23andMe is dealing with the legal and potential financial fallout of this hack, where they have like all of these court cases about how they should have kept their customers' data safe. And essentially the bankruptcy documents say like, we don't have the money to cover the potential damages from all of this litigation that we're facing. So we're going to file for bankruptcy to just like try to start over. Like we fucked up. We're in dire straits and like, we're going to try to start over. You're right. We have looked at a lot of bankruptcy documents over the years and they're usually super, super interesting.

14:49There's also like a lot of filings as part of a bankruptcy case. And by that, I mean, there's usually like thousands and thousands of pages of documents and they don't all come out at once. And so right now, there's a lot of information about who they owe money to, which is a lot of pharmaceutical companies. There's some AI companies, which is kind of interesting. There's a lot of marketing companies. But it doesn't say why they owe money to those companies. It doesn't say how they got into this situation. But as part of this, they will have to submit some various narratives about what went wrong and why they were doing all of this sort of thing.

15:28So it's something that we'll keep an eye on for sure. It is pretty wild that a credential stuffing attack, which is basically the lowest of the low hanging fruit you can get, generally speaking, it's wild that that sort of attack has basically killed a company, you know? And I understand why, and I understand why people are mad, but to go from basically a shit poster on this hacker forum to killing 23andMe is wild. Yeah, I mean, theoretically, isn't this something that should have been stopped by a rate limit sort of thing, one would think? Yeah, back at Motherboard, where we all used to work, we did a story about Ring cameras when they were getting hijacked, essentially.

16:16And hackers were doing the same sort of attack. They would break in with a reused password that maybe the victim had somewhere else or something, and then they just used it to log into Ring. and we found that there was no rate limiting. I can't remember the status of 2FA exactly, but it also didn't block connections from Tor, the anonymity network that a lot of ordinary people use, but a lot of criminals use. And if you are 23andMe, presumably you should be putting rate limiting in place to stop multiple logins from IPs and multiple attempts, all that sort of thing. And you should probably block Tor connections as well.

16:53I don't know whether the attackers in this case use that or not, But there are absolutely ways to protect against credential stuffing, even if your users have made the unfortunate mistake of reading a password. And just for the user advice as well, that is why you use a password manager, which generates a unique password for every site, so you don't have to remember them all and you don't end up using the same password everywhere. and then you're one of the 7 million people who has their genetic information published online. So what happens now, Jason? Do we just follow? So a couple of things.

17:32One, you can apparently delete your information from 23andMe. So you can log in and delete it. And that's actually what the Attorney General of California recommended people do. They sent an urgent warning to people in California saying, like, hey, go delete your information. If you do happen to live in California, California has a privacy law that makes... They have to delete your information. If you live elsewhere, you can request that it is deleted, and hopefully it is deleted, but who can say for sure? And then the other thing I'll say is, like just i i personally it's like i i wouldn't submit my information to a company like 23andme and i would hope that my family wouldn't either um but i do think that this is like a pretty tricky thing because the uses of genetic databases thus far have been to like catch the worst of the worst criminals and i think that that is something where it's like okay that's like kind of interesting i I think that personalized medicine where you can create pharmaceuticals that are targeted directly to people with specific genetic diseases, that is a potential very good thing for society.

18:52But what I worry about is that they're not privacy laws that protect from mission creep here. And so I just don't think that, like Congress has protected people. They haven't really thought about the potential implications of this. I think that, you know, right now we're catching serial killers, but there literally have been apartment complexes that have sequenced like dog shit DNA to identify the owners of dogs who are not picking up like dog poop in their apartment complexes, which is like, pick up, pick it up. But that is like weird surveillance stuff that you can easily imagine this being used for nonviolent offenders.

19:38You can easily imagine it being used to try to detect undocumented immigrants, things like that, especially with this current administration. And so I think it's something that we need to just be very, very thoughtful and cautious about as we roll out this sort of technology more widely. What happens next is they go through a bankruptcy proceeding. Usually these are pretty quick. So it could be only like a couple months before we know who buys 23andMe. I don't think that the company is going to go fully out of business because this genetic database is very valuable. So someone will buy it and do something with it.

20:21And it's like, can just kind of hope that the person that buys it or the company that buys it is not like a weird surveillance company or I don't know. It's like, it could be anyone at this point. So we'll continue to cover it. But that's sort of like what's going on at the moment. Yeah. And it sounds like you're probably not in this data, Jason. Sam, do you know if anyone in your family signed up to this? or i feel like jason and i have had like it's not really an argument but like everyone's phone will be like should i do 23 of me and he's like no dumbass and then i'm like okay i guess um but my i know like i have not immediate family but extended family who's done it so i'm kind of like am i fucked anyway you know i'm already in it i'm already in it probably kind of yeah this also makes me this whole thing this is a little bit of a side this makes me think of um there was a it was a couple years it was many years ago it's not a couple years ago it was 2019 um i did a story for vice about um it was the headline was did my did the fbi seize my vagina cultures and i had like i was like doing some stunt blog about like this culture company and um they were gonna like sequence something based on that i don't know but in the process of doing that story the fbi raided the office and took all of the data.

21:44So I was kind of like, okay, now does the FBI have this? And it's just like, you don't really know what's going to happen to this stuff once it's out of your hands. Once you put it in the mailbox, who knows? I forgot about that story. It's one of the best stories you've ever done. It's so wild. It's so wild that that happened. Yeah. It's such a weird turn of events. Please dig it up because I want to put that on the show notes because I don't think I've ever read that and I would love to read it as well. I did get the results back from the microbiome test eventually, but the FBI had it too. Did you get anything from the FBI?

22:18Did they get back to you? I don't even remember why the FBI was raiding. That's a bigger question is why was the FBI raiding this office? But I should look back into that and see what the progress is on that investigation for sure. I actually am in one of these databases. I'm not in 23andMe. Hopefully. I think some of my cousins have done it. But also similarly for a stunt blog, when I was a freelancer at Motherboard many, many years ago, me and my ex-girlfriend did a blog where you could send a spit sample to some random DNA sequencing startup that would then print a report about how compatible you were.

23:01And that company existed for like six seconds. We did it. They sent it back, said we weren't compatible. We then did break up like several months later. So very accurate. And then the company went out of business immediately. And it's like, I have no idea what happened to that. Like, I have no clue where it is or what happened to it. And it's like, my genetic data has not changed. And so it is somewhere. And that's like, that's kind of my point. It's like scary that a lot of these companies are very like fly by night. 23andMe is huge. They've been around forever. But there was a period where a lot of random startups are doing stuff like this.

23:47And it's like, who knows if they were acquired? Who knows if they sold their data to someone? Who knows if I've been getting targeted by advertisements based on my DNA for years? I have no idea. And that's concerning. Yeah, for sure. All right. We'll keep an eye on the bankruptcy documents. And when we come back, we're going to talk about a website that's been doxing Tesla owners across the US. We'll be right back after this.

24:29There are so many things in life that we just never get around to. Taking up that hobby, cleaning out the garage, you know, little things that don't really make a huge difference in our lives. Yet there's one thing that most of us have probably been neglecting that can have a huge impact on our family's future. It's life insurance. And with SelectQuote, getting covered with the right policy for you is easier and more affordable than you may think. SelectQuote is one of America's leading insurance brokers with nearly 40 years of experience, helping over 2 million customers find over$700 billion in coverage since 1985.

25:05Other life insurance brokers offer impersonal, one-size-fits-all policies that may cost you more and cover you less. While SelectQuote's licensed insurance agents work for you to tailor a life insurance policy for your individual needs in as little as 15 minutes. And have you ever worried about getting coverage with a pre-existing health condition? select quote partners with carriers that provide policies for a variety of health conditions. If you have high blood pressure, no problem. If you have diabetes, that's fine too. Even if you have heart disease, select quote partners with carriers that can cover those conditions and others.

25:41Or if you don't have any major health issues, they work with carriers that can get you same-day coverage with no medical exam required. Head to selectquote.com and a licensed insurance agent will call you right away with the right policy for your life and your budget. Select Quote. They shop, you save. Get the right life insurance for you for less at selectquote.com slash 404. Go to selectquote.com slash 404 today to get started. That's selectquote.com slash 404. Let's talk numbers. Traditional in-person therapy can cost anywhere from$100 to$250 per session. You can get quality care with BetterHelp's online therapy, and you'll save on average up to 50 % per session.

26:30Navigating the healthcare system is complicated, especially if you want to work on your mental health. Therapy should feel accessible, not like a luxury, because it can make a meaningful difference in your life. With online therapy, you get quality care at a price that makes sense and can help you with anything from anxiety to everyday stress. Your mental health is worth it. And now it's within reach. With BetterHelp, you can learn how to set boundaries, how to work through anxiety, and how to reframe your everyday experiences to better cope with the stress of modern life. Lots of us take our mental health for granted, but it's important to keep working at it, and therapy can help.

27:05With over 30 ,000 therapists, BetterHelp is the world's largest online therapy platform, having served over 5 million people globally with a simple-to-use platform that you can fit into your busy life. Your well-being is worth it. Visit betterhelp.com slash 404media today to get 10 % off your first month. That's betterhelp.com slash 404media. Hey, it's Joseph again. If you're a new listener to the 404 Media Podcast, or even a long-time one, you might not be aware of all of the impact our journalism has had recently, or how we even got here in the first place. In 2023, the four of us quit corporate media to go independent.

27:52We were sick of working for a VC-backed company that put profits before journalism. That gave birth to 404 Media. Since then, we've stopped the spread of AI books in public libraries, triggered class-action lawsuits against AI companies, got Congress to pressure big tech in various ways, and we've even shut down surveillance companies. This real-world impact is only possible because of our paying subscribers. As a journalist-owned business, they are the engine that powers our journalism and where the vast, vast majority of our revenue comes from. So please consider signing up today for$10 a month or$100 a year at 404media.co slash membership and get bonus content every week and access to all of our articles.

28:39Thank you and enjoy the rest of the podcast.

28:53All right, and we are back. This is one Jason and myself wrote. um doge quest site claims to dox tesla owners across the u.s um jason we did discuss the tesla protests in another recent episode but can you give us a super quick uh summary to get us up to speed these protests are still going on basically right yeah i mean the tesla takedown protests have only gotten bigger over time uh the tesla takedown is like uh what they're being called and they're being organized online and primarily they're happening on weekends uh like the organized ones at tesla dealerships all over the country um you know these have notably i believe had quite an impact on tesla stock price it's like tesla stock went down a huge amount uh you know for a variety of reasons um i i would attribute some of it to the protest it's since gone up you know due to lord knows what stock market stuff but also like i don't know trump advertising teslas at the white house things like this but basically there's been like concerted efforts to protest tesla all over the country so there's been that but then there's also been like acts of vandalism and arson at tesla dealerships which the trump administration and elon musk and others have wanted to classify as domestic terrorism or hate crimes or like a level above your like standard vandalism as a you know act of protecting elon musk yeah and we'll talk about that briefly in a second because we're actually going to talk about two stories here but very briefly on this doge quest website um one day i get this signal message saying hey check out this website which is doxing tesla owners and it links to this doge quest website um i say thank you i'm taking a look to whoever this tipster was and i open it up and there's this interface um like a google map style interface for the united states and it has all of these little icons there's one for tesla superchargers and it's a little image of a supercharger um there's ones of the doge dog the Shibuino, the meme dog.

31:18And then when you click that and it has personal information of members of Doge, I'm even hesitant to say employees because who really knows what the technical term is. I'm just going to say members of Doge. And then there are little Tesla car symbols and you click on those and they include the alleged personal information belonging to actual tesla drivers and now it's not every single tesla owner in in the states or or anything like that but you know there's names there's email addresses there's uh phone numbers um and it's funny because i've actually just opened the site and now i literally can't see any of the teslas on here so i actually don't know whether they've removed those or not there's the superchargers and the Tesla dealerships as well.

32:09But at least at the time, there was Tesla owner data on there. I went about verifying it. And initially this was, for the ones who had social media accounts, I was going through those and seeing if there was any information that would indicate they're a Tesla owner. Eventually I did find some of those. There were a few that were like fans of Musk or Tesla seemingly. And, you know, we got to the point where I felt comfortable enough to publish. So we did that with that headline. Then shortly after, people started responding to me. I obviously reached out to some of these people. And one gets back to me and confirms, yes, they're a Tesla owner.

32:48They said they bought it a while ago. And they say they're not a fan of Musk. They bought the vehicle before they knew what Musk would become, all of that sort of thing um but clearly this site sits i mean i think it would be unfair to say it sits with the the tesla takedown protest because those are non-violent protests where people are gathering like it i don't want to lump it in with that but it is obviously that broader context of people are very very mad at tesla um the company and seemingly some of the um owners of the vehicles as well at least based on what everybody says on social media and Jason, you earlier reporting about Cybertrucks and all of that sort of thing.

33:32I guess I'll just read out DogeQuest's own sort of definition on this website. It says that DogeQuest is the ultimate hub for enthusiasts of the Department of Government Efficiency, Doge. Our innovative platform allows users to explore an interactive map of Doge landmarks, but that's not all. We also cater to Tesla Motors owners, providing a comprehensive resource to locate nearby service centers, showrooms, and charging stations, all of their fingertips. And it goes on. Obviously, it is a very tongue-in-cheek way of doxing these people. And the cursor is a Molotov cocktail, which I think would, indicate some of the intent here, potentially.