Bad Actors Getting Your Health Data Is the FBI’s Latest Worry
A hacker activating a 3D rendering of DNA data.
In February 2015, the health insurer Anthem revealed that criminal hackers had gained access to the company's servers, exposing the personal information of nearly 79 million patients. It's the largest known healthcare breach in history.
FBI agents worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks.
That year, the data of millions more would be compromised in one cyberattack after another on American insurers and other healthcare organizations. In fact, for the past several years, the number of reported data breaches has increased each year, from 199 in 2010 to 344 in 2017, according to a September 2018 analysis in the Journal of the American Medical Association.
The FBI's Edward You sees this as a worrying trend. He says hackers aren't just interested in your social security or credit card number. They're increasingly interested in stealing your medical information. Hackers can currently use this information to make fake identities, file fraudulent insurance claims, and order and sell expensive drugs and medical equipment. But beyond that, a new kind of cybersecurity threat is around the corner.
Mr. You and others worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks. In the wrong hands, this data could be used to exploit or extort an individual, discriminate against certain groups of people, make targeted bioweapons, or give another country an economic advantage.
Precision medicine, of course, is the idea that medical treatments can be tailored to individuals based on their genetics, environment, lifestyle or other traits. But to do that requires collecting and analyzing huge quantities of health data from diverse populations. One research effort, called All of Us, launched by the U.S. National Institutes of Health last year, aims to collect genomic and other healthcare data from one million participants with the goal of advancing personalized medical care.
Other initiatives are underway by academic institutions and healthcare organizations. Electronic medical records, genetic tests, wearable health trackers, mobile apps, and social media are all sources of valuable healthcare data that a bad actor could potentially use to learn more about an individual or group of people.
"When you aggregate all of that data together, that becomes a very powerful profile of who you are," Mr. You says.
A supervisory special agent in the biological countermeasures unit within the FBI's weapons of mass destruction directorate, it's Mr. You's job to imagine worst-case bioterror scenarios and figure out how to prevent and prepare for them.
That used to mean focusing on threats like anthrax, Ebola, and smallpox—pathogens that could be used to intentionally infect people—"basically the dangerous bugs," as he puts it. In recent years, advances in gene editing and synthetic biology have given rise to fears that rogue, or even well-intentioned, scientists could create a virulent virus that's intentionally, or unintentionally, released outside the lab.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that."
While Mr. You is still tracking those threats, he's been traveling around the country talking to scientists, lawyers, software engineers, cyber security professionals, government officials and CEOs about new security threats—those posed by genetic and other biological data.
Emerging threats
Mr. You says one possible situation he can imagine is the potential for nefarious actors to use an individual's sensitive medical information to extort or blackmail that person.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that," he says. For instance, "what happens if you have a singular medical condition and an outside entity says they have a treatment for your condition?" You could get talked into paying a huge sum of money for a treatment that ends up being bogus.
Or what if hackers got a hold of a politician or high-profile CEO's health records? Say that person had a disease-causing genetic mutation that could affect their ability to carry out their job in the future and hackers threatened to expose that information. These scenarios may seem far-fetched, but Mr. You thinks they're becoming increasingly plausible.
On a wider scale, Kavita Berger, a scientist at Gryphon Scientific, a Washington, D.C.-area life sciences consulting firm, worries that data from different populations could be used to discriminate against certain groups of people, like minorities and immigrants.
For instance, the advocacy group Human Rights Watch in 2017 flagged a concerning trend in China's Xinjiang territory, a region with a history of government repression. Police there had purchased 12 DNA sequencers and were collecting and cataloging DNA samples from people to build a national database.
"The concern is that this particular province has a huge population of the Muslim minority in China," Ms. Berger says. "Now they have a really huge database of genetic sequences. You have to ask, why does a police station need 12 next-generation sequencers?"
Also alarming is the potential that large amounts of data from different groups of people could lead to customized bioweapons if that data ends up in the wrong hands.
Eleonore Pauwels, a research fellow on emerging cybertechnologies at United Nations University's Centre for Policy Research, says new insights gained from genomic and other data will give scientists a better understanding of how diseases occur and why certain people are more susceptible to certain diseases.
"As you get more and more knowledge about the genomic picture and how the microbiome and the immune system of different populations function, you could get a much deeper understanding about how you could target different populations for treatment but also how you could eventually target them with different forms of bioagents," Ms. Pauwels says.
Economic competitiveness
Another reason hackers might want to gain access to large genomic and other healthcare datasets is to give their country a leg up economically. Many large cyber-attacks on U.S. healthcare organizations have been tied to Chinese hacking groups.
"This is a biological space race and we just haven't woken up to the fact that we're in this race."
"It's becoming clear that China is increasingly interested in getting access to massive data sets that come from different countries," Ms. Pauwels says.
A year after U.S. President Barack Obama conceived of the Precision Medicine Initiative in 2015—later renamed All of Us—China followed suit, announcing the launch of a 15-year, $9 billion precision health effort aimed at turning China into a global leader in genomics.
Chinese genomics companies, too, are expanding their reach outside of Asia. One company, WuXi NextCODE, which has offices in Shanghai, Reykjavik, and Cambridge, Massachusetts, has built an extensive library of genomes from the U.S., China and Iceland, and is now setting its sights on Ireland.
Another Chinese company, BGI, has partnered with Children's Hospital of Philadelphia and Sinai Health System in Toronto, and also formed a collaboration with the Smithsonian Institute to sequence all species on the planet. BGI has built its own advanced genomic sequencing machines to compete with U.S.-based Illumina.
Mr. You says having access to all this data could lead to major breakthroughs in healthcare, such as new blockbuster drugs. "Whoever has the largest, most diverse dataset is truly going to win the day and come up with something very profitable," he says.
Some direct-to-consumer genetic testing companies with offices in the U.S., like Dante Labs, also use BGI to process customers' DNA.
Experts worry that China could race ahead the U.S. in precision medicine because of Chinese laws governing data sharing. Currently, China prohibits the exportation of genetic data without explicit permission from the government. Mr. You says this creates an asymmetry in data sharing between the U.S. and China.
"This is a biological space race and we just haven't woken up to the fact that we're in this race," he said in January at an American Society for Microbiology conference in Washington, D.C. "We don't have access to their data. There is absolutely no reciprocity."
Protecting your data
While Mr. You has been stressing the importance of data security to anyone who will listen, the National Academies of Sciences, Engineering, and Medicine, which makes scientific and policy recommendations on issues of national importance, has commissioned a study on "safeguarding the bioeconomy."
In the meantime, Ms. Berger says organizations that deal with people's health data should assess their security risks and identify potential vulnerabilities in their systems.
As for what individuals can do to protect themselves, she urges people to think about the different ways they're sharing healthcare data—such as via mobile health apps and wearables.
"Ask yourself, what's the benefit of sharing this? What are the potential consequences of sharing this?" she says.
Mr. You also cautions people to think twice before taking consumer DNA tests. They may seem harmless, he says, but at the end of the day, most people don't know where their genetic information is going. "If your genetic sequence is taken, once it's gone, it's gone. There's nothing you can do about it."
This “Absolutely Tireless” Researcher Made an Important Breakthrough for Cancer Patients
Theo Roth.
After months of looking at dead cells under a microscope, Theo Roth finally glimpsed what he had been hoping to see—flickers of green. His method was working.
"If we can go into the cell and add in new code and instructions, now we can give it whatever new functions we want."
When Roth joined the laboratory of Alex Marson at the University of California, San Francisco in June 2016, he set to work trying to figure out a new way to engineer human T cells, a type of white blood cell that's an important part of the immune system. If he succeeded, the resulting approach could make it easier and faster for scientists to develop and test cell and gene therapies, new treatments that involve genetically reprogramming the body's own cells.
For decades, researchers have been using engineered viruses to bestow human cells with new genetic characteristics. These so-called viral vectors "infect" human cells, transferring whatever new genetic material scientists put into them. The idea is that this new DNA could give T cells a boost to better fight diseases like cancer and HIV.
Several successful clinical trials have used virally-modified human T cells, and in fact, the U.S. Food and Drug Administration last year approved two such groundbreaking cancer gene therapies, Kymriah and Yescarta. But the process of genetically manipulating cells with viruses is expensive and time-consuming. In addition, viruses tend to randomly insert DNA with little predictability.
"What Theo wanted to do was to paste in big sequences of DNA at a targeted site without viruses," says Marson, an associate professor of microbiology and immunology. "That would have the benefit of being able to rewrite a specific site in the genome and do it flexibly and quickly without having to make a new virus for every site you want to manipulate."
Scientists have for a while been interested in non-viral engineering methods, but T cells are fragile and notoriously difficult to work with.
Previously, Marson's lab had collaborated with CRISPR pioneer Jennifer Doudna and her team at the University of California, Berkeley to use an electrical pulse together with CRISPR components to knock out certain genes. They also found some success with inserting very small pieces of DNA into a targeted site.
But Roth, a 27-year-old graduate student at UCSF pursuing MD and PhD degrees, was determined to figure out how to paste in much bigger sequences of genetic information. Marson says it was an "ambitious" goal. Scientists had tried before, but found that stuffing large chunks of DNA into T cells would quickly kill them.
"If we can go into the cell and add in new code and instructions, now we can give it whatever new functions we want," Roth says. "If you can add in new DNA sequences at the site that you want, then you have a much greater capacity to generate a cell that's going to be therapeutic or curative for a disease."
"He has already made his mark on the field."
So Roth began experimenting with hundreds of different variables a week, trying to find the right conditions to allow him to engineer T cells without the need for viruses. To know if the technique was working, Roth and his colleagues used a green fluorescent protein that would be expressed in cells that had successfully been modified.
"We went from having a lot of dead cells that didn't have any green to having maybe 1 percent of them being green," Roth says. "At that stage we got really excited."
After nearly a year of testing, he and collaborators found a combination of T cell ratios and DNA quantity mixed with CRISPR and zaps of electricity that seemed to work. These electrical pulses, called electroporation, deliver a jolt to cells that makes their membranes temporarily more permeable, allowing the CRISPR system to slip through. Once inside cells, CRISPR seeks out a specific place in the genome and makes a programmed, precise edit.
Roth and his colleagues used the approach to repair a genetic defect in T cells taken from children with a rare autoimmune disease and also to supercharge T cells so that they'd seek out and selectively kill human cancer cells while leaving healthy cells intact. In mice transplanted with human melanoma tissue, the edited T cells went to straight to the cancerous cells and attacked them. The findings were published in Nature in July.
Marson and Roth think even a relatively small number of modified T cells could be effective at treating some cancers, infections, and autoimmune diseases.
Roth is now working with the Parker Institute for Cancer Immunotherapy in San Francisco to engineer cells to treat a variety of cancers and hopefully commercialize his technique. Fred Ramsdell, vice president at the Parker Institute, says he's impressed by Roth's work. "He has already made his mark on the field."
Right now, there's a huge manufacturing backlog for viruses. If researchers want to start a clinical trial to test a new gene or cell therapy, they often have to wait a year to get the viruses they need.
"I think the biggest immediate impact is that it will lower the cost of a starting an early phase clinical trial."
Ramsdell says what Roth's findings allow researchers to do is engineer T cells quickly and more efficiently, cutting the time it takes to make them from several months to just a few weeks. That will allow researchers to develop and test several potential therapies in the lab at once.
"I think the biggest immediate impact is that it will lower the cost of a starting an early phase clinical trial," Roth says.
This isn't the first time Roth's work has been in the spotlight. As an undergraduate at Stanford University, he made significant contributions to traumatic brain injury research by developing a mouse model for observing the brain's cellular response to a concussion. He started the research, which was also published in Nature, the summer before entering college while he was an intern in Dorian McGavern's lab at the National Institutes of Health.
When Roth entered UCSF as a graduate student, his scientific interests shifted.
"It's definitely a big leap" from concussion research, says McGavern, who still keeps in touch with Roth. But he says he's not surprised about Roth's path. "He's absolutely tireless when it comes to the pursuit of science."
Roth says he's optimistic about the potential for gene and cell therapies to cure patients. "I want to try to figure out what one of the next therapies we should put into patients should be."
A patient with below-knee AMI amputation walks up the stairs.
"Here's a question for you," I say to our dinner guests, dodging a knowing glance from my wife. "Imagine a future in which you could surgically replace your legs with robotic substitutes that had all the functionality and sensation of their biological counterparts. Let's say these new legs would allow you to run all day at 20 miles per hour without getting tired. Would you have the surgery?"
Why are we so married to the arbitrary distinction between rehabilitating and augmenting?
Like most people I pose this question to, our guests respond with some variation on the theme of "no way"; the idea of undergoing a surgical procedure with the sole purpose of augmenting performance beyond traditional human limits borders on the unthinkable.
"Would your answer change if you had arthritis in your knees?" This is where things get interesting. People think differently about intervention when injury or illness is involved. The idea of a major surgery becomes more tractable to us in the setting of rehabilitation.
Consider the simplistic example of human walking speed. The average human walks at a baseline three miles per hour. If someone is only able to walk at one mile per hour, we do everything we can to increase their walking ability. However, to take a person who is already able to walk at three miles per hour and surgically alter their body so that they can walk twice as fast seems, to us, unreasonable.
What fascinates me about this is that the three-mile-per-hour baseline is set by arbitrary limitations of the healthy human body. If we ignore this reference point altogether, and consider that each case simply offers an improvement in walking ability, the line between augmentation and rehabilitation all but disappears. Why, then, are we so married to this arbitrary distinction between rehabilitating and augmenting? What makes us hold so tightly to baseline human function?
Where We Stand Now
As the functionality of advanced prosthetic devices continues to increase at an astounding rate, questions like these are becoming more relevant. Experimental prostheses, intended for the rehabilitation of people with amputation, are now able to replicate the motions of biological limbs with high fidelity. Neural interfacing technologies enable a person with amputation to control these devices with their brain and nervous system. Before long, synthetic body parts will outperform biological ones.
Our approach allows people to not only control a prosthesis with their brain, but also to feel its movements as if it were their own limb.
Against this backdrop, my colleagues and I developed a methodology to improve the connection between the biological body and a synthetic limb. Our approach, known as the agonist-antagonist myoneural interface ("AMI" for short), enables us to reflect joint movement sensations from a prosthetic limb onto the human nervous system. In other words, the AMI allows people to not only control a prosthesis with their brain, but also to feel its movements as if it were their own limb. The AMI involves a reimagining of the amputation surgery, so that the resultant residual limb is better suited to interact with a neurally-controlled prosthesis. In addition to increasing functionality, the AMI was designed with the primary goal of enabling adoption of a prosthetic limb as part of a patient's physical identity (known as "embodiment").
Early results have been remarkable. Patients with below-knee AMI amputation are better able to control an experimental prosthetic leg, compared to people who had their legs amputated in the traditional way. In addition, the AMI patients show increased evidence of embodiment. They identify with the device, and describe feeling as though it is part of them, part of self.
Where We're Going
True embodiment of robotic devices has the potential to fundamentally alter humankind's relationship with the built world. Throughout history, humans have excelled as tool builders. We innovate in ways that allow us to design and augment the world around us. However, tools for augmentation are typically external to our body identity; there is a clean line drawn between smart phone and self. As we advance our ability to integrate synthetic systems with physical identity, humanity will have the capacity to sculpt that very identity, rather than just the world in which it exists.
For this potential to be realized, we will need to let go of our reservations about surgery for augmentation. In reality, this shift has already begun. Consider the approximately 17.5 million surgical and minimally invasive cosmetic procedures performed in the United States in 2017 alone. Many of these represent patients with no demonstrated medical need, who have opted to undergo a surgical procedure for the sole purpose of synthetically enhancing their body. The ethical basis for such a procedure is built on the individual perception that the benefits of that procedure outweigh its costs.
At present, it seems absurd that amputation would ever reach this point. However, as robotic technology improves and becomes more integrated with self, the balance of cost and benefit will shift, lending a new perspective on what now seems like an unfathomable decision to electively amputate a healthy limb. When this barrier is crossed, we will collide head-on with the question of whether it is acceptable for a person to "upgrade" such an essential part of their body.
At a societal level, the potential benefits of physical augmentation are far-reaching. The world of robotic limb augmentation will be a world of experienced surgeons whose hands are perfectly steady, firefighters whose legs allow them to kick through walls, and athletes who never again have to worry about injury. It will be a world in which a teenage boy and his grandmother embark together on a four-hour sprint through the woods, for the sheer joy of it. It will be a world in which the human experience is fundamentally enriched, because our bodies, which play such a defining role in that experience, are truly malleable.
This is not to say that such societal benefits stand without potential costs. One justifiable concern is the misuse of augmentative technologies. We are all quite familiar with the proverbial supervillain whose nervous system has been fused to that of an all-powerful robot.
The world of robotic limb augmentation will be a world of experienced surgeons whose hands are perfectly steady.
In reality, misuse is likely to be both subtler and more insidious than this. As with all new technology, careful legislation will be necessary to work against those who would hijack physical augmentations for violent or oppressive purposes. It will also be important to ensure broad access to these technologies, to protect against further socioeconomic stratification. This particular issue is helped by the tendency of the cost of a technology to scale inversely with market size. It is my hope that when robotic augmentations are as ubiquitous as cell phones, the technology will serve to equalize, rather than to stratify.
In our future bodies, when we as a society decide that the benefits of augmentation outweigh the costs, it will no longer matter whether the base materials that make us up are biological or synthetic. When our AMI patients are connected to their experimental prosthesis, it is irrelevant to them that the leg is made of metal and carbon fiber; to them, it is simply their leg. After our first patient wore the experimental prosthesis for the first time, he sent me an email that provides a look at the immense possibility the future holds:
What transpired is still slowly sinking in. I keep trying to describe the sensation to people. Then this morning my daughter asked me if I felt like a cyborg. The answer was, "No, I felt like I had a foot."