Bad Actors Getting Your Health Data Is the FBI’s Latest Worry
A hacker activating a 3D rendering of DNA data.
In February 2015, the health insurer Anthem revealed that criminal hackers had gained access to the company's servers, exposing the personal information of nearly 79 million patients. It's the largest known healthcare breach in history.
FBI agents worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks.
That year, the data of millions more would be compromised in one cyberattack after another on American insurers and other healthcare organizations. In fact, for the past several years, the number of reported data breaches has increased each year, from 199 in 2010 to 344 in 2017, according to a September 2018 analysis in the Journal of the American Medical Association.
The FBI's Edward You sees this as a worrying trend. He says hackers aren't just interested in your social security or credit card number. They're increasingly interested in stealing your medical information. Hackers can currently use this information to make fake identities, file fraudulent insurance claims, and order and sell expensive drugs and medical equipment. But beyond that, a new kind of cybersecurity threat is around the corner.
Mr. You and others worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks. In the wrong hands, this data could be used to exploit or extort an individual, discriminate against certain groups of people, make targeted bioweapons, or give another country an economic advantage.
Precision medicine, of course, is the idea that medical treatments can be tailored to individuals based on their genetics, environment, lifestyle or other traits. But to do that requires collecting and analyzing huge quantities of health data from diverse populations. One research effort, called All of Us, launched by the U.S. National Institutes of Health last year, aims to collect genomic and other healthcare data from one million participants with the goal of advancing personalized medical care.
Other initiatives are underway by academic institutions and healthcare organizations. Electronic medical records, genetic tests, wearable health trackers, mobile apps, and social media are all sources of valuable healthcare data that a bad actor could potentially use to learn more about an individual or group of people.
"When you aggregate all of that data together, that becomes a very powerful profile of who you are," Mr. You says.
A supervisory special agent in the biological countermeasures unit within the FBI's weapons of mass destruction directorate, it's Mr. You's job to imagine worst-case bioterror scenarios and figure out how to prevent and prepare for them.
That used to mean focusing on threats like anthrax, Ebola, and smallpox—pathogens that could be used to intentionally infect people—"basically the dangerous bugs," as he puts it. In recent years, advances in gene editing and synthetic biology have given rise to fears that rogue, or even well-intentioned, scientists could create a virulent virus that's intentionally, or unintentionally, released outside the lab.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that."
While Mr. You is still tracking those threats, he's been traveling around the country talking to scientists, lawyers, software engineers, cyber security professionals, government officials and CEOs about new security threats—those posed by genetic and other biological data.
Emerging threats
Mr. You says one possible situation he can imagine is the potential for nefarious actors to use an individual's sensitive medical information to extort or blackmail that person.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that," he says. For instance, "what happens if you have a singular medical condition and an outside entity says they have a treatment for your condition?" You could get talked into paying a huge sum of money for a treatment that ends up being bogus.
Or what if hackers got a hold of a politician or high-profile CEO's health records? Say that person had a disease-causing genetic mutation that could affect their ability to carry out their job in the future and hackers threatened to expose that information. These scenarios may seem far-fetched, but Mr. You thinks they're becoming increasingly plausible.
On a wider scale, Kavita Berger, a scientist at Gryphon Scientific, a Washington, D.C.-area life sciences consulting firm, worries that data from different populations could be used to discriminate against certain groups of people, like minorities and immigrants.
For instance, the advocacy group Human Rights Watch in 2017 flagged a concerning trend in China's Xinjiang territory, a region with a history of government repression. Police there had purchased 12 DNA sequencers and were collecting and cataloging DNA samples from people to build a national database.
"The concern is that this particular province has a huge population of the Muslim minority in China," Ms. Berger says. "Now they have a really huge database of genetic sequences. You have to ask, why does a police station need 12 next-generation sequencers?"
Also alarming is the potential that large amounts of data from different groups of people could lead to customized bioweapons if that data ends up in the wrong hands.
Eleonore Pauwels, a research fellow on emerging cybertechnologies at United Nations University's Centre for Policy Research, says new insights gained from genomic and other data will give scientists a better understanding of how diseases occur and why certain people are more susceptible to certain diseases.
"As you get more and more knowledge about the genomic picture and how the microbiome and the immune system of different populations function, you could get a much deeper understanding about how you could target different populations for treatment but also how you could eventually target them with different forms of bioagents," Ms. Pauwels says.
Economic competitiveness
Another reason hackers might want to gain access to large genomic and other healthcare datasets is to give their country a leg up economically. Many large cyber-attacks on U.S. healthcare organizations have been tied to Chinese hacking groups.
"This is a biological space race and we just haven't woken up to the fact that we're in this race."
"It's becoming clear that China is increasingly interested in getting access to massive data sets that come from different countries," Ms. Pauwels says.
A year after U.S. President Barack Obama conceived of the Precision Medicine Initiative in 2015—later renamed All of Us—China followed suit, announcing the launch of a 15-year, $9 billion precision health effort aimed at turning China into a global leader in genomics.
Chinese genomics companies, too, are expanding their reach outside of Asia. One company, WuXi NextCODE, which has offices in Shanghai, Reykjavik, and Cambridge, Massachusetts, has built an extensive library of genomes from the U.S., China and Iceland, and is now setting its sights on Ireland.
Another Chinese company, BGI, has partnered with Children's Hospital of Philadelphia and Sinai Health System in Toronto, and also formed a collaboration with the Smithsonian Institute to sequence all species on the planet. BGI has built its own advanced genomic sequencing machines to compete with U.S.-based Illumina.
Mr. You says having access to all this data could lead to major breakthroughs in healthcare, such as new blockbuster drugs. "Whoever has the largest, most diverse dataset is truly going to win the day and come up with something very profitable," he says.
Some direct-to-consumer genetic testing companies with offices in the U.S., like Dante Labs, also use BGI to process customers' DNA.
Experts worry that China could race ahead the U.S. in precision medicine because of Chinese laws governing data sharing. Currently, China prohibits the exportation of genetic data without explicit permission from the government. Mr. You says this creates an asymmetry in data sharing between the U.S. and China.
"This is a biological space race and we just haven't woken up to the fact that we're in this race," he said in January at an American Society for Microbiology conference in Washington, D.C. "We don't have access to their data. There is absolutely no reciprocity."
Protecting your data
While Mr. You has been stressing the importance of data security to anyone who will listen, the National Academies of Sciences, Engineering, and Medicine, which makes scientific and policy recommendations on issues of national importance, has commissioned a study on "safeguarding the bioeconomy."
In the meantime, Ms. Berger says organizations that deal with people's health data should assess their security risks and identify potential vulnerabilities in their systems.
As for what individuals can do to protect themselves, she urges people to think about the different ways they're sharing healthcare data—such as via mobile health apps and wearables.
"Ask yourself, what's the benefit of sharing this? What are the potential consequences of sharing this?" she says.
Mr. You also cautions people to think twice before taking consumer DNA tests. They may seem harmless, he says, but at the end of the day, most people don't know where their genetic information is going. "If your genetic sequence is taken, once it's gone, it's gone. There's nothing you can do about it."
Can Radical Transparency Overcome Resistance to COVID-19 Vaccines?
Secretive panels of independent experts called Data Safety and Monitoring Boards examine clinical trials' data for safety and efficacy.
When historians look back on the COVID-19 pandemic, they may mark November 9, 2020 as the day the tide began to turn. That's when the New York-based pharmaceutical giant Pfizer announced that clinical trials showed its experimental vaccine, developed with the German firm BioNTech, to be 90 percent effective in preventing the disease.
A week later, Massachusetts biotech startup Moderna declared its vaccine to be 95 percent effective. By early December, Great Britain had begun mass inoculations, followed—once the Food and Drug Administration gave the thumbs-up—by the United States. In this scenario, the worst global health crisis in a century was on the cusp of resolution.
Yet future chroniclers may instead peg November 9 as the day false hope dawned. That could happen if serious safety issues, undetected so far, arise after millions of doses are administered. Experts consider it unlikely, however, that such problems alone (as opposed to the panic they might spark) would affect enough people to thwart a victory over the coronavirus. A more immediate obstacle is vaccine hesitancy—the prospect that much of the populace will refuse to roll up their sleeves.
To achieve "herd immunity" for COVID-19 (the point at which a vaccine reduces transmission rates enough to protect those who can't or won't take it, or for whom it doesn't work), epidemiologists estimate that up to 85 percent of the population will have to be vaccinated. Alarmingly, polls suggest that 40 to 50 percent of Americans intend to decline, judging the risks to be more worrisome than those posed by the coronavirus itself.
COVID vaccine skeptics occupy various positions on a spectrum of doubt. Some are committed anti-vaxxers, or devotees of conspiracy theories that view the pandemic as a hoax. Others belong to minority groups that have historically been used as guinea pigs in unethical medical research (for horrific examples, Google "Tuskegee syphilis experiment" or "Henrietta Lacks"). Still others simply mistrust Big Pharma and/or Big Government. A common fear is that the scramble to find a vaccine—intensified by partisan and profit motives—has led to corner-cutting in the testing and approval process. "They really rushed," an Iowa trucker told The Washington Post. "I'll probably wait a couple of months after they start to see how everyone else is handling it."
The COVID crisis has spurred calls for secretive Data Safety and Monitoring Boards to come out of the shadows.
The consensus among scientists, by contrast, is that the process has been rigorous enough, given the exigency of the situation, that the public can feel reasonably confident in any vaccine that has earned the imprimatur of the FDA. For those of us who share that assessment, finding ways to reassure the hesitant-but-persuadable is an urgent matter.
Vax-positive public health messaging is one obvious tactic, but a growing number of experts say it's not enough. They prescribe a regimen of radical transparency throughout the system that regulates research—in particular, regarding the secretive panels that oversee vaccine trials.
The Crucial Role of the Little-Known Panels
Like other large clinical trials involving potentially high-demand or controversial products, studies of COVID-19 vaccines in most countries are supervised by groups of independent observers. Known in the United States as data safety and monitoring boards (DSMBs), and elsewhere as data monitoring committees, these panels consist of scientists, clinicians, statisticians, and other authorities with no ties to the sponsor of the study.
The six trials funded by the federal program known as Operation Warp Speed (including those of newly approved Moderna and frontrunner AstraZeneca) share a DSMB, whose members are selected by the National Institutes of Health; other companies (including Pfizer) appoint their own. The panel's job is to monitor the safety and efficacy of a treatment while the trial is ongoing, and to ensure that data is being collected and analyzed correctly.
Vaccine studies are "double-blinded," which means neither the participants nor the doctors running the trial know who's getting the real thing and who's getting a placebo. But the DSMB can access that information if a study volunteer has what might be a serious side effect—and if the participant was in the vaccine group, the board can ask that the trial be paused for further investigation.
The DSMB also checks for efficacy at pre-determined intervals. If it finds that the vaccine group and the placebo group are getting sick at similar rates, the panel can recommend stopping the trial due to "futility." And if the results look overwhelmingly positive, the DSMB can recommend that the study sponsor apply for FDA approval before the scheduled end of the trial, in order to hurry the product to market.
With this kind of inside dope and high-level influence, DSMBs could easily become targets for outside pressure. That's why, since the 1980s, their membership has typically been kept secret.
During the early days of the AIDS crisis, researchers working on HIV drugs feared for the safety of the experts on their boards. "They didn't want them to be besieged and harassed by members of the community," explains Susan Ellenberg, a professor of biostatistics, medical ethics and health policy at the University of Pennsylvania, and co-author of Data Monitoring Committees in Clinical Trials, the DSMB bible. "You can understand why people would very much want to know how things were looking in a given trial. They wanted to save their own lives; they wanted to save their friends' lives." Ellenberg, who was founding director of the biostatistics branch of the AIDS division at the National Institute of Allergy and Infectious Diseases (NIAID), helped shape a range of policies designed to ensure that DSMBs made decisions based on data and nothing else.
Confidentiality also shields DSMB members from badgering by patient advocacy groups, who might urge that a drug be presented for approval before trial results are conclusive, or by profit-hungry investors. "It prevents people from trying to pry out information to get an edge in the stock market," says Art Caplan, a bioethicist at New York University.
Yet the COVID crisis has spurred calls for DSMBs to come out of the shadows. One triggering event came in March 2020, when the FDA approved hydroxychloroquine for COVID-19—a therapy that President Donald J. Trump touted, despite scant evidence for its efficacy. (Approval was rescinded in June.) If the agency could bow to political pressure on these medications, critics warned, it might do so with vaccines as well. In the end, that didn't happen; the Pfizer approval was issued well after Election Day, despite Trump's goading, and most experts agree that it was based on solid science. Still, public suspicion lingers.
Another shock came in September, after British-based AstraZeneca announced it was pausing its vaccine trial globally due to a "suspected adverse rection" in a volunteer. The company shared no details with the press. Instead, AstraZeneca's CEO divulged them in a private call with J.P. Morgan investors the next day, confirming that the volunteer was suffering from transverse myelitis, a rare and serious spinal inflammation—and that the study had also been halted in July, when another volunteer displayed neurological symptoms. STAT News broke the story after talking to tipsters.
Although both illnesses were found to be unrelated to the vaccine, and the trial was restarted, the incident had a paradoxical effect: while it confirmed for experts that the oversight system was working, AstraZeneca's initial lack of candor added to many laypeople's sense that it wasn't. "If you were seeking to undermine trust, that's kind of how you would go about doing it," says Charles Weijer, a bioethicist at Western University in Ontario, who has helped develop clinical trial guidelines for the World Health Organization.
Both Caplan and Weijer have served on many DSMBs; they believe the boards are generally trustworthy, and that those overseeing COVID vaccine trials are performing their jobs well. But the secrecy surrounding these groups, they and others argue, has become counterproductive. Shining a light on the statistical sausage-makers would help dispel doubts about the finished product.
"I'm not suggesting that any of these companies are doing things unethically," Weijer explains. "But the circumstances of a global pandemic are sufficiently challenging that perhaps they ought to be doing some things differently. I believe it would be trust-producing for data monitoring committees to be more forthcoming than usual."
Building Trust: More Transparency
Just how forthcoming is a matter of debate. Caplan suggests that each COVID vaccine DSMB reveal the name of its chair; that would enable the scientific community, as well as the media and the general public, to get a sense of the integrity and qualifications of the board as a whole while preserving the anonymity of the other members.
Indeed, when Operation Warp Speed's DSMB chair, Richard Whitley, was outed through a website slip-up, many observers applauded his selection for the role; a professor of pediatrics, microbiology, medicine and neurosurgery at the University of Alabama at Birmingham, he is "an exceptionally experienced and qualified individual," Weijer says. (Reporters with ProPublica later identified two other members: Susan Ellenberg and immunologist William Makgoba, known for his work on the South African AIDS Vaccine Initiative.)
Caplan would also like to see more details of the protocols DSMBs are using to make decisions, such as the statistical threshold for efficacy that would lead them to seek approval from the FDA. And he wishes the NIH would spell out specific responsibilities for these monitoring boards. "They don't really have clear, government-mandated charters," he notes. For example, there's no requirement that DSMBs include an ethicist or patient advocate—both of which Caplan considers essential for vaccine trials. "Rough guidelines," he says, "would be useful."
Weijer, for his part, thinks DSMBs should disclose all their members. "When you only disclose the chair, you leave questions unanswered," he says. "What expertise do [the others] bring to the table? Are they similarly free of relevant conflicts of interest? And it doesn't answer the question that will be foremost on many people's minds: are these people in the pocket of pharma?"
Weijer and Caplan both want to see greater transparency around the trial results themselves. Because the FDA approved the Pfizer and Moderna vaccines with emergency use authorizations rather than full licensure, which requires more extensive safety testing, these products reached the market without the usual paper trail of peer-reviewed publications. The same will likely be true of any future COVID vaccines that the agency greenlights. To add another level of scrutiny, both ethicists suggest, each company should publicly release its data at the end of a trial. "That offers the potential for academic groups to go in and do an analysis," Weijer explains, "to verify the claims about the safety and efficacy of the vaccine." The point, he says, is not only to ensure that the approval was justified, but to provide evidence to counter skeptics' qualms.
Caplan may differ on some of the details, but he endorses the premise. "It's all a matter of trust," he says. "You're always watching that, because a vaccine is only as good as the number of people who take it."
Scientists Attempt to Make Human Cells Resistant to Coronaviruses and Ebola
Scientists are experimenting with turning certain genes on and off to make cells better fight viral infection.
Under the electronic microscope, the Ebola particles looked like tiny round bubbles floating inside human cells. Except these Ebola particles couldn't get free from their confinement.
They were trapped inside their bubbles, unable to release their RNA into the human cells to start replicating. These cells stopped the Ebola infection. And they did it on their own, without any medications, albeit in a petri dish of immunologist Adam Lacy-Hulbert. He studies how cells fight infections at the Benaroya Research Institute in Seattle, Washington.
These weren't just any ordinary human cells. They had a specific gene turned on—namely CD74, which typically wouldn't be on. Lacy-Hulbert's team was experimenting with turning various genes on and off to see what made cells fight viral infections better. One particular form of the CD74 gene did the trick. Normally, the Ebola particles would use the cells' own proteases—enzymes that are often called "molecular scissors" because they slice proteins—to cut the bubbles open. But CD74 produced a protein that blocked the scissors from cutting the bubbles, leaving Ebola trapped.
"When that gene turns on, it makes the protein that interferes with Ebola replication," Lacy-Hulbert says. "The protein binds to those molecular scissors and stops them from working." Even better, the protein interfered with coronaviruses too, including SARS-CoV-2, as the team published in the journal Science.
This begs the question: If one can turn on cells' viral resistance in a lab, can this be done in a human body so we that we can better fight Ebola, coronaviruses and other viral scourges?
Recent research indeed shows that our ability to fight viral infections is written in our genes. Genetic variability is at least one reason why some coronavirus-infected people don't develop symptoms while others stay on ventilators for weeks—often due to the aberrant response of their immune system, which went on overdrive to kill the pathogen. But if cells activate certain genes early in the infection, they might successfully stop viruses from replicating before the immune system spirals out of control.
"If my father who is 70 years old tests positive, I would recommend he takes interferon as early as possible."
When we talk about fighting infections, we tend to think in terms of highly specialized immune system cells—B-cells that release antibodies and T-cells that stimulate inflammatory responses, says Lacy-Hulbert. But all other cells in the body have the ability to fight infections too via different means. When cells detect the presence of a pathogen, they release interferons—small protein molecules named so because they set off a genetic chain reaction that interferes with viral replication. These molecules work as alarm signals to other cells around them. The neighboring cells transduce these signals inside themselves and turn on genes responsible for cellular defenses.
"There are at least 300 to 400 genes that are stimulated by type I interferons," says professor Jean-Laurent Casanova at Rockefeller University.
Scientists don't yet know exactly what all of these genes do, but they change the molecular behavior of the cells. "The cells go into a dramatic change and start producing hundreds of proteins that interfere with viral replication on the inside," explains Qian Zhang, a researcher at Casanova's lab. "Some block the proteins the virus needs and some physically tether the virus."
Some cells produce only small amount of interferon, enough to alert their neighbors. Others, such microphages and monocytes, whose jobs are to detect foreign invaders, produce a lot, injecting interferons into the blood to sound the alarm throughout the body. "They are professional cells so their jobs [are] to detect a viral or bacterial infection," Zhang explains.
People with impaired interferon responses are more vulnerable to infections, including influenza and coronaviruses. In two recent studies published in the journal Science, Casanova, Zhang and their colleagues found that patients who lacked a certain type of interferon had more severe Covid-19 symptoms and some died from it. The team ran a genetic comparison of blood samples from patients hospitalized with severe coronavirus cases against those with the asymptomatic infections.
They found that people with severe disease had rare variants in the 13 genes responsible for interferon production. More than three percent of them had a genetic mutation resulting in non-functioning genes. And over ten percent had an autoimmune condition, in which misguided antibodies neutralized their interferons, dampening their bodies' defenses—and these patients were predominantly men. These discoveries help explain why some young and seemingly healthy individuals require life support, while others have mild symptoms or none. The findings also offer ways of stimulating cellular resistance.
A New Frontier in the Making
The idea of making human cells genetically resistant to infections—and possibly other stressors like cancer or aging—has been considered before. It is the concept behind the Genome Project-write or GP-write project, which aims to create "ultra-safe" versions of human cells that resist a variety of pathogens by way of "recoding" or rewriting the cells' genes.
To build proteins, cells use combinations of three DNA bases called codons to represent amino acids—the proteins' building blocks. But biologists find that many of the codons are redundant so if they were removed from all genes, the human cells would still make all their proteins. However, the viruses, whose genes would still include these eliminated redundant codons, would no longer successfully be able to replicate inside human cells.
In 2016, the GP-Write team successfully reduced the number of Escherichia coli's codons from 64 to 57. Recoding genes in all human cells would be harder, but some recoded cells may be transplanted into the body, says Harvard Medical School geneticist George Church, the GP-Write core founding member.
"You can recode a subset of the body, such as all of your blood," he says. "You can also grow an organ inside a recoded pig and transplant it."
Church adds that these methods are still in stages that are too early to help us with this pandemic.
LeapsMag exclusively interviewed Church in 2019 about his latest progress with DNA recoding:
The Push for Clinical Trials
In the meantime, interferons may prove an easier medicine. Lacy-Hulbert thinks that interferon gamma might play a role in activating the CD74 gene, which gums up the molecular scissors. There also may be other ways to activate that gene. "So we are now thinking, can we develop a drug that mimics that actual activity?" he says.
Some interferons are already manufactured and used for treating certain diseases, including multiple sclerosis. Theoretically, nothing prevents doctors from prescribing interferons to Covid patients, but it must be done in the early stages of infection—to stimulate genes that trigger cellular defenses before the virus invades too many cells and before the immune systems mobilizes its big guns.
"If my father who is 70 years old tests positive, I would recommend he takes interferon as early as possible," says Zhang. But to make it a mainstream practice, doctors need clear prescription guidelines. "What would really help doctors make these decisions is clinical trials," says Casanova, so that such guidelines can be established. "We are now starting to push for clinical trials," he adds.
Lina Zeldovich has written about science, medicine and technology for Popular Science, Smithsonian, National Geographic, Scientific American, Reader’s Digest, the New York Times and other major national and international publications. A Columbia J-School alumna, she has won several awards for her stories, including the ASJA Crisis Coverage Award for Covid reporting, and has been a contributing editor at Nautilus Magazine. In 2021, Zeldovich released her first book, The Other Dark Matter, published by the University of Chicago Press, about the science and business of turning waste into wealth and health. You can find her on http://linazeldovich.com/ and @linazeldovich.