9 ms·

TL;DR: I don't understand how adding homomorphic encryption makes a cloud virus scanner for physical pathogens a better idea > Only authorized researchers shou

TL;DR: I don't understand how adding homomorphic encryption makes a cloud virus scanner for physical pathogens a better idea > Only authorized researchers should be able to obtain DNA permitting them to assemble pandemic-capable agents. Imagine this becomes legally mandatory. What happens when they get breached? For example: * Does it enable denial-of-service attacks by returning false positives hospitals legally can't ignore? * Does it return false negatives as part of another attack? Example: printing known or novel virii which will be introduced in a specific lab? * Does the attacker selectively perform these behaviors as part of an action against a specific person or area? Metadata seems like it would enough to target the physical parts of an attack usefully, even without plaintext. The best security & privacy approach I've seen in hospitals is keeping critical services on-prem, or at least strictly intranet-only. The latter ends up being forced by physical scale once a medical complex grows large enough to span multiple buildings. The firmware embedding mentioned on their site seems better than cloud, yet still seems misguided. How will you debug problems, especially if you never have access to the plaintext? Formal methods and verified programs? Provably equivalent encrypted and plain operations?

deleted 3y ago
[deleted]
jefftk 3y ago
> I don't understand how adding homomorphic encryption makes a cloud virus scanner for physical pathogens a better idea The reason to use a cloud service is that you can check whether someone is trying to synthesize something hazardous without distributing a list of the hazards. There are a lot of subtle ways to cause harm with biology, and you don't want to tell people where to look. Then the reason to use homomorphic encryption is that otherwise the cloud service learns which sequences people are trying to synthesize. Biotech companies care a lot about keeping their in-progress work private, so they'd reject a cloud system without this. > Does it enable denial-of-service attacks by returning false positives hospitals legally can't ignore? Aside: I'm confused why you're saying "hospitals" -- medical providers don't synthesize things, it's researchers at universities and biotech companies. Maybe you're using "hospitals" as in "research hospitals" which is fine, but maybe you're using it because you're under the impression that synthesis is part of medical treatment? To answer your question, though, if an attacker managed to add something normal and harmless to the DB then yes, a benchtop synthesizer would refuse to synthesize the sequence. The lab would escalate, it would be sorted out, there'd be a postmortem etc. > Does it return false negatives as part of another attack? Example: printing known or novel virii which will be introduced in a specific lab? Yes, if an attacker managed to remove a harmful sequence from the database then it wouldn't raise any flags if they or a confederate tried to synthesize that sequence. Both of these cases come down to "it's important that you have good controls around what's in the DB, and a secure process for making changes." > Metadata seems like it would enough to target the physical parts of an attack usefully, even without plaintext. I'm not sure what you're saying here.
- Fomite 3y ago
  "Aside: I'm confused why you're saying "hospitals" -- medical providers don't synthesize things, it's researchers at universities and biotech companies" During at least two pandemics I've worked on, I've known hospital labs synthesizing their own PCR primers for diagnostic tests.

deleted 3y ago

[deleted]

jefftk 3y ago

> I don't understand how adding homomorphic encryption makes a cloud virus scanner for physical pathogens a better idea The reason to use a cloud service is that you can check whether someone is trying to synthesize something hazardous without distributing a list of the hazards. There are a lot of subtle ways to cause harm with biology, and you don't want to tell people where to look. Then the reason to use homomorphic encryption is that otherwise the cloud service learns which sequences people are trying to synthesize. Biotech companies care a lot about keeping their in-progress work private, so they'd reject a cloud system without this. > Does it enable denial-of-service attacks by returning false positives hospitals legally can't ignore? Aside: I'm confused why you're saying "hospitals" -- medical providers don't synthesize things, it's researchers at universities and biotech companies. Maybe you're using "hospitals" as in "research hospitals" which is fine, but maybe you're using it because you're under the impression that synthesis is part of medical treatment? To answer your question, though, if an attacker managed to add something normal and harmless to the DB then yes, a benchtop synthesizer would refuse to synthesize the sequence. The lab would escalate, it would be sorted out, there'd be a postmortem etc. > Does it return false negatives as part of another attack? Example: printing known or novel virii which will be introduced in a specific lab? Yes, if an attacker managed to remove a harmful sequence from the database then it wouldn't raise any flags if they or a confederate tried to synthesize that sequence. Both of these cases come down to "it's important that you have good controls around what's in the DB, and a secure process for making changes." > Metadata seems like it would enough to target the physical parts of an attack usefully, even without plaintext. I'm not sure what you're saying here.

Fomite 3y ago
"Aside: I'm confused why you're saying "hospitals" -- medical providers don't synthesize things, it's researchers at universities and biotech companies" During at least two pandemics I've worked on, I've known hospital labs synthesizing their own PCR primers for diagnostic tests.