Paper FAQ for Attacks on genetic privacy via uploads to genealogical databases

An FAQ written by Doc (Michael) Edge and Graham Coop on their paper about genetic genealogy & privacy (pdf link here).

The preprint is scheduled to appear on Oct 22nd and should be available at this link.

What is this paper about?

Our paper is about genetic privacy concerns related to a subset of direct-to-consumer (DTC) genetics services. The largest DTC genetics companies are Ancestry and 23andMe, but our paper is not directly about them—it’s about services that allow users to upload their own genetic datasets.

Several DTC genetics services, including GEDmatch, MyHeritage, FamilyTreeDNA, and LivingDNA, allow people who have been genotyped by other services to upload their data to their databases. So, imagine that you’ve been genotyped by 23andMe but want to find genetic relatives who were genotyped by other services. One option is to be genotyped by more genetic genealogy companies, but another option—usually cheaper and sometimes free—is to download your 23andMe genetic data and upload it to some other services. This helps genealogy enthusiasts find more genetic relatives for less money, and it helps the smaller DTC services grow their databases as well.

The potential problem to which we want to draw attention is that allowing users to upload their own datasets can present serious concerns about genetic privacy. In the paper, we describe some ways that a motivated person (we’ll call this person an “adversary”) could compromise the privacy of people in a DTC genetics database by uploading several genetic datasets, either real or fake. Under some circumstances, an adversary could reveal most of the genetic information of most people in a DTC database by uploading a few hundred datasets and aggregating the information returned by the DTC service. Many genetic genealogy services return the full names of relative matches, and some include email addresses.Therefore, in some cases large amounts of identifiable genome-wide data may be obtainable by a motivated adversary. We also describe some actions that DTC services can take to limit these risks.

Why did you write this paper?

DTC genetics is a massively growing industry, and genetic genealogy is a major driver of demand. Many people love having the ability to find their genetic relatives and piece together their family trees. The ability to search for genetic relatives can be especially valuable for people who are missing information about their genetic relatives, including adoptees, biological children of sperm donors, and descendants of slaves or holocaust survivors, among others. We want people to be able to continue to use these resources, but also to be able to do so as safely as possible. In writing this paper, we want to clarify some privacy risks so that companies offering DTC services can limit them and so that consumers can be informed. In using personal genomics sites, there is always a tradeoff between privacy risk and the ability to learn something new about your family. Our view is that clearly communicating these risks is the best way forward.

Doesn’t publishing this information make it possible for people to exploit the kinds of privacy vulnerabilities you describe?

To help protect users’ privacy, we wrote to all the entities we could find that currently offer or recently offered upload services—GEDmatch, MyHeritage, FamilyTreeDNA, LivingDNA, and DNA.LAND—ninety days before posting our manuscript. In our letters to them, we outlined the privacy risks we saw and some methods for limiting or preventing them.

Though sharing this information makes it available to people motivated to compromise genealogy enthusiasts’ privacy, it also makes it available to the people who run genetic genealogy services, to potential customers and the public, and to anyone thinking of founding a new DTC genetic genealogy service. We believe that having this information out in the open makes it easier to protect people’s privacy. And if we did not publish this information, there would be nothing to prevent someone motivated to compromise people’s privacy from figuring it out themselves. The ideas underlying these approaches are not very complex and not too difficult to implement. Thus, it seems best to lay out the issues clearly.

How can uploading genetic datasets to genealogy services potentially compromise the privacy of people in the database?

We describe three different approaches that an adversary could take to identify people’s genotype information, which we call “IBS tiling,” “IBS probing,” and “IBS baiting.” “IBS” stands for “identity by state,” a phrase that geneticists use to talk about segments of genome where two people’s genotypes partially match. If these segments are long stretches of the genome, it indicates that the two individuals have both inherited this genetic material from a recent common ancestor.

What is IBS tiling?

Because genetic information is inherited in large chunks broken up by recombination, you can think of a person’s genome as a mosaic of pieces inherited from a set of ancestors who lived, say, within the last 20 generations. If you look at ancestors from recent generations, the tiles in the mosaic will be big, because they have not been broken up by many recombination events. The tiles from ancestors farther back in the past will be small, because they have passed down to you through many generations, and the recombination events in each of those generations will have chipped away at the tiles. DTC genetics companies identify genetic relatives by looking for people who share big tiles. But you will tend to share small tiles with lots of people even if they are not closely related to you.

When a DTC genetics company reports that you share a tile with another user in their database, you learn something about the other user’s genotypes. After all, you know your own genotypes, and if the location of the shared tile is reported (it often is), then you know that the other user shares genetic variants with you within the tile. To perform IBS tiling, an adversary would upload lots of genetic datasets and keep track of their shared tiles with everyone in the database. Depending on the way in which the DTC service identifies and reports shared tiles of genetic information, an adversary that uploads enough genotypes could aggregate that information to find out a lot about the genotypes of people in the database. An adversary could gather genotypes to upload from a subset of the many publicly available genetic datasets used for research.

What is IBS probing?

The second approach we describe is called “IBS probing.” IBS probing is similar to IBS tiling, but an adversary could use it to find people who have a specific genetic variant of interest in a DTC service that reports only whether two people share a matching genetic tile and not where the match occurs. The idea is that the adversary fills in most of the genome with fake data that is designed to look unlike actual human genetic data, and thus not to match anyone in the database. The only exception is that in a small region of the genome, the adversary uses real data containing the genetic variant of interest. Thus, any matches returned by the database are likely to be people who have the genetic variant that the adversary is interested in.

What is IBS baiting?

The third approach is “IBS baiting,” and it relies on tricking a particular class of algorithms that is sometimes used to identify relatives. This class of algorithms does not represent the cutting edge of computational tools to identify IBS, but algorithms in this class potentially allow DTC genetics services to skip a data processing step that has been hard to perform in large datasets until recently. (The skippable step is called “phasing,” which is the attempt to identify genetic variants that occur together on the same strand of DNA.) If a DTC service uses one of these methods to detect relatives, then it might be possible for an adversary to upload pairs of fake datasets that reveal the genotypes of every user in the database at hundreds of places in the genome. Once enough genotypes are gathered by IBS baiting, it’s possible to use well-established algorithms to fill in the rest of the genotypes (this is called “genotype imputation’).

There seem to be large data breaches reported in the news often. Would a breach of a genetic database be any different from those?

Yes, digital security is an increasingly important issue, and major data breaches happen every year. In many cases, these breaches involve passwords, email addresses, or credit card information of customers.

Genetic data is especially important to protect. First off, genetic data could be used for discrimination. Though prediction of traits from genetic information is not very accurate for most traits, it is possible and even likely that the accuracy will increase. When it does, it might be possible to predict important health outcomes, which could lead to discrimination. For example, in the United States, health insurance companies are not allowed to discriminate on the basis of genotype because of the Genetic Information Nondiscrimination Act (GINA). However, GINA does not explicitly disallow discrimination for other kinds of insurance (such as life insurance). GINA may also be repealed in the future, and protections against genetic discrimination vary among states and countries.

Genetic data also has two special features that make it different from many other kinds of sensitive information, such as a credit card number. First, whereas we can change a credit card number or even a social security number (perhaps with a lot of hassle), we cannot change our genotypes. Second, whereas my credit card number does not reveal anything about the credit card numbers of my children or other genetic relatives, my genetic information can reveal something about my genetic relatives’ genotypes.

Couldn’t a criminal just hack into one of these databases by doing…whatever it is computer hackers normally do?

Yes, DTC genetics companies have to deal with all the same data security issues that other companies do. The difference is that the methods we talk about in our paper would only work on genetic data—they take advantage of the structure of genetic variation and the way it is distributed among people, or of the algorithms used to identify genetic relatives. To perform the attacks we describe, an adversary would need to know something about genetics and genetic datasets but would not need to know much about security hacking. The adversary would simply be uploading datasets and aggregating the information returned.

A direct-to-consumer genetics company has my genotype information. Should I be worried because of what’s in your paper?

Not necessarily. It’s important to understand that sharing your genetic information with any company or other organization will always entail some degree of privacy risk. The people we have corresponded with at DTC genetics services that allow uploads have all assured us that they take privacy seriously and that they either will take action or have already taken action to prevent the types of attacks we describe.

That said, we are not in a position to comment with much precision on the specific vulnerabilities of each service. In most cases, details of the computational steps these services use to identify relatives are private or proprietary, which makes it impossible to verify whether the attacks we describe might work. (Another way of finding this out would be to try to carry out the attacks ourselves, but we will not do this—we have no intention of violating anyone’s privacy, and all of our demonstrations were carried out entirely in publicly available data.)

Some information relevant to determining the risk users face of privacy violations is publicly available and is listed in our paper, such as the minimum matching segment length that the service will show to its users. Each service has had to make a choice about how much information it wants to release to users vs. how much it wants to keep its users’ genotypes private. Releasing more information (such as, for example, the chromosomal locations of matches between genetic relatives) can allow for more fine-grained genealogical analyses and is often appreciated by genetic genealogists, but it also presents extra risk.

Other information relevant to determining risk has not been publicly released, at least not by all DTC services that allow uploads. For example, MyHeritage released a description of their analysis pipeline that strongly suggests that they look for genetic relatives using phased genotypes, which would mean that the IBS baiting method we describe would not work at MyHeritage. We encourage all DTC companies that allow uploads to share such information publicly.

Can the privacy attacks you describe be prevented?

Yes, to a large extent. We describe a set of policies that DTC genetics services could adopt to limit or prevent the attacks we describe. Some DTC services had already adopted many of these policies when we wrote to them, and others mentioned possible plans to adopt some. These changes tend to involve a trade-off for their users—in some cases, better privacy protection means that genealogy enthusiasts have less information to work with, and so services or their user bases might reasonably decide not to adopt some of these suggestions. At the same time, there are some changes that help protect privacy without blocking much information that would be of much use to a genealogist. The possible policies we suggest are:

Only report shared genetic segments if they are long (we suggest 8 centiMorgans as a possible length threshold).
Do not report the chromosomal locations of matching genetic segments, only their length and number.
Require uploaded genotypes to be cryptographically signed to indicate that the source of the file is a trusted genotyping company. (This would require cooperation between several genotyping services.)
Report only a small number of relatives per uploaded genotype file (we suggest 50, but other or more flexible limits might be set).
Disallow searches of arbitrary genotype files against each other.
Block uploads of publicly available genotype data.
Block uploads with evidence of segments designed to have no matches in the database
Block uploads with long heterozygous segments or with segments that match many more people than would be expected.
Use phase-aware methods for detecting genetic relatives.

I have read news about law enforcement using databases like GEDmatch and FamilyTreeDNA. How does that fit in here?

Yes, in the last two years, genealogists working with law enforcement have uploaded genetic information to DTC genetic genealogy services, attempting to identify the sources of crime-scene samples or missing persons by identifying their relatives. This practice is called long-range familial search, and it received widespread public attention after being used to identify a subject in the decades-old Golden State Killer case. There has been little regulation or oversight of this practice until recently, when the Department of Justice released a set of interim guidelines for long-range familial searches, with a permanent policy to follow soon. Currently, GEDmatch users may opt in to being considered in law enforcement searches, and FamilyTreeDNA users may opt out. Other DTC services are not known to have been searched by law enforcement.

One implication of our paper is that a user that has uploaded many genotypes to a DTC genetic genealogy service may be able to access a lot of information about users in the database via the method we call IBS tiling. Companies that have cooperated with law enforcement to perform many investigations, such as Parabon Nanolabs and Bode Technologies, have uploaded dozens or hundreds of datasets to GEDmatch and/or FamilyTreeDNA. We have no reason to think that these companies are engaging in IBS tiling or storing any information that is not directly pertinent to their searches. Still, data management policies for long-range familial searching should be designed to prevent IBS tiling and the accidental acquisition of genotype information for many people.

What’s the bigger take-away from the paper?

As medical genomics and personal genomics spread into many aspects of our lives, we as individuals and societies need to balance their promises and pitfalls. The storage of large amounts of genetic data necessarily brings a range of privacy issues, some of which may only come to light after people have shared their information(for example, the long-range familial searches came as a surprise to many genetic genealogists). Given the sensitive nature of genetic information, we as a society need to be proactive about avoiding its misuse. We need genetic discrimination laws to be more comprehensive to ensure that personal genomics users are not exposed to discrimination, and we need tools in place to ensure that people can determine when and how their genetic information is used. We also need greater transparency from genomics companies, and organisations that interface with these companies, to allow users confidence in exploring their family histories and personal genomics.

Posted in cooplab, genetic genealogy, new paper | Leave a comment

Coop lab Evolution Talks

Doc Edge How much does GWAS stratification drive variation in polygenic scores? Selection 1 Saturday the 22nd 9:45 AM 552
Vince Buffalo Detecting the signature of polygenic adaptation in temporal datasets Molecular Ecology 1 Sat, June 22 4:15 PM 552
Erin Calfee Parallel selection on introgression into maize from a highland endemic wild relative Gene Flow 1 Sunday the 23rd 10:00 AM 551
Sivan Yair The timing and geography of adaptive Neanderthal introgression in modern humans Gene Flow 2 Sunday the 23rd 11:30 AM 551
Matt Osmond Genetic signatures of evolutionary rescue Pop Gen Theory 2 Tuesday the 25th 11:45 ball_bc

Posted in meetings, trips | Leave a comment

Toronto Darwin Day

Had a lot of fun giving the Darwin Day talk at the University of Toronto on Genetics, Genealogy, and our Vast Family Tree. Here is a pdf slides:
Toronto Darwin Day pdf
and the powerpoint
Toronto Darwin Day Power Point Slides
Thanks to all of the people who braved the snowstorm and shutdown campus to come along. Thanks to Aneil for the invitation, and the grad students for a lovely visit and helping out:

Posted in genetic genealogy, meetings, trips | 1 Comment

Woodland genetic genealogy talk

I gave a talk as part of the Woodland (CA) Public Library Science & Society Discussion Series (Thurs once a month). The powerpoint of the slides is here: Woodland genetic genealogy slides [ppt], a pdf of the slides is here (but lacks the animations & gifs).

The discussion was a lot of fun, with many great questions. Thanks to Sudhir Vaikkattil for inviting me, and to Woodland Public Library for hosting the series, the discussion series future schedule is here.

If you’re interested in more information you can read my blog posts on the topic, or check out one of these great books on the topic

Screen Shot 2018-06-29 at 9.31.01 AM.png

Posted in genetic genealogy, personal genomics, popgen teaching | Leave a comment

Coop lab at PEGQ

Emily Josephs. Detecting polygenic adaptation in maize. 11:20am – 11:40am Mon, May 14

Erin Calfee. Methods for detecting selection in admixed populations. Short talk: 4:30pm – 4:35pm Mon, May 14. Poster (56M) 8:00pm – 9:00pm Mon, May 14

Doc Edge. Reconstructing the history of polygenic adaptation using local coalescent trees. Poster (324T) 8:00pm – 9:00pm Tue, May 15

Sivan Yair. Characterizing adaptive Neanderthal introgression using ancient and modern population genomic data. Poster (122M) 8:00pm – 9:00pm Mon, May 14

Nancy Chen. Tracking short-term evolution in a pedigreed wild population. 11:00am – 11:15am. Tue, May 15

Kristin Lee. Detecting signatures of convergent adaptation in population genomic data. 3:15pm – 3:30pm Tue, May 15

Vince Buffalo. “A temporal signal of linked selection.” 3:45pm – 4:00pm Tue, May 15 2nd Floor – Capitol Ballroom

Posted in cooplab, meetings | Leave a comment

How lucky was the genetic investigation in the Golden State Killer case?

Last week, police arrested Joseph DeAngelo as a suspect in case of the Golden State Killer, an infamous serial murderer and rapist whose case has been open for over forty years. The arrest is huge news in and of itself, but for people interested in the social uses of genetic data, the way in which DeAngelo was identified—using genetic genealogy & genetic data from crime-scene samples—was noteworthy. In this blog post, we discuss some of the genetics and math underlying the way in which he was identified (see also Henn et al). Because there’s been lots of discussion of the ethics of these approaches, we will not focus on that here; see here for a collection of links & news articles.

 The use of genetic data to identify suspects is not new. In the US, law enforcement makes extensive use of their CODIS (Combined DNA Index System) database—genetic searches against the database have aided almost 400,000 investigations since the mid-1990s. The CODIS database contains the genotypes of over 13 million people, most of whom have been convicted of a crime. The genetic information included about each person in the CODIS database is relatively sparse. Most of the profiles record genotypes at just 13 sites in the genome (since 2017, 20 sites have been genotyped). Because the CODIS sites are highly variable microsatellites, CODIS genotypes identify people nearly uniquely—they are sometimes called “DNA fingerprints” . (The CODIS markers reveal more than fingerprints do, though–they can reveal considerable ancestry information, can reveal close relatives, and in some cases, it’s possible to identify genome-wide genetic profiles that “match” a particular CODIS dataset well.)

 In a typical case in which law enforcement uses genetic data, the procedure is to genotype a crime-scene sample at the CODIS loci and look for a full or partial match against the CODIS database. If the sample came from a person who is in the CODIS database, he or she is likely to be identified. If there is no match, then the genetic search ends unless other information can be brought to bear.

 In the Golden State Killer case, genotyping the samples at the CODIS markers did not reveal a match—Joseph DeAngelo was apparently not included in the CODIS database. Nonetheless, the genetic search continued. Investigators apparently genotyped the crime scene sample at a genome-wide set of SNPs, or single-nucleotide polymorphisms. SNPs are the markers of choice for large consumer genetics services like Ancestry and 23andMe (as well as for genome-wide association studies [GWAS].) The police cannot access private databases like these—at least not without an extended legal process—but they do not have to. Many users upload their SNP data to third-party websites to perform advanced analyses or to search for matches with people tested by different companies.

 These SNP databases are growing rapidly. The plot below shows the number of users in each of a set of repositories over the last few years (plot from here). The largest databases—AncestryDNA and 23andMe—are private. But the fourth-largest—GEDmatch, which now has about 950,000 profiles—is an online service that searches for genetic matches with any user who uploads an appropriately formatted genotype file. That’s the one that police searched for DeAngelo.

 Investigators searched for the suspect’s profile by making a personal user account and uploading a genotype file created from the SNP data obtained from crime-scene samples. To do this, the investigators must have created a data file mimicking the SNP set and file format provided by some genetic genealogy company . There was no exact match in the GEDmatch database—indeed, investigators did not expect that DeAngelo would have uploaded his own data—but the trail was not yet cold. The police could still run a  search scanning the database for relatives of the suspect. If it is possible to identify a close relative, then the search for the suspect will be narrowed considerably, even if the suspect is not in the database. This is similar to the familial searching done using the CODIS database, which is legal in some States. (But it is imperfect, see work here and here from Rori Rohlfs and colleagues). However, in the CODIS database, familial search efficacy is limited to close relatives (usually parents and siblings, and more tenuously uncles/aunts/nieces/nephews and first cousins). Thirteen microsatellite markers’ worth of information is simply not enough to distinguish a distant cousin from an unrelated person. With the hundreds of thousands of markers on a typical SNP chip, familial searching is much more powerful—third cousins can be found most of the time, and many (but not all) fourth cousins can be found too. A sample set of profile matches from GEDmatch is shown below:

 Looking at SNP-based relative matches in GEDmatch, police found what they needed in the form of 10 to 20 likely relatives. These likely relatives represented third-to-fourth cousins of DeAngelo, most of whom he had probably never met. Using this genetic data, in combination with genealogical information about these relatives, the Golden State Killer investigation narrowed to one extended family, eventually honing in on DeAngelo himself.

 Geneticists and genetic genealogists have been using these techniques for some time; the GEDmatch database exists because genealogists wanted to share genomic resources to help identify relatives, allowing families to be reunited (see here). Widespread reporting of the method used to identify DeAngelo as the suspected Golden State Killer has inspired a surge of interest in genetic privacy (see here for a general review of topic). Though DeAngelo’s capture is widely celebrated, people are also understandably surprised that the decisions of third or fourth cousins can potentially expose one to surveillance. In this post, we explore some simple models to ask questions about the extent of surveillance that is possible using the methods employed in the Golden State Killer case.

 Two opposed phenomena govern the effectiveness of familial searches on genetic databases, one genealogical and one genetic. The genealogical phenomenon, which we could call “genealogical blowup”, is that the number of relatives one has at a specified degree of relatedness increases as the relatedness becomes more distant. For example, whereas a typical person may have one, two, or three siblings, he or she will usually have a large number—dozens or even hundreds—of third cousins (or “third-degree” cousins). The picture below shows the genealogical blowup phenomenon. On the left, we see the probability that a random person has at least one cousin of degree p in a database (depending on the size of the database), and on the right, we see the average number of cousins contained in a database. The number of genealogical cousins one has—where genealogical cousins are cousins in the usual sense, those connected by genealogy—increases rapidly for more distant relationships.

(The calculation on the left is based on the work of to Shchur and Nielsen. To make our calculations, we adopt some simplifying assumptions that are certainly wrong—namely complete inbreeding avoidance, monogamy with random mating, non-overlapping generations, random participation in the database, and population sizes similar to US census sizes across the last few generations. However, these calculations are useful to get a rough sense of the problem. Some details and pointers to other sources are in the notes below. The primary caveat that our assumptions entail is that our computations apply most directly to ancestry groups that are well represented in the database. GEDmatch is mostly composed of profiles from Americans of European ancestry. Recent immigrants to the US and people from non-European backgrounds are likely to find fewer relatives in GEDmatch than are European-Americans whose families have been in the US for a few generations.)

The opposing genetic phenomenon is the noisiness of genetic inheritance. Whereas the typical person has many distant cousins, the amount of genetic material shared with each of these distant cousins is small. You are nearly certain to share a lot of your genome with your first cousin, as you both have inherited a lot of your genomes from your shared grandparents. As a result, it is easy to identify pairs of first cousins if they are in the database.

The genomic material you share with your first cousin is the overlapping fragments of genome that both of you have inherited from your shared grandparents. Below we show a simulation of you and your first cousin’s genomic material that you both inherited from your shared grandmother (details about how we made these simulations here). In the third panel we show the overlapping genomic regions in purple. These are regions where you and your cousin will have matching genomic material, due to having inherited it “identical by descent” from your shared grandmother. (If you are full first cousins, you will also have shared genomic regions from your shared grandfather, not shown here.)

 

Now consider the case of third cousins. You share one of eight sets of great-great grandparents with each of your (likely many) third cousins. On average, you and your third cousin each inherit one-sixteenth of your genome from each of those two great-great grandparents. This turns out to imply that on average, a little less than one percent of your and your third cousin’s genomes (2 * (1/16)^2 =0.78%) will be identical by virtue of descent from those shared ancestors. If you do share one percent of your genomes, then your relationship to your cousin will likely be detectable using SNPs—the shared portions will be concentrated in relatively long stretches of chromosome that are easy to see statistically. But the more interesting thing is the variation around that average. There is a non-trivial chance (~2%) that you will actually share no identical segments of your genome with your third cousin—in that case, we say you are genealogical cousins but not genetic cousins.

Here’s an example where third cousins share some blocks of their genome (on chromosome 16 and 2) due to their great, great grandmother:

Here’s an example where the same individual shares the same great, great grandmother with another 3rd cousin, but has no genetic sharing due to that connection:

 

As the degree of relatedness decreases—on to fourth cousins, fifth cousins, and so on—an ever-larger proportion of one’s genealogical cousins will not be genetic cousins. The figure below shows the proportion of degree-p cousins with which one expects to share either at least one, two, or three genetic blocks. Sharing 1 block is not very informative (see here). Individuals with whom one shares three or more large genetic fragments are likely strong leads. (Again, the assumptions used here are explained in the notes below.)

An appreciation of these two phenomena—genealogical blowup and the noisiness of genetic inheritance—is crucial for understanding how public SNP databases might be used by law enforcement in the future. There is a tradeoff. One typically has a large number of genealogical eighth cousins, but only a small proportion of them will be genetic cousins, and even these are often impossible to identify as such. On the other hand, it is easy to detect one’s first cousins, but because one typically has a small number of first cousins, the probability that a random person has one in a genetic database is low unless the database is very large. (Another factor relevant for law enforcement is that closer matches are more useful; they narrow the pool of possible suspects more.) The image below combines the considerations illustrated in the previous plots, showing the expected numbers of genetic cousins in the database. The tradeoff of genealogical blowup and the noisiness of genetic inheritance is optimized in the third to fifth cousin range—you have a lot of genealogical cousins at this degree of relatedness, and many of them will be detectable genetic cousins. Because closer relatives are more useful to law enforcement than more distant relatives, it’s likely that many of the cases that could be solved by these methods would involve some mix of 2nd, 3rd, and 4th cousins.

The Golden State Killer results are close to what we expect given the size of the GEDmatch database. Under the assumptions we make here, it’s likely that a large percentage of people have at least one high-confidence genetic cousin in GEDmatch, and the number of 3rd-4th cousins found for DeAngelo—10 to 20—is not too far from the expectations. It’s striking that uploading one’s information to a matching database potentially opens up a large number of other people to eventual identification, and that most of these people are distant enough relatives that one would likely never have met them. To illustrate, consider that 13 million individuals in CODIS likely wouldn’t reveal a familial match because only very close relatives are detectable in CODIS. But using the far smaller GEDmatch database (~1 million individuals), investigators tracked DeAngelo down. As Yaniv Erlich put it recently, “You are a beacon who illuminates 300 people around you.” It’s also striking that we’re already in an era in which familial searches against publicly accessible SNP databases are feasible for a lot of cases, probably the majority of cases where the suspect has substantial recent ancestry in the US—the public datasets are big enough (or will be soon). The limiting factor here may be the genealogical work to trace distant cousins through family trees, but big public datasets might make the genealogical task easier too. From here, it’s a question of deciding the circumstances under which we as a society want these familial searches to be used.

Doc Edge (@DocEdge85) & Graham Coop (@Graham_Coop) 

Thanks to the Coop lab and Debbie Kennett for helpful comments on an earlier draft.  

Notes

A pth cousin is a person with whom one shares an ancestor (in our model, an ancestral couple) p+1 generations ago (your great(p-1) grandparents). If there’s no inbreeding in one’s recent family tree, then one is descended from 2p ancestral couples p+1 generations ago. A pair of individuals in the present are pth cousins (or closer) if their sets of 2p ancestral couples overlap—they share ancestors p+1 generations ago. Let’s assume that there are Np potential ancestors in N/2 couples, p generations back. If each of these couples have the same probability of having children and there is not too much variation in family size, we can view the problem as if people in the present “choose” their ancestors p+1 generations ago at random. Your ancestors were no doubt very special people, but as far as this model is concerned they were just 2p random draws from all the couples who’ve left descendants. To calculate the probability that you and I are pth cousins, we just need to calculate the probability that our two sets of 2p ancestors overlap (note that this assumes monogamy, i.e. that we’ll be full not half cousins, but even if that wasn’t true, that just alters things by a factor of two). Now, we have something close to a classic probability problem: we draw a set of 2p balls at random from an urn with Np balls, replace the balls in the urn, and repeat the draw of 2p balls—what is the probability that at least one ball is a member of both sets of 2p balls?

The probability that you and I are pth cousins is roughly (4p/(Np/2)), when Np<<2p ie when your ancestors are a small fraction of the total people in the population. In a current-day database of K individuals, drawn from the same population as you, your expected number of pth cousins is K*4p/(Np/2). Two factors make this blow up quickly back over the generation. First, 4p grows quickly back over the generations; second, population sizes have increased rapidly in the recent past, which means that Np  declines quickly with p (because p counts generations backward in time).  

One of biggest uncertainties in our calculations is the size of the pool of possible ancestors. Our calculations should therefore be viewed as crude approximation. Our calculations are based on assuming that the population size of possible ancestors is given by the census population size of the USA. To get the census population size we assume a generation time of 30 years, and take the population size in the decade 1950-30*(p+1). We assume that roughly ½ of the individuals in the population are potentially parents, and that 90% of potentially parents have children. We impose a floor on the population size that it cannot drop below 1 million potential parents, to reflect the fact that for people of European-ancestry, the pool of ancestors back then would also include Europe. Given the large variation in family sizes N should likely be lower still, as variation in family size decreases the effective N further.

Shchur and Nielsen recently worked through the probability that you have no pth cousins in a database of K individuals, in a model similar to that described above. The model Shchur and Nielsen use is more realistic than the one we consider here—it allows for some inbreeding and takes explicit account of the fact that some couples will not have children. They find (their equation 7) that the probability that an individual has no pth cousins in the database, given a fixed population size of N, is approximately exp(-2(2*p-2)*K/N).

The math underlying the genetic calculation is described in more detail here. To summarize: if you share two ancestors p+1 generations with your pth cousin, then you share a particular autosomal chromosomal region with probability 2*(1/2p+1 -1). You have 22 autosomal chromosomes, and each generation, recombination happens in ~34 places on these chromosomes. Looking back p+1 generations, your chromosomes are broken up into approximately (22+34(p+1)) chunks, which are spread across your ancestors. Likewise, your relative’s genome is broken into (22+34*(p+1)) chunks. Because recombination events rarely happen in the exactly same place, your two genomes combined are broken into (22+34*d*2) pieces. As each of these is inherited identical by descent to both you and your cousins from that ancestor with probability 1/22(p+1 -1), you and your cousins should expect to share EB=1/22(p+1)-1 2*(22+34(p+1)) blocks of your autosomal genome. The probability that you share 0 blocks is approximately exp(-EB), while the probability of sharing 2 or more blocks (Qp) can approximately be obtained under the Poisson distribution (which is a good approximation beyond 1st cousins).

Putting all of this together, your expected number of genetic pth cousins is (Qp*K*4p/(Np/2). That’s the solid line plotted in the final figure.

Posted in genetic genealogy, popgen teaching | 5 Comments

Polygenic scores and tea drinking

Debates over the contribution of genetics to differences among populations have a long and contentious history. We have known for a long time that nearly all traits are partially heritable, meaning that genetic differences are associated with differences in phenotypes within populations (as are differences in environment). However, if a trait is highly heritable within a population, it doesn’t follow that differences between populations are due to genetics– environmental and cultural differences could instead be the primary driver of between-population differences.

Recently the field of genetics has made huge progress in identifying regions of the genome (single nucleotide polymorphisms, SNPs) that are associated with differences among individuals within a population, using genome-wide association studies (GWAS). GWAS studies have found SNPs associated with a dizzying array of traits, including behavioural traits, and sophisticated methods for estimating heritabilities have also emerged. The success of GWAS seems to suggest that we’ll soon be able to settle debates about whether behavioural differences among populations are driven in part by genetics. However, answering this question is a lot more complicated than it seems at first glance. In this blog post I’ll talk through some of the complications, including how gene-by-environment interactions and correlations among SNPs make it difficult to use polygenic scores to understand differences among populations.

Some of these complications are perhaps best illustrated with a toy example. Say we perform a GWAS of the amount of tea that individuals in the UK drink (e.g. in the UK Biobank). On the basis of this tea GWAS, someone (let’s call him Bob) could claim that we could learn about France-UK differences in tea consumption by just counting up the average number of alleles for tea preference that individuals in the UK and France carry. If the British, overall, are more likely to have alleles that increase tea consumption than French people, then Bob might say that we have demonstrated that the difference between French and UK people’s preference for tea is in part genetic. Bob would assure us that these alleles are polymorphic in both countries, and that both environment and culture plays a role. He would further reassure us that there’ll be an overlapping distribution of tea drinking preferences in both countries, so he’s not saying that all British people drink more tea for genetic reasons. He’ll tell us he’s simply interested in showing that the average difference in tea consumption is partly genetic.

At face value, Bob’s argument seems scientifically sound; If there are alleles for tea preference  to determine whether a British people’s love of a good cuppa tea is genetic, Bob just need to count these alleles up and compare them to the average allele counts in France. Adding up these tea preference alleles for individuals is one way of calculating an individual’s “polygenic score”. Polygenic scores are predictions of people’s traits computed from genotype data. There are several ways of calculating polygenic scores, and they have a range of potential uses. For example, people have done GWAS for risk of heart disease, and the resulting scores may offer a way forward in enabling preventive care. Currently, these polygenic scores often do not explain a lot of the variation in traits, but the size of studies is increasing, and predictions based on polygenic scores will become more accurate (within populations).

Now polygenic scores constructed using GWAS information from a single populations are expected to differ among populations. The allele frequency at every locus will vary among populations because of genetic drift, the compounding of chance variation in allele frequencies across generations, leads allele frequencies among populations to diverge over time. (If natural selection acts on the locus differently in the two populations, it also cause allele frequencies to differ.) Since a polygenic score is just a weighted sum of allele frequencies, it will also  vary among populations. Importantly, however, that does not imply that genetics must contribute to an observed difference in phenotype among populations. It could be the case that French people tend to have higher polygenic scores for tea-consumption than the British, but that this genetic predisposition is hidden or counter-acted by cultural influences. For example, perhaps British people on average find bitter (tannin) tastes slightly less palatable than French people, but this influence is overridden by the culture of tea drinking in the UK.

Even beyond the fact that environment and culture can overwhelm the influence of genetics, there’s another, deeper problem: polygenic scores are not strong statements about differences in the contribution of genetics to phenotypic variation among populations. The issue is that GWAS studies do not point to specific alleles FOR tea preferences, only to alleles that happen to be associated with tea preference in the current set of environments experienced by people in the UK Biobank. Similarly, as geneticists, we talk about height alleles. But these are not alleles FOR height, but simply alleles that are associated with differences in height within a population. There’s no guarantee that alleles mapped within populations will affect the trait in the same way in other populations and environments, nor (even if they do) that they will explain differences between populations.

Complex traits are just that—complex.  Most traits are incredibly polygenic, likely involving tens of thousands of loci. These loci will act via a vast number of pathways, mediated by interactions with many environmental and cultural factors.  Some of our tea-GWAS SNPs may well be enriched near olfactory receptors and genes expressed in relevant parts of brain, and some may overlap with SNPs associated with caffeine sensitivity. But the majority may not, they will often fall near genes with no simple connection to our trait. The rare cases where we can confidently make a specific causal connection to a gene and through a causal pathway all the way to phenotype may explain so little of the variance that, while they may provide important clues to biology, they often won’t allow us to state a general causal mechanism that explains a lot of the variance. In saying this, I’m not anti-GWAS. We have learned a lot of new biology from GWAS, and doubtless will learn a lot more over the coming decades. But they are far from a complete solution to understanding the causes of variation, especially variation among populations. Let’s see why.

Gene-by-environment interactions (G x E)

The effect of an allele on any given phenotype is always in the context of a particular set of environments. This issue is not new: debates over the meaning of heritability and the genetics in the context of environmental variation stretch back to the dawn of quantitative genetics (see, e.g., the debate between Hogben and Fisher). These issues are particularly difficult in humans, though, as we cannot raise humans in laboratory environments or randomized environments. Our behavioural, cultural and societal practices  will influence the ways in which genetic variants impact phenotypic variation.

For example, there are cultural differences between the UK and France in whether milk is taken with tea, in the types and quality of tea drunk, and in the prominence of coffee. What role do parents, and older siblings, play in an adult’s choice of beverage, which shape indirect genetic effects, and how does these differ between countries? Presumably all of these differences, and many others, could mean that the genetic basis of tea drinking will differ between France and the UK. Therefore, the loci that influence tea drinking in the UK could be somewhat different from those underlying differences in tea drinking in France.

Suppose after our GWAS for tea drinking in the UK and France, we found that the genetic basis of the trait within both countries was correlated. What would be a high enough correlation to constitute evidence of a genetic difference in phenotypic preferences between countries? Moreover, even if the polygenic score explained a lot of the variance within each country, it may not explain much of the difference between the countries. As one example: maybe if people who care about their weight more are more likely to drink tea (e.g., as compared to soda), then alleles that are correlated with BMI in the UK Biobank will be alleles that predispose you to tea drinking. These loci may be reliably associated with BMI and tea drinking in both the UK and France. Yet a difference in the frequency of loci associated with BMI between the UK and France would not imply that differences in tea drinking preferences among countries result from genetics. Suppose for example that an individual’s preference for tea is not influenced by their absolute BMI, but rather by their relative BMI within a country, because of how they feel about their weight relative to people they regularly encounter. In this scenario, a polygenic score could be predictive of individual’s phenotypes within multiple countries but have little predictive power in explaining differences among those countries.

Without a thorough understanding of the casual biological and cultural mechanisms by which GWAS SNPs interact with the range of environments encountered by individuals, it may be hard to rule out GxE as a serious confounder of inferences of polygenic scores across populations.

We don’t have the functional genetic markers.

A second major hurdle that we face in understanding polygenic scores is that we do not know the loci that are functionally important for trait variation, only loci that are statistical proxies for them—sometimes called tag SNPs—that will be nearby in the genome. (Technically the SNPs used to construct polygenic scores are in linkage disequilbrium with the functional loci—meaning that genotypes at the tag SNP are correlated with genotypes at the functional locus—but unlikely to be the functional loci themselves.) To understand this point, look at the example below. On the left is a cartoon of people from the UK. Each person has two chromosomes (horizontal black lines) and in this small stretch of the genome there are two loci (red and blue SNPs), the alleles of which are indicated by the presence/absence of a filled circle. Whether an individual drinks a lot of tea is indicated by the tea cup  next to the individual. Both of the filled circle alleles appear to be associated with tea drinking. (Obviously this sample size is laughably small, but you get the point.) However, only one of them is the functional SNP predisposing people toward tea drinking; the other SNP just happens to be associated because the mutation there arose at a similar point in history on the same genetic background. If we guess that the blue allele is the functional one, we would predict that French people have a slightly weaker preference to tea on the basis of this allele. But if we guess the red allele is the functional one, we would predict that the UK and France have very similar tea drinking habits on the basis of this locus.

What’s happened here is that the correlation between the alleles at the two loci have changed due to different histories of recombination and genetic drift. Now such a strong change in the correlation of loci is unlikely between two countries, such as Britain and France, that share so much of their genetic history. However, it is a serious problem when comparing populations that have been more distant from each other for a longer period of time. The fact that the correlation between any two SNPs changes over evolutionary time is a major reason why polygenic scores lose predictive ability as we move to populations that have been isolated from each other for more of their history. Even for closely related populations, it may be a problem when we consider that the many weak GWAS signals that likely much of the heritability for typical traits, as these associations may be due to collections of loosely linked SNPs. One way forward would be to perform GWAS in multiple populations and try to narrow down the actual functional SNPs, but again, this is no small undertaking.

tea_LD.png

A second, more subtle force can decrease the predictive validity of polygenic scores. Assortative mating among individuals can drive rapid changes in the SNPs associated with a trait. For example, if people who drink more tea tend to have children with taller people, this pattern of assortative mating can cause greater height and tea drinking to become associated (formally can lead to a genetic correlation). In other words, height-increasing alleles will be associated with tea drinking because the offspring of tea-drinking/tall couples will have alleles associated with both tea drinking and height. Even after assortative mating has stopped, these effects can persist for a few generations, making them potentially hard to rule out.  Such associations need not hold in other populations, however, if they do not have similar patterns assortative mating. Therefore, sets of loci that contribute to trait variation via genetic correlations may change rapidly across environments or populations due to shifts in assortative mating.

We will not map within a single population all of the alleles influencing trait differences among populations.

GWAS have the highest power to map alleles that are present at intermediate frequency in the GWAS population (all else being equal). The functional variants contributing to a trait will differ in frequency among populations due to genetic drift and selection; therefore, GWAS will miss many of the loci contributing to phenotypic variation in other populations. This may not be much of a problem for comparing the UK and French population, as allele frequencies are very similar in the two countries. However, it’s potentially a much bigger problem in comparing more distant populations.

An example of the complexity of the ways in which different variants contribute to a trait in different areas of the world is the genetics of skin pigmentation. The variants that were mapped within European populations, though important in Europe, explain little of the variation in skin pigmentation worldwide. Even variants that explain the lighter European skin pigmentation do not explain the lighter skin pigmentation in East Asians (e.g. see here and here). Work from Sarah Tishkoff and Brenna Henn‘s labs has demonstrated that a number of loci important for explaining skin-pigmentation variation world-wide were  missed by studies focused on non-African populations. A big part of the story was missing until variation within Africa was explored, with undoubtedly much more to uncover about this trait from GWAS in many populations. Furthermore, our understanding of the evolutionary history of skin-pigmentation in Europe has been majorly revised by ancient DNA.  This history of major shifts in our understanding of the genetics and evolutionary history of skin pigmentation suggests that bold claims about other traits, based on incomplete evidence, may well not stand the test of time.

In the coming decade, we will likely uncover a surprising amount of heterogeneity in the alleles controlling trait variation world-wide. Based on genetic drift alone, we should expect as much: the alleles that explain most variance in populations of European ancestry will not be the same alleles in East Asia as allele frequencies drift over time. Also as a result of allele frequency change at many loci, across populations, epistatic relationships among loci may also change in unpredictable ways, confounding cross-population predictions.

These problems of different alleles contributing to  traits in different populations will be compounded for traits subject to natural selection (as well as genetic drift). Whether traits are subject to stabilizing selection or directional selection (shared or divergent), selection will drive more rapid turnover in the loci contributing to trait variation among populations.

Again, one can hope to address these issues by performing GWAS in multiple worldwide populations, but we should expect to have a European-biased view of genetic variation for some time to come, simply because of the size of the studies in these populations dwarfs those done elsewhere.

Conclusion

Undoubtedly the coming decades of human genomics will see breakthroughs in the identification of functional loci, the size of GWAS performed world-wide, and in the statistical methodologies used to understand trait variation. There is also no doubt that we will come to understand much more about human variation. However, our ability to perform GWAS to identify loci underlying variation in traits among individuals vastly outstrips our ability to understand the causal mechanisms underlying these differences. In many cases, genetic contributions may not be separable from environmental and cultural differences. Certainly making a case for the relative importance of genetics in explaining among-population differences will involve a lot more work than simply counting up the number of tea preference alleles in populations and seeing how the averages differ.

These complications notwithstanding, I suspect that over the next decade, we are going to see a lot of partial results and incomplete (and in some cases initially downright incorrect) stories about the genetics of among-population variation in traits. For example, we now think we know something about the evolution of polygenic height scores among European populations. Results in hand allow us to demonstrate that natural selection has likely driven the higher polygenic height scores of Northern Europeans compared to Southern Europeans (Turchin et al, Berg and Coop, Robinson et al Mathieson et al, Berg, Zhang, & Coop). But they do not convincingly demonstrate that among-population differences in height in Europe are genetic (for all the reasons outlined above; for more, see here). Furthermore, our understanding of height genetics drops off quickly as we move away from Europe: we are even further away from understanding height differences among populations across Eurasia, and European-GWAS polygenic height predictions are positively misleading when applied to African populations. The complexity of such partial results reflects our uncertainty about the genetics of height–and that’s for height, an easily measured and well-studied trait. Applied to other and more fraught traits, this patchy understanding of the contribution of genetics to phenotypic differences will be fertile ground for misleading claims.

Finally, there is a more fundamental disconnect between talk of polygenic scores and what some people seem to think they might learn from this kind of research. Even if we could attribute some proportion of the phenotypic difference to a difference in polygenic score, on a deeper level, it is not even clear whether such a result really answers the question that an average person means to ask when they ask whether a difference is “genetic.” Saying a phenotypic difference among individuals is genetic often is implicitly taken as implying that it is immutable or unavoidable. However, even if we could attribute a some proportion of the difference in phenotypes between groups to polygenic scores, it would not lend support to the idea that this difference is immutable or “natural”. That is simply not how genetic variation works, as many phenotypes where genetics plays a role are modifiable.Without at least some working knowledge of causal mechanisms underlying the action of the genetic variation contributing to a trait, we may often not know how environment and culture shape the actions of these variants, nor how changes in these factors may modify any role played by genetics. Even if our tea polygenic scores were strongly predictive within and among populations, would cultural changes, e.g. a Europe-wide health food craze for drinking tea with dinner, stand these results on their head? Will taking tea with a meal moderate the role of caffeine-sensitivity SNPs; will exercise-conscious people now drink more tea? Will we know enough about the interaction of culture and genetics to predict this? If we do not, the statement that a difference in polygenic scores plays a role in explaining a difference in phenotypes among populations may often have little to say about how we as individuals or societies should view that difference. But will these critical subtleties be lost in the public’s understanding of results based on polygenic scores? Will such results be wrongly taken as supporting genetic determinism about human variation?

 

 

 

Posted in popgen teaching, Uncategorized | 2 Comments