Badges, Passwords, and Base Pairs: Auditing Who Really Holds the Keys to the American Genome

An Overlooked Perimeter

Discussions of genomic security tend to fixate on external adversaries: nation-state hackers, dark-web brokers, ransomware crews. Far less attention is paid to the people already inside the building. Sequencing facilities are, by design, staffed by a continuously changing population — doctoral candidates, rotation students, visiting scholars, contract bioinformaticians, and short-term technicians — all of whom may require legitimate access to raw sequence data in order to do their jobs.

The resulting exposure is structural rather than incidental. A genome, once viewed by an unauthorized insider, cannot be un-viewed, and the institution may never know the disclosure occurred.

What Near-Miss Reports Suggest

Formal incident disclosures involving insider misuse of genomic data remain rare in the public record. But near-miss accounts gathered from lab managers, IRB correspondence, and professional listservs describe a familiar pattern: a student curious about a relative's sample, a departing contractor copying datasets to personal cloud storage "to finish at home," a shared workstation left logged into a patient-linked pipeline.

None of these scenarios requires malicious sophistication. Most exploit the same handful of weaknesses — credential sharing, role creep, and the absence of query-level logging on analysis servers.

A Comparison of Sequencing Center Practices

To understand the current landscape, this paper reviewed publicly available policies, security questionnaires, and published standard operating procedures from large academic sequencing centers and commercial laboratories across the United States. The findings fall along a spectrum:

• Mature implementations layer single sign-on, hardware keys, per-project data enclaves, and immutable audit trails. Access expires automatically with grant funding or employment status.
• Intermediate practices enforce role-based access on paper but rely on manual deprovisioning, meaning a departing intern's account may persist until someone remembers to remove it.
• Minimal controls, more common in smaller academic labs, treat the sequencing drive as ordinary laboratory property — accessible to anyone with the lab's shared credentials.

The variance is striking given that all of these institutions handle data of equivalent identifiability. A hospital sequencing core and a direct-to-consumer laboratory may face identical insider risks while operating under wildly different rulebooks.

The Case for Genomic Access Tiering

We propose a baseline framework — genomic access tiering — that classifies personnel by the scope of data they can reasonably require:

1. Tier 0 (No raw access): Administrative, facilities, and sales staff. Data contact limited to aggregate reports.
2. Tier 1 (Pseudonymized access): Technicians processing samples under identifiers they cannot reverse without a separate authorization step.
3. Tier 2 (Linked access): Analysts who need identifier linkage, subject to dual authorization and session logging.
4. Tier 3 (Unrestricted custodianship): A small, named set of data stewards with audited authority over re-identification keys.

Movement between tiers should require documented justification, time-limited grants, and automatic review. Critically, tier assignment should follow the person — not the lab — so that a rotation student inherits no standing privileges.

Implementation Realities

Tiering imposes costs. Small cores lack dedicated security staff, and academic incentive structures rarely reward time spent on access hygiene. We therefore recommend that federal funders — NIH in particular — treat minimum access tiering as a condition of data-sharing certification, pairing the mandate with shared tooling rather than unfunded requirements.

Insider risk in genomics will never reach zero. But the current gap between best practice and common practice is wide enough to close with modest, standardized effort. The genome's custodians should know exactly who is holding the keys — and take them back the moment a job ends.