Is 23andMe Safe? A Cyber Security Expert‘s Analysis

As a cyber security professional who has specialized in protecting sensitive cloud data for over a decade, I‘ve watched the explosion in popularity of direct-to-consumer genetic testing services like 23andMe with both fascination and concern. The promise of unprecedented insights into our health and heritage is undeniably alluring. But as with all digital services that collect deeply personal information, entrusting a company with a copy of your genetic blueprint carries inherent privacy risks that warrant careful examination.

23andMe‘s 2023 data breach, which exposed millions of customers‘ account details through a targeted attack, brought these privacy concerns to the forefront. In this article, I‘ll dig into the technical specifics of what went wrong, the state of 23andMe‘s security practices today, and what you need to know to make an informed decision about whether 23andMe is safe enough for your personal risk tolerance.

What Data Does 23andMe Actually Collect?

First, it‘s important to understand the scope of data 23andMe holds. When you sign up for the service, you agree to send 23andMe a saliva sample for DNA analysis. 23andMe extracts DNA from the sample and analyzes it using genotyping technology that looks at specific genetic variants.

The resulting raw DNA data is stored in 23andMe‘s database, associated with your account information like name, date of birth, and email address. Depending on which services you use, 23andMe may also collect and store:

• Personal and family health history you provide through surveys
• Contacts you invite to the service to build your family tree
• Relatives identified through the DNA Relatives matching feature
• Credit card information used to make purchases

Altogether, it‘s an extensive portfolio of linked genetic and personal data that would be highly valuable to hackers, advertisers, insurance companies, and other third parties. A key question is: how robustly is 23andMe securing all this sensitive information?

23andMe‘s Security Practices in 2024

23andMe provides an overview of its security practices on its website, highlighting measures like encryption of genetic data in transit and at rest, regular security audits, employee background checks, and ISO 27001 certification for its information security management system. After the 2023 breach, 23andMe also implemented enhanced security controls like:

• Mandatory two-factor authentication for all users
• Enhanced account activity monitoring and logging
• Periodic prompts for users to update account passwords

These are all positive signs that 23andMe prioritizes data security and responds proactively to threats. However, as the 2023 incident shows, determined attackers can still find ways in, especially by exploiting password reuse across sites to circumvent two-factor authentication on individual accounts.

Comparing 23andMe‘s practices to other major genetic testing providers, they appear to be in line with industry norms. Ancestry.com and MyHeritage have similar documentation of their security standards, certifications, and use of encryption. However, the industry as a whole tends to be fairly opaque about the specifics of how genetic data is secured, likely for competitive reasons.

As a cyber security specialist, I would like to see even more transparency from 23andMe and its peers, such as:

• Making their ISO 27001 certification audit results available
• Disclosing details of their encryption algorithms and key management practices
• Publishing reports on their bug bounty programs and responsiveness to security researcher disclosures
• Providing clear, technical documentation of what their two-factor authentication system protects and how it is implemented

Greater openness would allow security experts to better vet these companies‘ practices and hold them accountable to the highest standards for securing sensitive genetic information.

Managing Your 23andMe Privacy Settings

If you do decide to use 23andMe, it‘s crucial to review and manage your account privacy settings to control how your data can be used and shared. Here are the key settings to focus on:

1. DNA Relatives – This feature compares your DNA to other users and notifies you of genetic matches. If you opt in, your genetic data will be available to your matches. Consider turning this off if you don‘t want unknown relatives accessing your profile.

2. Research Consent – 23andMe has an extensive research program where customers can opt to contribute their genetic data to scientific studies. This data is supposed to be de-identified and only shared in aggregate, but some studies have shown it is possible to re-identify individuals from anonymous genetic data. Think carefully about whether you are comfortable with this risk.

3. Data Sharing with Third Parties – 23andMe allows you to selectively share your genetic reports with others. Be judicious about who you choose to share with, as those individuals could further expose your data.

4. Saliva Sample Retention – By default, 23andMe will store your saliva sample after processing. You can request destruction of your sample through your account settings.

Deleting Your 23andMe Account and Erasing Your Data

Even if you‘ve used 23andMe in the past, you can still remove your data from the company‘s systems. The process is fairly straightforward:

1. Log into your 23andMe account and navigate to the Account Settings page
2. Under "Delete Your Data", click on "Delete Account"
3. Follow the prompts to confirm you want to permanently delete your genetic data, personal information, and account

23andMe states that deletion requests are processed within 30 days. The company will destroy your saliva sample (if still stored) and delete genetic data, account information, and any stored personal data like survey responses.

However, it‘s important to note that while 23andMe will remove data from its active database, it will retain "limited information" related to your account and orders. There‘s no clear documentation of exactly what data is kept in this dormant state.

Additionally, if you‘ve previously opted into 23andMe‘s research program, any data already used in studies cannot be withdrawn due to the difficulty of removing individual data from aggregate research datasets. This highlights the importance of carefully considering research consent upfront.

Some users may want to take the extra step of employing a data removal service like DeleteMe or Privacy Bee to completely erase their information from 23andMe and any other online databases. These services specialize in finding and removing personal data from digital sources. They can add peace of mind but come at an extra cost.

The Future of Genetic Data Security

Looking ahead, I believe securing genetic data will only become a more pressing concern as the value and sensitivity of this information grows. Today, the biggest threats are primarily hackers seeking to steal genetic data for identity theft or blackmail purposes. But in the future, we could see more sophisticated attempts to exploit genetic information for targeted advertising, insurance underwriting, or even biometric surveillance.

As genetic testing becomes more widespread, the chances of large-scale data breaches will increase, potentially exposing millions of people‘s DNA data at once. It‘s crucial that companies like 23andMe stay ahead of evolving threats and invest heavily in data security research and innovation.

At the same time, I believe we need stronger regulations and industry standards around genetic data protection. Existing laws like HIPAA and GINA offer some safeguards against misuse of genetic information by employers and health insurers. But more comprehensive rules are needed to address the unique risks of unprotected genetic data.

Governments and industry groups must work together to:

• Mandate robust encryption standards for storing and transferring genetic data
• Require regular security audits and certifications for genetic testing providers
• Impose strict penalties for data breaches and misuse of genetic information
• Establish protocols for secure data deletion and protect consumers‘ right to be forgotten
• Limit how genetic data can be monetized or shared with third parties
• Fund research into privacy-preserving technologies like homomorphic encryption and differential privacy

As a society, we are still in the early stages of grappling with the tremendous power and peril of mass genetic data collection. Establishing strong safeguards now is essential to ensuring this information is used to benefit rather than harm individuals.

So, Is 23andMe Safe Enough?

23andMe has made significant strides in bolstering its data security practices in the wake of the 2023 breach. For the average user, the company‘s technical controls, privacy settings, and account deletion options likely mitigate the most pressing risks of genetic data exposure.

However, no online service is completely impervious to hacking, and the consequences of leaked genetic data could be particularly devastating. Even with strong security measures in place, all it takes is one successful phishing attempt or rogue employee to compromise millions of users‘ most intimate information.

Ultimately, using 23andMe (or any genetic testing service) requires a personal calculation of whether the benefits outweigh the potential privacy costs. It‘s a decision that hinges on your individual risk tolerance, trust in corporate data practices, and the value you place on learning about your genetic background.

If you prioritize data privacy above all else, the only surefire way to protect your genetic information is not to digitize it in the first place. But if you‘re comfortable with some level of risk in exchange for potentially life-changing insights, 23andMe appears to be a relatively secure option with transparent user controls.

As a cyber security professional, my role is not to make that choice for you, but to provide a candid assessment of the technological and regulatory landscape so you can feel empowered to make an informed decision. Regardless of whether you use 23andMe, I encourage everyone to educate themselves about best practices for online data hygiene and to push for continued innovation in privacy-first technologies.

Our genetic code holds immense personal and societal power. Ensuring that power is harnessed responsibly will be one of the great challenges of the coming decades. For now, vigilance, transparency, and ongoing security learning are our best defenses as we navigate this uncharted frontier.