It all seemed good and it was all profitable—at least to the founders of GT23.
But the main article that ran with the sidebar threw a shadow over all the good news. It reported that regulatory enforcement of the billion-dollar genetic-analytics industry fell to the U.S. Food and Drug Administration, which until recently had taken a complete pass on those responsibilities. The article quoted a recent report from the National Human Genome Research Institute:
Until recent years, FDA chose to apply “enforcement discretion” to the vast majority of genetic tests. FDA can use such discretion when it has the authority to regulate tests but chooses not to.
The article went on to report that the FDA was only now in the process of formulating rules and regulations that would eventually be presented to Congress for adoption. Only then would any kind of enforcement begin.
Due to the rapid growth of direct-to-consumer genomic testing, and FDA’s mounting concern that unregulated tests pose a public health threat, FDA is modifying its approach. To this end, FDA has drafted new guidance to describe how it intends to regulate genetic testing. FDA “guidance” is different from laws and regulation in that it represents only FDA’s “current thinking” on a topic and is not legally binding for FDA or the parties it regulates.
I was stunned. The report concluded that there was virtually no government oversight and regulation in the burgeoning field of genetic analytics. The government was far behind the curve.
I printed a copy of the story for Myron to read and then went to GT23’s website to look for any acknowledgment that the services the company provided and the security it promised were not backed by government regulation. I found none. But I did stumble across a page that outlined how researchers could go about requesting anonymized data and biological samples and the fields of study the company supported:
Cancer
Nutrition
Social Behaviors
Risky Behaviors
Addiction
Insomnia
Autism
Mental Disorders (bipolar disorder, schizophrenia, schizo-affective disorder)
On the website the recipients of data and bio samples were called collaborators. It was all presented in a cheery, change-the-world-for-the-better pitch that I was sure was crafted to allay any potential participant’s concerns about anonymously putting their DNA into the great unknown of genetic analysis and storage.
Another section of the website contained a four-page privacy- and-informed-consent statement that outlined the anonymity guaranteed with the submission of one’s DNA in a GT23 home-sampling kit. This was the boring fine print but I read every word of it. The company promised participants multiple layers of security in the handling of their DNA and required all collaborators to meet the same levels of physical and technical protection of data. No biological sample would be transferred to a collaborator with any participant’s identity attached.
The consent statement clearly said that the low cost to participants for DNA analytics, matching, and health reporting was underwritten by the collaborating companies and labs that paid for the anonymized data. As such, the participant was agreeing to field requests from collaborators funneled through GT23 to maintain anonymity. The requests could range from additional information on personal habits to surveys in the specific field of study or even additional DNA samples. It was then up to the participant to decide whether to respond. Direct participation with collaborators was not required.
After three pages of outlining self-imposed security measures and promises, the last page contained the bottom line:
We cannot guarantee that a breach will never happen.
It was the lead sentence of the last paragraph and was followed by a list of worst-case scenarios that were “highly unlikely.” These ran from collaborator security breaches to the theft or destruction of DNA samples while in transit to labs sponsored by collaborators. There was one line in the disclaimer paragraph I read over and over, trying to understand it:
It may be possible, but unlikely, that a third party could identify you if they are able to combine your genetic data with other information available to them through other means.
I copied this off the screen and put it at the top of a notes document. Below it I typed: WTF?
I now had my first follow-up question. But before I pursued it I clicked on a tab labeled law enforcement on the menu. This page revealed GT23’s statement of support and cooperation with the FBI and police agencies in using its genetic data in criminal investigations. This had become a hot-button topic in recent years as police used genetic-analytics providers to help solve cases through linkage of familial DNA. In California, most notably, the alleged Golden State Killer was captured decades after a murder-and-rape spree when DNA from a rape kit was uploaded on GEDmatch and investigators were provided with matches to several relatives of the alleged killer. A family tree was constructed and soon a suspect was identified and then confirmed through further DNA analysis. Many other lesser-known murders were also solved similarly. GT23 made no bones about cooperating with law enforcement when asked.
I was now finished with my review of GT23’s website and I had one question on my notes page. I wasn’t sure what I had or what I was doing. I had a connection among the deaths of four young women. They were connected by their gender, the cause of their deaths, and their participation in GT23. I assumed that GT23 had millions of participants so was unsure if this last connection was a valid common denominator.
I sat up and looked over the wall of my cubicle. I could only see the top of Myron’s head in his cubby. I thought about going to him and saying now was the time to talk. But I quickly dismissed the idea. I didn’t like going to my editor, my boss, and saying I didn’t know what to do next. An editor wants confidence. He wants to hear a plan that will lead to a story. A story that would draw attention to FairWarning and what we were doing.
I stalled the decision by googling a contact number for GT23 and calling the corporate office in Palo Alto. I asked for Media Relations and soon was talking to a media specialist named Mark Bolender.
“I work for a consumer news site called FairWarning and I’m doing a piece on consumer privacy in the area of DNA analytics,” I said.
Bolender did not respond at first but I heard him typing.
“Got it,” he finally said. “Looking at your website right now. I was not familiar with it.”
“We usually partner on stories with more recognizable media outlets,” I said. “L.A. Times, Washington Post, NBC, and so on.”
“Who is your partner on this one?”
“No partner at the moment. I’m doing some preliminary work and—”
“Gathering string, huh?”
It was an old newspaper phrase. It told me Bolender was a former news guy who had crossed to the other side. He was handling media now, rather than being media.
“Only a reporter would say that,” I said. “Where’d you work?”
“Oh, here and there,” Bolender said. “My last gig was twelve years at the Merc as a tech reporter and then I took a buyout, ended up here.”
The San Jose Mercury News was a very good newspaper. If Bolender had been a tech reporter in the breadbasket of technology then I knew I wasn’t dealing with a public-relations hack. I now had to worry that he would figure out what I was really up to and find a way to block me.
“So what can I do for you and FairWarning?” Bolender asked.
“Well, right now I need some general information about security,” I said. “I was on the GT23 website and it says there are multiple layers of security established for handling participant genetic data and material, and I was hoping you could walk me through that.”
“I wish I could, Jack. But you are asking about proprietary matters that we don’t talk about. Suffice it to say, anyone who submits a genetic sample to GT23 can expect the highest level of security in the industry. Way beyond government requirements.”
It was a stock answer
and I noted that going beyond government requirements when there were no such requirements meant nothing. But I didn’t want to jump on Bolender and position myself as an adversary so early in the conversation. Instead, I typed his words into the file because I would need to use them in the story—if a story was published.
“Okay, I understand that,” I said. “But on your website you clearly say you can’t guarantee that there will never be a breach. How do you reconcile that with what you just said?”
“What is on the website is what the lawyers tell us to put on the website,” Bolender said, an edge sharpening in his voice. “Nothing in life is one hundred percent guaranteed, so we need to make that advisement. But as I said, our safety measures are beyond question second to none. Do you have another question?”
“Yes, hold on.”
I finished typing in his answer.
“Uh, could you explain what this means?” I asked. “It’s from your website: It may be possible, but unlikely, that a third party could identify you if they are able to combine your genetic data with other information available to them through other means.”
“It means exactly what it says,” Bolender said. “It’s possible but unlikely. Again, it’s legal speak. We are required to provide it in our consent form.”
“Do you want to expand on that? For example, what does ‘other information available to them’ mean?”
“It could mean a lot of things but we are not going to go past the disclaimer on that, Jack.”
“Has there ever been a breach of participant data at GT23?”
There was a pause before Bolender answered. Just long enough for me to be suspicious of his answer.
“Of course not,” Bolender said. “If there had been it would have been reported to the Food and Drug Administration, the agency that regulates the industry. You can check with them and you will find no report because it has never happened.”
“Okay.”
I was typing.
“Are you putting this into a story?” Bolender asked.
“I’m not sure,” I said. “Like you said, I’m just gathering string. We’ll see.”
“Are you talking to the others? Twenty-Three and Me, Ancestry?”
“I will, yes.”
“Well, I would appreciate it if you would circle back to me if you’re going to publish a story. I would like to review my quotes to make sure I’m quoted accurately.”
“Uh … you didn’t make that request at the top of the call, Mark. It’s not something I usually do.”
“Well, I didn’t know at the top what the call was about. Now I’m concerned about being quoted accurately and in context.”
“You don’t have to worry about that. I’ve been doing this a long time and I don’t make up quotes or use them out of context.”
“Then I guess this conversation is over.”
“Look, Mark, I don’t get why you’re upset. You were a reporter, you now deal with reporters, you know how it works. You don’t lay down rules after the interview. What’s upsetting you?”
“Well, for one, I pulled up your bio and now see who you are.”
“I told you who I was.”
“But you didn’t mention the books you wrote about those killers.”
“Those are old, old stories that have nothing to—”
“Both were about advances in technology being used by bad people. The Poet? The Scarecrow? Serial killers so bad they had media names. So I don’t think you called up here to do a reassuring piece on our security. There is something else going on.”
He wasn’t wrong but he wasn’t right either. I still didn’t know what I had but his evasiveness was only increasing my feeling that there might be something here.
“There is nothing going on,” I said. “I am truly interested in knowing about the security of the DNA that is submitted to your company. But I will do this for you: if you want me to read back your quotes to you now, I will do that. You will see that I have them down accurately.”
There was silence and then Bolender responded in a clipped tone that told me the conversation was over—unless I found a way to keep it going.
“So, if we’re done here, Jack—”
“I’d like to ask a couple more questions. I was reading about how GT23 has grown so quickly into one of the largest providers of DNA analytics.”
“That’s true. What’s your question?”
“Well, does GT23 still do all of the lab work or has it gotten so big so fast that it subcontracts lab work?”
“Uh, I believe there is some contracting out of work to other labs. I know your last question is whether they operate with the same safety-and-privacy measures and the answer is yes, absolutely. Same standards right down the line. Well beyond government requirements. There is no story here and I need to go now.”
“Last question. You mentioned that the company and its contractors go beyond federal regulations and requirements in terms of security, reporting of any privacy breaches, and so forth. Are you aware that there aren’t any regulations and requirements and that any reporting on these issues would have to be self-reporting?”
“I, uh … Jack, I think you have bad information there. The FDA regulates DNA.”
“True, it falls under FDA purview, but the FDA has chosen, up till now, at least, not to regulate. So when you say that GT23 goes beyond govern—”
“I think what I’m saying is that we’re done here, Jack. Have a nice day.”
Bolender disconnected and I put the phone back in its cradle. I made a fist and silently bounced it on the desk like a hammer. My torching of Bolender with his own words aside, I was feeling the groundswell building around me. Bolender had great reason to be upset. Beyond his efforts to protect the reputation of the company that employed him, he had to know that the larger secret of the industry as a whole was in danger of being exposed. Genetic testing was a self-regulating industry with very few if any government eyes upon it.
And that was a news story.
9
I printed out all of my notes from the research and interviews. After retrieving the pages from the communal printer, I left the office, passing by Myron while he was on the phone making a pitch to another potential donor. This was a break. I would not have to explain what I was doing or where I was going. I got out the door without hearing my name called.
It took me forty-five minutes to drive downtown and find parking. I knew I was risking about two hours of wasted time by not calling ahead but I also knew that calling ahead risked that Rachel Walling would be conveniently out of her office when I got there.
Her office was in the elegant old Mercantile Bank at 4th and Main. It was on the historic registry, which guaranteed that the front of the structure still looked like a bank. But the once-grand interior had been renovated and chopped up into private offices and creative spaces primarily leased by lawyers, lobbyists, and others with business in the nearby civic center. Rachel had a two-room office with a secretary.
On the door it said raw data services. RAW as in Rachel Anne Walling. Her secretary was named Thomas Rivette. He was sitting behind his desk, staring at his computer screen. He handled much of the computer work involved in the background investigations that were the mainstay of the business.
“Hey, Jack,” Thomas said. “Didn’t expect you today.”
“Wasn’t expecting it myself,” I said. “Rachel back there?”
“She is. Let me just check if it’s clear. She might have client stuff spread out.”
He picked up the desk phone and called the room six feet behind him.
“Rachel? Jack McEvoy is here.”
I noted the use of my full name. It made me wonder whether there was another Jack in Rachel’s life and Thomas had to be clear about which one was waiting to see her.
He hung up the phone and looked up at me with a smile.
“It’s all clear. You can go back.”
“Thank you, Thomas.”
I walked around his
desk and through the door centered on the wall behind him. Rachel had a long, rectangular office with a small seating area in front and then an L-shaped desk with large monitors on each side so she could work different jobs simultaneously on separate computers with separate IP addresses.
She looked away from one of the screens and at me as I entered and closed the door behind me. It had been at least a year since I had seen her and that was only at the crowded open house in these offices when she announced that RAW Data was in business. There had been random texts and emails in the meantime but I realized as I smiled at her that I had probably not been alone with her for two years.
“Jack,” she said.
Nothing else. No What are you doing here? No You can’t just show up here anytime you feel like it. No You need to make an appointment before coming here.
“Rachel,” I said.
I stepped up to her desk.
“Got a minute?” I asked.
“Of course. Sit down. How are you, Jack?”
I wanted to go around behind the desk and pull her up out of her chair into an embrace. She still had that power. I got the urge every time I saw her. It didn’t matter how long it had been.
“I’m good,” I said as I sat down. “You know, same old same old. What about you? How’s business?”
“It’s good,” she said. “Real good. Nobody trusts anybody anymore. That means business for me. We’ve got more than we can handle.”
“We?”
“Thomas and me. I made him a partner. He deserved it.”
I nodded when I couldn’t find my voice. Ten years ago we shared a dream of working side by side as private investigators. We put it off because Rachel wanted to wait until she was fully vested in her FBI pension. So she stayed with the bureau and I worked for the Velvet Coffin. Then the Rodney Fletcher case came up and I put the story ahead of what we had and what we planned. Rachel was two years shy of full vesting when they fired her. And our relationship fell apart. Now she did background searches and private investigations without me. And I did tough watchdog reporting for the consumer.
Fair Warning - Jack McEvoy Series 03 (2020) Page 7