Bad Actors Getting Your Health Data Is the FBI’s Latest Worry
A hacker activating a 3D rendering of DNA data.
In February 2015, the health insurer Anthem revealed that criminal hackers had gained access to the company's servers, exposing the personal information of nearly 79 million patients. It's the largest known healthcare breach in history.
FBI agents worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks.
That year, the data of millions more would be compromised in one cyberattack after another on American insurers and other healthcare organizations. In fact, for the past several years, the number of reported data breaches has increased each year, from 199 in 2010 to 344 in 2017, according to a September 2018 analysis in the Journal of the American Medical Association.
The FBI's Edward You sees this as a worrying trend. He says hackers aren't just interested in your social security or credit card number. They're increasingly interested in stealing your medical information. Hackers can currently use this information to make fake identities, file fraudulent insurance claims, and order and sell expensive drugs and medical equipment. But beyond that, a new kind of cybersecurity threat is around the corner.
Mr. You and others worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks. In the wrong hands, this data could be used to exploit or extort an individual, discriminate against certain groups of people, make targeted bioweapons, or give another country an economic advantage.
Precision medicine, of course, is the idea that medical treatments can be tailored to individuals based on their genetics, environment, lifestyle or other traits. But to do that requires collecting and analyzing huge quantities of health data from diverse populations. One research effort, called All of Us, launched by the U.S. National Institutes of Health last year, aims to collect genomic and other healthcare data from one million participants with the goal of advancing personalized medical care.
Other initiatives are underway by academic institutions and healthcare organizations. Electronic medical records, genetic tests, wearable health trackers, mobile apps, and social media are all sources of valuable healthcare data that a bad actor could potentially use to learn more about an individual or group of people.
"When you aggregate all of that data together, that becomes a very powerful profile of who you are," Mr. You says.
A supervisory special agent in the biological countermeasures unit within the FBI's weapons of mass destruction directorate, it's Mr. You's job to imagine worst-case bioterror scenarios and figure out how to prevent and prepare for them.
That used to mean focusing on threats like anthrax, Ebola, and smallpox—pathogens that could be used to intentionally infect people—"basically the dangerous bugs," as he puts it. In recent years, advances in gene editing and synthetic biology have given rise to fears that rogue, or even well-intentioned, scientists could create a virulent virus that's intentionally, or unintentionally, released outside the lab.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that."
While Mr. You is still tracking those threats, he's been traveling around the country talking to scientists, lawyers, software engineers, cyber security professionals, government officials and CEOs about new security threats—those posed by genetic and other biological data.
Emerging threats
Mr. You says one possible situation he can imagine is the potential for nefarious actors to use an individual's sensitive medical information to extort or blackmail that person.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that," he says. For instance, "what happens if you have a singular medical condition and an outside entity says they have a treatment for your condition?" You could get talked into paying a huge sum of money for a treatment that ends up being bogus.
Or what if hackers got a hold of a politician or high-profile CEO's health records? Say that person had a disease-causing genetic mutation that could affect their ability to carry out their job in the future and hackers threatened to expose that information. These scenarios may seem far-fetched, but Mr. You thinks they're becoming increasingly plausible.
On a wider scale, Kavita Berger, a scientist at Gryphon Scientific, a Washington, D.C.-area life sciences consulting firm, worries that data from different populations could be used to discriminate against certain groups of people, like minorities and immigrants.
For instance, the advocacy group Human Rights Watch in 2017 flagged a concerning trend in China's Xinjiang territory, a region with a history of government repression. Police there had purchased 12 DNA sequencers and were collecting and cataloging DNA samples from people to build a national database.
"The concern is that this particular province has a huge population of the Muslim minority in China," Ms. Berger says. "Now they have a really huge database of genetic sequences. You have to ask, why does a police station need 12 next-generation sequencers?"
Also alarming is the potential that large amounts of data from different groups of people could lead to customized bioweapons if that data ends up in the wrong hands.
Eleonore Pauwels, a research fellow on emerging cybertechnologies at United Nations University's Centre for Policy Research, says new insights gained from genomic and other data will give scientists a better understanding of how diseases occur and why certain people are more susceptible to certain diseases.
"As you get more and more knowledge about the genomic picture and how the microbiome and the immune system of different populations function, you could get a much deeper understanding about how you could target different populations for treatment but also how you could eventually target them with different forms of bioagents," Ms. Pauwels says.
Economic competitiveness
Another reason hackers might want to gain access to large genomic and other healthcare datasets is to give their country a leg up economically. Many large cyber-attacks on U.S. healthcare organizations have been tied to Chinese hacking groups.
"This is a biological space race and we just haven't woken up to the fact that we're in this race."
"It's becoming clear that China is increasingly interested in getting access to massive data sets that come from different countries," Ms. Pauwels says.
A year after U.S. President Barack Obama conceived of the Precision Medicine Initiative in 2015—later renamed All of Us—China followed suit, announcing the launch of a 15-year, $9 billion precision health effort aimed at turning China into a global leader in genomics.
Chinese genomics companies, too, are expanding their reach outside of Asia. One company, WuXi NextCODE, which has offices in Shanghai, Reykjavik, and Cambridge, Massachusetts, has built an extensive library of genomes from the U.S., China and Iceland, and is now setting its sights on Ireland.
Another Chinese company, BGI, has partnered with Children's Hospital of Philadelphia and Sinai Health System in Toronto, and also formed a collaboration with the Smithsonian Institute to sequence all species on the planet. BGI has built its own advanced genomic sequencing machines to compete with U.S.-based Illumina.
Mr. You says having access to all this data could lead to major breakthroughs in healthcare, such as new blockbuster drugs. "Whoever has the largest, most diverse dataset is truly going to win the day and come up with something very profitable," he says.
Some direct-to-consumer genetic testing companies with offices in the U.S., like Dante Labs, also use BGI to process customers' DNA.
Experts worry that China could race ahead the U.S. in precision medicine because of Chinese laws governing data sharing. Currently, China prohibits the exportation of genetic data without explicit permission from the government. Mr. You says this creates an asymmetry in data sharing between the U.S. and China.
"This is a biological space race and we just haven't woken up to the fact that we're in this race," he said in January at an American Society for Microbiology conference in Washington, D.C. "We don't have access to their data. There is absolutely no reciprocity."
Protecting your data
While Mr. You has been stressing the importance of data security to anyone who will listen, the National Academies of Sciences, Engineering, and Medicine, which makes scientific and policy recommendations on issues of national importance, has commissioned a study on "safeguarding the bioeconomy."
In the meantime, Ms. Berger says organizations that deal with people's health data should assess their security risks and identify potential vulnerabilities in their systems.
As for what individuals can do to protect themselves, she urges people to think about the different ways they're sharing healthcare data—such as via mobile health apps and wearables.
"Ask yourself, what's the benefit of sharing this? What are the potential consequences of sharing this?" she says.
Mr. You also cautions people to think twice before taking consumer DNA tests. They may seem harmless, he says, but at the end of the day, most people don't know where their genetic information is going. "If your genetic sequence is taken, once it's gone, it's gone. There's nothing you can do about it."
The CRISPR-Cas9 gene editing tool could be used to "turn off" pain directly, raising ethical questions for society.
Scientists have long been aware that some people live with what's known as "congenital insensitivity to pain"—the inability to register the tingles, jolts, and aches that alert most people to injury or illness.
"If you break the chain of transmission somewhere along there, it doesn't matter what the message is—the recipient will not get it."
On the ospposite end of the spectrum, others suffer from hyperalgesia, or extreme pain; for those with erythromelalgia, also known as "Man on Fire Syndrome," warm temperatures can feel like searing heat—even wearing socks and shoes can make walking unbearable.
Strangely enough, the two conditions can be traced to mutations in the same gene, SCN9A. It produces a protein that exists in spinal cells—specifically, in the dorsal root ganglion—which transmits the sensation of pain from the nerves at the peripheral site of an injury into the central nervous system and to the brain. This fact may become the key to pain relief for the roughly 20 percent of Americans who suffer from chronic pain, and countless other patients around the world.
"If you break the chain of transmission somewhere along there, it doesn't matter what the message is—the recipient will not get it," said Dr. Fyodor Urnov, director of the Innovative Genomics Institute and a professor of molecular and cell biology at the University of California, Berkeley. "For scientists and clinicians who study this, [there's] this consistent tracking of: You break this gene, you stop feeling pain; make this gene hyperactive, you feel lots of pain—that really cuts through the correlation versus causation question."
Researchers tried for years, without much success, to find a chemical that would block that protein from working and therefore mute the pain sensation. The CRISPR-Cas9 gene editing tool could completely sidestep that approach and "turn off" pain directly.
Yet as CRISPR makes such targeted therapies increasingly possible, the ethical questions surrounding gene editing have taken on a new and more urgent cast—particularly in light of the work of the disgraced Chinese scientist He Jiankui, who announced in late 2018 that he had created the world's first genetically edited babies. He used CRISPR to edit two embryos, with the goal of disabling a gene that makes people susceptible to HIV infection; but then took the unprecedented step of implanting the edited embryos for pregnancy and birth.
Edits to germline cells, like the ones He undertook, involve alterations to gametes or embryos and carry much higher risk than somatic cell edits, since changes will be passed on to any future generations. There are also concerns that imprecise edits could result in mutations and end up causing more disorders. Recent developments, particularly the "search-and replace" prime-editing technique published last fall, will help minimize those accidental edits, but the fact remains that we have little understanding of the long-term effects of these germline edits—for the future of the patients themselves, or for the broader gene pool.
"We need to have appropriate venues where we deliberate and consider the ethical, legal and social implications of gene editing as a society."
It is much harder to predict the effects, harmful or otherwise, on the larger human population as a result of interactions with the environment or other genetic variations; with somatic cell edits, on the other hand— like the ones that would be made in an individual to turn off pain—only the person receiving the treatment is affected.
Beyond the somatic/germline distinction, there is also a larger ethical question over how much genetic interference society is willing to tolerate, which may be couched as the difference between therapeutic editing—interventions in response to a demonstrated medical need—and "enhancement" editing. The Chinese scientist He was roundly criticized in the scientific community for the fact that there are already much safer and more proven methods of preventing the parent-to-child transmission of HIV through the IVF process, making his genetic edits medically unnecessary. (The edits may also have increased the girls' risk of susceptibility to other viruses, like influenza and the West Nile virus.)
Yet there are even more extreme goals that CRISPR could be used to reach, ones further removed from any sort of medical treatment. The 1997 science fiction movie Gattaca imagined a dystopian future where genetic selection for strength and intelligence is common, creating a society that explicitly and unapologetically endorses eugenics. In the real world, Russian President Vladimir Putin has commented that genetic editing could be used to create "a genius mathematician, a brilliant musician or a soldier, a man who can fight without fear, compassion, regret or pain."
"[Such uses] would be considered using gene editing for 'enhancement,'" said Dr. Zubin Master, an associate professor of biomedical ethics at the Mayo Clinic, who noted that a series of studies have strongly suggested that members of the public, in the U.S. and around the world, are much less amenable to the prospect of gene editing for these purposes than for the treatment of illness and disease.
Putin's comments were made in 2017, before news of He's experiment broke; since then no country has moved to continue experiments on germline editing (although one Russian IVF specialist, Denis Rebrikov, appears ready to do so, if given approval). Master noted that the World Health Organization has an 18-person committee currently dedicated to considering these questions. The Expert Advisory Committee on Developing Global Standards for Governance and Oversight of Human Genome Editing first convened in March 2019; that July, it issued a recommendation to regulatory and ethics authorities in all countries to refrain from approving clinical application requests for work on human germline genome editing—the kind of alterations to genetic cells used by He. The committee's report and a fleshed-out set of guidelines is expected after its final meeting, in Geneva this September (unless the COVID-19 pandemic disrupts the timeline).
Regardless of the WHO's report, in the U.S., all regulations of new medical procedures are overseen at the federal level, subjected to extensive regulatory review by the FDA; the chance of any doctor or company going rogue is minimal to none. Likewise, the challenges we face are more on the regulatory end of the spectrum than the Gattaca end. Dr. Stephanie Malia Fullerton, a bioethics professor at the University of Washington, pointed out that eugenics not only typically involves state-sponsored control of reproduction, but requires a much more clearly delineated genetic basis of common complex traits—indeed, SCN9A is one way to get to pain, but is not the only source—and suggested that current concerns about over-prescribing opioids are a more pressing question for society to address.
In fact, Navega Therapeutics, based in San Diego, hopes to find out whether the intersection of this research into SCN9A and CRISPR would be an effective way to address the U.S. opioid crisis. Currently in a preclinical funding stage, Navega's approach focuses on editing epigenetic molecules attached to the basic DNA strand—the idea is that the gene's expression can be activated or suppressed rather than removed entirely, reducing the risk of unwanted side effects from permanently altering the genetic code.
As these studies focused on the sensation of pain go forward, what we are likely to see simultaneously is the use of CRISPR to target diseases that are the root causes of that pain. Last summer, Victoria Gray, a Mississippi woman with sickle cell disease was the second-ever person to be treated with CRISPR therapy in the U.S. The disease is caused by a genetic mutation that creates malformed blood cells, which can't carry oxygen as normal and get stuck inside blood vessels, causing debilitating pain. For the study, conducted in concert with CRISPR Therapeutics, of Cambridge, Mass., cells were removed from Gray's bone marrow, modified using CRISPR, and infused back into her body, a technique called ex vivo editing.
In early February this year, researchers at the University of Pennsylvania published a study on a first-in-human phase 1 clinical trial, in which three patients with advanced cancer received an infusion of ex vivo engineered T cells in an effort to improve antitumor immunity. The modified cells persisted for up to nine months, and the patients experienced no serious adverse side effects, suggesting that this sort of therapeutic gene editing can be performed safely and could potentially allow patients to avoid the excruciating process of chemotherapy.
Then, just this spring, researchers made another advance: The first attempt at in vivo CRISPR editing—where the edits happen inside the patient's body—is currently underway, as doctors attempt to treat a patient blinded by Leber congenital amaurosis, a rare genetic disorder. In an Oregon study sponsored by Editas Medicine and Allergan, the patient, a volunteer, was injected with a harmless virus carrying CRISPR gene-editing machinery; the hope is that the tool will be able to edit out the genetic defect and restore production of a crucial protein. Based on preliminary safety reports, the study has been cleared to continue, and data on higher doses may be available by the end of 2020. Editas Medicine and CRISPR Therapeutics are joined in this sphere by Intellia Therapeutics, which is seeking approval for a trial later this year on amyloidosis, a rare liver condition.
For any such treatment targeting SCN9A to make its way to human subjects, it would first need to undergo years' worth of testing—on mice, on primates, and then on volunteer patients after an extended informed-consent process. If everything went perfectly, Urnov estimates it could take at least three to four years end to end and cost between $5 and 10 million—but that "if" is huge.
"The idea of a regular human being, genetically pure of pain?"
And as that happens, "we need to have appropriate venues where we deliberate and consider the ethical, legal and social implications of gene editing as a society," Master said. CRISPR itself is open-source, but its application is subject to the approval of governments, institutions, and societies, which will need to figure out where to draw the line between miracle treatments and playing God. Something as unpleasant and ubiquitous as pain may in fact be the most appropriate place to start.
"The pain circuit is very old," Urnov said. "We have evolved with the senses that we have, and have become the species that we are, as a result of who we are, physiologically. Yes, I take Advil—but when I get a headache! The idea of a regular human being, genetically pure of pain?... The permanent disabling or turning down of the pain sensation, for anything other than a medical reason? … That seems to be challenging Mother Nature in the wrong ways."
A biosensor in development (inset) could potentially be used to detect novel viruses in transit hubs like Grand Central Station in New York City.
The unprecedented scale and impact of the COVID-19 pandemic has caused scientists and engineers around the world to stop whatever they were working on and shift their research toward understanding a novel virus instead.
"We have confidence that we can use our system in the next pandemic."
For Guangyu Qiu, normally an environmental engineer at the Swiss Federal Laboratories for Materials Science and Technology, that means finding a clever way to take his work on detecting pollution in the air and apply it to living pathogens instead. He's developing a new type of biosensor to make disease diagnostics and detection faster and more accurate than what's currently available.
But even though this pandemic was the impetus for designing a new biosensor, Qiu actually has his eye on future disease outbreaks. He admits that it's unlikely his device will play a role in quelling this virus, but says researchers already need to be thinking about how to make better tools to fight the next one — because there will be a next one.
"In the last 20 years, there [have been] three different coronavirus [outbreaks] ... so we have to prepare for the coming one," Qiu says. "We have confidence that we can use our system in the next pandemic."
"A Really, Really Neat Idea"
His main concern is the diagnostic tool that's currently front and center for testing patients for SARS-Cov-2, the virus causing the novel coronavirus disease. The tool, called PCR (short for reverse transcription polymerase chain reaction), is the gold standard because it excels at detecting viruses in even very small samples of mucus. PCR can amplify genetic material in the limited sample and look for a genetic code matching the virus in question. But in many parts of the world, mucus samples have to be sent out to laboratories for that work, and results can take days to return. PCR is also notoriously prone to false positives and negatives.
"I read a lot of newspapers that report[ed] ... a lot of false negative or false positive results at the very beginning of the outbreak," Qiu says. "It's not good for protecting people to prevent further transmission of the disease."
So he set out to build a more sensitive device—one that's less likely to give you a false result. Qiu's biosensor relies on an idea similar to the dual-factor authentication required of anyone trying to access a secure webpage. Instead of verifying that a virus is really present by using one way of detecting genetic code, as with PCR, this biosensor asks for two forms of ID.
SARS-CoV-2 is what's called an RNA virus, which means it has a single strand of genetic code, unlike double-stranded DNA. Inside Qiu's biosensor are receptors with the complementary code for this particular virus' RNA; if the virus is present, its RNA will bind with the receptors, locking together like velcro. The biosensor also contains a prism and a laser that work together to verify that this RNA really belongs to SARS-CoV-2 by looking for a specific wavelength of light and temperature.
If the biosensor doesn't detect either, or only registers a match for one and not the other, then it can't produce a positive result. This multi-step authentication process helps make sure that the RNA binding with the receptors isn't a genetically similar coronavirus like SARS-CoV, known for its 2003 outbreak, or MERS-CoV, which caused an epidemic in 2012.
It could also be fitted to detect future novel viruses once their genomes are sequenced.
The dual-feature design of this biosensor "is a really, really neat idea that I have not seen before with other sensor technology," says Erin Bromage, a professor of infection and immunology at the University of Massachusetts Dartmouth; he was not involved in designing or testing Qiu's biosensor. "It makes you feel more secure that when you have a positive, you've really got a positive."
The light and temperature sensors are not in themselves new inventions, but the combination is a first. The part of the device that uses light to detect particles is actually central to Qiu's normal stream of environmental research, and is a versatile tool he's been working with for a long time to detect aerosols in the atmosphere and heavy metals in drinking water.
Bromage says this is a plus. "It's not high-risk in the sense that how they do this is unique, or not validated. They've taken aspects of really proven technology and sort of combined it together."
This new biosensor is still a prototype that will take at least another 12 months to validate in real world scenarios, though. The device is sound from a biological perspective and is sensitive enough to reliably detect SARS-CoV-2 — and to not be tricked by genetically similar viruses like SARS-CoV — but there is still a lot of engineering work that needs to be done in order for it to work outside the lab. Qiu says it's unlikely that the sensor will help minimize the impact of this pandemic, but the RNA receptors, prism, and laser inside the device can be customized to detect other viruses that may crop up in the future.
"If we choose another sequence—like SARS, like MERS, or like normal seasonal flu—we can detect other viruses, or even bacteria," Qiu says. "This device is very flexible."
It could also be fitted to detect future novel viruses once their genomes are sequenced.
The Long-Term Vision: Hospitals and Transit Hubs
The device has been designed to connect with two other systems: an air sampler and a microprocessor because the goal is to make it portable, and able to pick up samples from the air in hospitals or public areas like train stations or airports. A virus could hopefully be detected before it silently spreads and erupts into another global pandemic. In the case of SARS-CoV-2, there has been conflicting research about whether or not the virus is truly airborne (though it can be spread by droplets that briefly move through the air after a cough or sneeze), whereas the highly contagious RNA virus that causes measles can remain in the air for up to two hours.
"They've got a lot on the front end to work out," Bromage says. "They've got to work out how to capture and concentrate a virus, extract the RNA from the virus, and then get it onto the sensor. That's some pretty big hurdles, and may take some engineering that doesn't exist right now. But, if they can do that, then that works out really quite well."
One of the major obstacles in containing the COVID-19 pandemic has been in deploying accurate, quick tools that can be used for early detection of a virus outbreak and for later tracing its spread. That will still be true the next time a novel virus rears its head, and it's why Qiu feels that even if his biosensor can't help just yet, the research is still worth the effort.
It could also be fitted to detect future novel viruses once their genomes are sequenced.
The dual-feature design of this biosensor "is a really, really neat idea that I have not seen before with other sensor technology," says Erin Bromage, a professor of infection and immunology at the University of Massachusetts Dartmouth; he was not involved in designing or testing Qiu's biosensor. "It makes you feel more secure that when you have a positive, you've really got a positive."
The light and temperature sensors are not in themselves new inventions, but the combination is a first. The part of the device that uses light to detect particles is actually central to Qiu's normal stream of environmental research, and is a versatile tool he's been working with for a long time to detect aerosols in the atmosphere and heavy metals in drinking water.
Bromage says this is a plus. "It's not high-risk in the sense that how they do this is unique, or not validated. They've taken aspects of really proven technology and sort of combined it together."
This new biosensor is still a prototype that will take at least another 12 months to validate in real world scenarios, though. The device is sound from a biological perspective and is sensitive enough to reliably detect SARS-CoV-2 — and to not be tricked by genetically similar viruses like SARS-CoV — but there is still a lot of engineering work that needs to be done in order for it to work outside the lab. Qiu says it's unlikely that the sensor will help minimize the impact of this pandemic, but the RNA receptors, prism, and laser inside the device can be customized to detect other viruses that may crop up in the future.
"If we choose another sequence—like SARS, like MERS, or like normal seasonal flu—we can detect other viruses, or even bacteria," Qiu says. "This device is very flexible."
It could also be fitted to detect future novel viruses once their genomes are sequenced.
The Long-Term Vision: Hospitals and Transit Hubs
The device has been designed to connect with two other systems: an air sampler and a microprocessor because the goal is to make it portable, and able to pick up samples from the air in hospitals or public areas like train stations or airports. A virus could hopefully be detected before it silently spreads and erupts into another global pandemic. In the case of SARS-CoV-2, there has been conflicting research about whether or not the virus is truly airborne (though it can be spread by droplets that briefly move through the air after a cough or sneeze), whereas the highly contagious RNA virus that causes measles can remain in the air for up to two hours.
"They've got a lot on the front end to work out," Bromage says. "They've got to work out how to capture and concentrate a virus, extract the RNA from the virus, and then get it onto the sensor. That's some pretty big hurdles, and may take some engineering that doesn't exist right now. But, if they can do that, then that works out really quite well."
One of the major obstacles in containing the COVID-19 pandemic has been in deploying accurate, quick tools that can be used for early detection of a virus outbreak and for later tracing its spread. That will still be true the next time a novel virus rears its head, and it's why Qiu feels that even if his biosensor can't help just yet, the research is still worth the effort.