Close
today i learned (til)

GNU Privacy Guard (GPG) and the Protection of Sensitive Genetic Data

April 29, 2025

In today’s data-driven world, few forms of personal information are as personal and revealing as genetic information. Genetic sequencing has become more widely available and used, from determining health predispositions to investigating ancestry. But this growing availability also poses significant risk. Once digital, genetic information is vulnerable to breaches, abuse, and unauthorized surveillance. In order to safeguard this critical data, robust cybersecurity measures are required—and one of the most effective solutions out there is GNU Privacy Guard (GPG). GPG is open-source, free encryption software that adheres to the OpenPGP standard, used to ensure secure data encryption and digital authentication. Its value as a vehicle for genetic data security protection has grown exponentially in recent times, particularly in the wake of widely publicized breaches against firms. Effective resources such as GPG do exist, however, and ethical considerations are still at the top of the agenda—spanning data ownership dilemmas to the dangers of genetic discrimination.

How GNU Privacy Guard (GPG) Safeguards Genetic Data

GPG employs public-key cryptography to allow users to securely encrypt, decrypt, and verify digital data. When genetic information is encrypted with the public key of the recipient, only their private key can unlock it—offering complete protection from misuse. GPG also utilizes digital signatures, which verify origin and integrity and ensure the genetic data remains undamaged and that it came from a reliable source. Such trust is paramount for organizations responsible for dealing with sensitive genetic information.

How does GPG particularly serve genetic data well? It does end-to-end encryption, ensuring information is encrypted when it transits (such as between labs and providers) and when on storage. Second, as an open-source solution, GPG permits its codebase to be inspected by communities—leading to quicker vulnerability recognition and closure than that from closed-source counterparts. Third, GPG aids in compliance with rigorous privacy policies and protocols such as the Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR), and NIST recommendations. No encryption technique is completely secure, however. Handling of private keys in a mishandled fashion, inadequate operation security, or system setting faults can cause confidentiality to be compromised. Encryption must be part of a comprehensive security plan not one huge blob. Perhaps the most significant ethical difficulty in the processing of genetic information is that no informed consent exists. Most consumers of genetic test services do not know that their information can be retained forever or used as research data.

Infographic on Cybersecurity Created by Sajdah Muhammad

Ethical Implications and Breaches

23andMe and AncestryDNA, some of the most popular DNA testing service providers, have been accused of hiding consent provisions deep within terms and conditions. People must be made aware in a transparent manner how their data will be utilized, to whom it will be revealed, and what the long-term implications will be. In 2018, 23andMe struck a deal with pharmaceutical giant GlaxoSmithKline (GSK), which provided the pharma company access to millions of customers’ genetic maps in an effort to advance medicine discovery. Although these arrangements can benefit medicine, they amplify concerns over commodification of personal intimate data. Genetic information may provide one’s susceptibility to illness, mental illness, or even personality. This is dangerous and doesn’t allow proper consent for all customers.

Examples of genetic data breaches 

  1. Veritas genetics — 2019

In 2019, Veritas Genetics had a server was set up improperly that exposed customer data like sensitive test results. This could have been prevented with access controls and proper encryption.

2. GEDmatch and criminal investigations

GEDmatch is an internet-based service that compares autosomal DNA data from different testing companies. Law enforcement used the service to solve a case that had been pending for decades. But it created ethical and moral questions regarding whether genetic data should be exchanged recreationally or medically should be allowed to be used in criminal investigations. 

Citizen’s information is a constitutional right to be protected. As technology evolves, many professionals have tried implementing/worked with the authorities to enforce the following strategies with an ethical perspective:

  1. Respecting ownership data rights

2. Following GDPR, NIST, and HIPAA regulations

3. Implementing rigorous procedures and incident response policies

4. Implementing consent mechanisms

Such initiatives can enable gap filling of the ethical cybersecurity issue. As genes are increasingly tested, ethical data stewardship will only become more necessary. Innovation v.s. privacy as well as ethics is not only a technological puzzle but also making sure to keep morals alive.

————

References

General Data Protection Regulation. (2024, April 22). General Data Protection RegulationGDPR. General Data Protection Regulation (GDPR). https://gdpr-info.eu/.

GSK and 23andMe sign agreement to leverage genetic insights for the development of novel medicines. GSK. (2018, July 25). https://www.gsk.com/en-gb/media/press-releases/gsk-and-23andme-sign-agreement-to-leverage-genetic-insights-for-the-development-of-novel-medicines/

Orr, J. (2023, August 29). Incident of the week: DNA-testing company Veritas Genetics discloses unauthorized access of Customer Data. Cyber Security Hub. https://www.cshub.com/attacks/articles/incident-of-the-week-dna-testing-company-veritas-genetics-discloses-unauthorized-access-of-customer-data

Ross, R., & Pillitteri, V. (2024). Protecting controlled unclassified information in nonfederal systems and organizations. NIST Special Publication 800-171. https://doi.org/10.6028/nist.sp.800-171r3

Ross, W. L. (2020). Security and Privacy Controls for Information Systems and organizations. NIST Special Publication. https://doi.org/10.6028/nist.sp.800-53r5

Trujillo, M., Collings, P., Klosowski, T., Hussain, S., & Lynch, J. (n.d.). Genetic information privacy. Electronic Frontier Foundation. https://www.eff.org/issues/genetic-information-privacy#:~:text=In%202013%2C%20the%20HIPAA%20Omnibus,or%20long%2Dterm%20care%20insurance.

Wickenheiser RA. Forensic genealogy, bioethics and the Golden State Killer case. Forensic Sci Int Synerg. 2019 Jul 12;1:114-125. doi: 10.1016/j.fsisyn.2019.07.003. PMID: 32411963; PMCID: PMC7219171.

https://gnupg.org/

Infographic Created by Sajdah Muhammad

0Likes
About Author

You May Also Like

today i learned (til)
The Science Behind JaPow
today i learned (til)
E-Stim and Muscle
today i learned (til)
Save the Ocean Through One Simple Step
Articles, today i learned (til)
Why Is Math So Hated?

Your journey starts here! Let’s talk!

ThemeRex © 2026. All rights reserved.
  Timothy Durham was convicted of rape when a test showed his DNA genotype matched the DNA recovered from the crime scene. Eye witnesses testified that Durham was in a different state at the time of the incident, but he wasn’t exonerated from his 3000 year sentence until follow up DNA analysis showed that the preliminary forensic analysis used in the trial was misinterpreted (Thomas et al.). DNA testing serves an invaluable part in our criminal justice system, but it comes with complications and bias that can lead to wrongful convictions and misinformed juries.  

Background:

Forensic genetics aims to identify the origin of a biological sample. It can be traced back to Karl Landsteiner who discovered human ABO blood groups. With blood groups, suspects could be eliminated based on their blood type. For example, if a suspect had type A blood and there was type B blood left at the scene by the perpetrator, the investigators could rule out the suspect. Unfortunately, the reverse didn’t work. If the suspect and perpetrator both had the same blood type, it can’t be concluded that the suspect was guilty. Blood identifiers evolved into 8 distinct categories which improved the ability to eliminate suspects, but could only conclude that (if the system matched) it might be the perpetrator or this person might be related to the perpetrator (Jobling and Gill). The field evolved in the 1980s with the discovery of Minisatellites, lines of repetitive DNA that don’t encode proteins. Minisatellite patterns in DNA create what we know today as the DNA fingerprint, and it has a much higher accuracy rate than previous methods (Augustyn et al.). Around the same time, a breakthrough for victims of sexual assault was discovered. In the case of assault, bodily fluids of both the victim and the assaulter can get mixed. A process called differential lysis was created which could selectively increase the concentration of sperm in a fluid sample thereby allowing for accurate DNA testing (Jobling and Gill). Forensics evolved to use single-locus probe testing after several years because of its ease of interpretation. It looked at specific minisatellites that had high variability between subjects. This was the first DNA-based method to be used in a criminal investigation. Two murder homicides from several years apart were connected using DNA evidence. The evidence was then used to exonerate an innocent man, and the guilty party was found when he tried to evade mandatory DNA testing for all men in the small town. His guilt was then reinforced when the DNA profiles matched, and he gave a confession (Jobling and Gill). Finding DNA at a crime scene doesn’t guarantee that you’ll find a murderer. There are issues with non-pure samples and limited samples that make DNA work difficult, and accreditation of facilities and new techniques and take time (Jobling and Gill).  

Subjectivity of DNA Interpretation:

In a 2009 publication, the National Academy of Science discusses the possibility for subjective influence in lab based forensics. The interpretation bias happens in complex cases where, for example, there could be a mixture of DNA. A study published in 2011 looked specifically at this issue. A gang rape happened in Georgia, and the mixture in DNA from the case was used to prosecute one suspect after another suspect took a plea bargain to testify against him. With DNA mixtures, there are three possible conclusions: suspect excluded, suspect cannot be excluded, and inconclusive. If the suspect is excluded, it means that there’s little to no possibility that his DNA is part of the sample. If the suspect cannot be excluded, it means that there’s a possibility that his DNA is part of the sample. In the trial, the DNA examiners who knew the context of the case concluded that the suspect being prosecuted could not be excluded. The 2011 study gave the DNA evidence from this case and the DNA profiles of the suspects to 17 forensic examiners. These examiners had no context of the case, and they all worked independently. Of the 17, only 1 came to the same conclusion (suspect cannot be excluded) as the examiners who knew the context of the case. Twelve of the 17 concluded that the suspect who was prosecuted and convicted had no relation to the DNA found in the sample. Not only does this show that subjectivity occurs due to the context of the case, but the 17 examiners came up with different findings based on their past experiences meaning that not all DNA analysis is objective. Some organizations like the Scientific Working Group on DNA Analysis Methods say that quantitative statistical evidence should be presented with every categorical conclusion, but the US doesn’t require this (Dror and Hampikian).

False Positives:

There are two categories that cause wrongful identification in a DNA report: coincidental matches and false positives. Coincidental matches are DNA matches between two unrelated people. The probability of these matches is about 1 to 500,000 for white individuals and about 1 to 350,000 for black individuals. This small probability of coincidental matches makes people feel confident in DNA evidence. False positives, on the other hand, are matches between DNA and test DNA that result from issues in the forensics lab. There have been multiple cases of forensics labs accidentally switching victim and suspected rapist DNA which lead to convictions that were later overturned when the lab realized the error. There are also cases of misreading or misunderstanding a sample. In a case from 1993, a man was convicted of rape because someone interpreted a mixed sample of victim and perpetrator DNA as an individual sample. The conviction was again overturned. To prevent false convictions, retesting DNA is allowed, but it’s not an efficient solution. Many people are pushing for statistical information on the probability of false positives, so that the jurors can make accurate judgements based on DNA evidence (Thomas et al.).  

Conclusion:

DNA analysis is a useful tool for the criminal justice system, but subjectivity can be an issue in forensic testing. To combat wrongful convictions, there are organizations like The Innocence Project who use DNA testing to free the innocent, but reformed forensic testing standards should be put in place to prevent subjectivity and to ensure juries are correctly informed during trials. https://www.innocenceproject.org/    

Citation:

Augustyn , Adam, et al. “DNA Finerprinting.” Encyclopedia Britannica , 26 Apr. 2018, www.britannica.com/science/DNA-fingerprinting#ref153186. Dror, Itiel E., and Greg Hampikian. “Subjectivity and Bias in Forensic DNA Mixture Interpretation.” Science & Justice, vol. 51, no. 4, 2011, pp. 204–208., doi:10.1016/j.scijus.2011.08.004. Jobling, Mark A., and Peter Gill. “Encoded Evidence: DNA in Forensic Analysis.” Nature Reviews: Genetics, vol. 5, no. 10, Oct. 2004, pp. 739–751., doi:10.1038/nrg1455. Thompson, William C, et al. “How the Probability of a False Positive Affects the Value of DNA Evidence.” Journal of Forensic Sciences, vol. 48, no. 1, Jan. 2003, pp. 1–8., doi:10.1520/jfs2001171.