▶ 0:17:12filling in uh throughout the committee hearing because people stayed up all night watching America's team Murray State beat Duke to go to the College World Series. So uh people will be uh in momentarily. Uh, I recognize myself for the purpose of making an opening I want to welcome everyone to today's committee hearing on the privacy and national security concerns surrounding 23 andme bankruptcy sale.
▶ 0:17:4023 andme is a direct to consumer genetic testing company in possession of personal genetic data of millions of Americans. On March 23rd, 2025, the company voluntarily filed for Chapter 11 bankruptcy, leaving open the question of who will purchase 23 andme and who may gain access to the sensitive information of customers and their family members.
▶ 0:18:01On May 19th, 2025, Regeneron Pharmaceuticals, a biotechnology company based in New York, announced that it had entered into an asset purchase agreement to acquire 23me. On June 4th, 2025, the court decided to reopen the auction for 23 andme to allow for final bids from Regeneron uh TT AM Research.
▶ 0:18:24Uh and and let me note that uh TTAM was founded by 23 andMe co-founder and former CEO uh Miss Anjiki. uh with over 15 million customers worldwide, 23 and me users for uh for a a salava sample to uncover their ancestry, family traits, and potential health risk to whoever ends up controlling the company. There are serious concerns about what will happen to this private How will it be stored?
▶ 0:18:53What will it be used for? Could it end up in the hands of a foreign adversary through direct investment or indirectly through future partnerships? Could the information be used against customers and consumers? 23 andMe has a record of engaging with foreign adversaries, namely the Chinese Communist Party.
▶ 0:19:12In 2015, the company received 115 million in funding from investors, including Wooi Healthc Care Ventures, which was then a corporate venture arm of Wooi Attek, a company with ties to the CCP and Chinese People's Liberation Army.
▶ 0:19:30At the time, the investment valued 23 andme at $1.1 According to 23 andme, this partnership was terminated, but questions remain about the potential for the future owner of the company to partner with bad foreign actors. Notably, Regeneron partnered with a Chinese company called uh Zilab Limited on drug clinical trials during the height of the COVID pandemic.
▶ 0:19:55It is well known that the CCP engages in mass surveillance and has conducted dangerous activities to advance bioweapons both used against its critics. In fact, 23 andMe was hacked in 2023, exposing personal information from nearly 7 million profiles, mostly targeting Jewish and Chinese customers. The New York Times reported that China and other countries are working to dominate these technologies and are using both legal and illegal means to obtain American expertise.
▶ 0:20:23The CCP has a history of misusing genetic data, including DNA tests, to track Weisure Muslims. National security concerns about 23 and me are not new. In December 2019, the US Department of Defense advised members of the military not to use consumer DNA kits, saying the information collected by private companies could pose a security risk.
▶ 0:20:47A DoD memo warned that consumers DNA kits uh pose personal and operational risk to service members and raise concerns about outside parties using genetic genetic data for mass surveillance and authorized tracking. It is imperative that 23 and me and other companies like it ensure there is absolutely no legal or illegal way for foreign adversaries or anyone else to access, manipulate, and abuse Americans genetic data to advance their nefarious agendas.
▶ 0:21:15Potential harm for consumers does not come solely from hostile foreign actors. Disclosures of individuals genetic data could also be used for assessing higher insurance premium. Restrictions on credit extensions by financial institutions and targeted advertising based on predisposition to specific medical conditions. All of this raises concerns about whether Congress needs to take action to ensure safety of Americans personal genetic data.
▶ 0:21:41Given these serious risks, I look forward to hearing from the co-founder uh former CEO and current board member of 23 andMe who is bidding in the bankruptcy cell, Miss Anne Wjiki and interim CEO, Mr. uh Joseph Salavage. As previously discussed with the witnesses, the committee is aware of some courtmandated restrictions on public disclosure of specific aspects of the ongoing bankruptcy proceedings. It's our understanding that these restrictions are limited and not applicable to all aspects of the pending bankruptcy.
▶ 0:22:11The committee expects the witnesses to answer the questions to the fullest extent possible. And with that, I yield to Ranking Member Lynch for his opening statement. Thank you, Mr. Chairman. And I want to thank the witnesses for their willingness to come before the committee and help us with our work. Chairman Commer, thank you for calling this hearing to examine the very serious issue of how we can protect Americans sensitive personal data from hostile actors. 23 and me holds the genetic and biographical data of 15 million customers.
▶ 0:22:43This includes billions of phenotypic data points that make up DNA profiles, detailed genealological and ancestry history, and importantly, health predispositions. While health care providers and insurance companies must follow federal laws like the Health Insurance Portability and Account Accountability Act or HIPPA, which protects patient sensitive data from unauthorized sharing, direct to consumer companies like 23 and me operate with minimal oversight
▶ 0:23:13and regulation. The lengthy and opaque terms of service and privacy policies that customers are required to agree to typically allow for their data to be sold during a sale or bankruptcy. And that is precisely the situation that millions of the company's customers find themselves in today. Americans deserve to know what the sale of 23 and me will mean for sensitive genetic data it holds.
▶ 0:23:39Unfortunately, Chairman Comma has demanded this hearing take place today, unfortunately, in the midst of the bankruptcy bidding process when these witnesses are legally prohibited in some respects from speaking to any details related to the bankruptcy and sale. But we will do our best together to get answers. Despite this challenge, our concerns are magnified by the fact that the hostile actors, including foreign adversaries, are constantly attempting to buy or steal American sensitive data.
▶ 0:24:10In 2023, 23 andMe was the target of a massive breach in which an outside attacker stole the data of 7 million customers, reportedly targeting those with Ashkanazi Jewish heritage. The governments of the People's Republic of China, the Russian Federation, North Korea, and Iran conduct persistent cyber attacks against the United States.
▶ 0:24:31China's president Xi Jinping has made clear that dominating the AI race and achieving global supremacy and biotechnology are critical to the future geopolitical power and obtaining vast troves of American sensitive data is a key component of his strategy. Failing to safeguard Americans data from these hostile actors would not only be a critical violation of privacy but also a national security catastrophe.
▶ 0:24:58Given the sensitive date nature of the data that companies like 23 and me hold, the possibility for that data to end up in entirely new hands in the event of a sale or bankruptcy, and the risk of data breaches, including by hostile foreign governments, we cannot rely solely on corporate efforts to ensure this data is protected. We need strong privacy protections and comprehensive laws and regulations that address the evolving landscape. That is where the federal government comes in.
▶ 0:25:27But instead of a instead of a strong federal government that makes every effort to protect American sensitive data, the Trump administration and Doge are dismantling our IT and cyber security workforce and replacing hardworking civil servants with unqualified hacks. Just last week, President Trump installed a 22-year-old with no national security expertise to oversee a Department of Homeland Security hub for terrorist prevention.
▶ 0:25:54The administration has spent the last 5 months weakening our leading cyber security and consumer protection agencies and purging the federal watchdogs who ensure government works for the people's interests. I condemn those efforts and if committee Republicans were serious about this hearing, they would as well.
▶ 0:26:11If we are concerned about the security and privacy of American sensitive data, we need a hearing examining the myriad of ways that Doge is violating cyber security and privacy laws and making our personal information easier to steal or use against us.
▶ 0:26:25We need a hearing on how and why Doge installed a server of unknown nature and origin at the Office of Personnel Management or the specialized computers that Doge engineers in report are reportedly creating to merge Americans data across agencies with blatant disregard for federal laws that ensure Americans know where when their data is being accessed and by whom.
▶ 0:26:48We need a hearing on the way that Doge has exposed critical federal systems to hostile foreign actors and on the massive cuts to its personnel that Doge has made across the government, including at critical agencies like the Social Security Administration, which houses every American Social Security number. Last week, Republicans on the committee voted against again to shield Elon Musk from accountability for the destruction and danger he has wrought on Americans, quite possibly under the influence of hard drugs.
▶ 0:27:19But this is the oversight committee, and the American people deserve answers. We have weak privacy laws, persistent threats from foreign adversaries, and Trump's own estranged top advisor, and a president who is both in intentionally and through incompetence crippling the federal government's cyber security defenses, privacy safeguards, and oversight capabilities. This perfect storm leaves American sensitive data vulnerable to breaches, exploitation, and surveillance.
▶ 0:27:45Americans, not Americans, not private companies, hackers, or Elon Musk and Doge, deserve to own their data and make the decision about how, where, and if their sensitive information is used. I hope my Republican colleagues will join us in taking a comprehensive approach to securing Americans private data. Because while it appears Americans can opt out to delete their data from 23 and me, there are no options to delete their data from Doge. Mr. Chairman, I yield back.
▶ 0:28:15Gentleman yields back. I'm pleased to introduce our witnesses. Uh today, all witnesses are testifying in their personal capacities. Uh first of all, Ann Wiki is a co-founder, board member, and former CEO of 23 andMe. Uh before co-founding 23 andMe, Miss Wiki worked at various hedge funds and investment companies as a healthcare analyst. She founded 23 andme in 2006. Uh Miss Wiki served as CEO of 23me for almost 20 years.
▶ 0:28:43her service as CEO voluntarily came to an end on March 23rd, 2025. Joe Sales Savage is the current interim CEO of 23 andme as of March 23rd, 2025. He began working for 23 and me in November 2021 after the company was acquired by Lemonade uh health. He served as 23 and me's chief financial officer as he has over 25 years of accounting and finance experience. He formerly worked as a consultant and chief financial officer for various companies.
▶ 0:29:1423me's board chose Mr. Salavage to serve as interim CEO after Miss Wjiki voluntarily resign uh her resignation and 23me simultaneous bankruptcy announcement on March 23rd. Dr. Margaret Hu is the uh uh professor and professor of law at the director a director of digital democracy lab at William and Mary Law School. She previously served as special policy council in the civil rights division of the US Department of Justice.
▶ 0:29:42Pursuant to committee rule 9G, the witnesses will please stand and raise their right Do you all solemnly swear to tell the truth, the whole truth, and nothing but the truth? So, help you God. Uh, let the record show that the witnesses answered in the affirmative. Thank you all and you may take a seat. We appreciate you being here today and look forward to your testimony. Let me remind the witnesses that we have read your written statement and they will appear in full in the hearing record. Please limit your oral statements to five minutes.
▶ 0:30:11As a reminder, please press the button on the microphone in front of you so that it is on and the members can hear you. When you begin to speak, the light in front of you will turn green. After four minutes, the light will turn yellow. When the red light comes on, your five minutes have expired. And we do we would ask that you please wrap up. I now recognize Miss Wjiki for her opening Chair Comr, Ranking Member Lynch, and members of the committee. My name is Anne Wujiski.
▶ 0:30:37I co-founded 23ME nearly two decades ago with the mission of helping people access, understand, and benefit from the human genome. My personal mission is to have a meaningful impact on the world. It has been my life's passion to understand the human genome and DNA, the code of life. The committee has raised important questions about the protections and privacy that 23me applied to our customers data over the company's almost 20 year history.
▶ 0:31:07These are questions we thought seriously and deeply about. We did this because our focus has always been on improving the health of our customers. If we didn't have their trust, we would not have been able to do the groundbreaking research that impacted millions of lives. Let me be very clear about our practices and what we stood for. During my time as CEO, privacy was central to every decision we made.
▶ 0:31:34From product development to research customers had choice and transparency about what information they saw and how they consented for their data to be used. Customers were required to give explicit consent before their anonymized data was used for any research purpose. and over 80% of our customers made the choice to opt in.
▶ 0:31:58We never provided inform to any third party without the customer's explicit With that foundation, let me turn to our mission and what we were able to accomplish with our for our customers. The company's mission was driven by the belief that it is an individual's right to be able to affordably access their own genetic information and to learn what it means for them. This guiding light has always been at the core of 23me's mission and core to my beliefs.
▶ 0:32:2823me pioneered the field of genetic ancestry and direct to consumer genetic testing. The journey of pioneering access to genetic information for individuals has not always been easy, but I am incredibly proud of the impact we have had.
▶ 0:32:43Over 15 million customers have learned about their ancestry, found relatives, and potentially life-saving health For example, over a million customers learned they carried a genetic variant associated with blood clotting risk, allowing them to seek care to prevent potentially fatal clots. Customers also gained information about cickle cell disease, chronic kidney disease, type 2 diabetes, and coronary artery disease. In many cases, these reports were life-saving.
▶ 0:33:13Hearing from customers about how their genetic information changed their lives is what drives me every single day. One recent email from a customer read, "Hi, Anne. I just wanted to share my story with you because I was diagnosed with breast cancer on June 24th, 2024 at the age of I had no symptoms at all and the doctors felt no lumps. It was all because of 23 and me that I even got a mammogram and because of that we have caught it at an early stage.
▶ 0:33:44And although the upcoming months will be hard, it could have been so much worse. A few years ago, I did 23me and we did the health version and it showed that I had the BRCA1 gene mutation. I have no family history that we know about, so I was not on track to get a mammogram until I was 40. I just wanted to send this testimony and say thank you. I am so indebted to you for making me aware of this.
▶ 0:34:11And I truly feel like because this was caught early, my life is saved, and I owe you that from me, my family, my friends, and my one-year-old daughter. Thank you for saving our Let me be clear. None of these discoveries that saved lives would have been possible without scientific research.
▶ 0:34:32During my tenure as CEO of 23 andMe, our research program was truly The impact of our research has extended far beyond our customers. It has benefited the broader scientific community and communities from coast to coast. When I spoke with customers facing serious health conditions, their message to us was clear. Use the data we gave you. Help us if you can or help someone else. Don't store it. Do something with it.
▶ 0:35:00With my remaining time, I want to address one last topic. The threat posed by China to the biotechnology sector is real and is not new. China has made massive investments in life sciences and biotechnology and is rapidly positioning itself as a global leader. Meanwhile, the US is falling behind. This disparity concerns me deeply. Understanding the human genome is not just about scientific advancement.
▶ 0:35:30It is about national security, global competitiveness, and the health of all Americans. This belief has fueled my work throughout my career, and it continues to drive my unwavering commitment to advance advancing genomics for the public good. As I believe you know, I am currently pursuing an acquisition of the company as an independent bidder during the bankruptcy proceedings.
▶ 0:35:53Looking forward, I remain committed to this mission and driving meaningful change in our health care system by continuing to empower individuals and enable them to make informed decisions about their health because the future of healthcare belongs to all of us. I appreciate the opportunity to be here today and I look forward to your questions. Thank you very much. I now recognize uh Mr.
▶ 0:36:16Savage, Chairman Comr, Ranking Member Lynch, members of the committee, thank you for the opportunity to appear before you today. My name is Joseph Salavage and I am the interim chief executive officer of 23 andMe, a missiondriven organization founded on a simple yet transformative belief that individuals have the right to access, understand, and benefit from their own genetic From the very beginning, 23me's
▶ 0:36:46purpose has been clear. To help people live healthier lives through direct access to their own DNA, to accelerate scientific discovery, and to contribute meaningfully to the future of personalized medicine. We recognize that with this vision comes immense responsibility to the millions of individuals who have chosen to participate in something larger than themselves.
▶ 0:37:09We are here today not only to answer your questions, but to reaffirm our deep commitment to data privacy and security, transparency, customer choice, data stewardship, and scientific integrity. Founded in 2006, 23 andMe is a personal genomics and biotechnology company that pioneered direct to consumer genetic testing. We are named after the 23 pairs of chro chromosomes in every human cell.
▶ 0:37:39Our mission has always been to empower customers by providing access to information about their personal gen genetics based on the latest science so that they can make informed decisions about their healthcare journey. Our services allow customers to gain DNA insights about their genetic risk for dozens of conditions like type type 2 diabetes, Alzheimer's disease, and certain cancers.
▶ 0:38:04They can also learn about their carrier status for inherited conditions like cystic fibrosis or Tay-Sax disease or wellness factors like lactose intolerance or deep sleep tendencies. 23 andMe's customers have consistently reported taking positive health actions after learning about their genetics through 23 andme services. 82% of our customers with an actionable genetic results were previously unaware of their health risks.
▶ 0:38:34The value of personal genomics goes beyond the insights people learn about themselves. Customers who register for our services also have the option to for their data to be shared for research purposes and over 80% of our customers have chosen to consent to research. Consent is a central tenant of 23 andme's research program.
▶ 0:38:55We have separate research consents beyond our consent to processing sensitive data, a privacy statement, and terms of service that customers must review and agree to separately if they want to participate in our research program. We remove all identifying information before any genetic data is shared with any third party.
▶ 0:39:17And any customer who affirmatively consents to participate in our research program can easily opt out at any time through their account settings and always have been able to do so. Customers are also free to delete their accounts and information at any Customers who affirmatively consent contribute to more than 230 studies on topics that range from Parkinson's disease to lupus to asthma and more.
▶ 0:39:45We collaborate with advocacy organizations, universities, and biotech companies to bring customer opportunities to participate in research. Since 2010, 23me has published 293 papers that helped advance scientific research in a wide range of fields. Yeah. Due to circumstances that I discuss in more detail in my written testimony, 23 andMe is currently conducting a sales process supervised by a United States bankruptcy court.
▶ 0:40:15That process has been a success to date. We have two remaining biders, both American Enterprises, that will conduct a final round of bidding later this week before the sale to the winning bidder is presented for the approval by the court. Because this proceeding is ongoing, I am unable to speak about the merits of either bid for the ongoing sale process. But let me assure the committee that 23 andme remains committed to protecting customer data.
▶ 0:40:42We are requiring that anyone bidding for 23 andme must comply with all of our privacy policies. We recognize the vital importance of protecting every individual's right to access and control their genetic information. Empowering people with knowledge about their DNA is not only a matter of personal autonomy.
▶ 0:41:02It is a gateway to proactive and personalized health, informed decision-making, and greater engagement in scientific At 23me, we believe that when consumers are trusted with their own data, they become partners in advancing medicine and not just patients of it. I appreciate the opportunity to testify before the committee today and I welcome your questions. Thank you very much. I now recognize Professor Hoop for her opening statement. Thank you.
▶ 0:41:31Good morning, Chairman Comr, Ranking Member Lynch, and members of the committee. I am Margaret H. Davidson M. Douglas, professor of law and director of the digital democracy lab at William and Mary Law School in Williamsburg, Thank you for the opportunity to address the urgent matter of how best to secure Americans genetic data privacy.
▶ 0:41:50As this committee recognizes, the collection, storage, and analyses of sensitive genetic information and its disclosure can pose a range of national security concerns and risks, the bankruptcy proceedings of 23 and me demonstrate why these matters are so consequential, especially in the age of artificial intelligence and the future of AI warfare. The first decade of my law career was dedicated to the civil rights division of the US Department of Justice. My first day as a trial attorney was the day before the terrorist attacks of September 11th, 2001.
▶ 0:42:21I immediately joined a post 911 uh task force and focused on homeland security and border security issues. In the past decade, I have served as a researcher and a professor of AI law, constitutional law, and national security law. I would like to approach this topic from the perspective of AI and national security.
▶ 0:42:39My post 911 policy work introduced me to the topics that now form the basis of my current research in data privacy, cyber security and AI governance with a particular focus on biometric cyber surveillance and biometric cyber intelligence. This hearing is critically important. Genetic data and biometric cyber intelligence lies at the very center of a new battlefield in the age of AI. Safeguarding the genetic data of 23me and other biotech corporations is not just a matter of data privacy.
▶ 0:43:08It is of paramount importance as a matter of national security. Consequently, in addition to discussing the bankruptcy and consumer data protection laws of this current matter, I am grateful for this opportunity to support the committee's examination of the national security implications of the sale and transfer of this sensitive data. The topic of genetic data privacy unfolding within the context of this bankruptcy proceeding is simultaneously unfolding within the context of a much larger crisis.
▶ 0:43:36inadequate federal data privacy and cyber security safeguards generally and inadequate federal laws to address the challenges of the AI revolution. The 23 andme bankruptcy filing is a wake-up call that our current legal inaccuracy amounts to instability in our national security. In the age of AI, data privacy, cyber security, and AI infrastructure form the tapestry of overlapping systems of law and technologies.
▶ 0:44:01The Federal Aviation Administration, for example, coordinates airspace and aircraft traffic control, aircraft safety and investigation and sets standards for the national airport systems. Without question, the FAA is seen as an essential national security partner, coordinating closely with the US Department of Defense as it supports both civil and military aircrafts.
▶ 0:44:21Congress should now immediately enact both federal data privacy laws and cyber security laws and also take legislative action to enact federal AI laws that anticipate these important national security threats that can be posed by inadequate AI regulations.
▶ 0:44:36The 23me bankruptcy matter provides a window into why Congress should step forward and enact these laws that are capable of creating a similar administrative oversight structure as the FAA, including regulations that acknowledge the need to coordinate national security concerns in the handling of sensitive data. 23 andMe holds the genetic and personal data of over 15 million individuals, including predispositions to disease, ancestral background, and familial linkages.
▶ 0:45:02This data is not only personal and permanent, it's relational, making the stakes unusually high. Almost 7 million consumers were exposed in a data breach of 23 and me in 2023. The company um entered into a settlement agreement that involved a $30 million settlement.
▶ 0:45:18Now in the moment of AI warfare, there is a highly uh sensitive uh genetic data black market where foreign adversaries are fighting to get this data for a wide range of reasons including for strategic advantage, sometimes referred to as military identity dominance or for cyber intelligence purposes.
▶ 0:45:40Biometrics include often referred to as hard biometrics, fingerprints, I risk scans and palm prints and DNA. Um, in the intelligence context, the national security risks and misuses and abuses of genetic data by foreign adversaries may include potential biological warfare risks, blackmail, and increased surveillance, among other potential threats. The Pentagon has previously warned military personnel that DNA kits could pose a risk to national security.
▶ 0:46:11Other harms could potentially include abusing genetic data for isolating and discriminatory targeting and potentially analyzing genetic data and aggregating biometric data and biographical data for the purposes of cognitive warfare. Data privacy is not only a consumer data privacy issue but also a national security one. Thank you and I look forward to your questions today. Thank you very much. And uh we will now begin with our questions.
▶ 0:46:40I recognize myself for five minutes and Miss Wujigi, I really appreciate your your opening statement and uh the fact that uh that your company can identify the potential risk for cancer and things like that. I mean that's great. But let's talk about you.
▶ 0:46:58Our concern is the national security risk of what happens with the the data uh and and how it can be used against consumers and we're very concerned about that because there's a precedent here where companies with Chinese influence have stolen data. U so just to start off with your with 23 and me people provide a salava sample to the company. What what tests are run on the sample? I appreciate the question.
▶ 0:47:27Um the test that was run, it was actually run on a gene chip that Aluminina created. So the sample was sent to somebody takes a a saliva sample, they a tube. Okay. So what type of information did 23 and me obtain from the sample? It was about specific markers in your genome. So markers that are known to vary between humans known as SNIPS. Okay. So, are the samples tested for They're obviously tested for genetic markers, correct? Correct.
▶ 0:47:57Correct. So, 600,000 genetic markers. What's the purpose of testing the samples for genetic markers? Can you explain that? Yeah. Um, the purpose for it was really twofold. It's it's people have the opportunity to learn about their ancestry. Um, where they're from in the world, potentially areas that they did not know about. They have the opportunity to connect with family members. um potentially for instance adopes who are looking to identify um you know biological siblings or parents. Right.
▶ 0:48:26Out of curiosity, is this optional for consumers? It's completely optional because we realize there was a number of people who do not want to find additional family members and that they did not want to be identified. So it's a it's an explicit consent where we ask people specifically, do you want to find close family members or distant? And you have the ability at any time to toggle in or to toggle out of that. It's very easy to do.
▶ 0:48:52So, did 23 andme also track uh genetic markers over time in order to conduct long-term health studies? We did. So, so we also specifically tested on markers that are known to be predispositions for health conditions. So, in in my testimony, for example, I talked about the BRCA1.
▶ 0:49:12We specifically identified that there were a number of people who were not able to get their BRCA results because of the barriers that the insurance industry or uh the societies have put up. So we found actually about 20 to 30% of our customers were learning that they had potentially like a really detrimental genetic variant that put them at very high breast cancer risk and they couldn't otherwise get that information. So you use this type of testing during CO 19. What was the purpose of that?
▶ 0:49:42Well, the same it was the same test that we started with in 2006. It was the same test going forward. We were very consistent. What were the results? It was the same. It was the same types of results. Where did the data information from DNA swabs go once testing was complete? So, we worked with LabCore. LabCore had been our partner for 18 years or so. So, it went to LabCore. Uh they have a office in in LA as well as in North Carolina. So did the data get uploaded to a database? Yeah.
▶ 0:50:12So they would then send us data files and that data would come into into 23me. Um we also upload it into we work with uh Amazon AWS all on US servers. How was the data protected? It was encrypted from end to end. Um we had all kinds of ways that uh again the the team thought about how it was going to be encrypted, how it was sent.
▶ 0:50:35It also, I should be super clear, had no identifiable information when it was sent to LabCore or when we received it. So, how long how long does the data stay in that database? How long at at the 23me database? I'm sorry. At 23me, you mean? Yeah. As long as How long does the data stay in the database? As long as a customer wants, they have that opportunity to delete their data at any time.
▶ 0:51:03So where did the physical the the uh saliva sample go after testing is complete? The physical saliva sample would go to LabCore and customers had the ability to say do I want my saliva sample stored or not stored. And the reason why they might want it stored is for example we were offering in the future potentially you would want to upgrade you'd potentially want to get a different type of test or if there were additional services. So we offered biobase. If it wasn't stored, what happened?
▶ 0:51:33Did it get It was discarded. It was discarded. Correct. You're sure? We are sure. Okay. Was it possible to run multiple tests on one sample? It was possible to run multiple tests on one Okay. The last question. Under your leadership, did 23ME scientists ever run multiple tests on a single sample? And if so, were customers notified about the additional test?
▶ 0:51:58We ran additional tests potentially for the FDA submissions that we did. So in order to do validation studies, we would find customers with potentially very rare variants and we had to do an additional type of test sometimes called Sanger sequencing to prove to the FDA that the results we were generating were indeed accurate. Good. So we also, so let me also be clear, we also sometimes did additional research studies.
▶ 0:52:26So we would occasionally look and say let's do whole genome analysis for additional research studies. Thank you. Chair recognizes Thank you Mr. Chairman. Uh Miss Wajiski is Wajiski, right? It's Wajiski, correct? Yeah. We have my neighborhood. We have a Polish triangle where all the Polish families lives. Look familiar. Okay.
▶ 0:52:46Uh first of all, I appreciate you sharing your your personal history here and uh you know, I I I fully appreciate the value of early detection uh through 23 and me and and and other technologies as well in terms of the value that that provides for early treatment protocols for breast cancer. That's really really really important.
▶ 0:53:13And I hope that's something that that uh people get from from this hearing today. Uh but also your experience and and and uh your situation actually amplifies the need for greater privacy protections. Right. Uh on this committee back in 2015, I was I was a member then. Uh we had a a huge hack of the OPM uh servers, the Office of Personnel Management.
▶ 0:53:40So, uh, the massive data breach back then compromised the personal information of about 22 million people. But most importantly, uh, that included federal employees and anyone in the federal government that was applying for a national sec uh, uh, national security clearance. So, think about that. Who would who would need in our government who would need uh, national security clearance, right? Those people are doing uh, very sensitive work.
▶ 0:54:08So all that information went over to the Chinese. It was a Chinese threat actor. Uh at that time the oversight Republicans really I have to give them great credit. Jason Cha Chafitz was the the chair of the committee at that point. I was just a subcommittee uh chair at the point at that uh ranking member at that point.
▶ 0:54:26But we conducted an investigation and uh they came up with 13 recommendations that that the OPM system and as chief information officer uh should be empowered, accountable, competent and should quote improve federal recruitment, training and retention of federal cyber security specialists.
▶ 0:54:48What what the Trump administration has done though is just done a blanket firing uh of uh some of our most talented cyber security experts. Uh they've disregarded the cyber security and data privacy laws. Uh DOE is reportedly creating a master database of sensitive information across federal agencies by carrying around unsecured backpacks full of laptops, paving the way for unparalleled surveillance capabilities.
▶ 0:55:17So this this is a this is an extreme danger to the very systems that we want to we want to protect. So uh professor who how does does does firing all these uh IT and uh cyber security experts does that make Americans data safer? Thank you for that question. And I think that this raises deep concerns as far as how best do we safeguard very sensitive governmental data.
▶ 0:55:44And as you mentioned, the leadership of this committee after the OPM hack, I think was very important um not only in recommending best practices for cyber security moving forward for the federal government, but also uncovering the ways in which the laws of this body, Congress, were not followed and that some of those threats that created the um the types of um uh issues that we saw after the OPM hack could have been
▶ 0:56:14um avoided. And so part of what we've seen over the last 10 years is that the federal government has undertaken very serious protocols and training programs and the hiring of some of the most qualified cyber security officials in these agencies.
▶ 0:56:31And now the concern is once those are dismantled, the expertise and also the failure to follow the protocols that followed um after the OPM hack that that leaves um our nation's most sensitive databases and data on our citizens um up to potential abuse and national security risks. Let me ask you this. So uh in the past we have look we have several uh government agencies that collect troves of information.
▶ 0:56:59You think about uh social security u lot of information about you know people getting benefits their banking information things like that the census uh you know that's a a repeat every 10 year process we actually send people to folks doors to get personal information uh the IRS when you take a look at your tax return and you figure out all the information that you're giving uh the federal government uh we've kept those silos separate until now.
▶ 0:57:28Now Elon Musk is joining those. So all that information will be in one central database. We got that from a whistleblower. What kind of what kind of damage did that do to our our national security and and privacy? Well, I I as was pointed out in the oversight committee hearing u recently, especially by uh the testimony that we saw by Bneer that the firewalls that are created by keeping those data central decentralization creates additional security safeguards.
▶ 0:57:57And so allowing for um the integration and consolidation of that data increases vulnerabilities in cyber security. It's much easier to create the types of risks of exposure that now are the heart of the topic of the discussion today. Thank you Mr. Chairman. I thank you for your courtesy and I yield back. Gentleman yields back. Chair now recognizes Dr. Gosar for five minutes. Thank you Mr. Chairman. As a former dentist, I know how important HIPPA compliance is for the doctor patient trust.
▶ 0:58:28When customers sign up for testing like 23 and me, they paid for the service, not the storage and continued research of their DNA. But at the minimum, America data shouldn't leave America hands. China has already said it wants to create a database of genetic data to build boweapons. If we're questioning whether our adversaries are going to use this genetic data to create a boweapon against Americans, then quite frankly, this data collected from Americans should be destroyed, not stored. Mr.
▶ 0:58:58Savalage, how does 23 andme store customers data? Is it physical or digital or both? Congressman, it's both. I mean 23me stores the digital data and we t as I me as majiski mentioned and I did in my statement security and data privacy is a top priority for the company.
▶ 0:59:18All of that data is stored in an encrypted format and if co customers do choose to bioank their sample with a consent the physical saliva sample is maintained as well. Okay. Okay. So when a customer requests their data to be erased, what kind of data is re is erased?
▶ 0:59:38All of the data that they have in a digital format with the exception, you know, of their name, email address, and purchase information is erased from the company's data records. In addition, if they had consented to bioank their sample, that physical sample is also destroyed. So now in 2019, the Department of Defense advised our service members not to to avoid these types of DNA kits due to the security concerns.
▶ 1:00:09Can you address that? Why that would be? I am not familiar with the, you know, why they requested that service members not do or the personal GNA DNA test. So let me ask you the next question. Have you ever participated in a 23 andme test? Is your data at risk, too? My data is at risk.
▶ 1:00:30I first joined 23 andme in 2013 and have done subsequent tests with on new health chips with 2013 and have continued to maintain my personal data and have not deleted it. Nor am I and I and I continue to bio bank my sample with 23 and me. Miss Woski, did I say it wrong? No worries. Okay, that's perfect. I tell everybody I speak two languages. One not so good and that one is English.
▶ 1:00:58Um, so, um, as a as a former CEO and board member of 23 and me, do you have access to the customer's I do not. Who who would be accessible to that data? Who could get to that data? That is a great question. And um, as I mentioned before, privacy and data security was always top of mind when I was CEO of 23ME.
▶ 1:01:22So we came up with very strict protocols about how you could ever link up genetic information with the identifiable information. So that was a if you think about how our databases were set up, all of your personal information, meaning your name, your address, your email was in a separate database that was stored separately that could very few people could connect it then with the genetic information.
▶ 1:01:49So from a database design, it was separated out. So a few people within the company had the ability to put that key together. So for example, imagine if you were a customer and you didn't get the right results or you have a question about something or you're you're wondering something does not make sense to you. You would have to be able to call the customer care team and they would have to be able to analyze your results.
▶ 1:02:15So only in very specific situations would we ever be able to reconnect that. And so I should also be clear when we did research identifiable information like your name, your address, your email was never part of that and none of the partners that we ever had had any identifiable information. So when I see a a a data like this hackers got nearly seven million people's data from 23 and me firm blamed users in a very dumb move.
▶ 1:02:44I wanted to put this to the record. Could you address this? Yes. So, the the situation that happened there and and we have said before to our to our our customers and everything that happened that there was a a deep apology for everything that has happened here. It was a credential stuffing. So, it was not actually a breach of our systems. It was credential stuffing.
▶ 1:03:07And what that actually means is that the thread actor found old addresses, email addresses and passwords on the dark web and they ran them against 23me and they found a number of customers where they actually could enter into their accounts. So it was specific, it was a credential stuffing incident and through that they were able to actually get access to their account. Since then we've made pretty substantial changes.
▶ 1:03:34So in response we um immediately want wanted to learn from this. So we forced all of our customers to reset their password. So every single customer had to go and reset their password. And then secondly we had do uh double factor authentication which was mandated and we had actually had two-factor authentication for a while but it was not mandated because it was not industry Thank you Mr. Chairman. I yield back.
▶ 1:04:05charact Norton from Washington DC. Thank you, Mr. Chairman. Uh when Elon Musk joined the uh Trump administration, he reportedly described him himself as quote tech support for the federal government.
▶ 1:04:25clad in a absurd quote tech support uh close quote Elon Musk assured President Trump's cabinet uh that slashing the federal workforce was necessary to save the federal government uh money and make it more efficient. We all saw what happened next.
▶ 1:04:51The so-called Department of Government Efficiency threw the government into chaos by recklessly firing federal employees regardless of their role, experience or or their value brought to the agencies. This effort has ultimately cost taxpayers more than uh 35 billion dollars according to Partnership for Public Service.
▶ 1:05:20The Trump administration's purge of the federal workforce is also making it harder for the government to maintain its sensitive databases and records and prevent cyber attacks. The US digital uh was the technology office in the white house that led modernization of federal technology and software systems. That is until the Trump administration.
▶ 1:05:50Then Elon Musk took over and fired dozens of its employees. Another uh 21 IT workers resigned from the office rather than carry out the destruction Musk demanded of them.
▶ 1:06:07The mass resignation letter signed by these skilled engineers, data scientists, and IT professionals, including a included a stark indictment of the Trump explaining that they had been asked to take actions inconsistent with their oath to serve the American people and uphold the Constitution.
▶ 1:06:32I ask unanimous consent uh to enter in uh this letter in into the record. Mr. Chairman, without objection, it's ordered. The US Digital Service is not only the only agency that has been gulled uh that has been gutted. IT personnel have been laid off across the federal government uh leaving many agencies further exposed to threats.
▶ 1:07:01For example, the department of government efficiency demanded a 50% cut in techn in the technology division of the social security administration. Uh, this division maintains the Social Security Administration's website, uh, benefits, portals, and IT systems.
▶ 1:07:20The Trump administration also reportedly planned to fire an additional 25% of the employees who manage the data systems at the Social Security Administration. how has the Trump administration administration's purge of IT and cyber professionals left the federal government more vulnerable uh to data Thank you for that question,
▶ 1:07:50Congresswoman. I think that what we're witnessing, especially in news reports with Doge now entering into 17 agencies and the dozens of lawsuits that have followed um since the start of Doge, is a deep concern about whether or not um this falls outside the scope of what is constitutional or legal, particularly given this body.
▶ 1:08:12the digital services office that you refer to was something that received funding and was specifically included legislatively is my understanding whereas DOE is not and that is part of the current legisl uh the current litigation whether or not um this type of um body uh is is legal is constitutional and whether or not these types of actions that you describe are also outside the scope of the law both with FSMA for example and the Administrative
▶ 1:08:42Procedure Act. So, we just saw within the last couple of days um you know in the district court a concern about the OPM databases and uh whether or not an injunction is necessary in order to stop continued access. The Trump administration's um proposed 2026 IRS budget would cut a staggering $8 billion and nearly 20% of positions from fiscal 20 uh 25
▶ 1:09:13levels including 60% of the IT SA staff. Professor, what are the risks of making a massive cut to the IT workforce at the IRS, which holds the most sensitive financial information of every American? Thank you for that question.
▶ 1:09:35the attempt to consolidate the information that is so sensitive, our financial information, our tax information, our information about our health in order to try to um create that type of consolidation increases the national security risk tremendously as we saw from the OPM hack for example um that you had millions of Americans um data exposed but not only their uh biographic information but their biometric information.
▶ 1:10:03So as a result of the 2015 hack, it was reported that 5.6 million fingerprints were also then released. So these are very serious issues particularly with national security implications. Thank you. Thank you. Gentle lady's times expired. Chair recognizes Dr. Fox from North Carolina. Thank you, Mr. Chairman, and thank you to our witnesses for being here. Mr. cell savage.
▶ 1:10:26We all know the Chinese Communist Party CCP has a track record of misusing genetic data and even the New York Times acknowledge that quote China uses genetic tests to track members of the Ugers end quote who are politically disfavored minority group. This abuse can surely be per u perpetrated against any disfavored group whose genetic data is available.
▶ 1:10:52How does 23 and me prevent the genetic data mainly from Americans controlled by the company from being used by the CCP or some other malign actor to track or harm Americans? Congresswoman, you know, 23 and me puts data security and privacy at the top of a forefront of our company. You know, all of our data is secured with top security encryption.
▶ 1:11:18you know we have you know security professionals you know in place at 23 and me implementing the latest technologies in security and we've received you know three ISO certifications in for the company in terms of security cyber security and privacy to make sure that the data of our customers is secure in addition you know as you after the cyber security incident we made sure that you know basically we we've implemented two-factor authentication we've ensured that
▶ 1:11:48customers have reset their passwords and we make sure that those passwords are not have not been you know basically in compromised databases anywhere to make sure that our customer data is safe. Uh Mr. cells Savage.
▶ 1:12:01Besides the 15 million individuals who have their genetic data stored with the company, family members by virtue of having a similar genetic makeup to those who took the test are also potentially at risk if 23 andMe's genetic data is exposed or used for nefarious purposes. Is that correct?
▶ 1:12:21you know, if a customer at 23 andme chooses to allow their data to be shared as through as such as a DNA relatives feature at 23 andme um you know people can access can relatives could actually and family members can see that additional data. Yes, Miss Weski.
▶ 1:12:39Precisely because of concerns about the genetic information controlled by 23 andMe falling into the wrong hands, the Pentagon warned its personnel in 2019 not to use consumer DNA kits. How did 23 andme respond to the Pentagon's warning at that time? Thank you for that question. Um, I have to say in all honesty, we were surprised. Um, we had not been contacted. We were surprised.
▶ 1:13:07So we were we're happy to engage around that discussion as to what are the potential concerns but it was a surprise to us and we did not get forewarning and we did not no one engaged afterwards. So after the warning did you did the company change the way it handled or protected consumers genetic data? Uh thank you for that.
▶ 1:13:29I I there were not substantial changes because as I mentioned privacy and data security had really been top priority since then. So um since the inception of the company. So I would say after that notice and reading about that um it definitely became top of mind and I think the number one takeaway we had was really there should be an engagement around the understanding of our of of how we actually are uh making sure that we're securing data and how we're making sure that
▶ 1:13:59customers we're always honoring the customer's privacy. So it was a great opportunity for us to consider engaging um we always are reviewing our systems. We're always looking at sort of the update of what else should we be doing with our security protocols. Um, and so that was the primary takeaway from that. Do you believe there's anything could have been done to prevent the 2023 That is a uh I appreciate that question.
▶ 1:14:28Um, I'm pretty limited with what I can say specifically around that because of the the potential litigation or the the ongoing litigation around there. Um the thing that we always said is that you have to be vigilant on a daily basis. You have to always live in a world of paranoia because you see how many threat actors there are out there, the number of security incidents that are there. So the primary takeaway we always thought is like what's also the product by design?
▶ 1:14:55How are we making sure we're designing the product so if and when something happens that we're doing everything we can to protect the privacy of our customers. The database security design has always been really important for us about making sure that if there ever was a threat actor, how are we actually making sure that we're doing everything we can to prevent that? So, it was always top of mind for us to think about what those potential risks Thank you, Mr. Chairman. I yield back. Gentle lady yields back. Chair recognizes Miss Brown from Ohio.
▶ 1:15:26Thank you, Mr. Chairman. Today's hearing gives us an opportunity to explore bipartisan solutions to protect Americans personal identifiable information. When services like 23 andMe first launched, they were seen as groundbreaking, giving people unprecedented access to information about their ancestry, health, and genetics. For the first time, you could uncover longlost family connections or gain insights into potential health risks, all from the comfort of your home.
▶ 1:15:54But what many of 23ME's nearly 25 million customers didn't realize was that unless they actively opted out, they were also consenting to share their personal DNA data with third parties. Unlike a password, you can't change your DNA and it can't truly be anonymized. What's more, one person's genetic data can reveal information about their entire family. Now with that company's future uncertain, the safety and security of that data cha hangs in the balance.
▶ 1:16:24Americans deserve real oversight and tough privacy protections to keep their most sensitive data safe. Mr. Selvich, you ca you come before you be when you became the CEO just as 23 and me experienced a massive breach that exposed the sensitive genetic data of 7 million users. What concrete steps have you taken since to prevent this from happening again?
▶ 1:16:49And what can you tell your customers today, right now, that you couldn't say a year ago, to reassure them their most personal data is safe? Congresswoman, you know, I will just want to reiterate that 23 and me always has put our consumers security and data security and privacy at the forefront of the company. You know, since the data incident, we have implemented additional security measures.
▶ 1:17:17We, you know, forced every customer to actually reset their password to make sure that their accounts are safer. Um, we implemented two-factor authentication whereby a customer has to either gets an SMS or an email certifi code to actually enter in addition to their password to make sure their data is secure.
▶ 1:17:37And then we also ensure that any sensitive data like the personal genomic data that the customer has if they requested that data that there was additional verification of the customer requesting it such as their date of birth um and other credentials and then also put a time limit so that they couldn't access that data immediately but rather put a time delay of 48 hours on that data.
▶ 1:18:03In addition, you know, we've hired a new chief information security officer at the company um and put in additional security controls. Um through the bankruptcy process, we're making sure that you know essentially through the process that the our customers data is safe because we're requiring any bidder for the company to continue with the privacy policies and consents that are in place here at 23 and me. Thank you.
▶ 1:18:27We are having this conversation at a time when foreign adversaries like China and Russia are working overtime to exploit Americans personal data. We know that China has targeted Americans genetic data to train their AI technologies to develop advanced medicine and even for military research and we are facing this threat with fewer resources. The Trump administration has made massive cuts to funding and staffing at our nation's top cyber security agencies.
▶ 1:18:53We need both strong cyber security protections and federal privacy laws to protect Americans data. So, Miss Who, as you know, there is no federal framework for how private companies handle consumer biological data. What steps should Congress take to ensure that private industries isn't putting Americans private health and genetic data at risk, especially in the hands of our foreign adversaries? Thank you so much, Congresswoman, for that question.
▶ 1:19:18I do believe that we need an overlapping regime that takes into account both strong federal data privacy protections that now need to update laws such as HIPPA that do not cover these types of new biotech um services and wearables and other types of apps, new health data is being generated that is not covered under our existing health data protection laws.
▶ 1:19:42And we are increasingly faced with cyber security laws and data privacy laws at the state level that are now stepping in to fill the gap that is being left by Congress, but especially with AI warfare on the horizon. It's absolutely critical and I agree with you. This is a bipartisan issue. Thank you so much. I'll close with this. Americans deserve to know their sensitive private data is safe and secure. I look forward to working with my colleagues on both sides of the aisle as we continue these important conversations. And with that, Mr. Chairman, I yield back.
▶ 1:20:13Thank you very much. Chair recognizes Mr. Palmer from Thank you, Mr. Chairman. Um, M was withi um you initially shared data with Glacos Smith Klein in regard to research on Parkinson's and then in 2023 u it looks like you shared the entire database with them. Is that correct? Thanks for being here. So in 2018, I appreciate that question.
▶ 1:20:43In 2018, I need a yes or no. Did you share the entire the entire database? No. What we did is we shared specifically the partnership was around using genetic insights for drug discovery. But so we specifically used not the entire data set, but what we did is we analyze it. We are looking at all the genetic information. We have phenotypes like Parkinson's and saying what is it? What is that genetic association? You received an additional $20 million.
▶ 1:21:13And I think at that point you're realizing that the company was in financial trouble. And it looks to me like um you made a decision to to provide more than what you had provided earlier. But you also said that people had the opportunity to opt out of that. How aggressive were you in notifying your customers that they had the opportunity to opt out to of that data being shared with uh Glacos Smith Klein? Yep. I appreciate the question. Were you aggressive? Not that aggressive.
▶ 1:21:43Was it an email notification? How how aggressive were you? Did you try to make sure that they understood they could opt out? We actually sent an email notification to all of our customers at the time of the signing of the GSK collaboration. Did you receive a link follow up from people who later found out the data had been shared that they wanted to opt out but they didn't do so before you shared the data? Customers always have the opportunity at any time to opt out.
▶ 1:22:11So some number of customers did respond to that email and opted out. Does does that include removing the data from Glaco Smith Klein? It removed the data from all future analyses. But I'm asking now if you weren't very aggressive in notifying people before you shared it with the pharmaceutical company and people found out later that it had been shared and they wanted to opt out. Uh was their data removed from Glacos Smith Klein?
▶ 1:22:38Their data would have been removed from any future Glacos Smith Klein. Yeah, you're saying any future but any past sharing of their data that it it's it you're saying that it's pretty much gone. It was it was never individuals data. It was the aggregate. So essentially it's the summary. It's the analysis. So saying this specific gene is associated with Parkinson this when 23 and me publicly announced it was filing for bankruptcy.
▶ 1:23:04Roughly how many users reached out to 23 and me to delete their account and their data altogether? I was not part of the company at that time so I would not be able Savage. Can you answer that? Yes I can. From the time we actually announced bankruptcy until today, approximately 1.9 million customers have requested that. What percentage of your Well, that's what roughly 15%. 15%.
▶ 1:23:30Uh, if a user wanted to delete completely their entire account with 23 and me and delete all of their identifying data, does 23 and me allow that? And if so, what does the process look like? I really don't want to know what the process looks like. I just want to know if they have the ability to do that. The customer has the ability to do that. And for any customer, it's a very easy process. They can just log into their account, go to their settings, and request their account and data be deleted.
▶ 1:23:5823 and me uh became popular because uh you advertised it as as as uh identifying familial connections uh that go back centuries in some cases. How accurate um would you say that that data is?
▶ 1:24:19You know, for our DNA relatives feature, you know, we believe that those features are highly accurate, you know, um and you know, essentially we actually take When you say highly accurate, could you put a percentage on that? Is it 100% accurate? 90, 80? Um you know, it is in the high 90s% of accurate. High 90s.
▶ 1:24:38Uh the thing that that concerns me here is is how you advertised u your product and I'm not sure that u people understood that that you were planning to share that data with with other companies because once you they shared their DNA sample with you that's a one-time sale there's no repeat business from that you have to generate income from other means and apparently you you did that through sharing that in that data with um pharmaceutical companies Let me ask you this.
▶ 1:25:09Do you support the motion filed by 27 state attorneys generals to request the bankruptcy court appoint a consumer privacy ombbudzman and a security examiner? Do you support that congressman? Yes, respectfully. We were the first group company was first to actually very quickly I got we support that. Yes. has has uh a 23 million uh employee ever had access to the data other other than those who are uh cleared to to have it.
▶ 1:25:39Has anybody else ever had access to that data? To the best of my knowledge, only people with need the need to access that genetic data at 20. To the best of your knowledge, but you you cannot assert that no one else has had access, Congressman. That is to the best of my knowledge as indicated I have only been interim CEO since March of 2025 but to the best of my knowledge no other individual other than the employees who have a need to access to data have had access to Mr.
▶ 1:26:08Chairman I think we need to make sure that we need a more certain answer on this about who's had access to this data. I see Mr. Lynch not agreement. So, uh, could you do a deep dive investigation to make that determination, notify the committee through Mr. Chairman, the ranking member? Congressman, I'll take that back to our team and we'll and look into that for you. That's not a look into. That's a a requested required reply. That's understood. We'll take that back. Yes, sir. I yield back.
▶ 1:26:37Thank you, chair. Miss Stainsbury from New Mexico. Thank you, Mr. Chairman, and thank you to our witnesses for being here today. Um, this topic is of particular interest, I think, not only to myself, but millions of Americans.
▶ 1:26:53Not just because the company in question here actually owns the genetic data of millions and millions of Americans, but because of what's happening right now with Doge, with the Trump administration, with private contractors getting multi-million dollar contracts to integrate Americans personal data, with the court cases that are in front of the Supreme Court and the district courts.
▶ 1:27:19Um, and this proposal that came through this house just two weeks ago in the dead of night that basically would preempt state and local laws from our private data through AI systems. And so, I mean, I it's hard to not sit here and listen to this conversation and not feel like we're living through a sci-fi movie, right?
▶ 1:27:44Like we've all we've all seen this scary sci-fi me movie before that our private biological data. Not me personally. I I'm too much of a privacy freak to do these genetic tests myself. that a private company has our data. They experience bankruptcy and now we have no federal regulatory system to protect that data.
▶ 1:28:10and we're concerned that foreign adversaries might purchase the company and thus the data. I mean, this is insane. Like, this is crazy. And meanwhile, I completely agree this is bipartisan in this hearing, but our colleagues across the aisle are trying to pass legislation that would deregulate and preempt data privacy and AI laws across the United States in every single state and locality for the next 10 years. That's bonkers.
▶ 1:28:38Like you can't you can't have it both ways. You can't haul a private company in before Congress to talk about their bankruptcy and the fact that they have 15 million Americans private biological data and you want to protect it and then you're trying to use Congress to preempt state and local law so that we can't protect private data. Like that is completely intellectually inongruent and dangerous for Americans.
▶ 1:29:03um, professor who I I was really interested in your background because you've worked both on the DOJ side as well as on the academic side and you know you've outlined some of this in your testimony but I'm particularly interested in your background in national security and prosecuting national security cases and if you could talk a bit more about this like political intersection we're seeing right now in this moment and what threats
▶ 1:29:33that poses for not just national security with foreign adversaries, but the potential that Americans data could be misused by private companies here in the United States. Thank you so much, Congresswoman. I think because of the bipartisan nature of this topic, it is so critical to come together and try to advocate for the types of legal uh framework that we need in order to address these national security threats appropriately.
▶ 1:29:58And I do believe that part of the issue right now is because in an absence of congressional legislation, we are asking these corporations to come in and fill that gap. And so we're asking of companies like 23 and me, you need to have the best data privacy, the best cyber security possible. But what about federal law that then mandates that instead of looking to industry standards?
▶ 1:30:24And I am very concerned about the moratorum and the idea that in the absence of federal law that regulates comprehensively AI systems that we would ban and bar states and localities from going forward with their attempts to try to offer some type of meaningful safeguard on these types of technologies. And so thank you very much. I do think that this is so critical for there to be true bipartisanship for this national security issue. Thank you.
▶ 1:30:50And you know, one of the things I really want to emphasize if for folks who are out there watching this and concerned about data privacy, which I believe is everybody, you know, I I watch my share of both liberal and conservative news. And I mean, everybody from Theo Vaughn to our colleague Marjorie Taylor Green to myself to this side of the aisle are raising the alarm on this provision because of the significance that it has for the safety of Americans.
▶ 1:31:19And so, um, I think it's really, really important that we elevate this conversation right now and understand what they're proposing in this bill because when you read that bill, it literally not only says we would preempt state and local laws, it basically says any company even that wants to use an AI system in a locality could not be barred from accessing your data.
▶ 1:31:42which means that presumably a private company that does not have privacy um and secured uh data systems could then be compelled under this preeemption law to give away your data. I mean that's dangerous. That is dangerous. So I really appreciate you all being here today and we're going to continue to work on this issue. Thank you Mr. Chairman. Thank you chair. Now recognize Mr. Groman from Wisconsin. Yeah, Miss Who.
▶ 1:32:10Uh, first of all, just kind of a first of all, kind of a big picture thing here. If if these guys have my genetic data, why should I care? genetic data is and bi biometric data is now increasingly anchoring modern warfare because of the attempts in AIdriven targeting to try to aggregate biographic and biometric data.
▶ 1:32:41And so part of what I think is misunderstood is that this is not really a consumer data privacy issue alone that this really does map into very significantly the way in which we conduct national security strategies. Okay. So so I should be afraid that if we go to war I I hope we never go to war. If we go to war and they know my genome that they will find some way to target me. Well it's it's not just um an active kinetic type of warfare situation.
▶ 1:33:09The new battlefield of AI warfare is really engaged in cognitive security issues and also the way in which we look at manipulation social engineering as a cyber security risk. Okay, give me example. So the way in which for example if we go back to the OPM hack of 2015 occurred, many experts say that it was through social engineering that the way in which the Chinese hackers got access into the OPM systems was through social engineering, some type of manipulation.
▶ 1:33:36And so at first that they were able to manipulate somebody within OPM to give up their passwords and then from there able to install this type of how would they manipulate them? Um well one of the examples given by some cyber security companies were the ways in which Chinese would pose for example as uh trying to present some type of alumni event from your university and to get you to click on that and then to install the malware from there because they have my genome.
▶ 1:34:02Well, the fact that the Department of Defense raised the alarm about the potential risks of it, I think are really important for us to examine. Why why is the Department of Defense saying that this should not be something that um the military should access? And I think that's I I can think of reasons that's of concern, but not exactly your reasons. Um I I'll take it though for granted that we don't want to have my genome out there on the internet floating around. Uh Mr.
▶ 1:34:30cell savage where is if if I had used this company's services in the past where is my data kept right now the actual data in basically this um data is stored on Amazon web services um and secure encrypted database files and can we assume that my data will be there after I die it will right now under the current law be there forever
▶ 1:35:00Um, your data is there, but you always have the right to delete your data at any time. And your beneficiaries and executives of your will or trust will also have the right to delete that data in the future. Does anybody call right now to have their data deleted? Yes. Um, since, you know, we announced bankruptcy, you know, we've had 1.9 million customers called and requested that we delete their data. And we have done so within a reasonable time frame.
▶ 1:35:30How many customers called to delete their data? 1.9 called or emailed or requested their data be deleted. There was 1.9 million customers. That's kind of amazing. I think I mean I think it's probably a smart thing to do, but it wouldn't occur to me. Um okay. Uh next question.
▶ 1:35:52Um, does Regeneron intend to update their policy, their their privacy Regeneron and TTAM Research Institute, both of the biders under the current um bankruptcy rules um for the bidding process for the company have both agreed to maintain the privacy policies and consents of the company of 23 andB in the future. So, by that you mean they're not going to change anything? They're saying they're not going to change.
▶ 1:36:21They're not going to They said not only did they say they're not going to change anything, they also agreed to that in their contract which is an asset purchase agreement in writing that they would continue to maintain the policies. Mr. Biki, are you aware that in 2015 23 and me received 111 $115 million in funding from a variety of investors including Wuji Healthcare? I am aware. Okay.
▶ 1:36:47Um and you know they had ties with I have been made aware of that. Yes. Okay. Did you consider this a risk at all or do you think for you or in the future anybody should care that the Chinese um take over one of these A as I said in my statement, I am concerned about China and how China is leading in biotechnology and I am concerned that China has been super clear that they would like to have
▶ 1:37:17the most genetic information they would like to lead. So yes, I am always concerned about what China's Do you think a company trying to to take over this company should be a company the Chinese have access to or should they be out of the picture when it comes from a to a potential buyer? I do not believe that we should that 23me in this bankruptcy process should go to anyone with a Chinese tie. Thank you. Thank you chair guys.
▶ 1:37:42Miss Randall from Washington Thank you um Mr. Chair and thank you to our witnesses for being here today. You know in this modern world our sensitive data is stored in an increasing number of places. We've got smartwatches that track our vitals and sleep quality and apps that track menstrual cycles and ovulation and our phone track our steps and analyze our activity.
▶ 1:38:09And companies like 23 and me convinced so many to trade access to their DNA to unlock personal history and detailed genealogy reports. Miss who? What kinds of entities are left out of our existing federal framework for protecting health data and how could we strengthen federal privacy laws so that it's not left to the states um to do uh that privacy protection work that you mentioned
▶ 1:38:39earlier? Thank you so much, Congresswoman. And I I think that this is um another chance to revisit uh the prior congressman's question about why it matters. I think that, you know, these types of very sensitive data can be open to um exploitation both in national security but on also consumer um you know exploitation purposes as well.
▶ 1:39:00Um and in the absence of these comprehensive federal laws, we do see um the need to have um the states try to enact these laws that are operating um to fill the gap that's left by HIPPA.
▶ 1:39:16So I think in the future we do need to look to Congress to try to create comprehensive laws that protect against um the type of um data sharing thirdparty use misuses and abuses in our wearables in our health apps in the way in which health data is captured through teleaalth systems that might not come um under the protection of federal law and I hope that we're able to move forward with that. Thank you.
▶ 1:39:43And you know, we just level setting for folks tuning in. Um, in 2022, the Biden administration issued important guidance to ensure that private health information that would be covered by HIPPA and other circumstances could not be disclosed to entities seeking to investigate someone for accessing reproductive health care, for example.
▶ 1:40:06But um that guidance has been withdrawn under the Trump administration in an effort to push forward an anti-productive health agenda putting both doctors and patients at risk and discouraging folks from seeking care. I think we have to remember that you know this these um issues are intertwined.
▶ 1:40:28you know what companies who's able to access the p private health data that um companies now have access to under our increasingly online and um I don't know digitized lifestyle you know miss who should Americans be concerned what's the implication of uh individuals having their healthcare
▶ 1:40:58data being accessed, should they be concerned that they might be investigated or potentially prosecuted in this political environment? Yes, thank you so much for that question. I think that part of the concern is the way in which law enforcement or others can access this for investigatory purposes. Basically doing a workaround around around the fourth amendment protections. if it can be purchased, if it can be repackaged, sold, borrowed.
▶ 1:41:22You know, I think that this is the kind of data that can then end up in a way that is used against an individual um without the types of constitutional protections and criminal procedure rights that they have become accustomed to. Thank you.
▶ 1:41:37you know that we've made some progress on this in Washington state when I was there in the legislature and I know that many other states are trying to enact these sort of shield laws to better protect the individual data of um consumers particularly their individual health and genetic data. Um, are there specific steps that you would recommend Congress taking to ensure that our health information including medical records remain secure?
▶ 1:42:07Yeah, I think that this is where we need to look at this comprehensively, not just in a silent way, not just health data, for example, or education data or financial data and not just a federal or a state level issue. I think that this truly needs to be um across the board. So you'd mentioned um state of Washington having biometric protections for example as well.
▶ 1:42:27Not all states have that type of biometric data um protections or genetic data protections and right now in federal law we only have it under for example GINA um for in the employment context but it really does need uh to have that very full comprehensive approach. Thank you so much. I yield back Mr. Lady yields back chairizers. Mr. Perry from Pennsylvania. Thank you Mr.
▶ 1:42:54when when a customer comes to 23 and me are there I assume there's I don't know so I'm asking there's disclaimers there's information where they you let them know that their data is going to be obviously used to provide the information that they're looking for their ancestry maybe their health information whatever you provide right um is there information also letting them know that it might be used anonymous anonymously or otherwise for other purposes
▶ 1:43:25when they access your Uh great question. I appreciate that. Um the goal of the company has always been about transparency and choice for our customers and it's an area I feel incredibly passionate about that too often in healthcare customers are not actually given transparency and choice with their information. So when you sign up for 23 andme it is not a simple process.
▶ 1:43:54There's a number of very easy to understand explicit consents and there's never a default. So for example if you go through 23me we don't default you into research. You have to actively click yes. So during that process it is it is you know easily a 10-minute.
▶ 1:44:14So customers are choosing to allow, and I'm just paraphrasing it the way I would say it, choosing to allow you to use their data as as you kind of see fit with who you see fit, whether it's a with a pharmaceutical country company or maybe in this case, I'm not saying you do, but another country. Is that is that generally correct? I mean, they're choosing what they allow, right? Correct.
▶ 1:44:39So we have a an I it's a consent form that has gone through an an ethics review. It's under an institutional review board. So it specifically allows us to do research and only with qualified research. So when you say um and this is moving into a little bit of a different direction. I'll probably get back to that. But when the data you said it was discarded, you said you use the term discarded. Does that mean destroyed or just discarded? Destroyed. Destroyed. How how is it destroyed?
▶ 1:45:07I'm not aware of the specifics around how it's destroyed. So, it could be just thrown away. Look, you I'm just asking that question because you can learn a lot by going through somebody's trash, right? And I'm not saying somebody did. But, so in this context, as I read about you, bankruptcy doesn't necessarily mean the end of 23 and me. As a matter of fact, it seems like it means like it's going to continue under some other structure. Is that about right? It's not going away.
▶ 1:45:31It's just going to continue under some other whether you buy it or whether regeneron it 23 and me is not going and the date is going to be around it sounds like. Am I am I correct about that or is that the correct hopeful outcome? Yes. So um is is 23 and me precluded by law from selling all or some of the data or partnering with somebody that could do are they procluded by law? And I'm asking the question because I don't know. Are are they procluded?
▶ 1:45:58Are you is your company or the one that you started and want to have again, is it procluded by any law from using that data or or partnering with somebody that could use the data any way they want or is there any law that stops you from doing that? Uh, I think that's a great question. I'm not an expert in all the different laws. I do would like to highlight there was another genetics company that just went through chapter 11 that was successfully just sold. But but you don't know. Okay.
▶ 1:46:25Maybe the you don't know of a law that precludes should there be like should there be and look I'm I'm not for consumers and American citizens or whatever have the freedom to make choices and if you make bad choices like I'm not using your service ma'am I don't I don't want you to know like I I marvel at the amount of people that are concerned about the federal government's intrusion into their personal lives but are happy to give private companies all that data but that's their choice and I wonder if it should be well I think it Um,
▶ 1:46:55but what obligations do you have? So maybe the question should be, what moral or ethical obligation does a company like yours or yours in particular or 23 and me maybe the better way to put it, what obligation do you have to safeguard that information from either being purchased or through partnering with somebody like the Communist Party of China or somebody affiliate affiliated with them or the People's Liberation Army? What moral and ethical uh obligations do you have?
▶ 1:47:26I think the most important thing that 23 andme can do is make sure that we're always giving people choice. And I think that the most important thing in this process is to make sure long-term that customers always have that opportunity. I understand that, but you're not answering my question.
▶ 1:47:41What obligation does your company or companies like yours have knowing that this is personal information that it might be uh that that it could lead to national security implications and certainly personal implications that are delletterious to those who subscribe? What obligations do you have or should you have or a company like yours have? What obligations moral or ethical?
▶ 1:48:06So, I think there should be I think that's why we're in a bankruptcy hearing where there is oversight on it and very concerned about where it is going and that is specifically why I have put in a bid as a nonprofit entity to acquire it. I I yield yields back. Uh chair recognizes Mr. Superman from Virginia. Uh thank you, Mr. Chair.
▶ 1:48:29I um as mentioned before, I think it was 15 million people have now signed up and and used the service over the years. It's a large number and uh I was one of them. I actually got it for free. I was lucky enough to get a free um kit and uh at the time I said, you know, what's what's there to lose? But um I guess now as my dad says, everything has a price, right? Nothing's free in life.
▶ 1:48:56And so I think a lot of people are concerned about the fact that they did this many years ago and they're worried about what's going on with their data and they feel like they don't have a sense of control anymore. And um you know what I'm hearing is that they do have control though, right? In the sense that they can go online and delete their data. But when I go to the website on 23 it's not readily apparent that 23 andme is going through a bankruptcy right now. In fact, it's not anywhere on the front page of the website.
▶ 1:49:27Uh you really have to dig into the website to look into. I have it up right now. And uh the other part is uh there are instructions online on how to delete your data, but even that stuff is kind of buried a little bit. You really have to look for how to delete your data. Um I'm I'm actually going and doing it right now. And one of the things it does is you have to go to the settings page, but you have to scroll through the settings page. you may almost miss it.
▶ 1:49:53And then you click on your 23 andme data and then even that it goes through a whole list of things that are happening. And if they if there simply was a delete my data page or button uh somewhere more prominent then I think it would be easier for a lot of people to feel that control. Um and this process would be a lot easier for people who do truly want to delete their data. But that's not quite what's happening.
▶ 1:50:20The second thing is uh you know if I if I didn't know about this I wasn't reading the news about what's going on I'd also um not know until maybe it's too late what's happened to my data and where it ended up and so I guess my question maybe this was already asked Mr. Selzvich um if you sell the data to a third party in this bankruptcy can they sell the data to other companies after that? Um so first let me address um a couple questions.
▶ 1:50:49Well, can just to answer my question, can they sell the data? Can the company that is receives this data through a sale and bankruptcy then sell the data to another company? the the companies that are two potential companies that are acquiring 23 and me as potential biders are adopting and stepping into the shoes of the company and adopting the privacy policies and consents of but they but they could you could sell it to a company that then sells it to another third party who then sells it to another third party and then you
▶ 1:51:19end up with a situation where the genetic data is out there and multiple companies own my genetic data and the millions of people's genetic data. Is that correct, Congressman? With all due respect, I'm you know, not a legal expert in this, but you know, basically the acquire potential acquirers of 23 andme are adopting the privacy policies and consents of 23 and me where it does allow for the sale of the assets of the company.
▶ 1:51:49So yes, the answer to my question is yes. So then um if you if let's say a health care company bought the data um professor who couldn't the health care company then look at your genetic data and raise your premiums because they see some bad genetics in there for instance can we have a health care system that now has all your genetic information and then we'll adjust premiums based on what they think is risk for them.
▶ 1:52:17Yeah thank you so much Congressman for that question. And I do think that genetic data is particularly sensitive because of those types of risks that the way in which you do have insurance companies and other corporations trying to link up genetic predispositions even for example you know financial literacy and accountability. So not just for insurance um issues perhaps even um other types of issues could be open to abuse.
▶ 1:52:44And then couldn't a foreign actor either hack into the data or even acquire the data as well and then use that and posing a national security threat. Yeah, absolutely. I think that part of what was deeply concerning I understand about the um issue of credential stuffing um as the source of the cyber attack or the the risk this in the prior breach.
▶ 1:53:10But um nonetheless, what we did see was a hacker named Gollum um post the DNA particularly of the um you know Chinese and and um Jewish ancestry um on the dark web. So I I just deleted my data. I hope everyone at home has the opportunity to do so does so. And uh I hope a good actor does buy this data because it could slip into the wrong hands. I yield back. Very good. Uh chair now recognizes Miss Luna from Florida.
▶ 1:53:40Hey everyone, thank you so much for coming in today. Um, specifically, thank you for your work on the human genome. Aside from that, this is pretty quick on questioning. My question for you guys is we talk about for if people want to actually delete their data, just so I'm clear and so people watching this are clear. In the event that they choose to opt out, delete their data, what happens to the data? Is it gone forever? Is there, you know, an area where it can be pulled back up after deleted? What happens?
▶ 1:54:07uh Miss Miss uh W if you will. Uh I appreciate that. Um when you when a customer when I was during my tenure when I was CEO um and I can only speak about that since I've not been there since March. Um if a customer wanted to delete their data, it was irreversible. It was gone. So if you wanted to delete your data, it was gone. Okay. So there's no way that they can bring it back up after the fact.
▶ 1:54:34No, it's actually it's it becomes an issue then if people want to upload it again, you would have to you would have to respit. Okay, perfect. Well, thank you. That's all for my line of questioning. Does anyone else want my time? No, that's it. Thank you guys. Uh chair recognizes Miss Lee. Thank you, Mr. Chair. I um I think what we've seen in in both last week's hearing uh on AI and today's uh is how unprepared this country is to protect people's private information.
▶ 1:55:03This bankruptcy in the cell 23 and me demonstrates just how little control people actually have over their sensitive information. The few like federal privacy laws we do have on the books have just not kept up with the internet age and the technological advancement. As a result, more and more of our data is just accessed by more and more interests and it's just out there.
▶ 1:55:28Companies are handing over private data to the government that would normally be protected by the fourth amendment for instance and you would need a warrant to get that includes genetic data at 23 and me. Some states have of course pushed for stronger uh consumer protections uh around privacy but the data threats are not stopped by state lines. So people need protections that cover the entire country. Um, professor who just briefly, what is your biggest concern about the gaps in privacy law uh that Congress ought to address through legislation?
▶ 1:55:59Um, my deep concern is the way in which AI is ch changing I think the nature of data. I think that um as it's been explained before, data is to AI the way that airspace is to aircraft. And without being able to have a way in which to really protect it um and secure it, I think that we're going to increasingly see abuses, misuses, and discrimination flow from that lack of regulation. Thank you.
▶ 1:56:25Um the patchwork of privacy protections in this country has created an ecosystem where data uh brokers and companies like 23 and me hold massive amounts of sensitive information for millions of Americans and they can just really do what they want with it. Beyond just collection and storage of data, um we should also be worried about how these companies use uh this data, including who has access to it. For one, law enforcement officers. There are few restrictions on law enforcement's access to DNA profiles stored in databases like 23 and me.
▶ 1:56:53Um, the so-called forensic genealogy is often done without a court approved warrant, uh, and can mean that law enforcement has access to the genetic information of millions of Americans with little to no oversight. Even if you yourself did not give your DNA away, if you have a family member who did, you could be affected. What's even worse is that people usually aren't even aware that their profiles are being shared with police.
▶ 1:57:1723ME's current privacy policy states that when faced with law enforcement requests, the company will quote only comply with court order, subpoenas, search warrants, or other requests that we determine are legally are legally valid, unquote. Mr. Cell Savage, that last part is a bit concerning. What exactly do you mean by other requests that are legally valid? And what other request is going to get 23 and me to give over information to police? Um, let me first say that 23me to date has not given any information over to law enforcement.
▶ 1:57:47We have a transparency page on our website which shows the requests that we've received from law enforcement. It's a small number and those that we've complied with and you'll see that it is zero that we've complied with. the only way we will comply with a law enforcement request is with a legally valid process such as a court order or subpoena and to do Yeah, I see that. I just just really specifically just really wondering about the other requests that we determine.
▶ 1:58:15I get that I get the the subpoenas in a search warrant, but there does there is a caveat for others other requests that we determine are legally valid. Can you give an example of what that might be? um that is I cannot give an exact example of that other you know I will can say that you know basically the only way we would comply with a law enforcement request was with what we've determined to be a legally valid thank you I I think that the fact that you can't define what that means is a massive loophole for 23 and me uh to do what it wants with people's datas and that's I think a really
▶ 1:58:45big concern um Mr. Michelle Savage. Also, how does 23ME notify a customer when it has provided their genetic data to law enforcement? I'm sorry if you already answered that. What information do you provide them about requests? Um, as I mentioned, to date, we have not provided any information to law if you did. Do you have an example of if you do you know what the policy would be about how you would notify them? Um, I do not, but I can take that back to our team. Thank you. I appreciate that.
▶ 1:59:12that I think these policies have a lot of room uh for improvement and that your customers deserve better, but it's at least a a baseline hopefully of protection. Can you commit that 23 and me will not get rid of this policy regardless of who ends up owning it once the bankruptcy sale goes through?
▶ 1:59:27Um, I can say that the two biders for the company have both agreed both, you know, verbally and in writing in their contracts to purchase the company that they will step into the shoes of the company and adopt the privacy policies and other consents go on a go forward basis. God willing, I guess it's uh really scary that people have to rely on the whims of private company to protect their private information. The fourth amendment can only protect us so much as these loopholes and workarounds need to be fixed.
▶ 1:59:56Uh, so I thank you all so much for your testimony today and and I yield back. Chair, now recognize Mr. Burchett from Tennessee. Thank you, Mr. Chairman. I believe you're from Kentucky, neighboring state. Um, Miss Waj Siki, did I get that right? Close. Very close. All right. Well, nobody gets Burchett right, so don't feel like the Lone Ranger up here.
▶ 2:00:17Um are you aware that in two 2015 23 and me received funds from a variety of investors including Wooie Healthc Care Ventures? I am aware of that. Okay. And according to 23 and May this partnership has dissolved. Is that correct? That is correct. Do you know how much Wooie Healthcare Ventures invested in your company in 2015?
▶ 2:00:44They invested $10 million out of a $115 million round. Okay. Are you aware that at that time Wooie Healthcare Ventures had direct ties to the CCP and the Chinese People's Liberation Army? We were not aware. Can you explain how the partnership between Wooie Healthcare Ventures and 23 andMe was dissolved? I believe that they sold their shares. It was just an investment.
▶ 2:01:11Well, investors though in a corporation do have votes on things that that occur though. They had no control. They just gave y'all $10 million with no strings attached. There was no control. They just gave y'all $10 million with no strings attached. That's a yes or no. They were just an investor. No strings. Okay. I have a bill HR2286.
▶ 2:01:38It's the American Genetic Privacy Act of and it was actually um put forth last year and you're all lobbyists do an excellent job and this Congress as Congresses in the past have very little guts to do what I feel like is the right thing because it takes a great deal of trust for Americans to share their sensitive genetic information with DNA testing companies and selling this information to companies with direct links to malicious foreign actors I feel like is a huge violation.
▶ 2:02:09of trust. DNA testing companies must keep Americans genetic information private so it isn't used against us by the Chinese Communist Party or any other nefarious characters. The bill that I've put forth would prohibit commercial DNA testing services from disclosing this genetic information of the United States nationals to the CCP or entities entities affiliated with it. If we had passed this and it doesn't come through this committee, it's another committee.
▶ 2:02:36But if we had passed that, we we be probably uh the questions be a little different up here. I I made aware of a situation where supposedly the Chinese could say they they collected this data that was sold to them on the market.
▶ 2:02:53Um, and they could possibly create they would do a genome, which I understand is a study of genetic information, and develop a pattern, and they could possibly develop diseases or something a bug along that line that could say stop women and at childbearing ages from bearing children. And this was discussed up here.
▶ 2:03:19Yet we have not brought forth any legislation to stop that and that was over a year ago under a previous To me that just shows the gutless nature of Congress and of us and our greed and the power of the K Street lobbyist. I would hope that this body and the media would bring attention to this problem.
▶ 2:03:41To me, this is a serious breach of um it's a serious breach of ethics, but our national security and it should go past parties and pointing fingers. We just need to to get some legislation filed and we need to enforce it. It's worthless when we pass these worthless bills, these so-called uh studies and um and then we what happens is we we get a good piece of legislation. You got a committee that goes forth with the legislation.
▶ 2:04:08you have a well-intended uh congressperson, yet a staff member is has uh their ear is is uh the lobbyists have their ear and they stop that legislation for whatever reason. They say, "Oh, we're going to we we want you to do something, but we need to do a study." Well, folks, if you ever seen the movie Raiders of the Lost Ark, where at the end there's a warehouse full of of this stuff of things that we're supposed to be looking at.
▶ 2:04:38That is what I believe these studies go to. Is there some worthless warehouse? And we go home and we tell everybody, "Look what we did." And we don't do a dad gum thing up here. We've got to get past the greed and the gutless nature of this thing. We need to take our dad gum country back. And both parties ought to be ashamed. Mr. Chairman, I yield back the remainder of my time. Gentleman yields back. Chair recognizes Miss Talib from Michigan. Uh thank you, Chairman uh Comr. You know, Americans are rightfully worried.
▶ 2:05:08Uh I know the professor knows and probably hears from a lot of folks uh about corporations um and how our government is allowing them like 23 and me and others to use and sell deeply personal information including medical and genetic data.
▶ 2:05:24Sometimes I I want to tell my colleagues and I'm glad to hear some of them speak up about this because sometimes I feel like our country has gradually turned into a surveillance state where everything about who we are uh what we do is gener is generating private profit and leave us without any privacy surveillance pricing in grocery stores. Come on.
▶ 2:05:45uh the NSA spying on our private communications, insurance companies using discriminatory factors uh based on our private medical and genetic history. I don't know any American Republican, Democrat, Libertarian, independent, whatever the labels that they put on wants to live like that. No one does.
▶ 2:06:06So, professor who you know how can we ensure that genetic data of 15 million users as you mean being put for sale won't be used for private actors and I I just wanted to be clear I know everybody's talking about China but I'm actually really worried about corporate greed here in our country and the corporations here in our country that you know to me corporate greed in our country is a disease it is causing more death I don't care if it's a fossil fuel industry the what my residents call sick care not healthcare in our country whatever it is.
▶ 2:06:36But I'm really worried, Professor W, because Professor who I can see healthc care insurance companies using data saying, "Oh, your genetics shows you might get breast cancer. We're not going to cover you. You're not going to get life insurance. You're not going to be able to get access." Or they're going to again use this to profit, not to help. We don't seem to prevent death and destruction in our in our in our country. Even this this chamber doesn't do that. And so what can we do?
▶ 2:07:05Uh I mean this is genetical medical you know history as you know. Um it's it's incredibly important especially you know I know a lot of ethnic and racial heritage is also mixed up in there and you saw them targeting folks of Jewish faith and uh some of again is just to me watching this happen and then we do nothing. We'll have this hearing and I know Chairman Comr is trying to do his best but we're going to have this hearing but are we going to actually update HIPPA?
▶ 2:07:32Are we going to actually do something to push back against pro, you know, profit for this kind of data and information? Thank you so much, Congressman, for that question. And I do think that this is a moment to assess first principles in our commitment to the constitution and to what extent does the increasing privatization and modification commodification of this data come into conflict with our core values?
▶ 2:07:55Um but not only just our our constitutional values, our national security interests and the way in which our national security interests are infused by these fundamental commitments to rights and liberty and freedom and expressive rights and privacy rights as anchoring how we see um you know ourselves as a nation. So you know your question about you know what can we do to stop drifting into a surveillance state.
▶ 2:08:20do think that one of the things that we need to um make sure that we understand is that um our ability I believe for us to remain dominant geopolitically is not about deregulation nor devolution of the regulations around data privacy, cyber security and AI but leaning into them so that we can make sure that these systems unfold safely and securely and and other nations are now embracing these types of legal
▶ 2:08:50regimes including China um and we are not and I think that that puts us at a great national security disadvantage. I agree I I think for many of our colleagues here you know expressing on X your concern and everything about like again privacy uh is important but I think we need really comprehensive data that make you know protects the Americans private data.
▶ 2:09:12I mean, this is literally going to be a fight between those that want to that the corporate greed and the government surveillance and how overreaching that is because it is again going to be profit before the people and many of them are going to 23 and me because they want to live. They want to live. They don't want to get sick. They want to preventive care. Um, and I know like there are, you know, the Trump administration right now is destroying privacy protections. I see it rating private social security uh data, tax info, bank account numbers, you name it.
▶ 2:09:42I'm really concerned about this growing factor. But I also want many of my colleagues to know, I mean, Trump is now working with data and surveillance companies like what is it? Planter, is that how you say it? I mean, look at this. To compile databases on Americans first to target immigrants, they always start there. And then they're going to target, you know, it's going to be our neighbor other folks.
▶ 2:10:04It's going to be unbelievable because you know Pete Peter Thal and Alex Karp who made it clear that they care more about political domination than American democracy or individual privacy. I say this because we're talking about 23 and me but understand there's a bigger movement in our country that we need to put in check right now because they don't care about us. Uh they don't care about the folks that put us here and told us to protect them.
▶ 2:10:31And so I think it's really important chairman after this hearing let's not just have it in the congressional record let's actually do legislation to hold them accountable. With that I yield. Gentle lady yields. Chair recognized Mr. Berles from Missouri. Thank you Mr. Chairman. Um professor who I um it's been talked about a lot in this hearing about the potential threats and um risks of you know foreign actor getting access to you know Americans DNA records.
▶ 2:11:00Can you elaborate on what is what what is the potential risks that we are facing? Yes. Um some of the risks include for example blackmail um using it um in order to exploit and try to make um individuals more vulnerable um greater surveillance risks and um as was discussed potential biochemical biioric types of warfare. Um but I do think that there's also um potential AI driven targeting risks as well.
▶ 2:11:28And then um you know this isn't new. I mean the hospitals um providers their their electronic medical records are they they're attempted to be hacked all the time. Um have you heard of what the street value of someone's medical record is? Well, at one point I'd heard that it's over $50,000 or more. It's probably a lot more today. Um m Mr.
▶ 2:11:56self self Um my one of my questions has to do with how the hack occurred in 2023. Is it correct that individuals um who had stolen, you know, passwords from other other businesses then used that in a form that's called um stuffing where they where they used an automated system to take say the the hacked passwords and accounts from another company and then just rolled
▶ 2:12:27through those to see if those same passwords were used on your site. Is that am I getting that accurately? That's generally accurate. It is something called credential stuffing whereby a user you know and we all have done this is use the same username and password on multiple websites right and other websites were hacked and they were able to obtain those usernames and passwords and then they tried them on 23 and me and they were able to access a number of accounts um to get into and
▶ 2:12:57take the DNA relative information and so the the mechanisms that you've put in place to stop that from happening in the future or that you you check to see you send a text message to verify that somebody's logging in from that that was the original individual. You or what other steps do you take? Um you know right after the um cyber security incident the first thing we did was force every consumer to reset their password and as part of that process they couldn't use the previous one.
▶ 2:13:26they couldn't use the previous one. And we also checked that that password against known hacked passwords, right? Just to make sure that, you know, the same thing wasn't going to be happening with another credentials. I think if the American people are listening, this is you you should never use the same password for for different website businesses. Yeah. Um that's a very good just a good policy to follow.
▶ 2:13:49And then second, you also mentioned we did also implement two-factor authentication whereby either, you know, basically we actually then either sent the customer a text message or an email confirming that it was them and they entered that code to make sure that there was an additional layer of security, a second factor. Yeah. To access their account. Thank you, Miss Wetszky.
▶ 2:14:11Is that Um, you know, I think that one of the things that that's kind of striking me is that when someone enters into an agreement, they they know your company, they know your reputation, they know you. I think what we're kind of going through is a situation where potentially that what the trust that was placed in you because of this situation is is um in jeopardy if if somebody else gets access to that information.
▶ 2:14:41The question is um what will they do with that? So my one of my my questions is would you do you think that there should be a law that upon the sale of a business that an individual has to reconfirm that they want that company to have the new company to have access to their data. Thank you for that question. Um I'm a huge believer that people should have choice and transparency.
▶ 2:15:09So I think it's a complicated question the one you just asked um because there's individuals for instance like my sister who recently passed away of lung cancer who established a lung cancer community in 23 and me and feels very passionately about identifying genetic risk for non-smoking lung cancer. So she is deceased. Um she opted in to research because she really cared about that mission and it was really important for her to be able to do you know lung cancer is massively underfunded.
▶ 2:15:39It is one of the poorest funded areas. So how could we all come together? So how could she possibly reconsent? I I just had one more question. So when a separate company that you've that you've created had a contract with and you shared some of that data, do you what mechanisms do you have to protect and make sure that company is not then reselling it and sharing that data? That would have been part of the contract. So for example with GSK they were looking at aggregate statistics.
▶ 2:16:08They could not go and then share that with other partners. Okay. Thank you. I yield back. Chair now recognizes Miss Presley from Miss Wajinski, uh, you you claimed that 23 andMe is all about consumer empowerment, but most people ended up actually exploited, not knowing that they signed up to have their genetic data auctioned off to the highest bidder. We're not just talking about email addresses.
▶ 2:16:37We're talking about names, birth dates, genetic lineages, literal DNA data that implicates entire families, not just the person who gave the sample. Miss Wajjinski, can genetic data, even if deidentified, be linked back to individuals? I appreciate that question.
▶ 2:17:01Um, could genetic data be linked back to you would um you can link back your DNA is is your DNA. If I have a way of matching it to something that potentially connects to you then you could potentially identify. So the answer is yes. The answer is yes. The genetic data even if deidentified can be linked back to individuals.
▶ 2:17:28is the science well to no DNA if if I had your sample essentially if I know what your picture looks like and I see another picture I can connect those but just having your DNA alone if I just went to the subway and I swabbed it and I looked at samples I would not be able to identify who was there because I'm I don't have much of and there's a lot of ground I need to cover here and so I want a more direct question here so I'm going to go to Miss who is deident identified genetic data
▶ 2:17:58truly anonymous or can it be traced back to individuals? Miss Woo, thank you so much, Congresswoman. I'm not um a scientific expert on that exactly, but there has been research on the limits of deidentification and also the risks of reidentification. All right, fair enough. Yes, it absolutely can.
▶ 2:18:18With just a few pieces of additional information like zip codes, gender, um, or 23memes find your relative feature, it becomes easy to reidentify people and to expose their personal health information. 23M's privacy agreement talks about anonymous data, but DNA can never truly be anonymous. That is the point.
▶ 2:18:42Now, uh, Miss Wajinsky, you you said a limited number of customers were compromised by the data breach, but the truth of the matter is that out of the 15 million people who trusted this company, half of 7 million had their data exposed. So, that that's not inconsequential, it's deeply consequential. And now that same data can be sold off to a for-profit pharmaceutical company. So, you can understand why people are rushing to delete their accounts.
▶ 2:19:11But the thing is when people have tried to log in and delete their data, they received error messages and then the website crashed. That is not okay. Your company is preventing people from deleting their information. Mr. Cell Savage, it's time to put people first. Will you contact each of your customers seeking consent for 23 and me to continue holding their data? Yes or no?
▶ 2:19:37um be a simple opt-in communication that you send out before any bankruptcy sale. I want to really underscore that. Um Congresswoman, we first have sent a notice out to all of our customers um via emailing notifying them of the of the sale and that we a second email is currently going out this week notifying my time. Please just answer the question yes or no. Okay.
▶ 2:20:01Will you commit to contacting each of your customers seeking consent for 23me to continue holding their data? This should be a simple optin communication that you send out before any bankruptcy sale. Yes or no, Congresswoman, it's not that simple. We believe we've already these people are deserving of this, you know, these asurances and this insurance. They're they're already uh they've been violated in so many ways here.
▶ 2:20:27Miss Wajinski, will you amend your bid to commit to a similar consent requirement? Then I don't believe I can talk extensively about my bankruptcy about the the bid, but I can say in the past, for example, when we did the GSK partnership, we proactively communicated with all customers. I know that I know that. I know that. I know that it's not good enough. It's not good enough. It is just not good enough. people trusted you with their more personal information.
▶ 2:20:58Show them you respect them. They do not need your apologies anymore and they don't need your sympathy. What they need is legal protection. So if you're not able to protect the 15 million people and their families who trusted you, this company should not exist. The breach of data, the breach of civil liberties, the confusion this has caused for millions, it might just be time to give it up. I yield back. Chair now recognizes Mr. McGuire from Virginia. Thank you, Mr. Chairman.
▶ 2:21:28Thank you to our witnesses for being here to answer our questions regarding safety of millions of Americans, genetic information and personal data. If malign foreign actors such as ch the Chinese Communist Party CCP were to get their hands on the data, the privacy of millions of Americans and our national security will be at risk. And I apologize if I don't pronounce your name right, but Miss Wiki, is that right?
▶ 2:21:54We know approximately 15 million customers have submitted their DNA samples for genetic testing to 23 and me. Do you know roughly how many of these customers are American citizens? I believe the last one I was there it was about 80 85% of customers were from the US. Thank you. And Miss Wiki, uh, yes or no. Did 23me already give Chinese corporations associated with CCP and the Chinese people P people's liberation army access to this data?
▶ 2:22:23To the best of my knowledge since I have not been there since March. No. Understanding that every company in China has is associated with the CCP. All right. Miss Wki 23 and me received investments from Wooi Healthcare Ventures a company tied to the Chinese People's Liberations Army and CCP. What other foreign entities have invested in 23 andme?
▶ 2:22:48Uh in 2018 23 and me had an investment from Glacos Smith Klein which is a UK based operation and Miss U cell Mr. Cell Savage and Miss Wekki. Yes or no? Would you be comfortable with you your or your family's genetic information and sensitive data being in the hands of a malign foreign actor such as CCP? Yes or no? I would not be comfortable. I would not be comfortable.
▶ 2:23:20All right. Followup. What steps are you taking to ensure the sensitive data of millions of Americans is secure and will not be sold to malign foreign actors? I can take that question. Um, you know, as part of the bankruptcy 363 sale process, we have, you know, special committee has affirmatively said that the company will not be sold to any entity in China, Russia, North Korea, Iran or any other foreign adversary.
▶ 2:23:50I am happy to report that through the bankruptcy process, we at the current time have two final bidders, both American enterprises. TTAM research institute which is with is an American foundation and second is Regeneron Pharmaceuticals which is an American pharmaceutical company here in the and as as a public company.
▶ 2:24:15There will be dire consequences to our national security as well as the privacy of millions of Americans if the CCP or another Milan foreign actors are able to gain access to sensitive data of 23 and The CCP and any other foreign actor should not be allowed to gain access to millions of American sensitive data which can then be weaponized against them through surveillance or even the creation of a boweapon.
▶ 2:24:40It is our duty as members of Congress to protect our constituents privacy and our country from foreign actors who will weaponize this data against us if given the opportunity. And with that, Mr. Chairman, I yield back. Uh would you yield a minute to me of your remaining time? Absolutely. How confident are you all that your data will not end up in the hands of a bad actor?
▶ 2:25:07Are you very confident, somewhat confident or you have no idea? I as interim CEO I'm very confident that you know the sale of the company will that it will not result in the company being sold or the data ending up in the hands of a bad actor and by that I am referring to China, Russia, Iran, um Venezuela or other foreign avatar. What about health insurance companies or things like that?
▶ 2:25:36American health insurance companies or as um I think I'm very happy to report that the final two biders for the company are TTAM research institute which is a foundation here in the US founded by Miss Wajiski and second is Regeneron Pharmaceuticals. Neither of those are healthcare companies. Okay. And I feel confident that they will they are taking over the privacy and policies and consents of How confident are you?
▶ 2:26:06I I'm not I'm not involved in the bankruptcy process other than being a bidder. And so for myself, if if you end up with it, you're confident that your company will I am confident. Chair recognizes Mr. Men from California. Uh thank you very much, Chair Comr. Um I have to confess I don't use 23me. I've never been tested for genetics. Uh but I certainly have a lot of customers who have uh chosen to uh use 23 and me and I've heard from a lot of them. Uh but Mr.
▶ 2:26:33Selzivage uh I understand that customers of 23me can choose to consent to have their individual genetic information shared with your researchers. Uh what protections were put in place to protect your customers from the misuse of that First, you know, our customer data and their our policies are always putting our customers first, right? Reclaiming my time just briefly, what protections are in place to protect your customers from misuse of that data?
▶ 2:27:00Um, first and they can have the right to actually remove their consent to that data for being used for research policies at any time. The company always has provided researchers with deanonymized data. We are not providing individual identifiers when we actually share that data for any research. And I believe you also have protections that it's it's explicitly limited to just research purposes, right? You couldn't like go ahead and sell that to Goldman Sachs, right?
▶ 2:27:29Um, you know, our research consents are first there's a research consent that only 23 can use their data for research purposes and there is a separate individual consent for using that data with third parties. Right. I I understand that, but I'm looking at your terms of service right now and I don't see any specific language giving 23me any ownership rights to people's individual level genetic health information. Is that correct? That's correct.
▶ 2:27:56Our customers data claiming my time under the section that's described as licensing and IP rights, your terms of agreement state that uh you you get a license to use quote unquote user content which is described as information, data, things like that that are generated by users of the service and transmitted to you. It goes on to say specifically, user content does not include genetic or health information. I take it from this and the fact that licensing rights for individual genetic or health data are not mentioned anywhere else in your terms of service.
▶ 2:28:23Uh that you also don't receive a licensing right or royalty rights to people's individual genetic or health data. Is that correct? Um I'm not a lawyer, but you know, you don't own it. You don't own you don't own the data individually of people. You can use it for some purposes for research if they consent to it, but you don't have an ownership right in in that. I think you just said that. Is that correct? That is correct. Our customers own their data and they control that data at all times.
▶ 2:28:47So, I want to re ask the question, could you share uh somebody's individual data, genetic data with Goldman Sachs or Elon Musk or with the Chinese government? Could you sell it to the highest bidder? um you know our um policies state that you know basically we can we can actually reclaiming my time if I was really interested in the genetic data of chairman comr uh could you sell could I buy chairman coner data if he was a client of your service no we could not why not um because we are not
▶ 2:29:17share we don't have the right to share because you don't own it right you don't own the the rights to that uh could you sell the homes of your customers could you sell any other assets they owned The answer is no because you don't own that, right? So you don't own people's genetic or health information.
▶ 2:29:33So I guess I'm really just wondering why you think you can sell this data at an individual level to a third party company that's coming in uh where we don't I know you're talking about protections on that data, but I'm just wondering I'm not a customer of yours, but for those who are, including my constituents, why are you selling their genetic data when you don't own it? You know, you know the terms of service and the agreements at 25. I looked at your terms of service. Yeah.
▶ 2:29:58Mentioned that we can basically in the event we can sell in the event of a sale of the company or a bankruptcy of the company that the data can be transferred to the new company. Look, I I um 23 and me what you guys do uh at I think at your height you you seem like you were doing great things. Uh but you fall into a clear regulatory gap here uh between HIPPA and GINA as I think has been described.
▶ 2:30:22And I think this is one of those rare instances where my Republican colleagues and I all we all agree on on the problems that this raises. And I think it's clear that we need some kind of regulatory protection. So I guess I'm going to ask you in the meantime before we address this with law, I I want to echo the point made by my colleague uh Rep. Presley.
▶ 2:30:41uh why won't you commit to what seems like a very reasonable and common sense opt-in policy uh given that you're about to sell people's individual level genetic data very valuable information very personal information why won't you commit to doing that it's a it seems like a very reasonable reasonable thing to do and congressman we believe our customers have already consented to the transfer of their data through the consents that they signed up for when they signed up for the service second we've provided the customers with notice notice of the
▶ 2:31:11bankruptcy and we'll be providing them with notice of who the company do you check every email you read? Um I don't I I certainly don't and and I I certainly might miss an email like or several emails like this and I would just encourage you to think about an opt-in policy because what you're describing right now is the transfer and sale of data that is very very personal and I personally find it very outrageous that you're not allowing people to opt into this not giving them that right uh knowing that the open rates of your emails are probably very low. With that I yield back. Gentleman yields back.
▶ 2:31:41Uh I hate to interrupt this good bipartisan hearing, but uh at the request of the witnesses, we're going to take a fiveminut bathroom break. When we return, uh Mr. Timmons will be asking questions. So pursuant to the previous order, the committee will stand in recess for five minutes.
▶ 2:39:56The House Committee on Oversight and Government Reform full Committee hearing titled Securing Americans Genetic Information, Privacy and National Security Concerns Surrounding 23 andMe's Bankruptcy Sale is back in session. The chair recognizes Miss Green of Georgia for five minutes for questioning. Thank you, Mr. Chairman. Uh, Miss Wedge Siki, sorry, apologize.
▶ 2:40:22Um, you co-founded uh 23 and me in 2006 and took the company public in 2021. Is that correct? That is correct. And this is this is all about DNA, which is we would call science. Is that right? It was really about how individuals can learn about their own genetic information. But DNA and the study of it is science. Is that correct? Uh it's about learning about their family, their ancestry, science, and their health risks. Okay.
▶ 2:40:52So, it's science. Um now, in 2001, you reposted uh Dr. Raven the science maven who reposted my post of a sign that I kept outside of my office that said there are two genders male and female trust the science and uh the attack uh on this which you reposted so you must have agreed with them was as a scientist with a transgender parent I need you to sit down you don't know the science or the history you trust
▶ 2:41:22the science science draws a difference between sex at birth and gender identity the systematic of gender is a product of colonization. Uh what does colonization have to do with gender? I haven't seen that in a long time. I don't you reposted it though, so you must have known something about it.
▶ 2:41:47Um, also, uh, 23 and me that the company that you led at the time or that you're still there and you're trying to buy opponents of trans rights use the phrase trust the science to make false claims about sex and gender. We support what the science actually says, accepting and affirming trans people has a positive impact on their health.
▶ 2:42:08trust the science support trans health which is really interesting because in DNA it shows that there's only two sexes two genders male and female and that should be something that you're intricate in intric you know you're you're very tied into that since you founded the company co-founded the company took it public and you want to buy it again um so it's baffling that 23 and me a company that specialized es in
▶ 2:42:39DNA and people's very personal information and how God has designed human beings would support and continue to support the trans ideology that this is something that can be changed. Have you ever seen any DNA or know of DNA that a biological male can give birth to a baby? No. No. So, this is something that we know cannot be changed. That's scientific.
▶ 2:43:09That's the design of our DNA. And um I I don't understand and I think most people don't understand why 23 and me would take such a uh hard left political position uh supporting trans rights. And here's what's the really weird part about it is it says this is one of the many reasons why we've been working to improve our products for trans and non-binary customers.
▶ 2:43:36I thought your product is helping people understand their DNA, uh, linking themselves with family trees. So, I can't comprehend what kind of product 23 and me could give to people who identify themselves in some other way. That just that doesn't make a lot of sense. Um, another thing that's hard to understand is, you know, the beauty of DNA is it's the beautiful design.
▶ 2:44:05God, it's God's design down to the finest detail, a granular level of how we're made, but it also helps people link with their family trees. Um yet this was something this is a letter that you put out after the Scotas uh ruling overturning Row versus Wade and you put out a letter very much against the ruling that the the right should go back to the states and you clear you clearly
▶ 2:44:35put it your own personal belief in here on the 23 andMe uh social media that you are very much for the killing of the unborn, the killing of babies which completely would destroy what your company is all about. How can we study DNA?
▶ 2:44:53How can we study people's lineage if the one of the very co-founders and who wants to own the company again supports the murder of the unborn, the murder of God's design and the murder of God's creation which we can link it to DNA. And um Mr. Chairman, I'm running out of time, but I think that's 100% against the science and I think it's 100% against God. I yield back. The gentle lady yields back. The gentleman, Mr.
▶ 2:45:23Bell is recognized for five minutes for questioning. Thank you, Mr. Chair, ranking member, and our witnesses for being here today. And the in Missouri, we are currently recovering from one of the largest natural disasters since which has left an impact statewide with extens extensive damage to my district in the St. Louis region.
▶ 2:45:47As we recover from these storms, the threat of waste, fraud, and abuse lingers above the lives of the thousands of individuals impacted. These same individuals who are already exhausted and depleted from the mental turmoil and physical loss are now faced with the threat of fraud. Studies have suggested that individuals recovering from natural disasters are at a higher risk of being susceptible to scams.
▶ 2:46:16Many of these scams come in the form of impostors who are impersonating government officials, bank workers, or even FEMA employees to acquire VA to acquire vulnerable information. These fraudsters preying on these vulnerable communities use the tactic of acquiring individuals private information like social security numbers, bank account numbers, and addresses by posing as a resource to provide help but subsequently using the information
▶ 2:46:46obtained for their own personal gain. Miss who do you agree that access to this personal information poses a significant threat to Americans livelihoods especially those in vulnerable communities? Thank you Congressman.
▶ 2:47:02I think that you are helping to elevate one of the critical issues about data privacy and that is the way in which it can be exploited particularly to those who are most vulnerable and without comprehensive privacy laws or greater cyber security protections at the federal level. I fear that we're going to continue to face these types of issues. And since we were talking about privacy, I'm going to go off um off my remarks for a second.
▶ 2:47:29Um I don't um to the the previous questions. I don't really care what your uh positions are on um on abortion. What I care about is that a woman has a right to make a decision with her own body. that people have a right to make a decision with their own body and healthc care choices.
▶ 2:47:50Um, so what have we what we have seen with 23 and me is a breach of privacy that has left many communities vulnerable to fraudster attacks ranging from identity theft to risk from exposure of genetic data. I agree and recognize the need for comprehensive legislation that ensures transparency in the collection and use of personal data along with stronger security measures and protections when it is handled by corporations.
▶ 2:48:19But I also know that the threat of fraud and abuse does not just lie in our corporations but amongst our very own government. What we have been seeing over the last couple months is one of the largest frosters of them all and his name is Elon Musk who this committee refuses to bring uh to to uh this to a hearing to question.
▶ 2:48:40Musk who is who has scammed the American people with false promises of efficiency and elimination of waste, fraud, and abuse has carried out the exact opposite. Musk and his Doge team, or whatever you want to call them, have ransacked multiple federal buildings under false pretenses, gathered sensitive and personal data, and vanished, leaving others to pick up the pieces and rebuild.
▶ 2:49:07Sounds pretty similar to the tactics of disaster frauders to me. It is our duty not only to hold corporations accountable, but also to hold anyone accountable who violates the privacy and safety of the American people. I will continue calling out and fighting back against fosters and protecting the individuals who need it most. Thank you. And I yield back to the ranking member. The Does the gentleman yield his time back?
▶ 2:49:37To the ranking member. Yes. Thank you for that. I yield back. The gentleman yields. The gentleman from Arizona, Mr. Biggs, is recognized for five minutes for questioning. Thank Thank you, Mr. Chairman, and thank the witnesses for being here. I want each of you to answer this question as succinctly as possible. Who owns who owns the genetic information at 23 and Miss Weki, uh, what we have said in the past is that you, you're the individual, always owns their genetic information.
▶ 2:50:08Okay. So, I'm going to leave it right there. The owner you've said is the basically the person who submitted their genetic information. Mr. Selvich, the owner of the genetic information is the customer at 23 and me. You agree with that, Professor Hugh? In their terms, they say that they can sell. Okay. Yeah. So, yeah. Not that they can sell, but that the actual ownership rights and and when you own it legally, you got a bundle of rights. And then I think Mr.
▶ 2:50:34Salvage, you said that there was that that there's a license for use and I think that Miss Wiki, I thought I heard you say that too, that that somebody opts in, they're providing a license for use either for research or or other use. Is that fair? You're you're operating under a license agreement at that point. Our customers, you know, basically provide consent for us to use their data. Strike that. Let's let's hold on. Let's not get let's not get funny with the words. Are you given a license to use it?
▶ 2:51:06Congressman, with all due respect, I'm not a lawyer. Okay? You know, I do know that Congress are always given the right to consent or remove that consent to use their data for research purposes. All right? So, so we'll leave it there for a sec and let's just get to liability because even in a license agreement, you you can breach a license agreement and even if someone provides consent, you can abuse consent a consensual arrangement. Um, and the question is who has liability at that point?
▶ 2:51:35And I would suggest you 23 and me does. Uh, would you agree with that, Miss Wshiki? I'm not sure I understand the question. If if uh if you guys 23 and me were to violate what apparently is not a license, but a some kind of consent you you would have liability for that for failure to to protect the markers. If 23 and me violated the consent, yes, then I would believe there would be an issue. Mr. Salvage, you agree with that?
▶ 2:52:04Yes, I believe 23 and me has a duty to uphold the consent that our customers have agreed to and that we've agreed to with them. Okay. Professor who? And then yes, in the breach litigation, I think the class action shows that there was liability, right? And so let's let's now compare to uh just national security for just a moment.
▶ 2:52:29Uh professor Hugh what national uh what specific vulnerabilities in our current laws allow this data to be exploited the data we're talking about that 23me is sitting on. Yeah, I I'm deeply concerned that if it is um you know faced with foreign investor which has already been brought up whether or not there could be other um ways in which there could be um once there's a breach um that it can fall into a foreign adversar's hands.
▶ 2:52:58Does the Let's get back to the liability for just a second again because this is driving me crazy. Um it does as as one who owns the um uh the genetic information. Let's say I did uh at any point you said I can withdraw consent. Can I order you to destroy that genetic information? Yes, you can. Our customers always have the right of ownership. They can have complete control over their data. They can access it.
▶ 2:53:29So, so I'm talking about it specifically the sample as well as the data. Yes, they can request a deletion of their data which we will and we would delete that data and they can request and at the same time if we had a saliva sample which they agreed to have bio banks we would destroy that as well. Professor Hugh Americans are really concerned about domestic surveillance programs. Believe me, FISA has been abused by our own government etc. How can Congress prevent the US government from having unauthorized access to 23me's genetic data?
▶ 2:53:57I I think that what we need is to expand HIPPA and we need to expand GINA. We need to have greater um I think protections and cyber security um asurances. So, um I I'm going to lay this out you with with the abuse of FISA that we have seen and these are massive databases being accumulated on American citizens um and inquiries being made by the FBI without any kind of uh judicial uh authority nor uh with consent of the individual.
▶ 2:54:27Uh do you think Miss Wiki and Mr. Salvage that you guys have taken 23 and me has taken adequate um protective measures to prevent incursion from any um non or any state or non-state actor. I mean you know you had the problem uh where you were hacked. So what what have you done then to uh make sure that you're secure against even things like the the US government?
▶ 2:54:56And and as a compound question, have you ever received a request from the federal government or any other governmental entity to have access to a particular uh DNA sample in that perhaps might be in your database? The gentleman's time is expired, but the g the witness will be allowed to answer the question. Okay. I'll take the second question first.
▶ 2:55:16you know, the company has published, you know, on our transparency page, which is a public page on our website, you know, requests that we've received from law enforcement with regard to DNA data that the company has held. At no time have we actually um provided that data to law enforcement or other authorities.
▶ 2:55:37Um second you know basically after the cyber security incident we have taken additional steps to secure the data that we have at 23 and me from both you know foreign actors or any type of threat actor including you know in providing additional encryption over the data you know hiring putting in additional security measures and for simple access to customer accounts adding in two-factor authentication and requiring all our customers to reset their passwords
▶ 2:56:08and ensuring those passwords and usernames have not been used in other compromised um websites. I thank the gentleman. Uh Mr. Timmans from South Carolina is recognized for five minutes for questioning. Thank you, Mr. Chairman. I want to focus on the potential of your data being used for bioweapons. Um you have the second largest collection of DNA behind ancestry DNA. Is that correct? That is correct.
▶ 2:56:35So the internet says 25 million is what Ancestry DNA has. You're at what 14 15 million? That is correct. And you agree that there is the potential that a rogue actor or a um evil nation state could use um the genetic data that you or ancestry DNA has uh gathered to then create a targeted bioweapon that would target people of certain geographic locations, ethnicity.
▶ 2:57:05You could even do eye color. Is that scientifically possible? Would you agree? Um, you're not a scientist, but Congressman, I'm not a scientist, but I understand the the research has abound for really the last two decades. It shows that um should a nation state or a well-funded rogue actor um be willing to engage in such um atrocities, they could do that.
▶ 2:57:31And realistically, in order for that to be effective, they would need a very large amount of uh data from all over the planet. Um, as you consider how this uh bankruptcy is going to be resolved, is that front of mind? Are are you going to make sure that the vast amount of data that you have is is not going to fall into the hands of a uh evil actor? Is that fair? That is fair.
▶ 2:58:00First, let me say that as part of the bankruptcy process, the special committee of 23 and me has committed to ensuring that under no circumstances will we sell this data to any foreign adversary, including any enterprise in or controlled by China, Russia, Iran, Venezuela, North Korea, or any foreign adversaries to the United States.
▶ 2:58:25Second, you know, we have two final biders in the auction process for 23 and me. Both of those, TTIM Research Institute and Regeneron are American enterprises. Regeneron, an American pharmaceutical company on it's a public company with $55 billion in market. Thank you for that. That's helpful.
▶ 2:58:45Before I go to Miss uh Wiki, I want to point out that while every individual technically owns their data that you have, it is comical to think that that ownership is uh real because the likelihood of even 1% of the individuals who have used your service asking you to delete their data is virtually zero. So I mean you you while we all agree that um I actually did 23 and me.
▶ 2:59:11So, I mean, while I do own my data and I could probably log in and try to figure out how to delete it, I'm not going to do that. And no, nobody else that has uh used your uh business is going to. Uh, Miss Wiki, um, when you were CEO, did you or your board ever consider the national security implications of selling, licensing, or sharing genetic data with research institutions abroad, including those in China? We talked about things like that extensively.
▶ 2:59:38And did any foreign um actor attempt to purchase any data or for research purposes or other? No. Um so Wui Healthcare Ventures was an investor. They have direct ties to the CCP uh and the PLA. Is that I mean they they were just we'll give you money, but uh we want to hear about what you're doing, but we don't need anything from that. Is that fair? That was it was a $150 million that we raised in that round.
▶ 3:00:07They were a $10 million investor. They had no board seat. No access. And your investors have no access to any information. No access to information. But they get, I would imagine, um, investor updates that shows progress. I don't I don't have access to my records. I don't believe that they were a large enough.
▶ 3:00:23Fair to say that in Ancestry DNA has um continued to be successful versus uh 23 and me largely because they stayed focused on giving customers their their ancestry, their ancestry history as opposed to 23 and me was kind of trying to engage in secondary lines of effort um genetic testing to kind of help people understand potential um health issues they could have. Is that where things might have gone wrong or?
▶ 3:00:52Ancestry.com actually has a very expensive monthly subscription to be able to look at old historical records versus 23 andme has really been about the acceleration of knowledge around human genetics for the benefit of all of us to be healthier. So they were successful where you all have clearly failed because they just stayed true to the to the main business model and you all expanded. Is that fair?
▶ 3:01:18I would say our mission since the beginning was to help people access, understand and benefit from the human genome. And that benefit has always been about the benefit of human health and that understanding. So the the two companies are incredibly different. Okay. Thank you, Mr. Chairman. I'm out of time. I yield back. Gentleman yields back. The gentleman from Texas, Mr. Sessions, is recognized. I stand corrected. Mr. Frost is recognized for five minutes for questioning. Thank you, Mr.
▶ 3:01:48Chair. The federal government must play a bigger role in protecting our personal data, not just from criminals or foreign adversaries, but from law-abiding American companies as well. 23 andMe holds the genetic information of more than 15 million people and is one of the largest collections of human DNA in the entire world.
▶ 3:02:07They've compiled with our very or they've complied with our very basic laws by not sharing data with insurance companies or law enforcement unless legally required and providing some terms of service disclosures upfront. But that's not enough. Printed here in the terms of service and uh US uh privacy policies that users uh review before opting in. It's about 20 pages.
▶ 3:02:31Buried in the privacy policy are the lines, quote, "If we are involved in a bankruptcy, your personal information may be accessed, sold, or transferred, accessed, sold, or transferred as a part of that transaction." End quote. Uh, Mr. Cell Savage, is that how you say it? That's correct.
▶ 3:02:51Do you know approximately how many people read online terms of service that they agree I don't but you know one thing we do it's about 10% less than 10% less than 10% of people will read the online terms of services that they uh agree to according to the Pew Research Service 23 and me customers are now panicking uh simple notice is not going to be enough. Uh professor who why does our personal genetic information hold so much value in the open market?
▶ 3:03:22Thank you for that question uh Congressman. And I think that it is highly incentivized by the black market because of the way in which it can be exploited and the way that it can be used, especially in our AI age. I think that increasingly there is great value in that type of personal um data that um can then serve multiple purposes.
▶ 3:03:46Why should consumers or people not want their information just available for purchase by the highest bidder? Well, I I think especially in this instance, it's so critical for us to look at the way in which we do not have a comprehensive um system of protection. Um we have a very siloed system in the United States where we look at all of this individually within its field, but it really the impact is integrated and especially with um AI technologies.
▶ 3:04:16We're going to see an increasing integration. No, you're 100% right. I mean, Congress has failed to deal with this for a long time. Um, how could uh 23 andme's bankruptcy proceedings lead to the release of people's private genetic information?
▶ 3:04:32Well, I I have multiple concerns about whether or not in the time of bankruptcy whether the cyber security and the data protection protocols will be foremost um and I completely understand the commitments that have been made in the past and um they have been known as a very strong company in their data privacy and cyber security protections but it's a time of chaos when you're in financial duress and when you are now transferring potentially the company to others even if there's promises upfront that you carry over those prior commitments.
▶ 3:05:02It's really uncertain and I think that that's why people are panicking when it comes down to strengthening privacy regulation for our uh personal data that's held by corporations. What examples can we pull from in terms of state laws? Well, there are several states now that have very strong data privacy protections and um there are also states that are now leading the way in genetic privacy and biometric information um privacy.
▶ 3:05:27And I think that if Congress were to help to understand how best to um you know bring further protections, strengthening GINA, strengthening HIPPA, then I think that we could get much farther. Are there any approaches that haven't been tried yet?
▶ 3:05:42Well, I think that um Colorado, for example, with their high-risk AI, you know, consumer protection act is a model of borrowing from the EU and looking at what types of technologies and what type of AI systems or datadriven systems are going to pose the greatest risk. And I think that that's something that Congress could examine. Yeah, genetic research has had life-saving results and large amounts of data can only assist in this work. But the loss of data privacy cannot be collateral damage for these breakthroughs.
▶ 3:06:11And innovation must not mean surrender to corporate control. This is not about one company. But in the battle between people's data, privacy, and corporate profits, the people usually lose. And I hope that both my Democratic and Republican colleagues can agree that it's imperative um and past time for Congress to step in on this. Thank you. I yield Gentleman yields back. The gentleman from Texas, Mr. Sessions is recognized for 5 minutes for questioning. Mr. Chairman, thank you very much and for this hearing today.
▶ 3:06:40Most interesting on both sides. Miss Wilche, you and I met on 120 2015 up at the rules committee. I was chairman of the rules committee at the time and covered much of the things that we are covering today with a different viewpoint perhaps back then. Although we understood that there were members of the House, soon to be Senate uh who did hold very dear uh thoughts about privacy and the things that would come with that. I have three questions.
▶ 3:07:11The first one is I assume for anyone who can answer it, who's going to decide who gets the company? Is it the bankruptcy It is first um a recommendation from the special committee of 23me to evaluate the two final biders to ensure that there is a highest and best bid for the company. That recommendation will then be presented to the bankruptcy court for the bankruptcy court's evaluation.
▶ 3:07:40So recommendation and theoretically it could be off highest bidder. uh are they is the bankruptcy judge then going to determine the remaining value of what happens in that disposition of the uh bankruptcy amount. It is the bankruptcy court which will determine what happens with the proceeds from the sale if that's what your question is. Thank you. Anyone disagree with that? Thank you. uh data that is being held.
▶ 3:08:11I see the term often uh that might be reserved for the term research. This is used for research. Is there a corresponding value where a person 23 and me would ping back a person if they discovered that all of a sudden a something appeared in the marketplace that would correspond to some DNA
▶ 3:08:42that then 23 and me recognized, hey, we have a trial, we have an answer, we have dated and information. could we get you to take part in a trial? Is there a moving back from 23 and me to a person that was whose data you had? Yes. Um it's a great question.
▶ 3:09:08So we actually called this was the flywheel is that we actually when we set out the company we wanted to create a research platform that was actually what we say by the people for the people. So that if if the consenting customers wanted to go and research a topic that we could go and all collectively come together, input that information, research it, and then we'd actually put that back to customers as a new report.
▶ 3:09:33So this means to me that 23 and me has data and information specific to what might be new research or something that appeared in science, a trial, data and information where you can link that back to the individual.
▶ 3:09:59And I had heard people perhaps the and I could be wrong this panel say there is no direct link back to a person. Is it is it based upon if a person opted into that or do you have it even in someone didn't opt in or opt away that you could as part of the service tell them 10 years later 12 years later hey we believe
▶ 3:10:29on predictive analysis of what we've learned you have something on the surface or deep in your DNA we want you to be aware of something So it's a great question and two very different parts of the service. So customers have the ability to opt into research and in that research part we are doing the scientists are doing discovery.
▶ 3:10:52So they would have had to have opted in in the beginning and perhaps that was a vi value of 23 and me at least it was in 2015 that you and I spoke about. They have the ability to opt in. We make a discovery once we've made a discovery. For instance, we have what's called polygenic risk scores on areas like type two diabetes.
▶ 3:11:14Once we say we have validated, we have the ability to predict potentially who's at higher risk for type 2 diabetes, we turn that into a report. And one of the features of 23me as a customer who is buying into the subscription is we continuously update your account with new information as it's coming. So, so my point in saying this, and I'm sorry to cut you off. I've got about one second left.
▶ 3:11:40There is a direct link that with the sale of 23 and me, you would have corresponding data specific to an individual. Thank you very much. I appreciate you being here today. I hope that this stuff is on a website, frequently asked questions or something. There's a a lot of people that are here today talking about fear.
▶ 3:12:07I think fear is a very negative way to look at things. I think education is. So, I hope you're able to make sure if you need to update it that you're looking at that and and appropriately answering questions perhaps that members had today. I Mr. Chairman, I want to thank you for the 29 seconds extra. I yield back my time. The gentleman yields. Uh, Mr. Crane, the gentleman from Arizona is recognized for five minutes for question.
▶ 3:12:38Thank you, Mr. Chairman. Um, according to public reporting, individuals with Jewish and Chinese heritage were targeted in the hack that uh happened a couple years ago at 23 and me. Um, Miss Weki, why were Chinese and Jewish individuals targeted during this Um, that that's a great question. I don't believe it was specifically those individuals.
▶ 3:13:05Um, it was definitely something that was reported in the media and there were a lot of Jewish relatives that were in some of that information, but I don't believe it was necessarily a specific attack on those. It was the credential stuffing. But didn't one of the in didn't one of the individuals say that he would sell information about individuals with Jewish heritage? They did report that they said that. Interesting.
▶ 3:13:32Um, having people's personal DNA profiles unsecured is obviously a very serious issue. Could be used um to develop boweapons um force readiness analysis, black miller coercion, and pharmaceutical targeting. I noticed when Miss Presley asked if you would allow consumers who had submitted their DNA to 23 and me to erase their data from the site before the sale to a new buyer. Neither of you could answer yes.
▶ 3:14:02I want to go into that for a second. Why could neither of you answer yes if both of you claim that the individ the owners of the DNA is actually your customers? Our customers always have control over their data.
▶ 3:14:17um they can de you know basically they can access their data, they can edit their data, they can opt in or out of any research consent and most importantly at any time they so choose to they can delete their data in the case of then why couldn't you answer Miss Presley's question that way? Um do you remember that question sir?
▶ 3:14:37I don't remember the exact question she asked but for our customers you know her question sir was will you give your your customers the ability to opt in back in before the sale to a new a new owner that they didn't in they didn't submit their data to. I believe her question to me was will we give people direct notice to say that they can opt out opt in or out of keeping their data.
▶ 3:15:07You know what I am saying today is at any time and this has been the case since the founding of 23 and me a customer can delete their data. It's an automated process. They simply go into their account click you know go to the settings and they can click delete their data. It's an automated process.
▶ 3:15:25We delete all their um digital data and if they've biobanked a sample and consent it to that we destroy that sample and we do that timely and we've done that for every customer who requested us since you know since inception including the large number of customers who requested the deletion of their data since the bankruptcy. How difficult is it is it to do that Mr. Selvich? I think it is very simple.
▶ 3:15:52I mean, I think it probably takes somebody less than five minutes to go into their account, go to the settings, click delete my data, and for the company, it's an automated process. Mr. Selvage, you said um you're very confident that American data will not wind up in the hands of a bad actor. Did you say that a few minutes ago? I did, Congressman. How can you make that claim when 7 million users have already had their information stolen?
▶ 3:16:18Congressman, you know, the cyber incident at 23 was very regrettable and we've we apologized for that to our customers. The data that was actually released in that cyber security incident was you know prim mostly DNA relative data you know and while it's is customer data that was revealed we believe we've since you know enhanced the security at 23 and mean where we've always maintained that it's a top priority for the company
▶ 3:16:48and then second is through the sale process we're ensuring that the sale of the company will not go to any company that is a foreign adversary to the US. Miss Waj Kiki, did I say that right? Wujiski. Wujiski, sorry. You said the same thing that you were very confident that data would not wind up in the hands of a bad actor. I mean, you've been in the space for a long time. You know, hacks happen every single day.
▶ 3:17:13You know that many nation states that are adversarial to the United States of America have very robust cyber security operations. How can you how can you be confident when 7 million of your customers have already had their data Just to re I'm not part of the bankruptcy process other than the fact that I'm an active bidder. Um during my time at the company, we did very proactive steps.
▶ 3:17:38For instance, like I mentioned, keeping the genetic information separate from all the identifiable information. So we tried to create a structure where even if there was some kind of breach that you would not be able to reconnect those and identify back to the individuals and who they were. So in the cyber incident it was as as as Mr. Salavage was saying a lot of it was DNA relatives names and small amounts of information. So it was mostly those names. Okay. Thank you Mr.
▶ 3:18:08Chairman. I yield back. The gentleman yields. I recognize myself for five minutes for questioning. I think it's important to note and from as America observes is fascinating hearing that uh digital data is not secure. You have reports of according to my research about 27% of Fortune 500 companies have had major data breaches. These are the wealthiest companies the most most advanced security systems.
▶ 3:18:40data breach statistics show a significant increase in both the the number of breaches and the number of records exposed within those breaches. For example, in the United States, the number of data breaches increased from in 2012 to over 3,200 in 2023. In 2023, 353 million individuals were impacted by data compromises.
▶ 3:19:06And globally, data breaches exposed over 818 million data sets in the first quarter of 2024. It was intellectually unsound to discuss digital data as if it was and and and therein lies the problem Miss Wiki 23 and me. Congratulations on the success of the c of the company.
▶ 3:19:35I'm a Republican. I support for enterprise. Glad you had a good run. But let's talk about the issue right now because 23 and me began with a DNA swab. And that swab was sent in to a laboratory I presume 23 and me and that laboratory analyzed that that physical data and created a digital file. Is that correct? Uh yes, we would we're moving quickly. I'm just summarizing here for the American people.
▶ 3:20:05You send in a swab is physical DNA that's received by a laboratory and transition to a digital At that point, America no longer secure. And I I need to only point to modern history and data breaches and digital let's move a little bit deeper into this into this uh consideration in these laboratories and 23 and me. Did you have Chinese nationals working, ma'am?
▶ 3:20:37So 23 and me contracted with lab core. Yeah. Yeah. Did you have did you have Chinese nationals working in laboratories that were processing the DNA physical data and transitioning that data to digital files? So, LabCore is a public company. It's one of the largest lab tech. Yes or no? What? I I didn't control their hiring. Would Would you would you believe me when I tell you the answer is yes. He had Chinese nationals. Listen to this.
▶ 3:21:05America, you sent in your DNA on a swab. No problem. That's cool to to check your your family history and your your family tree. You know, I did it, too. But the expectation of privacy of your digital data was gone the moment you put that thing in the mail. And now Congress has to determine whether or not we're going to allow the abject sale of that data.
▶ 3:21:34And let me just say that we're going to draft legislation. Mr. sell savage. We will draft legislation. I don't know if we'll get it right because it's complex. I would I would I would estimate there'll probably be a dozen different iterations of legislation covering uh DNA digital data control over the next decade.
▶ 3:21:59But but Congress must act in response to this this newly emergent threat because you're not just talking about 15 million people, but 23 and me. According to my research, over the course of 30 years, 15 million people become 100 million the same basic DNA profile, therefore subject to the same uh threat of biological weaponization
▶ 3:22:30of that DNA profile. And that DNA profile exists in the digital realm where we already acknowledge it's not secure. So this body is going to create legislation and that legislation will impact the sale of this data. So both of you have a stake. Quickly, madam and sir, advise this body.
▶ 3:22:57Will you be available for consultation to this committee for as we work through what legislation will look like? I would be honored to help and participate however I can to help make sure that genetics however you can. Thank you, ma'am. Good sir. And likewise, I'd be happy to help. Professor Who, we're going to need you. Will you be available? Absolutely. Thank you. My time is expired. Uh, the chair recognizes Mr.
▶ 3:23:24Gil for five minutes for Thank you, Mr. Stand. Corrected, Mr. Gil. I apologize. Miss Crockett has arrived. Miss Crockett is recognized for five minutes for questioning. I apologize, Mr. Gil. Thank you so much, Mr. Chair.
▶ 3:23:39Despite the messy breakup we all saw unfold last week between the world's richest billionaire and the world's pettiest billionaire, we cannot forget the damage Elon Musk and President Trump have done together to our government, national security, and Americans privacy.
▶ 3:23:56Republicans are holding this hearing acting like they care about protecting your privacy, pretending like their president isn't out there trashing privacy and cyber security laws to build profiles of Americans sensitive information that could give him unparalleled power to control what we say and what we do. That's right.
▶ 3:24:16Whistleblowers have told the committee that Doge is carrying around quote backpacks full of laptops to combine protected data from different agencies and that Doge is not notifying Americans that their data is being moved around even though they're required to do so by federal law. Professor who why do federal laws like the privacy act and the federal information security management act place safeguards around how the federal government handles and uses Americans data.
▶ 3:24:47Thank you so much Congresswoman for that question. And I think that it's absolutely critical to see the urgency of this moment in history that as we are asking 23 and me to exercise such care and moral obligation to safeguard our national security interest that we also ask that of our own federal government and that we look to the laws that we have such as the privacy act and FSMA as reasons why it's so critical not only because of the history of potential abuses and misuses that we've seen in the past that then and also the vulnerabilities
▶ 3:25:18that led to the enactment of those laws, but because of the critical national security issues that are emerging, especially in light of AI warfare. Thank you so much, Professor H. Let me ask you one more question. How does DOA's haphazard and cavalier handling of American sensitive data present privacy and security risk?
▶ 3:25:36I think that what we really need to understand is that um that aggregation and that consolidation of data opens us up to great deal of targeting and also the type of misuse and abuse of that data and without making sure that we reinforce the systems that we have put in place previously and those specialists and experts that we had hired previously to safeguard those systems. We are really jeopardizing I think Americans privacy.
▶ 3:26:03Yeah, it seems like we decided to leave all our valuables in the car out where everybody can see it and the door is unlocked. That's what it feels like. But I digress. Um, our federal agencies are tasked with protecting cyber security and maintaining critical IT infrastructure that has been gutted by this administration. Almost a thousand employees were fired or forced out of the cyber security and infrastructure security agency, better known as SIZA, weakening America's cyber defenses.
▶ 3:26:30Professor who how will these workforce cuts jeopardize our nation's ability to protect Americans data from cyber attacks? Yeah, I think that we need to um understand the critical role that these agencies and professionals including CISA, the cyber security and infrastructure security agency of the Department of Homeland Security, the role that they play in making sure that they safeguard all of our critical infrastructure. And without uh the proper staffing, um we're throwing ourselves into a great deal of jeopardy.
▶ 3:26:57And I I think that we also need to recognize the potential conflict of interest here um of those that are trying to dismantle these um cyber security systems. Thank you so much. As another example, Trump's acting director of the Consumer Financial Bureau of Protection um which Trump is also trying to unconstitutionally dismantle recently killed a bill that would have shielded American sensitive information from data brokers.
▶ 3:27:20Instead of protecting Americans from companies that sell their address, email, phone number, financial data, political affiliation, religious beliefs, and other sensitive information, Trump is letting them run wild. I'd ask unanimous consent to enter into the record a wired article titled, quote, CFPB quietly kills rule to shield Americans from data brokers. Without objection to order, thank you so much.
▶ 3:27:42Congressional Democrats and American people are rightfully concerned that their sensitive information is being used, abused, and pulled without regard to our nation's privacy and information security laws. And we won't forget that just last week, Republicans made us wait more than half an hour while they scrambled to get their members into this committee room that they for a hearing that they called yet did not bother to attend because Democrats had the votes to subpoena Elon Musk.
▶ 3:28:09If they agree with what Elon has done, why are they so scared to hear from Elon himself? Maybe now that Elon broke up with Donald, the majority will finally join us in demanding answers from Mr. Mus time within his this administration. Let me tell you something. We have seen that this ad administration has decided to go after students because of things that they have said. We have seen people get fired because they refuse to pledge their loyalty to this dagon cult. This is absurd and we don't need people being targeted.
▶ 3:28:38They are weaponizing us while at the same time making us very vulnerable to those that want to hurt us the most. Now listen, I never sent my DNA to anybody, so I don't know where I was stolen from. I'mma tell you right now, I did not do it because I was concerned because there is a history, especially when it comes to black folk with taking our stuff. So, I didn't do it. So, now I sit here clueless about my heritage.
▶ 3:29:03But I tell you that hearing having a hearing on this issue brings about all of those worst fears for me though. The fact that our data is just out there and and our personal biographical information. So I am just going to ask any and everyone around the science world so that we can make sure that we move forward in this country when it comes to science. We got to make sure that we are protecting people's information as we are trying to move forward.
▶ 3:29:30whether it's AI, whether we're talking about things such as our genes or otherwise. Thank you so much and I yield. Thank you so much, Mr. Chair. Chair recognized Mr. Gil from Texas. Thank you, Mr. Chair, and thank you for for holding this hearing on a uh a very important topic, which is which is data privacy. But I've got a couple other things that I I want to talk about while we're here related to this. Uh Mr. Miss, excuse me, Winski, is that how you pronounce it? Yes. Wiski. Wiski. Okay.
▶ 3:30:00Thank you for for being here and taking the time. Um, 23 andMe has has really uh over the past few years gone gone out of its way to to show how woke it is. And one of the things that it's been promoting amongst many others is um a variety of different pronouns. We got here's a a tweet that you guys put out in June of 2021. Um I just want to ask you what is what does E mean as a pronoun?
▶ 3:30:31It's E. To be honest, I'm not sure. Okay. Do you know what what M means as a pronoun? I'm also not sure. Okay. Seem Don't you think it's important to know what what these mean? You guys are in this post you wrote or somebody on your comm's team wrote that using the correct pronouns impacts trans people's health can reduce the risk of depression and suicide. That's a pretty serious claim. And it seems like if you're going to demand people use these pronouns, you would know what they mean, right?
▶ 3:31:02Uh I I I delegate 23 me on a lot of people. We had six. You You're CEO though, right? I was CEO, but it doesn't mean I can oversee every single post. Well, this is a very very politically charged post that you guys put out. I I would think that you would have a view on that. Can you tell us what what is the difference between Z and Z? One of them is ZE and one is XE. I'm I'm not up to speed on that. Okay.
▶ 3:31:29Does it does it concern you that not understanding this might increase the risk of depression and suicide amongst trans people? I support my my research team that that felt that you know it's important for us to be inclusive of everybody and it was very much grounded. I I agree but it doesn't seem very inclusive if you don't know what they mean. Right. I respect the the the the social team and the research team that put that post But you don't know what any of these pronouns mean, but you guys are promoting it.
▶ 3:31:58I assume it's it's it's different ways people like to be referred to. What about here? H I r what does that mean? I don't know either. What about faire? F a f a rer. Again, some you'd agree these are pretty unusual things, wouldn't you? I think they represent a lot of the diversity in this country. Okay. Well, I I I'm trying to understand the diversity and I'm asking you what they mean. Do you I'll give you one one more chance.
▶ 3:32:25Do you know what Z here Zim FAF fair em mean? I do not. Okay. Does that concern you that you don't know it? According to your own your own post here, um, understanding these and and using the correct pronouns would improve your product for trans and non non-binary people. It seems like this is directly related to the product.
▶ 3:32:50Again, it was the team, the social team and the research team that felt strongly around putting Well, you were you were CEO, so you can't pawn off uh responsibility to to somebody else here. What what about bathroom access on 23 andme's website? I've got it up here on my phone. Um there's a 23 andme blog and there's a little subheading about bathroom access. Is it still 23 andme's official position that men should be using women's restrooms? I'm not at 23 and me anymore. Okay.
▶ 3:33:20Was it while you were at 23 and me? I think we had non-gendered bathrooms as well. Well, that's that's not what this is referring to. This is referring to laws uh that seek to force in your own words force trans individuals to use a restroom that that does not correspond to their gender gender identity. Um is it while you were there was it 23 and me's position that men should be using women's restrooms? I think our position was just to make sure that we're applicable to laws that this isn't in reference.
▶ 3:33:51This is actually against laws that would stop people from using the wrong restroom. Um, so this is this is actually against laws. I haven't seen I I don't have that post in front of me, so I I can't comment specifically. Is it is it was it 23 and me's position while you were there that children should be transed? Because that's on this website as well. I I don't know specifically what you're referring to. I can uh read you a little bit about it.
▶ 3:34:18Um supports gender affirming health care such as hormones in surgery for trans youth. I think 23 andme referred specifically some of some of the pediatric Sounds to me like you took a genetics company which you built and congratulations for doing that and turned it into a a woke social justice organization. You want to run away from that now. You don't doesn't sound like you even knew what you were talking about at the time. You don't know what any of these pronouns mean.
▶ 3:34:47Um and now realize that this is politically not very popular. um says a lot about about where your convictions were and and what you meant here. So, thank you, Mr. Chairman. Thank you. And uh just one last question before we uh go to a brief closing statement. Uh go first. You go first. I'm sorry. Go ahead. Uh thank you, Mr. Chair.
▶ 3:35:11Um I I will just will note that uh several of our Republican colleagues uh spent so much time talking about trans and this is the oversight committee. this is a hearing about genetic information and instead we are focused I think it's fair to say that a number of my Republican colleagues seem obsessed with trans issues as opposed to say things like the corruption we're seeing in our government the illegal uh removals and deportations of citizens and people here on permanent residents and uh permanent green cards and student visas.
▶ 3:35:39Uh but this is an important hearing because Americans do do deserve to know what the sale of 23 andme will mean for their sensitive genetic data. While 23 andme's privacy policies current allow currently allow customers to delete their data from the company, the next buyer of 23me could do away with these types of safeguards for its 15 million customers. Despite today's testimony from the current and former CEO of 23 andme customers visibility into their data, where it may be sold, and what the company's third party partners do with it is extremely opaque.
▶ 3:36:09In addition, it's clear that no comprehensive federal data exists to limit companies like 23 andme from selling their data to third parties. The collection and storage of copious amounts of sensitive personal information, whether it's in 23 andme's database or in the federal databases containing Americans sensitive information creates a clear target for hostile actors.
▶ 3:36:30Sensitive data can be subject to exploitation both for national security purposes whether it's the CCP, Russia or other foreign adversaries or for consumer exploitation, including by data brokers and advertising and market analytics Our nation's federal laws have not kept up with technological advances or the potential threats from malicious and foreign actors.
▶ 3:36:51Americans need strong oversight and stronger laws to bolster our national security, our private security, and our privacy protections to make sure that our sensitive data remains safe. If Americans were scared about what 23 and me might do with their data, they'd be really scared if they thought about what Doge and the Trump administration are already doing with this data.
▶ 3:37:10Congressional Republicans cannot continue to ignore the Trump administration's blatant attacks on and destruction of critical security and privacy protections across the This Trump administration has conducted mass terminations of critical uh federal IT experts, chief information officers, and other technology professionals while also removing many of the inspector generals that are meant to ensure good processes.
▶ 3:37:35Doge, meanwhile, has seized unauthorized access of Americans data, disregarding long-standing cyber security practices and existing data privacy laws. And thanks to a brave whistleblower, we know that here on the oversight committee, Democrats learned that Doge is reportedly creating a master database of sensitive information from across all federal agencies in apparent violation of existing privacy and cyber security protections that ensure that this data must be cannot be exploited or misused.
▶ 3:38:04But here on this committee, unfortunately, the majority is just ignoring this all uh and sacrificing our rights to data privacy and security. All to shield Elon Musk, Donald Trump, and their cronies from accountability. And again, want to focus on reiterate the fact that so many of our colleagues in this hearing uh focused on trans issues. They attacked the trans community. Not sure what that's about. When we're talking about privacy, we face real and clear threats to our privacy.
▶ 3:38:29uh this hearing raised some of them, but we ought to be thinking about the federal the threats to our federally held privacy as well. Congress has to open our eyes and address the threats in front of the American people much better. I yield back. Uh before I close, Miss Wiki, there are news reports that uh and rumors that Oracle and executive chairman Larry Ellison is the backer in your bid to acquire 23 and me. Are you aware of these rumors?
▶ 3:38:59So I I have I've I've read some news reports. Is Oracle the company backing the current bid is exclusively from me? Is exclusively what? Is exclusively from All right. So you're buying your own company out of bankruptcy exclusively. I'm trying very hard. Wow. Very good. Okay.
▶ 3:39:30Well, I think that uh this was a very productive hearing. I want to thank our witnesses who were here today. Uh I think it's very clear there's bipartisan concern that Americans sensitive genetic data could end up in the hands of bad actors. We've heard commitment from uh the two witnesses from 23 and me today that that will not happen.
▶ 3:39:57We'll be watching that very very closely and uh uh as as the bankruptcy proceeding moves forward and more information is known about the state of the company, then this committee will continue to uh conduct its investigation and continue to be transparent with the American people on on what we find and do everything in our ability to see that uh America's private data is is protected from bad actors.
▶ 3:40:26So with that members uh all members have five legislative days within which to submit materials and additional written questions for the witnesses which will be forwarded to the witnesses. If there's no further business without objection the committee stands Thank you all.