DNA sites show why we need a Hippocratic Oath for data science

A suspect in the Golden State Killer murders has been arrested, based largely on DNA evidence that was apparently obtained in part through creating a dummy profile on a heredity website. California’s laws are apparently fairly permissive when it comes to using familial DNA to match suspects to crimes.

Solving unsolved rape and murder cases is generally good, but turning private websites into repositories of criminal evidence police can obtain without a warrant is generally bad. Like, extra bad.

One of the first things this reminded me of was Cathy O’Neil’s recent call for a Hippocratic Oath for data scientists. The idea is for data scientists to have some ethical guidelines, and above all to avoid doing harm or violating the rights of the people implicated by the practice of data science. In order to do that, you need to bring in the various stakeholders, properly weigh each of their concerns, and continually work to address them.

It’s always an incomplete process, because as O’Neil notes right away, data science isn’t limited to the acts of professional data scientists; it’s also the province of companies, and algorithms, and automated or self-learning uses of data. So in addition to a Hippocratic Oath (or some version of it), you also need a version of HIPAA (the law that guarantees the secure storage and distribution of health information).

DNA/heredity sites seem like the perfect test case for figuring out the compatibility of these two modes of operating. It seems like largely, they’re being treated either as a simple data regime, a la social media networks, and/or under criminal statutes. But a person’s DNA is, or should be, treated like medical information, with strict limits on its use. There has to be some way to figure out how to weigh all of these things together without compromising people’s rights.

• medicine