H.Hrg.119

1[House Hearing, 119 Congress]2[From the U.S. Government Publishing Office]34                      SECURING AMERICANS' GENETIC5                   INFORMATION: PRIVACY AND NATIONAL6                   SECURITY CONCERNS SURROUNDING7                       23ANDME'S BANKRUPTCY SALE89  =======================================================================1011                                 HEARING1213                               BEFORE THE1415                        COMMITTEE ON OVERSIGHT AND16                            GOVERNMENT REFORM1718                     U.S. HOUSE OF REPRESENTATIVES1920                    ONE HUNDRED NINETEENTH CONGRESS2122                             FIRST SESSION2324                               __________2526                              JUNE 10, 20252728                               __________2930                           Serial No. 119-323132                               __________3334Printed for the use of the Committee on Oversight and Government Reform[3536[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]3738    Available on: govinfo.gov, oversight.house.gov or docs.house.gov3940                                __________4142                   U.S. GOVERNMENT PUBLISHING OFFICE4360-682 PDF                  WASHINGTON : 20254445-----------------------------------------------------------------------------------4647              COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM4849                    JAMES COMER, Kentucky, Chairman5051Jim Jordan, Ohio                     Vacant, Ranking Minority Member52Mike Turner, Ohio                    Eleanor Holmes Norton, District of53Paul Gosar, Arizona                      Columbia54Virginia Foxx, North Carolina        Stephen F. Lynch, Massachusetts55Glenn Grothman, Wisconsin            Raja Krishnamoorthi, Illinois56Michael Cloud, Texas                 Ro Khanna, California57Gary Palmer, Alabama                 Kweisi Mfume, Maryland58Clay Higgins, Louisiana              Shontel Brown, Ohio59Pete Sessions, Texas                 Melanie Stansbury, New Mexico60Andy Biggs, Arizona                  Robert Garcia, California61Nancy Mace, South Carolina           Maxwell Frost, Florida62Pat Fallon, Texas                    Summer Lee, Pennsylvania63Byron Donalds, Florida               Greg Casar, Texas64Scott Perry, Pennsylvania            Jasmine Crockett, Texas65William Timmons, South Carolina      Emily Randall, Washington66Tim Burchett, Tennessee              Suhas Subramanyam, Virginia67Marjorie Taylor Greene, Georgia      Yassamin Ansari, Arizona68Lauren Boebert, Colorado             Wesley Bell, Missouri69Anna Paulina Luna, Florida           Lateefah Simon, California70Nick Langworthy, New York            Dave Min, California71Eric Burlison, Missouri              Ayanna Pressley, Massachusetts72Eli Crane, Arizona                   Rashida Tlaib, Michigan73Brian Jack, Georgia74John McGuire, Virginia75Brandon Gill, Texas7677                                 ------7879                       Mark Marin, Staff Director80                James Rust, Chief Counsel for Oversight81                     Mitch Benzine, General Counsel82                    Margaret Harker, Senior Advisor83                         Ellison Tolan, Counsel84              Sharon Utz, Senior Professional Staff Member85               Charles Donahue, Professional Staff Member86      Mallory Cogar, Deputy Director of Operations and Chief Clerk8788                      Contact Number: 202-225-50748990                  Jamie Smith, Minority Staff Director91                      Contact Number: 202-225-50519293                                 ------94                         C  O  N  T  E  N  T  S9596                              ----------9798                           OPENING STATEMENTS99100                                                                   Page101102Hon. James Comer, U.S. Representative, Chairman..................     1103104Hon. Stephen F. Lynch, U.S. Representative, Ranking Member.......     3105106                               WITNESSES107108Ms. Anne Wojcicki, Board Member, 23andMe Holding Co.109Oral Statement...................................................     5110111Mr. Joe Selsavage, Interim CEO, 23andMe Holding Co.112Oral Statement...................................................     7113114Professor Margaret Hu (Minority Witness), Professor of Law,115  William & Mary Law School116Oral Statement...................................................     8117118Written opening statements and bios are available on the U.S.119  House of Representatives Document Repository at:120  docs.house.gov.121122                           INDEX OF DOCUMENTS123124  * Article, Wired, ``CFPB Quietly Kills Rule to Shield Americans125  From Data Brokers''; submitted by Rep. Crockett.126127  * Article, The Guardian, ``Hackers Got Nearly 7M People's Data128  from 23andMe. Firm Blamed Users''; submitted by Rep. Gosar.129130  * Letter, re: USDS Resignation; submitted by Rep. Norton.131132The documents listed are available at: docs.house.gov.133134                          ADDITIONAL DOCUMENTS135136  * Questions for the Record: Professor Hu; submitted by Rep.137  Lynch.138139  * Questions for the Record: Professor Hu; submitted by Rep.140  Ansari.141142  * Questions for the Record: Mr. Selsavage; submitted by Rep.143  Langworthy.144145  * Questions for the Record: Mr. Selsavage; submitted by Rep.146  Lynch.147148  * Questions for the Record: Mr. Selsavage; submitted by Rep.149  Mfume.150151  * Questions for the Record: Ms. Wojcicki; submitted by Chairman152  Comer.153154  * Questions for the Record: Mr. Wojcicki; submitted by Rep.155  Langworthy.156157These documents were submitted after the hearing, and may be158  available upon request.159160                      SECURING AMERICANS' GENETIC161                   INFORMATION: PRIVACY AND NATIONAL162                   SECURITY CONCERNS SURROUNDING163                       23ANDME'S BANKRUPTCY SALE164165                              ----------166167                         TUESDAY, JUNE 10, 2025168169                     U.S. House of Representatives170171              Committee on Oversight and Government Reform172173                                                   Washington, D.C.174175    The Committee met, pursuant to notice, at 10:02 a.m., in176HVC-210, U.S. Capitol Building, Hon. James Comer [Chairman of177the Committee] presiding.178    Present: Representatives Comer, Gosar, Foxx, Grothman,179Cloud, Palmer, Higgins, Sessions, Biggs, Perry, Timmons,180Burchett, Greene, Luna, Burlison, Crane, McGuire, Gill, Norton,181Lynch, Krishnamoorthi, Mfume, Brown, Stansbury, Frost, Lee,182Crockett, Randall, Subramanyam, Bell, Min, Pressley, and Tlaib.183    Chairman Comer. Filling in throughout the Committee hearing184because people stayed up all night watching America's team,185Murray State, beat Duke to go to the College World Series, so186people will be in momentarily.187    I recognize myself for the purpose of making an opening188statement.189190 OPENING STATEMENT OF THE CHAIRMAN JAMES COMER, REPRESENTATIVE191                         FROM KENTUCKY192193    I want to welcome everyone to today's Committee hearing on194the privacy and national security concerns surrounding 23andMe195bankruptcy sale. 23andMe is a direct-to-consumer genetic196testing company in possession of personal genetic data of197millions of Americans. On March 23, 2025, the company198voluntarily filed for Chapter 11 bankruptcy, leaving open the199question of who will purchase 23andMe and who may gain access200to the sensitive information of customers and their family201members.202    On May 19, 2025, Regeneron Pharmaceuticals, a biotechnology203company based in New York, announced that it had entered into204an asset purchase agreement to acquire 23andMe. On June 4,2052025, the court decided to reopen the auction for 23andMe to206allow for final bids from Regeneron, TTAM Research, and let me207note that TTAM was founded by 23andMe co-founder and former208CEO, Ms. Anne Wojcicki. With over 15 million customers209worldwide, 23andMe uses a saliva sample to uncover their210ancestry, family traits, and potential health risks. To whoever211ends up controlling the company, there are serious concerns212about what will happen to this private information. How will it213be stored? What will it be used for? Could it end up in the214hands of a foreign adversary through direct investment or215indirectly through future partnerships? Could the information216be used against customers and consumers?217    23andMe has a record of engaging with foreign adversaries,218namely the Chinese Communist Party (CCP). In 2015, the company219received $115 million in funding from investors, including WuXi220Healthcare Ventures, which was then a corporate venture arm of221WuXi AppTec, a company with ties to the CCP and Chinese222People's Liberation Army. At the time, the investment valued22323andMe at $1.1 billion. According to 23andMe, this partnership224was terminated, but questions remain about the potential for225the future owner of the company to partner with bad foreign226actors. Notably, Regeneron partnered with a Chinese company227called Zai Lab Limited on drug clinical trials during the228height of the COVID pandemic.229    It is well known that the CCP engages in mass surveillance230and has conducted dangerous activities to advance bio weapons,231both used against its critics. In fact, 23andMe was hacked in2322023, exposing personal information from nearly seven million233profiles, mostly targeting Jewish and Chinese customers. The234New York Times reported that China and other countries are235working to dominate these technologies and are using both legal236and illegal means to obtain American expertise. The CCP has a237history of misusing genetic data, including DNA tests to track238Uyghur Muslims.239    National security concerns about 23andMe are not new. In240December 2019, the U.S. Department of Defense advised members241of the military not to use consumer DNA kits, saying the242information collected by private companies could pose a243security risk. A DOD memo warned that consumers' DNA kits pose244personal and operational risks to service members and raised245concerns about outside parties using genetic data for mass246surveillance and unauthorized tracking. It is imperative that24723andMe and other companies like it ensure there is absolutely248no legal or illegal way for foreign adversaries or anyone else249to access, manipulate, and abuse Americans' genetic data to250advance their nefarious agendas.251    Potential harm for consumers does not come solely from252hostile foreign actors. Disclosures of individuals' genetic253data could also be used for assessing higher insurance premium,254restrictions on credit extensions by financial institutions,255and targeted advertising based on predisposition to specific256medical conditions. All of this raises concerns about whether257Congress needs to take action to ensure safety of Americans'258personal genetic data. Given these serious risks, I look259forward to hearing from the co-founder, former CEO, and current260board member of 23andMe, who is bidding in the bankruptcy sale,261Ms. Anne Wojcicki and interim CEO, Mr. Joseph Selsavage.262    As previously discussed with the witnesses, the Committee263is aware of some court-mandated restrictions on public264disclosure of specific aspects of the ongoing bankruptcy265proceedings. It is our understanding that these restrictions266are limited and not applicable to all aspects of the pending267bankruptcy. The Committee expects the witnesses to answer the268questions to the fullest extent possible. And with that, I269yield to Ranking Member Lynch for his opening statement.270    Mr. Lynch. Thank you, Mr. Chairman, and I want to thank the271witnesses for their willingness to come before the Committee272and help us with our work.273274      OPENING STATEMENT OF RANKING MEMBER STEPHEN LYNCH,275               REPRESENTATIVE FROM MASSACHUSETTS276277    Mr. Lynch. Chairman Comer, thank you for calling this278hearing to examine the very serious issue of how we can protect279Americans' sensitive personal data from hostile actors. 23andMe280holds the genetic and biographical data of 15 million281customers. This includes billions of phenotypic data points282that make up DNA profiles, detailed genealogical and ancestry283history, and importantly, health predispositions. While284healthcare providers and insurance companies must follow285Federal laws like the Health Insurance Portability and286Accountability Act, or HIPAA, which protects patients'287sensitive data from unauthorized sharing, direct-to-consumer288companies like 23andMe operate with minimal oversight and289regulation. The lengthy and opaque terms of service and privacy290policies that customers are required to agree to typically291allow for their data to be sold during a sale or bankruptcy,292and that is precisely the situation that millions of the293company's customers find themselves in today.294    Americans deserve to know what the sale of 23andMe will295mean for sensitive genetic data it holds. Unfortunately,296Chairman Comer has demanded this hearing take place today,297unfortunately, in the midst of the bankruptcy bidding process298when these witnesses are legally prohibited in some respects299from speaking to any details related to the bankruptcy and300sale, but we will do our best together to get answers despite301this challenge. Our concerns are magnified by the fact that the302hostile actors, including foreign adversaries, are constantly303attempting to buy or steal Americans' sensitive data.304    In 2023, 23andMe was the target of a massive breach in305which an outside attacker stole the data of seven million306customers, reportedly targeting those with Ashkenazi Jewish307heritage. The governments of the People's Republic of China,308the Russian Federation, North Korea, and Iran conduct309persistent cyberattacks against the United States. China's310president, Xi Jinping, has made clear that dominating the AI311race and achieving global supremacy in biotechnology are312critical to the future geopolitical power, and obtaining vast313troves of Americans' sensitive data is a key component of this314strategy. Failing to safeguard Americans' data from these315hostile actors would not only be a critical violation of316privacy, but also a national security catastrophe. Given the317sensitive nature of the data that companies like 23andMe hold,318the possibility for that data to end up in entirely new hands319in the event of a sale or bankruptcy and the risk of data320breaches, including by hostile foreign governments, we cannot321rely solely on corporate efforts to ensure this data is322protected. We need strong privacy protections and comprehensive323laws and regulations that address the evolving landscape.324    That is where the Federal government comes in, but instead325of a strong Federal government that makes every effort to326protect Americans' sensitive data, the Trump Administration and327Department of Government Efficiency (DOGE) are dismantling our328IT and cybersecurity workforce and replacing hardworking civil329servants with unqualified hacks.330    [Photo]331    Mr. Lynch. Just last week, President Trump installed a 22-332year-old with no national security expertise to oversee a333Department of Homeland Security hub for terrorist prevention.334The Administration has spent the last five months weakening our335leading cybersecurity and consumer protection agencies and336purging the Federal watchdogs who ensure government works for337the people's interests. I condemn those efforts, and if338Committee Republicans were serious about this hearing, they339would as well.340    If we are concerned about the security and privacy of341Americans' sensitive data, we need a hearing examining the342myriad of ways that DOGE is violating cybersecurity and privacy343laws, and making our personal information easier to steal or344use against us. We need a hearing on how and why DOGE installed345a server of unknown nature and origin at the Office of346Personnel Management, or the specialized computers that DOGE347engineers are reportedly creating to merge Americans' data348across agencies with blatant disregard for Federal laws that349ensure Americans know when their data is being accessed and by350whom. We need a hearing on the way that DOGE has exposed351critical Federal systems to hostile foreign actors, and on the352massive cuts to its personnel that DOGE has made across the353government, including at critical agencies like the Social354Security Administration, which houses every American's Social355Security number.356    Last week, Republicans on the Committee voted against,357again, to shield Elon Musk from accountability for the358destruction and danger he has wrought on Americans, quite359possibly under the influence of hard drugs, but this is the360Oversight Committee and the American people deserve answers. We361have weak privacy laws, persistent threats from foreign362adversaries, and Trump's own estranged top advisor and a363President who is both intentionally and through incompetence364crippling the Federal government's cybersecurity defenses,365privacy safeguards, and oversight capabilities. This perfect366storm leaves Americans' sensitive data vulnerable to breaches,367exploitation, and surveillance. Americans, not private368companies, hackers, or Elon Musk and DOGE, deserve to own their369data and make the decision about how, where, and if their370sensitive information is used.371    I hope my Republican colleagues will join us in taking a372comprehensive approach to securing Americans' private data373because while it appears Americans can opt out to delete their374data from 23andMe, there are no options to delete their data375from DOGE. Mr. Chairman, I yield back.376    Chairman Comer. The gentleman yields back. I am pleased to377introduce our witnesses. Today, all witnesses are testifying in378their personal capacities.379    First of all, Anne Wojcicki is a co-founder, board member,380and former CEO of 23andMe. Before co-founding 23andMe, Ms.381Wojcicki worked at various hedge funds and investment companies382as a healthcare analyst. She founded 23andMe in 2006. Ms.383Wojcicki served as CEO of 23andMe for almost 20 years. Her384service as CEO voluntarily came to an end on March 23, 2025.385    Joe Selsavage is the current interim CEO of 23andMe as of386March 23, 2025. He began working for 23andMe in November 2021387after the company was acquired by Lemonaid Health. He served as38823andMe's Chief Financial Officer as he has over 25 years of389accounting and finance experience. He formerly worked as a390consultant and chief financial officer for various companies.39123andMe's board chose Mr. Selsavage to serve as interim CEO392after Ms. Wojcicki voluntarily resigned her resignation and39323andMe's simultaneous bankruptcy announcement on March 23.394    Dr. Margaret Hu is the professor of law and Director of395Digital Democracy Lab at William & Mary Law School. She396previously served as special policy counsel in the Civil Rights397Division of the U.S. Department of Justice.398    Pursuant to Committee rule 9(g), the witnesses will please399stand and raise their right hands.400    Do you all solemnly swear to tell the truth, the whole401truth, and nothing but the truth, so help you God?402    [A chorus of ayes.]403    Chairman Comer. Let the record show that the witnesses have404answered in the affirmative. Thank you all. You may take a405seat.406    We appreciate you being here today and look forward to your407testimony. Let me remind the witnesses that we have read your408written statement and they will appear in full in the hearing409record. Please limit your oral statements to 5 minutes. As a410reminder, please press the button on the microphone in front of411you so that it is on and the Members can hear you. When you412begin to speak, the light in front of you will turn green.413After 4 minutes, the light will turn yellow. When the red light414comes on, your 5 minutes have expired, and we would ask that415you please wrap up.416    I now recognize Ms. Wojcicki for her opening statement.417418 STATEMENT OF ANNE WOJCICKI, BOARD MEMBER, 23ANDME HOLDING CO.419420    Ms. Wojcicki. Chair Comer, Ranking Member Lynch, and421Members of the Committee, my name is Anne Wojcicki. I co-422founded 23andMe nearly two decades ago with the mission of423helping people access, understand, and benefit from the human424genome. My personal mission is to have a meaningful impact on425the world. It has been my life's passion to understand the426human genome and DNA, the code of life.427    The Committee has raised important questions about the428protections and privacy that 23andMe applied to our customers'429data. Over the company's almost 20-year history, these are430questions we thought seriously and deeply about. We did this431because our focus has always been on improving the health of432our customers. If we did not have their trust, we would not433have been able to do the groundbreaking research that impacted434millions of lives.435    Let me be very clear about our practices and what we stood436for. During my time as CEO, privacy was central to every437decision we made from product development to research438initiatives. Customers had choice and transparency about what439information they saw and how they consented for their data to440be used. Customers were required to give explicit consent441before their anonymized data was used for any research purpose,442and over 80 percent of our customers made the choice to opt in.443We never provided information to any third party without the444customer's explicit consent. With that foundation, let me turn445to our mission and what we were able to accomplish for our446customers.447    The company's mission was driven by the belief that it is448an individual's right to be able to affordably access their own449genetic information and to learn what it means for them. This450guiding light has always been at the core of 23andMe's mission451and core to my beliefs. 23andMe pioneered the field of genetic452ancestry and direct-to-consumer genetic testing. The journey of453pioneering access to genetic information for individuals has454not always been easy, but I am incredibly proud of the impact455we have had. Over 15 million customers have learned about their456ancestry, found relatives, and potentially lifesaving health457information. For example, over a million customers learned they458carried a genetic variant associated with blood clotting risk,459allowing them to seek care to prevent potentially fatal clots.460Customers also gained information about sickle cell disease,461chronic kidney disease, type 2 diabetes, and coronary artery462disease. In many cases, these reports were lifesaving. Hearing463from customers about how their genetic information changed464their lives is what drives me every single day.465    One recent email from a customer read, ``Hi Anne. I just466wanted to share my story with you because I was diagnosed with467breast cancer on June 24, 2024, at the age of 33. I had no468symptoms at all, and the doctors felt no lumps. It was all469because of 23andMe that I even got a mammogram, and because of470that, we have caught it at an early stage. And although the471upcoming months will be hard, it could have been so much worse.472A few years ago, I did 23andMe and we did the health version,473and it showed that I had the BRCA1 gene mutation. I have no474family history that we know about, so I was not on track to get475a mammogram until I was 40. I just wanted to send this476testimony and say thank you. I am so indebted to you for making477me aware of this, and I truly feel like because this was caught478early, my life is saved and I owe you that. From me, my family,479my friends, and my 1-year-old daughter, thank you for saving480our lives.''481    Let me be clear. None of these discoveries that saved lives482would have been possible without scientific research. During my483tenure as CEO of 23andMe, our research program was truly484groundbreaking. The impact of our research has extended far485beyond our customers. It has benefited the broader scientific486community and communities from coast to coast. When I spoke487with customers facing serious health conditions, their message488to us was clear: use the data we gave you. Help us if you can489or help someone else. Do not store it. Do something with it.490    With my remaining time, I want to address one last topic:491China. The threat posed by China to the biotechnology sector is492real and is not new. China has made massive investments in life493sciences and biotechnology and is rapidly positioning itself as494a global leader. Meanwhile, the U.S. is falling behind. This495disparity concerns me deeply. Understanding the human genome is496not just about scientific advancement, it is about national497security, global competitiveness, and the health of all498Americans. This belief has fueled my work throughout my career,499and it continues to drive my unwavering commitment to advancing500genomics for the public good. As I believe you know, I am501currently pursuing an acquisition of the company as an502independent bidder during the bankruptcy proceedings. Looking503forward, I remain committed to this mission in driving504meaningful change in our healthcare system by continuing to505empower individuals and enable them to make informed decisions506about their health because the future of healthcare belongs to507all of us.508    I appreciate the opportunity to be here today, and I look509forward to your questions.510    Chairman Comer. Thank you very much. I now recognize Mr.511Selsavage.512513  STATEMENT OF JOE SELSAVAGE, INTERIM CEO, 23ANDME HOLDING CO.514515    Mr. Selsavage. Chairman Comer, Ranking Member Lynch,516Members of the Committee, thank you for the opportunity to517appear before you today. My name is Joseph Selsavage, and I am518the interim chief executive officer of 23andMe, a mission-519driven organization founded on a simple, yet transformative520belief that individuals have the right to access, understand,521and benefit from their own genetic information.522    From the very beginning, 23andMe's purpose has been clear:523to help people live healthier lives through direct access to524their own DNA, to accelerate scientific discovery, and to525contribute meaningfully to the future of personalized medicine.526We recognize that with this vision comes immense responsibility527to the millions of individuals who have chosen to participate528in something larger than themselves. We are here today not only529to answer your questions, but to reaffirm our deep commitment530to data privacy and security, transparency, customer choice,531data stewardship, and scientific integrity.532    Founded in 2006, 23andMe is a personal genomics and533biotechnology company that pioneered direct-to-consumer genetic534testing. We are named after the 23 pairs of chromosomes in535every human cell. Our mission has always been to empower536customers by providing access to information about their537personal genetics based on the latest science so that they can538make informed decisions about their healthcare journey. Our539services allow customers to gain DNA insights about their540genetic risk for dozens of conditions like type 2 diabetes,541Alzheimer's disease, and certain cancers. They can also learn542about their carrier status for inherited conditions like cystic543fibrosis or Tay-Sachs disease, or wellness factors like lactose544intolerance or deep sleep tendencies.545    23andMe's customers have consistently reported taking546positive health actions after learning about their genetics547through 23andMe services. Eighty-two percent of our customers548with actionable genetic results were previously unaware of549their health risks. The value of personal genomics goes beyond550the insights people learn about themselves. Customers who551register for our services also have the option for their data552to be shared for research purposes, and over 80 percent of our553customers have chosen to consent to research.554    Consent is a central tenant of 23andMe's research program.555We have separate research consents beyond our consent to556processing sensitive data, a privacy statement, and terms of557service that customers must review and agree to separately if558they want to participate in our research program. We remove all559identifying information before any genetic data is shared with560any third party. And any customer who affirmatively consents to561participate in our research program can easily opt out at any562time through their account settings and always have been able563to do so. Customers are also free to delete their accounts and564information at any time. Customers who affirmatively consent565contribute to more than 230 studies on topics that range from566Parkinson's disease to lupus to asthma and more. We collaborate567with advocacy organizations, universities, and biotech568companies to bring customer opportunities to participate in569research. Since 2010, 23andMe has published 293 papers that570helped advance scientific research in a wide range of fields.571    Due to circumstances that I discuss in more detail in my572written testimony, 23andMe is currently conducting a sales573process supervised by a United States bankruptcy court. That574process has been a success to date. We have two remaining575bidders, both American enterprises that will conduct a final576round of bidding later this week before the sale to the winning577bidder is presented for the approval by the court. Because this578proceeding is ongoing, I am unable to speak about the merits of579either bid for the ongoing sale process, but let me assure the580Committee that 23andMe remains committed to protecting customer581data. We are requiring that anyone bidding for 23andMe must582comply with all of our privacy policies. We recognize the vital583importance of protecting every individual's right to access and584control their genetic information. Empowering people with585knowledge about their DNA is not only a matter of personal586autonomy, it is a gateway to proactive and personalized health,587informed decision-making, and greater engagement in scientific588process.589    At 23andMe, we believe that when consumers are trusted with590their own data, they become partners in advancing medicine and591not just patients of it. I appreciate the opportunity to592testify before the Committee today, and I welcome your593questions.594    Chairman Comer. Thank you very much. I now recognize595Professor Hu for her opening statement.596597STATEMENT OF MARGARET HU (MINORITY WITNESS), PROFESSOR OF LAW,598                   WILLIAM & MARY LAW SCHOOL599600    Professor Hu. Thank you. Good morning, Chairman Comer,601Ranking Member Lynch, and Members of the Committee. I am602Margaret Hu, Davison M. Douglas professor of law and Director603of the Digital Democracy Lab at William & Mary Law School in604Williamsburg, Virginia. Thank you for the opportunity to605address the urgent matter of how best to secure Americans'606genetic data privacy.607    As this Committee recognizes, the collection, storage, and608analysis of sensitive genetic information and its disclosure609can pose a range of national security concerns and risks. The610bankruptcy proceedings of 23andMe demonstrate why these matters611are so consequential, especially in the age of artificial612intelligence and the future of AI warfare. The first decade of613my law career was dedicated to the Civil Rights Division of the614U.S. Department of Justice. My first day as a trial attorney615was the day before the terrorist attacks of September 11, 2001.616I immediately joined a post-9/11 task force and focused on617Homeland Security and border security issues. In the past618decade, I have served as a researcher and a professor of AI619law, constitutional law, and national security law. I would620like to approach this topic from the perspective of AI and621national security. My post-9/11 policy work introduced me to622the topics that now form the basis of my current research in623data privacy, cybersecurity, and AI governance with a624particular focus on biometric cybersurveillance and biometric625cyber intelligence.626    This hearing is critically important. Genetic data and627biometric cyber intelligence lies at the very center of a new628battlefield in the age of AI. Safeguarding the genetic data of62923andMe and other biotech corporations is not just a matter of630data privacy. It is of paramount importance as a matter of631national security. Consequently, in addition to discussing the632bankruptcy and consumer data protection laws of this current633matter, I am grateful for this opportunity to support the634Committee's examination of the national security implications635of the sale and transfer of this sensitive data. The topic of636genetic data privacy unfolding within the context of this637bankruptcy proceeding is simultaneously unfolding within the638context of a much larger crisis: inadequate Federal data639privacy and cybersecurity safeguards generally and inadequate640Federal laws to address the challenges of the AI revolution.641The 23andMe bankruptcy filing is a wake-up call that our642current legal inadequacy amounts to instability in our national643security.644    In the age of AI, data privacy, cybersecurity, and AI645infrastructure form the tapestry of overlapping systems of law646and technologies. The Federal Aviation Administration (FAA),647for example, coordinates airspace and aircraft traffic control,648aircraft safety and investigation, and sets standards for the649National Airport Systems. Without question, the FAA is seen as650an essential national security partner coordinating closely651with the U.S. Department of Defense as it supports both civil652and military aircrafts. Congress should now immediately enact653both Federal data privacy laws and cybersecurity laws, and also654take legislative action to enact Federal AI laws that655anticipate these important national security threats that can656be posed by inadequate AI regulations. The 23andMe bankruptcy657matter provides a window into why Congress should step forward658and enact these laws that are capable of creating a similar659administrative oversight structure as the FAA, including660regulations that acknowledge the need to coordinate national661security concerns in the handling of sensitive data.662    23andMe holds the genetic and personal data of over 15663million individuals, including predispositions to disease,664ancestral background, and familial linkages. This data is not665only personal and permanent, it is relational, making the666stakes unusually high. Almost seven million consumers were667exposed in a data breach of 23andMe in 2023. The company668entered into a settlement agreement that involved a $30 million669settlement. Now, in the moment of AI warfare, there is a highly670sensitive genetic data black market where foreign adversaries671are fighting to get this data for a wide range of reasons,672including for strategic advantage, sometimes referred to as673military identity dominance or for cyber intelligence purposes.674Biometrics included often referred to as hard biometrics,675fingerprints, iris scans, and palm prints, and DNA.676    In the intelligence context, the national security risks677and misuses and abuses of genetic data by foreign adversaries678may include potential biological warfare risks, blackmail, and679increased surveillance among other potential threats. The680Pentagon has previously warned military personnel that DNA kits681could pose a risk to national security. Other harms could682potentially include abusing genetic data for isolating and683discriminatory targeting, and potentially analyzing genetic684data and aggregating biometric data and biographical data for685the purposes of cognitive warfare.686    Data privacy is not only a consumer data privacy issue, but687also a national security one. Thank you, and I look forward to688your questions today.689    Chairman Comer. Thank you very much, and we will now begin690with our questions. I recognize myself for 5 minutes.691    And Ms. Wojcicki, I really appreciate your opening692statement and the fact that your company can identify the693potential risk for cancer and things like that. I mean, that is694great. But let us talk about--our concern is the national695security risk of what happens with the data and how it can be696used against consumers, and we are very concerned about that697because there is a precedence here where companies with Chinese698influence have stolen data. So, just to start off, with69923andMe, people provide a saliva sample to the company. What700tests are run on the sample?701    Ms. Wojcicki. I appreciate the question. The test that was702run, it was actually run on a gene chip that Illumina created.703So, the sample was sent. Somebody takes a saliva sample. They704get a tube.705    Chairman Comer. Okay. Okay. So, what type of information706did 23andMe obtain from the sample?707    Ms. Wojcicki. It was about 600,000 specific markers in your708genome, so markers that are known to vary between humans known709as snips.710    Chairman Comer. Okay. So, are the samples tested? They are711obviously tested for genetic markers, correct?712    Ms. Wojcicki. Correct. Correct. So, it was 600,000 genetic713markers.714    Chairman Comer. What is the purpose of testing the samples715for genetic markers? Can you explain that?716    Ms. Wojcicki. Yes. The purpose for it was really twofold.717It lets people have the opportunity to learn about their718ancestry, where they are from in the world, potentially areas719that they did not know about. They have the opportunity to720connect with family members, potentially, for instance,721adoptees who are looking to identify, you know, biological722siblings or parents.723    Chairman Comer. Right. Out of curiosity, is this optional724for consumers?725    Ms. Wojcicki. It is completely optional because we realized726there was a number of people who do not want to find additional727family members, and that they did not want to be identified.728So, it is an explicit consent where we ask people specifically,729do you want to find close family members or distant and you730have the ability at any time to toggle in or to toggle out of731that. It is very easy to do.732    Chairman Comer. So, did 23andMe also track genetic markers733over time in order to conduct long-term health studies?734    Ms. Wojcicki. We did. So, we also specifically tested on735markers that are known to be predispositions for health736conditions. So, in my testimony, for example, I talked about737the BRCA1. We specifically identified that there were a number738of people who were not able to get their BRCA results because739of the barriers that the insurance industry or their societies740have put up. So, we found actually about 20 to 30 percent of741our customers were learning that they had potentially, like, a742really detrimental genetic variant that put them at very high743breast cancer risk and they could not otherwise get that744information.745    Chairman Comer. So, you used this type of testing during746COVID-19. What was the purpose of that?747    Ms. Wojcicki. Well, it was the same test that we started748with in 2006. It was the same test going forward. We were very749consistent.750    Chairman Comer. What were the results?751    Ms. Wojcicki. It was the same. It was the same types of752results.753    Chairman Comer. Where did the data information from DNA754swabs go once testing was complete?755    Ms. Wojcicki. So, we worked with Labcorp. Labcorp had been756our partner for 18 years or so, so, it went to Labcorp. They757have an office in LA as well as in North Carolina.758    Chairman Comer. So, did the data get uploaded to a759database?760    Ms. Wojcicki. Yes. So, they would then send us data files761and that data would come into 23andMe. We also upload it. We762work with Amazon, AWS, all on U.S. servers.763    Chairman Comer. How was the data protected?764    Ms. Wojcicki. It was encrypted from end to end. We had all765kinds of ways that, again, the team thought about how it was766going to be encrypted, how it was sent. It also, I should be767super clear, had no identifiable information when it was sent768to Labcorp or when we received it, so we----769    Chairman Comer. How long does the data stay in that770database? How long? Forever?771    Ms. Wojcicki. At the 23andMe database?772    Chairman Comer. I am sorry?773    Ms. Wojcicki. At 23andMe you mean?774    Chairman Comer. Yes.775    Ms. Wojcicki. As long as the customer wants.776    Chairman Comer. Or anywhere, how long does the data stay in777the database?778    Ms. Wojcicki. As long as the customer wants. They have that779opportunity to delete their data at any time.780    Chairman Comer. So, where did the physical saliva sample go781after testing is complete?782    Ms. Wojcicki. The physical saliva sample would go to783Labcorp, and customers had the ability to say do I want my784saliva sample stored or not stored. And the reason why they785might want it stored is, for example, we were offering, in the786future, potentially you would want to upgrade, you would787potentially want to get a different type of test, or if there788were additional services. So, we offered biobank.789    Chairman Comer. If it was not stored, what happened? Did it790get----791    Ms. Wojcicki. It was discarded.792    Chairman Comer. It was discarded?793    Ms. Wojcicki. Correct.794    Chairman Comer. You are sure?795    Ms. Wojcicki. We are sure.796    Chairman Comer. Okay. Was it possible to run multiple tests797on one sample?798    Ms. Wojcicki. It was possible to run multiple tests on one799sample.800    Chairman Comer. Okay. The last question. Under your801leadership, did 23andMe scientists ever run multiple tests on a802single sample, and if so, were customers notified about the803additional tests?804    Ms. Wojcicki. We ran additional tests potentially for the805FDA submissions that we did. So, in order to do validation806studies, we would find customers with potentially very rare807variants, and we had to do an additional type of test,808sometimes called Sanger sequencing, to prove to the FDA that809the results we were generating were indeed accurate.810    Chairman Comer. Okay.811    Ms. Wojcicki. So, let me also be clear, we also sometimes812did additional research studies. So, we would occasionally look813and say let us do whole genome analysis for additional research814studies.815    Chairman Comer. Okay. Thank you. The Chair recognizes the816Ranking Member.817    Mr. Lynch. Thank you, Mr. Chairman. Ms. Wojcicki, right?818    Ms. Wojcicki. It is Wojcicki, correct. Yes.819    Mr. Lynch. In my neighborhood, we have a Polish triangle820where all the Polish families live. You look familiar.821    Ms. Wojcicki. Okay.822    Mr. Lynch. First of all, I appreciate you sharing your823personal history here. And you know, I fully appreciate the824value of early detection through 23andMe and other technologies825as well in terms of the value that that provides for early826treatment protocols for breast cancer. That is really, really,827really important. I hope that is something that people get from828this hearing today, but also your experience and your situation829actually amplifies the need for greater privacy protections,830right?831    On this Committee, back in 2015--I was a Member then--we832had a huge hack of the OPM servers, the Office of Personnel833Management. So, the massive data breach back then compromised834the personal information of about 22 million people, but most835importantly, that included Federal employees and anyone in the836Federal government that was applying for a national security837clearance. So, think about that. In our government, who would838need national security clearance, right? Those people who are839doing very sensitive work, so all that information went over to840the Chinese. It was a Chinese threat actor.841    At that time, the Oversight Republicans, really, I have to842give him great credit. Jason Chaffetz was the Chair of the843Committee at that point. I was just a Subcommittee Ranking844Member at that point, but we conducted an investigation, and845they came up with 13 recommendations that the OPM system and846its chief information officer should be empowered, accountable,847competent, and should ``improve Federal recruitment, training,848and retention of Federal cybersecurity specialists.'' What the849Trump Administration has done, though, is just done a blanket850firing of some of our most talented cybersecurity experts. They851have disregarded the cybersecurity and data privacy laws. DOGE852is reportedly creating a master database of sensitive853information across Federal agencies by carrying around854unsecured backpacks full of laptops, paving the way for855unparalleled surveillance capabilities. So, this is an extreme856danger to the very systems that we want to protect.857    So, Professor Hu, does firing all these IT and858cybersecurity experts, does that make Americans' data safer?859    Professor Hu. Thank you for that question. I think that860this raises deep concerns as far as how best do we safeguard861very sensitive governmental data. And as you mentioned, the862leadership of this Committee after the OPM hack, I think, was863very important, not only in recommending best practices for864cybersecurity moving forward for the Federal government, but865also uncovering the ways in which the laws of this body,866Congress, were not followed. And that some of those threats867that created, the types of issues that we saw after the OPM868hack could have been avoided.869    And so, part of what we have seen over the last ten years870is that the Federal government has undertaken very serious871protocols and training programs and the hiring of some of the872most qualified cybersecurity officials in these agencies. And873now the concern is, once those are dismantled, the expertise874and also the failure to follow the protocols that followed875after the OPM hack, that that leaves our Nation's most876sensitive databases and data on our citizens up to potential877abuse and national security risks.878    Mr. Lynch. Let me ask you this. So, in the past we have879several government agencies that collect troves of information.880You think about Social Security, a lot of information about,881you know, people getting benefits, their banking information,882things like that. The census, you know, that is a repeat every88310-year process, we actually send people to folks doors to get884personal information. The IRS, when you take a look at your tax885return, you figure out all the information that you are giving886the Federal government. We have kept those silos separate until887now. Now, Elon Musk is joining those so all that information888will be in one central database. We got that from a889whistleblower. What kind of damage would that do to our890national security and privacy?891    Professor Hu. Well, as was pointed out in the Oversight892Committee hearing recently, especially by the testimony that we893saw by Bruce Schneier, that the firewalls that are created by894keeping those data decentralization creates additional security895safeguards. And so, allowing for the integration and896consolidation of that data increases vulnerabilities in897cybersecurity. It is much easier to create the types of risks898of exposure that now are the heart of the topic of the899discussion today.900    Mr. Lynch. Thank you. Mr. Chairman, I thank you for your901courtesy and I yield back.902    Chairman Comer. The gentleman yields back. The Chair now903recognizes Dr. Gosar for 5 minutes.904    Mr. Gosar. Thank you, Mr. Chairman. As a former dentist, I905know how important HIPAA compliance is for the doctor-patient906trust. When customers sign up for testing like 23andMe, they907pay for the service, not the storage, and continued research of908their DNA, but at the minimum, American data should not leave909American hands. China has already said it wants to create a910database of genetic data to build bioweapons. If we are911questioning whether our adversaries are going to use this912genetic data to create a bioweapon against Americans, then913quite frankly, this data collected from Americans should be914destroyed, not stored.915    Mr. Selsavage, how does 23andMe store customer's data? Is916it physical or digital, or both?917    Mr. Selsavage. Congressman, it is both. I mean, 23andMe918stores the digital data, and as Ms. Wojcicki mentioned and I919did in my statement, security and data privacy is a top920priority for the company. All of that data is stored in an921encrypted format, and if customers do choose to biobank their922sample, with a consent, the physical saliva sample is923maintained as well.924    Mr. Gosar. Okay. So, when a customer requests their data to925be erased, what kind of data is erased?926    Mr. Selsavage. All of the data that they have in the927digital format, with the exception, you know, of their name,928email address, and purchase information, is erased from the929company's data records. In addition, if they had consented to930biobank their sample, that physical sample is also destroyed.931    Mr. Gosar. So, now, in 2019, the Department of Defense932advised our service members to avoid these types of DNA kits933due to the security concerns. Can you address that? Why that934would be?935    Mr. Selsavage. I am not familiar with, you know, why they936requested that service members not do the personal DNA test.937    Mr. Gosar. So, let me ask you the next question. Have you938ever participated in a 23andMe test? Is your data at risk, too?939    Mr. Selsavage. My data is at risk. I first joined 23andMe940in 2013 and have done subsequent tests with new health chips941with 2013 and have continued to maintain my personal data and942have not deleted it, and I continue to biobank my sample with94323andMe.944    Mr. Gosar. Ms. Wojcicki. Did I say it wrong?945    Ms. Wojcicki. No worries.946    Mr. Gosar. Okay.947    Ms. Wojcicki. That is perfect.948    Mr. Gosar. I tell everybody I speak two languages, one not949so good and that one is English. So, as a former CEO and board950member of 23andMe, do you have access to the customer's data?951    Ms. Wojcicki. I do not.952    Mr. Gosar. Who would be accessible to that data? Who could953get to that data?954    Ms. Wojcicki. That is a great question, and as I mentioned955before, privacy and data security was always top of mind when I956was CEO at 23andMe. So, we came up with very strict protocols957about how you could ever link up genetic information with the958identifiable information. So, if you think about how our959databases were set up, all of your personal information,960meaning your name, your address, your email, was in a separate961database that was stored separately. Very few people could962connect it then with the genetic information, so from a963database design, it was separated out.964    So, a few people within the company had the ability to put965that key together. So, for example, imagine if you were a966customer and you did not get the right results, or you have a967question about something, or you are wondering, something does968not make sense to you. You would have to be able to call the969customer care team and they would have to be able to analyze970your results, so only in very specific situations would we ever971be able to reconnect that. And so, I should also be clear, when972we did research identifiable information, like your name, your973address, your email, was never part of that, and none of the974partners that we ever had, had any identifiable information.975    Mr. Gosar. So, when I see a data like this, a ``Hacker has976got nearly seven million people's data from 23andMe, the firm977blamed users in a very dumb move.'' I want you to put this to978the record. Could you address this?979    Ms. Wojcicki. Yes. So, the situation that happened there,980and we have said before to our customers and everything that981happened, that there was a deep apology for everything that has982happened here. It was a credential stuffing, so it was not983actually a breach of our systems. It was credential stuffing,984and what that actually means is that the threat actor found old985addresses, email addresses and passwords, on the dark web, and986they ran them against 23andMe, and they found a number of987customers where they actually could enter into their accounts,988so it was specific. It was a credential stuffing incident, and989through that, they were able to actually get access to their990account.991    Since then, we have made pretty substantial changes. So, in992response, we immediately wanted to learn from this, so we993forced all of our customers to reset their password, so every994single customer had to go and reset their password. And then995second, we had double-factor authentication, which was996mandated, and we had actually had two-factor authentication for997a while, but it was not mandated because it was not industry998standard.999    Mr. Gosar. Thank you, Mr. Chairman. I yield back.1000    Chairman Comer. The Chair recognizes Ms. Norton from1001Washington, D.C.1002    Ms. Norton. Thank you, Mr. Chairman. When Elon Musk joined1003the Trump Administration, he reportedly described himself as1004``tech support'' for the Federal government. Clad in an absurd1005``tech support'' tee shirt, Elon Musk assured President Trump's1006Cabinet that slashing the Federal workforce was necessary to1007save the Federal government money and make it more efficient.1008We all saw what happened next. The so-called Department of1009Government Efficiency threw the government into chaos by1010recklessly firing Federal employees regardless of their role,1011experience, or their value brought to the agencies. This effort1012has ultimately cost taxpayers more than $135 billion, according1013to Partnership for Public Service.1014    The Trump Administration's purge of the Federal workforce1015is also making it harder for the government to maintain its1016sensitive databases and records and prevent cyberattacks. The1017U.S. Digital Service was the technology office in the White1018House that led modernization of Federal technology and software1019systems, that is until the Trump Administration. Then Elon Musk1020took over and fired dozens of its employees. Another 21 IT1021workers resigned from the office rather than carry out the1022destruction Musk demanded of them. The mass resignation letter1023signed by these skilled engineers, data scientists, and IT1024professionals, included a stark indictment of the Trump1025Administration, explaining that they had been asked to take1026actions inconsistent with their oath to serve the American1027people and uphold the Constitution.1028    I ask unanimous consent to enter this letter into the1029record, Mr. Chairman.1030    Chairman Comer. Without objection, so ordered.1031    Ms. Norton. The U.S. Digital Service is not only the only1032Agency that has been gutted. IT personnel have been laid off1033across the Federal government, leaving many agencies further1034exposed to threats. For example, the Department of Government1035Efficiency demanded a 50-percent cut in the technology division1036of the Social Security Administration. This division maintains1037the Social Security Administration's website, benefits,1038portals, and IT systems. The Trump Administration also1039reportedly planned to fire an additional 25 percent of the1040employees who manage the data systems at the Social Security1041Administration. Professor, how has the Trump Administration's1042purge of IT and cyber professionals left the Federal government1043more vulnerable to data intrusions?1044    Professor Hu. Thank you for that question, Congresswoman. I1045think that what we are witnessing, especially in news reports1046with DOGE now entering into 17 agencies and the dozens of1047lawsuits that have followed since the start of DOGE, is a deep1048concern about whether or not this falls outside the scope of1049what is constitutional or legal, particularly given this body.1050The Digital Services Office that you referred to was something1051that received funding and was specifically included1052legislatively, is my understanding, whereas DOGE is not, and1053that is part of the current litigation, whether or not this1054type of body is legal, is constitutional, and whether or not1055these types of actions that you describe are also outside the1056scope of the law both with FSMA, for example, and the1057Administrative Procedure Act. So, we just saw within the last1058couple days, you know, in the district court a concern about1059the OPM databases and whether or not an injunction is necessary1060in order to stop continued access.1061    Ms. Norton. The Trump Administration's proposed 2026 IRS1062budget would cut a staggering $8 billion and nearly 20 percent1063of positions from fiscal 2025 levels, including 60 percent of1064the IT staff. Professor, what are the risks of making a massive1065cut to the IT workforce at the IRS, which holds the most1066sensitive financial information of every American?1067    Professor Hu. Thank you for that question. The attempt to1068consolidate the information that is so sensitive--our financial1069information, our tax information, our information about our1070health--in order to try to create that type of consolidation1071increases the national security risk tremendously. As we saw1072from the OPM hack, for example, that you had millions of1073Americans' data exposed, but not only their biographic1074information, but their biometric information. So, as a result1075of the 2015 hack, it was reported that 5.6 million fingerprints1076were also then released. So, these are very serious issues,1077particularly with national security implications.1078    Chairman Comer. Thank you. The gentlelady's time has1079expired. The Chair recognizes Dr. Foxx from North Carolina.1080    Ms. Foxx. Thank you, Mr. Chairman and thank you to our1081witnesses for being here.1082    Mr. Selsavage, we all know the Chinese Communist Party has1083a track record of misusing genetic data, and even the New York1084Times acknowledged that ``China used its genetic tests to track1085members of the Uyghur,'' who are a politically disfavored1086minority group. This abuse can surely be perpetrated against1087any disfavored group whose genetic data is available. How does108823andMe prevent the genetic data, mainly from Americans1089controlled by the company, from being used by the CCP or some1090other malign actor to track or harm Americans?1091    Mr. Selsavage. Congresswoman, you know, 23andMe puts data1092security and privacy at the top of the forefront of our1093company. You know, all of our data is secured with top security1094encryption. You know, we have, you know, security professionals1095in place at 23andMe implementing the latest technologies in1096security, and we have received three ISO certifications for the1097company in terms of security, cybersecurity, and privacy to1098make sure that the data of our customers is secure.1099    In addition, after the cybersecurity incident, we made sure1100that, you know, basically we have implemented two-factor1101authentication. We have ensured that customers have reset their1102passwords, and we make sure that those passwords have not been,1103you know, basically in the compromised databases anywhere to1104make sure that our customer data is safe.1105    Ms. Foxx. Mr. Selsavage, besides the 15 million individuals1106who have their genetic data stored with the company, family1107members, by virtue of having a similar genetic makeup to those1108who took the test, are also potentially at risk if 23andMe's1109genetic data is exposed or used for nefarious purposes. Is that1110correct?1111    Mr. Selsavage. You know, if a customer at 23andMe chooses1112to allow their data to be shared, such as a DNA relatives1113feature at 23andMe, you know, relatives could actually and1114family members can see that additional data, yes.1115    Ms. Foxx. Ms. Wojcicki, precisely because of concerns about1116the genetic information controlled by 23andMe falling into the1117wrong hands, the Pentagon warned its personnel in 2019 not to1118use consumer DNA kits. How did 23andMe respond to the1119Pentagon's warning at that time?1120    Ms. Wojcicki. Thank you for that question. I have to say,1121in all honesty, we were surprised. We had not been contacted.1122We were surprised. So, we were happy to engage around that1123discussion as to what are the potential concerns, but it was a1124surprise to us, and we did not get forewarning and we did not1125know and engaged afterwards.1126    Ms. Foxx. So, after the warning, did the company change the1127way it handled or protected consumers' genetic data?1128    Ms. Wojcicki. Thank you for that. There were not1129substantial changes because, as I mentioned, privacy and data1130security had really been top priority since the inception of1131the company. So, I would say after that notice and reading1132about that, it definitely became top of mind, and I think the1133number one takeaway we had was, really, there should be an1134engagement around the understanding of how we actually are1135making sure that we are securing data and how we are making1136sure that customers, we are always honoring the customer's1137privacy. So, it was a great opportunity for us to consider1138engaging. We always are reviewing our systems. We are always1139looking at sort of the update of what else should we be doing1140with our security protocols, and so that was the primary1141takeaway from that.1142    Ms. Foxx. Do you believe there is anything that could have1143been done to prevent the 2023 breach?1144    Ms. Wojcicki. I appreciate that question. I am pretty1145limited with what I can say specifically around that because of1146the potential litigation or the ongoing litigation around1147there. The thing that we always said, is that you have to be1148vigilant on a daily basis. You have to always live in a world1149of paranoia because you see how many threat actors there are1150out there, the number of security incidents that are there. So,1151the primary takeaway we always thought is like, what is also1152the product by design? How are we making sure we are designing1153the product so if and when something happens, that we are doing1154everything we can to protect the privacy of our customers. The1155database security design has always been really important for1156us about making sure that if there ever was a threat actor, how1157are we actually making sure that we are doing everything we can1158to prevent that. So, it was always top of mind for us to think1159about what those potential risks are.1160    Ms. Foxx. Thank you. Mr. Chairman, I yield back.1161    Chairman Comer. The gentlelady yields back. The Chair1162recognizes Ms. Brown from Ohio.1163    Ms. Brown. Thank you, Mr. Chairman. Today's hearing gives1164us an opportunity to explore bipartisan solutions to protect1165Americans' personal identifiable information. When services1166like 23andMe first launched, they were seen as groundbreaking,1167giving people unprecedented access to information about their1168ancestry, health, and genetics. For the first time, you could1169uncover long lost family connections or gain insights into1170potential health risks all from the comfort of your home. But1171what many of 23andMe's nearly 25 million customers did not1172realize was that unless they actively opted out, they were also1173consenting to share their personal DNA data with third parties.1174Unlike a password, you cannot change your DNA, and it cannot1175truly be anonymized. What is more, one person's genetic data1176can reveal information about their entire family. Now with that1177company's future uncertain, the safety and security of that1178data hangs in the balance. Americans deserve real oversight and1179tough privacy protections to keep their most sensitive data1180safe.1181    Mr. Selsavage, when you became the CEO just as 23andMe1182experienced a massive breach that exposed the sensitive genetic1183data of seven million users, what concrete steps have you taken1184since to prevent this from happening again? And what can you1185tell your customers today, right now, that you could not say a1186year ago to reassure them their most personal data is safe?1187    Mr. Selsavage. Congresswoman, you know, I want to reiterate1188that 23andMe always has put our consumers' security, data1189security, and privacy at the forefront of the company. Since1190the data incident, we have implemented additional security1191measures. We, you know, force every customer to actually reset1192their password to make sure that their accounts are safer. We1193implemented two-factor authentication, whereby a customer1194either gets an SMS or an email sort of code to actually enter1195in addition to their password to make sure their data is1196secure. And then we also ensure that any sensitive data, like1197the personal genomic data that the customer has, if they1198requested that data, that there was additional verification of1199the customer requesting it, such as their date of birth and1200other credentials, and then also put a time limit so that they1201could not access that data immediately, but rather put a time1202delay of 48 hours on that data.1203    In addition, we have hired a new chief information security1204officer at the company and put in additional security controls.1205Through the bankruptcy process, we are making sure that,1206essentially, through the process, that our customers' data is1207safe because we are requiring any bidder for the company to1208continue with the privacy policies and consents that are in1209place here at 23andMe.1210    Ms. Brown. Thank you. We are having this conversation at a1211time when foreign adversaries, like China and Russia, are1212working overtime to exploit Americans' personal data. We know1213that China has targeted Americans' genetic data to train their1214AI technologies to develop advanced medicine and even for1215military research, and we are facing this threat with fewer1216resources. The Trump Administration has made massive cuts to1217funding and staffing at our Nation's top cybersecurity1218agencies. We need both strong cybersecurity protections and1219Federal privacy laws to protect Americans' data. So, Ms. Hu, as1220you know, there is no Federal framework for how private1221companies handle consumer biological data. What steps should1222Congress take to ensure that private industries is not putting1223Americans' private health and genetic data at risk, especially1224in the hands of our foreign adversaries?1225    Professor Hu. Thank you so much, Congresswoman, for that1226question. I do believe that we need an overlapping regime that1227takes into account both strong Federal data privacy protections1228that now need to update laws such as HIPAA, that do not cover1229these types of new biotech services and wearables and other1230types of apps. New health data is being generated that is not1231covered under our existing health data protection laws, and we1232are increasingly faced with cybersecurity laws and data privacy1233laws at the state level that are now stepping in to fill the1234gap that is being left by Congress, but especially, with AI1235warfare on the horizon, it is absolutely critical. And I agree1236with you, this is a bipartisan issue.1237    Ms. Brown. Thank you so much. I will close with this.1238Americans deserve to know their sensitive private data is safe1239and secure. I look forward to working with my colleagues on1240both sides of the aisle as we continue these important1241conversations, and with that, Mr. Chairman, I yield back.1242    Chairman Comer. Thank you very much. The Chair recognizes1243Mr. Palmer from Alabama.1244    Mr. Palmer. Thank you, Mr. Chairman. Ms. Wojcicki, you1245initially shared data with GlaxoSmithKline (GSK) in regard to1246research on Parkinson's, and then in 2023, it looks like you1247shared the entire database with them. Is that correct?1248    Ms. Wojcicki. I appreciate that question. In 2018, we----1249    Mr. Palmer. I need ``yes'' or ``no.'' Did you share the1250entire database?1251    Ms. Wojcicki. No, what we did was share specifically. The1252partnership was around using genetic insights for drug1253discovery, so we specifically use not the entire data set, but1254what we did is we analyze it. We are looking at all the genetic1255information we have, phenotypes like Parkinson's and saying,1256what is it? What is that genetic association?1257    Mr. Palmer. But you received an additional $20 million, and1258I think at that point, you are realizing that the company was1259in financial trouble. And it looks to me like you made a1260decision to provide more than what you had provided earlier,1261but you also said that people had the opportunity to opt out of1262that. How aggressive were you in notifying your customers that1263they had the opportunity to opt out of that data being shared1264with GlaxoSmithKline?1265    Ms. Wojcicki. Yes. I appreciate the question.1266    Mr. Palmer. Were you aggressive, not that aggressive? Was1267it an email notification? How aggressive were you? Did you try1268to make sure that they understood they could opt out?1269    Ms. Wojcicki. We actually sent an email notification to all1270of our customers at the time of the signing of the GSK1271collaboration with a link.1272    Mr. Palmer. Did you receive a follow-up from people who1273later found out the data had been shared that they wanted to1274opt out, but they did not do so before you shared the data?1275    Ms. Wojcicki. Customers always have the opportunity at any1276time to opt out, so some number of customers did respond to1277that email. They opted out.1278    Mr. Palmer. When they opted out, does that include removing1279the data from GlaxoSmithKline?1280    Ms. Wojcicki. It removed the data from all future analyses.1281    Mr. Palmer. But I am asking now, if you were not very1282aggressive in notifying people before you shared it with the1283pharmaceutical company, and people found out later that it had1284been shared and they wanted to opt out, was their data removed1285from GlaxoSmithKline?1286    Ms. Wojcicki. Their data would have been removed from any1287future GlaxoSmithKline----1288    Mr. Palmer. Yes, you are saying ``any future,'' but any1289past sharing of their data, you are saying that it is pretty1290much gone?1291    Ms. Wojcicki. It was never individual's data. It was the1292aggregate. So, essentially, it is the summary. It is the1293analysis, so saying this specific gene is associated with1294Parkinson's.1295    Mr. Palmer. Let me ask you this. When 23andMe publicly1296announced it was filing for bankruptcy, roughly how many users1297reached out to 23andMe to delete their account and their data1298altogether?1299    Ms. Wojcicki. I was not part of the company at the time, so1300I would not be able to answer.1301    Mr. Palmer. Mr. Selsavage, can you answer that?1302    Mr. Selsavage. Yes, I can. From the time we actually1303announced bankruptcy until today, approximately 1.9 million1304customers have requested that their----1305    Mr. Palmer. Well, that is what?1306    Mr. Selsavage. Roughly 15 percent.1307    Mr. Palmer. Fifteen percent. If a user wanted to delete1308completely their entire account with 23andMe and delete all of1309their identifying data, does 23andMe allow that, and if so,1310what does the process look like? I really do not want to know1311what the process looks like. I just want to know if they have1312the ability to do that.1313    Mr. Selsavage. The customer has the ability to do that, and1314for any customer, it is a very easy process. They can just log1315into their account, go to their settings, and request their1316account and data be deleted.1317    Mr. Palmer. 23andMe became popular because you advertised1318it as identifying familial connections that go back centuries1319in some cases. How accurate would you say that data is?1320    Mr. Selsavage. You know, for our DNA relatives feature, you1321know, we believe that those features are highly accurate, and,1322essentially, we actually take a look----1323    Mr. Palmer. When you say, ``highly accurate,'' could you1324put a percentage on that? Is it 100 percent accurate, 90, 80?1325    Mr. Selsavage. You know, it is in the high 90s percent of1326accuracy.1327    Mr. Palmer. High 90s? The thing that concerns me here is1328how you advertise your product, and I am not sure that people1329understood that you were planning to share that data with other1330companies because once they share their DNA sample with you,1331that is a one-time sale. There is no repeat business from that.1332You have to generate income from other means, and, apparently,1333you did that through sharing that data with pharmaceutical1334companies.1335    Let me ask you this. Do you support the motion filed by 271336state attorneys general to request the bankruptcy court appoint1337a consumer privacy ombudsman and a security examiner? Do you1338support that?1339    Mr. Selsavage. Congressman, yes, respectfully. The company1340was first to actually----1341    Mr. Palmer. Very quickly. I got a last question.1342    Mr. Selsavage. Yes, we support that. Yes.1343    Mr. Palmer. Has a 23andMe employee ever had access to the1344data, other than those who are cleared to have it? Has anybody1345else ever had access to that data?1346    Mr. Selsavage. To the best of my knowledge, only people1347with the need to access that genetic data at 23andMe have1348access to it.1349    Mr. Palmer. That is to the best of your knowledge, but you1350cannot assert that no one else has had access?1351    Mr. Selsavage. Congressman, that is to the best of my1352knowledge. As indicated, I have only been interim CEO since1353March 2025, but to the best of my knowledge, no other1354individual other than the employees who have a need to have1355access to data have had access to it.1356    Mr. Palmer. Mr. Chairman?1357    Chairman Comer. Yes, sir.1358    Mr. Palmer. I think we need a more certain answer on this1359about who has had access to this data. I see Mr. Lynch is in1360agreement.1361    Chairman Comer. Absolutely.1362    Mr. Palmer. So, could you do a deep dive investigation to1363make that determination, notify the Committee through Mr.1364Chairman and the Ranking Member?1365    Mr. Selsavage. Congressman, I will take that back to our1366team and look into that for you.1367    Mr. Palmer. That is not a look into. That is a required1368reply.1369    Mr. Selsavage. That is understood. We will take that back.1370    Mr. Palmer. Thank you, sir. I yield back.1371    Chairman Comer. Thank you. The Chair recognizes Ms.1372Stansbury from New Mexico.1373    Ms. Stansbury. Thank you, Mr. Chairman, and thank you to1374our witnesses for being here today. This topic is of particular1375interest, I think, not only to myself, but millions of1376Americans, not just because the company in question here1377actually owns the genetic data of millions and millions of1378Americans, but because of what is happening right now with1379DOGE, with the Trump Administration, with private contractors1380getting multi-million dollar contracts to integrate Americans'1381personal data, with the court cases that are in front of the1382Supreme Court and the district courts, and this proposal that1383came through this House just two weeks ago in the dead of night1384that basically would preempt state and local laws from1385regulating our private data through AI systems.1386    And so, I mean, it is hard to not sit here and listen to1387this conversation and not feel like we are living through a1388sci-fi movie, right? Like we have all seen this scary sci-fi1389movie before that our private biological data--not me1390personally; I am too much of a privacy freak to do these1391genetic tests myself--that a private company has our data, they1392experience bankruptcy, and now we have no Federal regulatory1393system to protect that data, and we are concerned that foreign1394adversaries might purchase the company and thus the data. I1395mean, this is insane. This is crazy.1396    And meanwhile, I completely agree, this is bipartisan in1397this hearing, but our colleagues across the aisle are trying to1398pass legislation that would deregulate and preempt data privacy1399and AI laws across the United States in every single state and1400locality for the next ten years. That is bonkers. Like, you1401cannot have it both ways. You cannot haul a private company in1402before Congress to talk about their bankruptcy and the fact1403that they had 15 million Americans' private biological data and1404you want to protect it, and then you are trying to use Congress1405to preempt state and local law so that we cannot protect1406private data. Like, that is completely intellectually1407incongruent and dangerous for Americans.1408    Professor Hu, I was really interested in your background1409because you have worked both on the DOJ side as well as on the1410academic side. And you have outlined some of this in your1411testimony, but I am particularly interested in your background1412in national security and prosecuting national security cases.1413And if you could talk a bit more about this, like, political1414intersection we are seeing right now in this moment and what1415threats that poses for not just national security with foreign1416adversaries, but the potential that Americans' data could be1417misused by private companies here in the United States.1418    Professor Hu. Thank you so much, Congresswoman. I think1419because of the bipartisan nature of this topic, it is so1420critical to come together and try to advocate for the types of1421legal framework that we need in order to address these national1422security threats appropriately. And I do believe that part of1423the issue right now is because in an absence of congressional1424legislation, we are asking these corporations to come in and1425fill that gap. And so, we are asking of companies, like142623andMe, you need to have the best data privacy, the best cyber1427security possible, but what about Federal law that then1428mandates that instead of looking to industry standards?1429    And I am very concerned about the moratorium and the idea1430that in the absence of Federal law that regulates1431comprehensively AI systems, that we would ban and bar states1432and localities from going forward with their attempts to try to1433offer some type of meaningful safeguard on these types of1434technologies. And so, thank you very much. I do think that this1435is so critical for there to be true bipartisanship for this1436national security issue.1437    Ms. Stansbury. Thank you, and, you know, one of the things1438I really want to emphasize, for folks who are out there1439watching this and concerned about data privacy, which I believe1440is everybody. You know, I watch my share of both liberal and1441conservative news, and, I mean, everybody from Theo Vaughn to1442our colleague Marjorie Taylor Greene to myself to this side of1443the aisle are raising the alarm on this provision because of1444the significance that it has for the safety of Americans.1445    And so I think it is really, really important that we1446elevate this conversation right now and understand what they1447are proposing in this bill because when you read that bill, it1448literally not only says we would preempt state and local laws,1449it basically says any company even that wants to use an AI1450system in a locality could not be barred from accessing your1451data, which means that, presumably, a private company that does1452not have privacy and secured data systems could then be1453compelled under this preemption law to give away your data. I1454mean, that is dangerous. That is dangerous. So, I really1455appreciate you all being here today and we are going to1456continue to work on this issue. Thank you, Mr. Chairman.1457    Chairman Comer. Thank you. The Chair now recognizes Mr.1458Grothman from Wisconsin.1459    Mr. Grothman. Yes. Ms. Hu, first of all, just kind of a big1460picture thing here, if these guys have my genetic data, why1461should I care?1462    Professor Hu. Genetic data is and biometric data is now1463increasingly anchoring modern warfare because of the attempts1464in AI-driven targeting to try to aggregate biographic and1465biometric data. And so, part of what I think is misunderstood1466is that this is not really a consumer data privacy issue alone,1467that this really does map into very significantly the way in1468which we conduct national security strategies.1469    Mr. Grothman. Okay. So, I should be afraid that if we go to1470war--well, I hope we never go to war--if we go to war and they1471know my genome, that they will find some way to target me.1472    Professor Hu. Well, it is not just an active, kinetic type1473of warfare situation. The new battlefield of AI warfare is1474really engaged in cognitive security issues and also the way in1475which we look at manipulation, social engineering as a1476cybersecurity risk.1477    Mr. Grothman. Okay. Give me an example.1478    Professor Hu. So, the way in which, for example, if we go1479back to the OPM hack of 2015 occurred, many experts say that it1480was through social engineering, that the way in which the1481Chinese hackers got access into the OPM systems was through1482social engineering, some type of manipulation. And so, at1483first, that they were able to manipulate somebody within OPM to1484give up their passwords, and then from there, able to install1485this type of----1486    Mr. Grothman. How would they manipulate them?1487    Professor Hu. Well, one of the examples given by some1488cybersecurity companies were the ways in which Chinese would1489pose, for example, as trying to present some type of alumni1490event from your university, and to get you to click on that,1491and then to install the malware from there.1492    Mr. Grothman. Because they have my genome?1493    Professor Hu. Well, the fact that the Department of Defense1494raised the alarm about the potential risks of it, I think, are1495really important for us to examine why. Why is the Department1496of Defense saying that this should not be something that the1497military should access? And I think it is----1498    Mr. Grothman. Okay. I can think of reasons that is of1499concern, but not exactly your reasons. I will take it, though,1500for granted that we do not want to have my genome out there on1501the internet floating around. Mr. Selsavage, if I could use1502this company's services in the past, where is my data kept1503right now?1504    Mr. Selsavage. The actual data and, basically, this data is1505stored on Amazon Web Services in secure, encrypted database1506files.1507    Mr. Grothman. And can we assume that my data will be there1508after I die or right now, under the current law, be there1509forever?1510    Mr. Selsavage. Your data is there, but you always have the1511right to delete your data at any time, and your beneficiaries1512and executors of your will or trust will also have the right to1513delete that data in the future.1514    Mr. Grothman. Does anybody call right now to have their1515data deleted?1516    Mr. Selsavage. Yes. Since we announced bankruptcy, we have1517had 1.9 million customers called and requested that we delete1518their data, and we have done so within a reasonable timeframe.1519    Mr. Grothman. How many customers called to delete their1520data?1521    Mr. Selsavage. Called or emailed or requested their data be1522deleted, there was 1.9 million customers.1523    Mr. Grothman. That is kind of amazing, I think. I mean, I1524think it is probably a smart thing to do, but it would not1525occur to me. Okay. Next question. Does Regeneron intend to1526update their privacy policy?1527    Mr. Selsavage. Regeneron and TTAM Research Institute, both1528of the bidders under the current bankruptcy rules for the1529bidding process for the company, have both agreed to maintain1530the privacy policies and consents of the company of 23andMe in1531the future.1532    Mr. Grothman. So, by that, you mean they are not going to1533change anything? They are saying they are not going to change1534anything?1535    Mr. Selsavage. Not only did they say they are not going to1536change anything, they also agreed to that in their contract,1537which is an asset purchase agreement, in writing that they1538would continue to maintain the policies.1539    Mr. Grothman. Okay. Ms. Wojcicki, are you aware that in15402015, 23andMe received $115 million in funding from a variety1541of investors, including WuXi Healthcare?1542    Ms. Wojcicki. I am aware.1543    Mr. Grothman. Okay. And you know they had ties with CCP?1544    Ms. Wojcicki. I have been made aware of that, yes.1545    Mr. Grothman. Okay. Did you consider this a risk at all, or1546do you think, for you or in the future, anybody should care1547that the Chinese take over one of these companies?1548    Ms. Wojcicki. As I said in my statement, I am concerned1549about China and how China is leading in biotechnology, and I am1550concerned that China has been super clear that they would like1551to have the most genetic information they would like to lead.1552So yes, I am always concerned about what China----1553    Mr. Grothman. Do you think a company trying to take over1554this company should be a company the Chinese have access to, or1555should they be out of the picture when it comes to a potential1556buyer?1557    Ms. Wojcicki. I do not believe that 23andMe in this1558bankruptcy process should go to anyone with a Chinese tie.1559    Mr. Grothman. Thank you.1560    Chairman Comer. Thank you. The Chair recognizes Ms. Randall1561from Washington State.1562    Ms. Randall. Thank you, Mr. Chair, and thank you to our1563witnesses for being here today. You know, in this modern world1564our sensitive data is stored in an increasing number of places.1565We have got smart watches that track our vitals and sleep1566quality and apps that track menstrual cycles and ovulation, and1567our phones track our steps and analyze our activity. And1568companies, like 23andMe, convinced so many to trade access to1569their DNA to unlock personal history and detailed genealogy1570reports. Ms. Hu, what kinds of entities are left out of our1571existing Federal framework for protecting health data, and how1572could we strengthen Federal privacy laws so that it is not left1573to the states to do that privacy protection work that you1574mentioned earlier?1575    Professor Hu. Thank you so much, Congresswoman, and I think1576that this is another chance to revisit the prior Congressman's1577question about why it matters. I think that, you know, these1578types of very sensitive data can be open to exploitation, both1579in national security but on also consumer, you know,1580exploitation purposes as well. And in the absence of these1581comprehensive Federal laws, we do see the need to have the1582states try to enact these laws that are operating to fill the1583gap that is left by HIPAA. So, I think in the future, we do1584need to look to Congress to try to create comprehensive laws1585that protect against the type of data sharing, third-party use,1586misuses, and abuses in our wearables, in our health apps, in1587the way in which health data is captured through telehealth1588systems that might not come under the protection of Federal1589law, and I hope that we are able to move forward with that.1590    Ms. Randall. Thank you, and you know, just level setting1591for folks tuning in. In 2022, the Biden Administration issued1592important guidance to ensure that private health information1593that would be covered by HIPAA and other circumstances could1594not be disclosed to entities seeking to investigate someone for1595accessing reproductive healthcare, for example, but that1596guidance has been withdrawn under the Trump Administration in1597an effort to push forward an anti-reproductive health agenda,1598putting both doctors and patients at risk, and discouraging1599folks from seeking care. I think we have to remember that, you1600know, these issues are intertwined, you know, who is able to1601access the private health data that companies now have access1602to under our increasingly online and, I do not know, digitized1603lifestyle.1604    You know, Ms. Hu, should Americans be concerned? What is1605the implication of individuals having their healthcare data1606being accessed? Should they be concerned that they might be1607investigated or potentially prosecuted in this political1608environment?1609    Professor Hu. Yes, thank you so much for that question. I1610think that part of the concern is the way in which law1611enforcement or others can access this for investigatory1612purposes, basically doing a workaround around the Fourth1613Amendment protections, if it can be purchased, if it can be1614repackaged, sold, borrowed. You know, I think that this is the1615kind of data that can then end up in a way that is used against1616an individual without the types of constitutional protections1617and criminal procedure rights that they have become accustomed1618to.1619    Ms. Randall. Thank you. You know, we have made some1620progress on this in Washington State when I was there in the1621legislature, and I know that many other states are trying to1622enact these sort of shield laws to better protect the1623individual data of consumers, particularly their individual1624health and genetic data. Are there specific steps that you1625would recommend Congress taking to ensure that our health1626information, including medical records, remains secure?1627    Professor Hu. Yes, I think that this is where we need to1628look at this comprehensively, not just in a siloed way, not1629just health data, for example, or education data or financial1630data, and not just a Federal or a state level issue. I think1631that this truly needs to be across the board. So, you had1632mentioned state of Washington having biometric protections, for1633example, as well. Not all states have that type of biometric1634data protections or genetic data protections, and right now in1635Federal law, we only have it under, for example, GINA for in1636the employment context, but it really does need to have that1637very full comprehensive approach.1638    Ms. Randall. Thank you so much. I yield back, Mr. Chair.1639    Chairman Comer. The gentlelady yields back. The Chair1640recognizes Mr. Perry from Pennsylvania.1641    Mr. Perry. Thank you, Mr. Chairman. Ms. Wojcicki, when a1642customer comes to 23andMe, are there--I assume there is, I do1643not know, so I am asking--there are disclaimers? There is1644information where you let them know that their data is going to1645be obviously used to provide the information that they are1646looking for, their ancestry, maybe their health information,1647whatever you provide, right? Is there information also letting1648them know that it might be used, anonymously or otherwise, for1649other purposes when they access your service?1650    Ms. Wojcicki. Great question. I appreciate that. The goal1651of the company has always been about transparency and choice1652for our customers, and it is an area I feel incredibly1653passionate about, that too often in healthcare, customers are1654not actually given transparency and choice with their1655information. So, when you sign up for 23andMe, it is not a1656simple process. There are a number of very easy-to-understand1657explicit consents and there is never a default. So, for1658example, if you go through 23andMe, we do not default you into1659research. You have to actively click ``yes.'' So, during that1660process, it is, you know, easily a 10-minute sign up process.1661    Mr. Perry. So, customers are choosing to allow, and I am1662just paraphrasing it the way I would say it, choosing to allow1663you to use their data as you kind of see fit, with who you see1664fit, whether it is with a pharmaceutical company, or maybe in1665this case--I am not saying you do--but another country. Is that1666generally correct? I mean, they are choosing what they allow,1667right?1668    Ms. Wojcicki. Correct.1669    Mr. Perry. Okay.1670    Ms. Wojcicki. So, it is a consent form that has gone1671through an ethics review. It is under an institutional review1672board, so it specifically allows us to do research and only1673with qualified researchers.1674    Mr. Perry. So, would you say--and this is moving into a1675little bit of a different direction. I will probably get back1676to that, but the data you said it was discarded. You used the1677term ``discarded.'' Does that mean destroyed or just discarded?1678    Ms. Wojcicki. Destroyed.1679    Mr. Perry. Destroyed. How is it destroyed?1680    Ms. Wojcicki. I am not aware of the specifics around how it1681is destroyed.1682    Mr. Perry. It could be just thrown away. Look, I am just1683asking that question because you can learn a lot by going1684through somebody's trash, right? And I am not saying somebody1685did, but so in this context, as I read about you, bankruptcy1686does not necessarily mean the end of 23andMe. As a matter of1687fact, it seems like it means like it is going to continue under1688some other structure. Is that about right? It is not going1689away. It is just going to continue. Whether you buy it or1690whether Regeneron, 23andMe is not going, and the data is going1691to be around, it sounds like. Am I correct about that, or is1692that the goal?1693    Ms. Wojcicki. That is the correct hopeful outcome, yes.1694    Mr. Perry. So, is 23andMe precluded by law from selling all1695or some of the data or partnering with somebody that could do1696that, are they precluded by law, and I am asking the question1697because I do not know. Are they precluded? Is your company, or1698the one that you started and want to have again, is it1699precluded by any law from using that data or partnering with1700somebody that could use the data any way they want, or is there1701any law that stops you from doing that?1702    Ms. Wojcicki. I think that is a great question. I am not an1703expert in all the different laws. I would like to highlight1704there was another genetics company that just went through1705Chapter 11 that was successfully just sold.1706    Mr. Perry. Okay. Maybe you do not know of a law that1707precludes. Should there be? Like, should there be? And look,1708consumers and American citizens or whatever have the freedom to1709make choices, and if you make bad choices, like, I am not using1710your service, ma'am. I do not want you to know. Like, I marvel1711at the amount of people that are concerned about the Federal1712government's intrusion into their personal lives but are happy1713to give private companies all that data, but that is their1714choice, and I wonder if it should be. Well, I think it should1715be, but what obligations do you have?1716    So, maybe the question should be what moral or ethical1717obligation does a company like yours, or yours in particular,1718or 23andMe may be the better way to put it, what obligation do1719you have to safeguard that information from either being1720purchased or through partnering with somebody, like the1721Communist Party of China or somebody affiliated with them or1722the People's Liberation Army? What moral and ethical1723obligations do you have?1724    Ms. Wojcicki. I think the most important thing that 23andMe1725can do is make sure that we are always giving people choice,1726and I think that the most important thing in this process is to1727make sure long-term that customers always have that opportunity1728to delete the data.1729    Mr. Perry. Yes, I understand that, ma'am, but you are not1730answering my question. What obligation does your company or1731companies like yours have, knowing that this is personal1732information, that it could lead to national security1733implications and certainly personal implications that are1734deleterious to those who subscribe, what obligations do you1735have or should you have or a company like yours have? What1736obligations, moral or ethical?1737    Ms. Wojcicki. So, I think there should be. I think that is1738why we are in a bankruptcy hearing where there is oversight on1739it and very concerned about where it is going, and that is1740specifically why I have put in a bid as a nonprofit entity to1741acquire it.1742    Mr. Perry. I yield.1743    Chairman Comer. The gentleman yields back. The Chair1744recognizes Mr. Subramanyam from Virginia.1745    Mr. Subramanyam. Thank you, Mr. Chair. As mentioned before,1746I think it was 15 million people have now signed up and used1747the service over the years. It is a large number, and I was one1748of them. I actually got it for free. I was lucky enough to get1749a free kit, and at the time I said, you know, what is there to1750lose, but I guess now, as my dad says, everything has a price,1751right? Nothing is free in life. And so, I think a lot of people1752are concerned about the fact that they did this many years ago,1753they are worried about what is going on with their data, and1754they feel like they do not have a sense of control anymore. And1755you know, what I am hearing is that they do have control,1756though, right, in the sense that they can go online and delete1757their data. But when I go to the website on 23andme.com, it is1758not readily apparent that 23andMe is going through a bankruptcy1759right now. In fact, it is not anywhere on the front page of the1760website. You really have to dig into the website to look into1761it. I have it up right now.1762    And the other part is there are instructions online on how1763to delete your data, but even that stuff is kind of buried a1764little bit. You really have to look for how to delete your1765data. I am actually going and doing it right now, and one of1766the things it does is you have to go to the settings page, but1767you have to scroll through the settings page and you may almost1768miss it. And then you click on your 23andMe data, and then even1769that, it goes through a whole list of things that are1770happening. And if there simply was a delete my data page or1771button somewhere more prominent, then I think it would be1772easier for a lot of people to feel that control, and this1773process would be a lot easier for people who do truly want to1774delete their data, but that is not quite what is happening.1775    The second thing is, you know, if I did not know about1776this, I was not reading the news about what is going on, I1777would also not know until maybe it is too late what has1778happened to my data and where it ended up. And so, I guess my1779question--maybe this was already asked--Mr. Selsavage, if you1780sell the data to a third party in this bankruptcy, can they1781sell the data to other companies after that?1782    Mr. Selsavage. So first, let me address a couple questions.1783    Mr. Subramanyam. Well, just answer my question. Can they1784sell the data? Can the company that receives this data through1785a sale and bankruptcy then sell the data to another company?1786    Mr. Selsavage. Two potential companies that are acquiring178723andMe as potential bidders are adopting and stepping into the1788shoes of the company and adopting the privacy policies and1789consents.1790    Mr. Subramanyam. But they could sell it to a company that1791then sells it to another third party, who then sells it to1792another third party, and then you end up with a situation where1793the genetic data is out there and multiple companies own my1794genetic data and the millions of people's genetic data. Is that1795correct?1796    Mr. Selsavage. Congressman, with all due respect, I am not1797a legal expert in this, but basically, the potential acquirers1798of 23andMe are adopting the privacy policies and consents of179923andMe where it does allow for the sale of the assets of the1800company.1801    Mr. Subramanyam. So, yes, the answer to my question is yes.1802So, then, if, let us say a healthcare company bought the data,1803Professor Hu, couldn't the healthcare company then look at your1804genetic data and raise your premiums because they see some bad1805genetics in there, for instance? Can we have a healthcare1806system that now has all your genetic information and then will1807adjust premiums based on what they think is risk for them?1808    Professor Hu. Yes, thank you so much, Congressman, for that1809question. I do think that genetic data is particularly1810sensitive because of those types of risks, that the way in1811which you do have insurance companies and other corporations1812trying to link up genetic predispositions, even, for example,1813you know, financial literacy and accountability, so not just1814for insurance issues. Perhaps even other types of issues could1815be open to abuse.1816    Mr. Subramanyam. And then couldn't a foreign actor either1817hack into the data or even acquired the data as well and then1818use that and posing a national security threat?1819    Professor Hu. Yes, absolutely. I think that part of what1820was deeply concerning, I understand about the issue of1821credential stuffing as the source of the cyberattack or the1822risk, this and the prior breach, but nonetheless, what we did1823see was a hacker named Golem post the DNA, particularly of the1824Chinese and Jewish ancestry on the dark web.1825    Mr. Subramanyam. I just deleted my data. I hope everyone at1826home has the opportunity to do so, does so, and I hope a good1827actor does buy this data because it could slip into the wrong1828hands. I yield back.1829    Chairman Comer. Very good. The Chair now recognizes Mrs.1830Luna from Florida.1831    Mrs. Luna. Hey, everyone. Thank you so much for coming in1832today. Specifically, thank you for your work on the human1833genome. Aside from that, this is pretty quick on questioning.1834My question for you guys is, we talk about if people want to1835actually delete their data, just so I am clear and so people1836watching this are clear, in the event that they choose to opt1837out, delete their data, what happened to the data? Is it gone1838forever? Is there, you know, an area where it can be pulled1839back up after deleted? What happens? Ms. W, if you will.1840    Ms. Wojcicki. I appreciate that. During my tenure when I1841was CEO, and I can only speak about that since I have not been1842there since March, if a customer wanted to delete their data,1843it was irreversible. It was gone, so if you wanted to delete1844your data, it was gone.1845    Mrs. Luna. Okay. So, there is no way that they can bring it1846back up after the fact?1847    Ms. Wojcicki. No, it becomes an issue then. If people want1848to upload it again, you would have to re-spit.1849    Mrs. Luna. Okay. Perfect. Well, thank you. That is all for1850my line of questioning. Does anyone else want my time? No. That1851is it. Thank you guys.1852    Chairman Comer. The Chair recognizes Ms. Lee.1853    Ms. Lee. Thank you, Mr. Chair. I think what we have seen in1854both last week's hearing on AI and today's is how unprepared1855this country is to protect people's private information. This1856bankruptcy and the sale of 23andMe demonstrates just how little1857control people actually have over their sensitive information.1858The few Federal privacy laws we do have on the books have just1859not kept up with the internet age and the technological1860advancement. As a result, more and more of our data is just1861accessed by more and more interests, and it is just out there.1862Companies are handing over private data to the government that1863would normally be protected by the Fourth Amendment, for1864instance, and you would need a warrant to get. That includes1865genetic data at 23andMe. Some states have, of course, pushed1866for stronger consumer protections around privacy, but the data1867threats are not stopped by state lines, so people need1868protections that cover the entire country.1869    Professor Hu, just briefly, what is your biggest concern1870about the gaps in privacy law that Congress ought to address1871through legislation?1872    Professor Hu. My deep concern is the way in which AI is1873changing, I think, the nature of data. I think that, as it has1874been explained before, data is to AI the way that airspace is1875to aircraft, and without being able to have a way in which to1876really protect it and secure it, I think that we are going to1877increasingly see abuses, misuses, and discrimination flow from1878that lack of regulation.1879    Ms. Lee. Thank you. The patchwork of privacy protections in1880this country has created an ecosystem where data brokers and1881companies like 23andMe hold massive amounts of sensitive1882information from millions of Americans and they can just really1883do what they want with it. Beyond just collection and storage1884of data, we should also be worried about how these companies1885use this data, including who has access to it, for one, law1886enforcement officers. There are few restrictions on law1887enforcement's access to DNA profiles stored in databases, like188823andMe. This so-called forensic genealogy is often done1889without a court-approved warrant and can mean that law1890enforcement has access to the genetic information of millions1891of Americans with little to no oversight. Even if you,1892yourself, did not give your DNA away, if you have a family1893member who did, you could be affected.1894    What is even worse is that people usually are not even1895aware that their profiles are being shared with police.189623andMe's current privacy policy states that when faced with1897law enforcement requests, the company will ``only comply with1898court orders, subpoenas, search warrants, or other requests1899that we determine are legally valid.'' Mr. Selsavage, that last1900part is a bit concerning. What exactly do you mean by other1901requests that are legally valid, and what other request is1902going to get 23andMe to give over information to police?1903    Mr. Selsavage. Let me first say that 23andMe, to date, has1904not given any information over to law enforcement. We have a1905transparency page on our website, which shows the requests that1906we have received from law enforcement. It is a small number and1907those that we have complied with, and you will see that it is1908zero that we have complied with. The only way we will comply1909with a law enforcement request is with a legally valid process,1910such as a court order or subpoena, and to date----1911    Ms. Lee. Yes, I see that. Just really specifically, just1912really wondering about the other requests that we determine, I1913get the subpoenas and a search warrant, but there is a caveat1914for other requests that we determine are legally valid. Can you1915give an example of what that might be?1916    Mr. Selsavage. I cannot give an exact example of that1917``other'', you know. I can say that, you know, basically the1918only way we would comply with a law enforcement request was1919with what we determined----1920    Ms. Lee. Thank you.1921    Mr. Selsavage [continuing]. To be a legally valid process.1922    Ms. Lee. Thank you. I think of the fact that you cannot1923define what that means is a massive loophole for 23andMe to do1924what it wants with people's data, and that is, I think, a1925really big concern. Mr. Selsavage, also, how does 23andMe1926notify a customer when it has provided their genetic data to1927law enforcement? I am sorry if you already answered that. What1928information do you provide them about the requests?1929    Mr. Selsavage. As I mentioned, to date, we have not1930provided any information to law enforcement.1931    Ms. Lee. Yes. If you did, do you have an example? Do you1932know what the policy would be about how you would notify them?1933    Mr. Selsavage. I do not, but I can take that back to our1934team.1935    Ms. Lee. Thank you. I appreciate that.1936    I think these policies have a lot of room for improvement1937and that your customers deserve better, but it is at least a1938baseline, hopefully, of protection. Can you commit that 23andMe1939will not get rid of this policy regardless of who ends up1940owning it once the bankruptcy sale goes through?1941    Mr. Selsavage. I can say that the two bidders for the1942company have both agreed, both, you know, verbally and in1943writing in their contracts to purchase the company, that they1944will step into the shoes of the company and adopt the privacy1945policies and other consents on a go-forward basis.1946    Ms. Lee. God willing, I guess. It is really scary that1947people have to rely on the whims of a private company to1948protect their private information. The Fourth Amendment can1949only protect us so much as these loopholes and workarounds need1950to be fixed. So, I thank you all so much for your testimony1951today, and I yield back.1952    Chairman Comer. The Chair now recognizes Mr. Burchett from1953Tennessee.1954    Mr. Burchett. Thank you, Mr. Chairman. I believe you are1955from Kentucky, neighboring state. Ms. Wojcicki, did I get that1956right? Close?1957    Ms. Wojcicki. Very close.1958    Mr. Burchett. All right. Well, nobody gets ``Burchett'1959right, so do not feel like the lone ranger up here. Are you1960aware that in 2015, 23andMe received funds from a variety of1961investors, including WuXi Healthcare Ventures?1962    Ms. Wojcicki. I am aware of that.1963    Mr. Burchett. Okay. And according to 23andMe, this1964partnership has dissolved. Is that correct?1965    Ms. Wojcicki. That is correct.1966    Mr. Burchett. Do you know how much WuXi Healthcare Ventures1967invested in your company in 2015?1968    Ms. Wojcicki. They invested $10 million out of a $1151969million round.1970    Mr. Burchett. Okay. Are you aware that at that time WuXi1971Healthcare Ventures had direct ties to the CCP and the Chinese1972People's Liberation Army?1973    Ms. Wojcicki. We were not aware.1974    Mr. Burchett. Can you explain how the partnership between1975WuXi Healthcare Ventures and 23andMe was dissolved?1976    Ms. Wojcicki. I believe that they sold their shares. It was1977just an investment.1978    Mr. Burchett. Well, investors, though, in a corporation do1979have votes on things that occur, though.1980    Ms. Wojcicki. They had no control.1981    Mr. Burchett. They just gave you all $10 million with no1982strings attached?1983    Ms. Wojcicki. There was no control.1984    Mr. Burchett. They just gave you all $10 million with no1985strings attached? That is a yes or no?1986    Ms. Wojcicki. They were just an investor. No strings.1987    Mr. Burchett. Okay. I have a bill, H.R. 2286. It is the1988American Genetic Privacy Act of 2025, and it was actually put1989forth last year and you all's lobbyists do an excellent job.1990And this Congress, as Congresses in the past, have very little1991guts to do what I feel like is the right thing because it takes1992a great deal of trust for Americans to share their sensitive1993genetic information with DNA testing companies. And selling1994this information to companies with direct links to malicious1995foreign actors, I feel like, is a huge violation of trust. DNA1996testing companies must keep Americans' genetic information1997private so it is not used against us by the Chinese Communist1998Party or any other nefarious characters.1999    The bill that I put forth would prohibit commercial DNA2000testing services from disclosing this genetic information of2001the United States nationals to the CCP or entities affiliated2002with it. And if we had passed this, and it does not come2003through this Committee, it is another committee, but if we had2004passed that, we would be probably, the questions would be a2005little different up here. I was made aware of a situation where2006supposedly the Chinese could say they collected this data that2007was sold to them on the market, and they would do a genome,2008which I understand is a study of genetic information, and2009develop a pattern. And they could possibly develop diseases or2010something, a bug along that line, that could say, stop American2011women at childbearing ages from bearing children. And this was2012discussed up here, yet we have not brought forth any2013legislation to stop that, and that was over a year ago under a2014previous administration.2015    To me, that just shows the gutless nature of Congress and2016of us, and our greed and the power of the power of the K Street2017lobbyists. I would hope that this body and the media would2018bring attention to this problem. To me, it is a serious breach2019of ethics but our national security, and it should go past2020parties and pointing fingers. We just need to get some2021legislation filed, and we need to enforce it. It is worthless2022when we pass these worthless bills, these so-called studies.2023And then what happens is we get a good piece of legislation,2024you have got a committee that goes forth with the legislation,2025you have a well-intended Congress person, yet a staff person,2026the lobbyists have their ear and they stop that legislation for2027whatever reason. They say, we want you to do something, but we2028need to do a study.2029    Well, folks, if you have ever seen the movie ``Raiders of2030the Lost Ark,'' where at the end, there is a warehouse full of2031this stuff, of things that we are supposed to be looking at,2032that is what I believe these studies go to, is there is some2033worthless warehouse, and we go home and we tell everybody, look2034what we did, and we do not do a dadgum thing up here. We have2035got to get past the greed and the gutless nature of this thing.2036We need to take our dadgum country back, and both parties ought2037to be ashamed. Mr. Chairman, I yield back the remainder of my2038time.2039    Chairman Comer. The gentleman yields back. The Chair2040recognizes Ms. Tlaib from Michigan.2041    Ms. Tlaib. Thank you, Chairman Comer. You know, Americans2042are rightfully worried. I know the professor knows and probably2043hears from a lot of folks about corporations and how our2044government is allowing them, like 23andMe and others, to use2045and sell deeply personal information, including medical and2046genetic data. I want to tell my colleagues, and I am glad to2047hear some of them speak up about this because sometimes I feel2048like our country has gradually turned into a surveillance state2049where everything about who we are, what we do is generating2050private profit and leave us without any privacy: surveillance2051pricing in grocery stores, come on; the NSA spying on our2052private communications; insurance companies using2053discriminatory factors based on our private medical and genetic2054history. I do not know any American, Republican, Democrat,2055Libertarian, independent, whatever the labels that they put2056out, wants to live like that. No one does.2057    So, Professor Hu, you know, how can we ensure that genetic2058data of 15 million users as 23andMe is being put for sale, will2059not be used for private actors? And I just wanted to be clear:2060I know everybody is talking about China, but I am actually2061really worried about corporate greed here in our country. You2062know, to me, corporate greed in our country is a disease. It is2063causing more death. I do not care if it is a fossil fuel2064industry, what my residents call sick care, not health care in2065our country, whatever it is. But I am really worried, Professor2066Hu, because, Professor Hu, I can see healthcare insurance2067companies using data saying, your genetics shows you might get2068breast cancer, we are not going to cover you, you are not going2069to get life insurance, you are not going to be able to get2070access, or they are going to, again, use this to profit, not to2071help. We do not seem to prevent death and destruction in our2072country. Even this chamber does not do that, and so what can we2073do? I mean, this is genetical, medical, you know, history. As2074you know, it is incredibly important, especially, you know, I2075know a lot of ethnic and racial heritage is also mixed up in2076there, and you saw them targeting folks of Jewish faith, and2077again, is just to me watching this happen, and then we do2078nothing. We will have this hearing, and I know Chairman Comer2079is trying to do his best, but we are going to have this2080hearing, but are we going to actually update HIPAA? Are we2081going to actually do something to push back against, you know,2082profit for this kind of data and information?2083    Professor Hu. Thank you so much, Congresswoman, for that2084question. And I do think that this is a moment to assess first2085principles in our commitment to the Constitution and to what2086extent does the increasing privatization and commodification of2087this data come into conflict with our core values, but not only2088just our constitutional values, our national security2089interests, and the way in which our national security interests2090are infused by these fundamental commitments to rights and2091liberty and freedom and expressive rights and privacy rights as2092anchoring how we see, you know, ourselves as a Nation.2093    So, you know, your question about, you know, what can we do2094to stop drifting into a surveillance state, I do think that one2095of the things that we need to make sure that we understand is2096that our ability, I believe, for us, to remain dominant2097geopolitically is not about deregulation or de-devolution of2098the regulations around data privacy, cybersecurity, and AI but2099leaning into them so that we can make sure that these systems2100unfold safely and securely, and other nations are now embracing2101these types of legal regimes, including China, and we are not.2102And I think that that puts us at a great national security2103disadvantage.2104    Ms. Tlaib. I agree. I think for many of our colleagues2105here, you know, expressing on X your concern and everything2106about like, again, privacy is important, but I think we need2107really comprehensive data that protects the Americans' private2108data. I mean, this is literally going to be a fight between the2109corporate greed and the government surveillance and how2110overreaching that is because it is, again, going to be profit2111before the people, and many of them are going to 23andMe2112because they want to live. They want to live. They do not want2113to get sick. They want preventive care.2114    And I know, like, you know, the Trump Administration right2115now is destroying privacy protections. I see it raiding private2116Social Security data, tax info, bank account numbers, you name2117it. I am really concerned about this growing factor, but I also2118want many of my colleagues to know, I mean, Trump is now2119working with data and surveillance companies like, what is it?2120Palantir--is that how you say it--I mean, look at this, to2121compile databases on Americans. First to target immigrants.2122They always start there, and then they are going to target, you2123know, it is going to be other folks. It is going to be2124unbelievable because, you know, Peter Thiel and Alex Karp, who2125made it clear that they care more about political domination2126than American democracy or individual privacy.2127    I say this because we are talking about 23andMe, but2128understand there is a bigger movement in our country that we2129need to put in check right now because they do not care about2130us. They do not care about the folks that put us here and told2131us to protect them, and so I think it is really important,2132Chairman, after this hearing, let us not just have it in the2133congressional Record. Let us actually do legislation to hold2134them accountable. With that I yield.2135    Chairman Comer. The gentlelady yields. The Chair recognizes2136Mr. Burlison from Missouri.2137    Mr. Burlison. Thank you, Mr. Chairman. Professor Hu, it has2138been talked about a lot in this hearing about the potential2139threats and risks of, you know, a foreign actor getting access2140to, you know, Americans' DNA records. Can you elaborate on what2141is the potential risks that we are facing?2142    Professor Hu. Yes. Some of the risks include, for example,2143blackmail, using it in order to exploit and try to make2144individuals more vulnerable, greater surveillance risks, and as2145was discussed, potential biochemical, biometric types of2146warfare. But I do think that there are also potential AI-driven2147targeting risks as well.2148    Mr. Burlison. And then, you know, this is not new. I mean,2149the hospitals, providers, their electronic medical records,2150they are tempted to be hacked all the time. Have you heard of2151what the street value of someone's medical record is? At one2152point I had heard that it is over $50,000 or more. It is2153probably a lot more today. Mr. Selsavage, one of my questions2154has to do with how the hack occurred in 2023. Is it correct2155that individuals who had stolen, you know, passwords from other2156businesses then use that in a form that is called stuffing,2157where they used an automated system to take, say, the hacked2158passwords and accounts from another company and then just2159rolled through those to see if those same passwords were used2160on your site. Am I getting that accurately?2161    Mr. Selsavage. That is generally accurate. It is something2162called credential stuffing, whereby a user, you know, and we2163all have done this, has used the same username and password on2164multiple websites.2165    Mr. Burlison. Right.2166    Mr. Selsavage. And other websites were hacked, and they2167were able to obtain those usernames and passwords, and then2168they tried them on 23andMe and they were able to access a2169number of accounts, to get into and take the DNA relative2170information.2171    Mr. Burlison. And so, the mechanisms that you have put in2172place to stop that from happening in the future are that you2173send a text message to verify that somebody is logging in from,2174that was the original individual. What other steps do you take?2175    Mr. Selsavage. You know, right after the cybersecurity2176incident, the first thing we did was force every consumer to2177reset their password, and as part of that process----2178    Mr. Burlison. They could not use the previous one.2179    Mr. Selsavage. They could not use the previous one, and we2180also checked that password against known hacked passwords,2181right, just to make sure that, you know, the same thing wasn't2182going to be happening with another credential stuffing.2183    Mr. Burlison. I think if the American people are listening,2184you should never use the same password for different website2185businesses.2186    Mr. Selsavage. That is a very good process.2187    Mr. Burlison. Just a good policy to follow.2188    Mr. Selsavage. And then second, you also mentioned we did2189also implement two-factor authentication, whereby, you know,2190basically we actually then either sent the customer a text2191message or an email confirming that it was them, and they2192entered that code to make sure that there was an additional2193layer of security, a second factor, to access their account.2194    Mr. Burlison. Yes. Thank you. Ms. Wojcicki. Is that2195correct? You know, I think that one of the things that is kind2196of striking me is that when someone enters into an agreement,2197they know your company, they know your reputation, they know2198you. I think what we are kind of going through is a situation2199where potentially that what the trust that was placed in you2200because of this situation is in jeopardy if somebody else gets2201access to that information. The question is, what will they do2202with that? So, one of my questions is, do you think that there2203should be a law that upon the sale of a business that an2204individual has to reconfirm that they want the new company to2205have access to their data?2206    Ms. Wojcicki. Thank you for that question. I am a huge2207believer that people should have choice in transparency. So, I2208think it is a complicated question, the one you just asked,2209because there are individuals, for instance, like my sister,2210who recently passed away of lung cancer, who established a lung2211cancer community in 23andMe, and feels very passionately about2212identifying genetic risk for non-smoking lung cancer. So, she2213is deceased. She opted in to research because she really cared2214about that mission, and it was really important for her. You2215know, lung cancer is massively underfunded, it is one of the2216poorest-funded areas, so how could we all come together? So,2217how could she possibly reconsent?2218    Mr. Burlison. I just have one more question. So, when a2219separate company that you have created, have a contract with2220you and you shared some of that data, what mechanisms do you2221have to protect and make sure that company is not then2222reselling it and sharing that data?2223    Ms. Wojcicki. That would have been part of the contract.2224So, for example, with GSK, they were looking at aggregate2225statistics, they could not go and then share that with other2226partners.2227    Mr. Burlison. Okay. Thank you. I yield back.2228    Chairman Comer. The Chair now recognizes Ms. Pressley from2229Massachusetts.2230    Ms. Pressley. Ms. Wojcicki, you claimed that 23andMe is all2231about consumer empowerment, but most people ended up actually2232exploited, not knowing that they signed up to have their2233genetic data auctioned off to the highest bidder. We are not2234just talking about email addresses, we are talking about names,2235birth dates, genetic lineages, literal DNA, data that2236implicates entire families, not just the person who gave the2237sample. Ms. Wojcicki, can genetic data, even if de-identified,2238be linked back to individuals?2239    Ms. Wojcicki. I appreciate that question. Could genetic2240data be linked back to individuals? You can link back. Your DNA2241is your DNA. If I have a way of matching it to something that2242potentially connects to you, then you could potentially2243identify.2244    Ms. Pressley. So, the answer is yes. The answer is yes. The2245genetic data, even if de-identified, can be linked back to2246individuals, just the science?2247    Ms. Wojcicki. No. DNA, if I had your sample, essentially,2248if I know what your picture looks like and I see another2249picture, I can connect those, but just having your DNA alone,2250if I just went to the subway and I swabbed it and I looked at2251samples, I would not be able to identify who is there.2252    Ms. Pressley. Let me reclaim my time because I do not have2253much of it and there is a lot of ground I need to cover here,2254and so I want a more direct question here. So, I am going to go2255to Ms. Hu. Is de-identified genetic data truly anonymous or can2256it be traced back to individuals? Ms. Hu.2257    Professor Hu. Thank you so much, Congresswoman. I am not a2258scientific expert on that exactly, but there has been research2259on the limits of de-identification and also the risks of re-2260identification.2261    Ms. Pressley. All right. Fair enough. Yes, it absolutely2262can. With just a few pieces of additional information, like zip2263codes, gender, or 23andMe's Find Your Relative feature, it2264becomes easy to re-identify people and to expose their personal2265health information. 23andMe's privacy agreement talks about2266anonymous data, but DNA can never truly be anonymous. That is2267the point.2268    Now, Ms. Wojcicki, you said a limited number of customers2269were compromised by the data breach, but the truth of the2270matter is that out of the 15 million people who trusted this2271company, half of them, seven million, had their data exposed.2272So, that is not inconsequential. It is deeply consequential.2273And now, that same data can be sold off to a for-profit2274pharmaceutical company, so you can understand why people are2275rushing to delete their accounts. But the thing is, when people2276have tried to log in and delete their data, they received error2277messages, and then the website crashed. That is not okay. Your2278company is preventing people from deleting their information.2279    Mr. Selsavage, it is time to put people first. Will you2280contact each of your customers seeking consent for 23andMe to2281continue holding their data? Yes or no, your simple opt-in2282communication that you send out before any bankruptcy sale. I2283want to really underscore that.2284    Mr. Selsavage. Congresswoman, we first have sent a notice2285out to all of our customers via email----2286    Ms. Pressley. Reclaiming my time, Mr. Selsavage.2287    Mr. Selsavage [continuing]. Notifying them of the sale. A2288second email is currently going out this week, notifying them2289that the sale----2290    Ms. Pressley. Mr. Selsavage, reclaiming my time. Please2291just answer the question yes or no, okay? Will you commit to2292contacting each of your customers seeking consent for 23andMe2293to continue holding their data? This should be a simple opt-in2294communication that you send out before any bankruptcy sale. Yes2295or no.2296    Mr. Selsavage. Congresswoman, it is not that simple. We2297believe we have already received consent from them.2298    Ms. Pressley. Why not? These people are deserving of these2299assurances and this insurance. They have been violated in so2300many ways here. Ms. Wojcicki, will you amend your bid to commit2301to a similar consent requirement then?2302    Ms. Wojcicki. I do not believe I can talk extensively about2303my bankruptcy, about the bid, but I can say in the past, for2304example, when we did the GSK partnership, we proactively2305communicated with all customers.2306    Ms. Pressley. I know that, I know that, I know that, I know2307that. It is not good enough. It is not good enough. It is just2308not good enough. People trusted you with their more personal2309information. Show them you respect them. They do not need your2310apologies anymore, and they do not need your sympathy. What2311they need is legal protection. So, if you are not able to2312protect the 15 million people and their families who trusted2313you, this company should not exist. The breach of data, the2314breach of civil liberties, the confusion this has caused for2315millions, it might just be time to give it up. I yield back.2316    Chairman Comer. The Chair now recognizes Mr. McGuire from2317Virginia.2318    Mr. McGuire. Thank you, Mr. Chairman. Thank you to our2319witnesses for being here today to answer our questions2320regarding the safety of millions of Americans' genetic2321information and personal data. If malign foreign actors such as2322the Chinese Communist Party, CCP, were to get their hands on2323the data, the privacy of millions of Americans and our national2324security will be at risk. And I apologize if I do not pronounce2325your name right, but Ms. Wojcicki. Is that right?2326    Ms. Wojcicki. That is great.2327    Mr. McGuire. We know approximately 15 million customers2328have submitted their DNA samples for genetic testing to232923andMe. Do you know roughly how many of these customers are2330American citizens?2331    Ms. Wojcicki. I believe the last when I was there, it was2332about 85 percent of customers were from the U.S.2333    Mr. McGuire. Thank you, and, Ms. Wojcicki, yes or no. Did233423andMe already give Chinese corporations associated with CCP2335and the Chinese People's Liberation Army access to this data?2336    Ms. Wojcicki. To the best of my knowledge, since I have not2337been there since March, no.2338    Mr. McGuire. Understanding that every company in China is2339associated with the CCP. All right, Ms. Wojcicki, 23andMe2340received investments from WuXi Healthcare Ventures, a company2341tied to the Chinese People's Liberation Army and CCP. What2342other foreign entities have invested in 23andMe?2343    Ms. Wojcicki. In 2018, 23andMe had an investment from2344GlaxoSmithKline, which is a U.K.-based operation.2345    Mr. McGuire. And Mr. Selsavage and Ms. Wojcicki, yes or no.2346Would you be comfortable with your or your family's genetic2347information and sensitive data being in the hands of a malign2348foreign actor such as CCP? Yes or no.2349    Ms. Wojcicki. I would not be comfortable.2350    Mr. Selsavage. I would not be comfortable.2351    Mr. McGuire. All right. follow-up: what steps are you2352taking to ensure the sensitive data of millions of Americans is2353secure and will not be sold to malign foreign actors?2354    Mr. Selsavage. I can take that question.2355    Mr. McGuire. Thank you.2356    Mr. Selsavage. You know, as part of the bankruptcy 363 sale2357process, we have, you know, special committee has affirmatively2358said that the company will not be sold to any entity in China,2359Russia, North Korea, Iran, or any other foreign adversary. I am2360happy to report that through the bankruptcy process, we, at the2361current time have two final bidders, both American enterprises:2362TTAM Research Institute, which is an American foundation, and2363second is Regeneron Pharmaceuticals, which is an American2364pharmaceutical company, here as a public company.2365    Mr. McGuire. There will be dire consequences to our2366national security as well as the privacy of millions of2367Americans if the CCP or other malign foreign actors are able to2368gain access to sensitive data of 23andMe. The CCP and any of2369the foreign actors should not be allowed to gain access to2370millions of Americans' sensitive data, which can then be2371weaponized against them through surveillance or even the2372creation of a bioweapon. It is our duty as Members of Congress2373to protect our constituents' privacy and our country from2374foreign actors who will weaponize this data against us if given2375the opportunity. And with that, Mr. Chairman, I yield back.2376    Chairman Comer. Would you yield a minute to me of your2377remaining time?2378    Mr. McGuire. Absolutely.2379    Chairman Comer. How confident are you all that your data2380will not end up in the hands of a bad actor? Are you very2381confident, somewhat confident, or you have no idea?2382    Mr. Selsavage. As interim CEO, I am very confident that,2383you know, the sale of the company will not result in the2384company being sold or the data ending up in the hands of a bad2385actor, and by that I am referring to China, Russia, Iran,2386Venezuela, or other foreign adversaries.2387    Chairman Comer. What about health insurance companies or2388things like that, American health insurance companies?2389    Mr. Selsavage. I think I am very happy to report that the2390final two bidders for the company are TTAM Research Institute,2391which is a foundation here in the U.S., founded by Ms.2392Wojcicki; and second is Regeneron Pharmaceuticals. Neither of2393those are healthcare companies.2394    Chairman Comer. Yes. Okay.2395    Mr. Selsavage. And I feel confident that they are taking2396over the privacy and policies and consensus of 23andMe.2397    Chairman Comer. Ma'am, how confident are you?2398    Ms. Wojcicki. I am not involved in the bankruptcy process2399other than being a bidder, and so for myself----2400    Chairman Comer. If you end up with it, you are confident2401that your company will?2402    Ms. Wojcicki. I am confident.2403    Chairman Comer. All right. The Chair recognizes Mr. Min2404from California.2405    Mr. Min. Thank you very much, Chair Comer. I have to2406confess, I do not use 23andMe. I have never been tested for2407genetics, but I certainly have a lot of customers who have2408chosen to use 23andMe, and I have heard from a lot of them. But2409Mr. Selsavage, I understand that customers of 23andMe can2410choose to consent to have their individual genetic information2411shared with your researchers. What protections were put in2412place to protect your customers from the misuse of that data?2413    Mr. Selsavage. First, you know, our customer data and our2414policies are always putting our customers first.2415    Mr. Min. Right. Reclaiming my time. Just briefly, what2416protections are in place to protect your customers from misuse2417of that data?2418    Mr. Selsavage. First, they can have the right to actually2419remove their consent to that data for being used for research2420policies at any time. The company always has provided2421researchers with de-anonymized data. We are not providing2422individual identifiers when we actually share that data for any2423research.2424    Mr. Min. And I believe you also have protections that it is2425explicitly limited to just research purposes, right? You could2426not, like, go ahead and sell that to Goldman Sachs, right?2427    Mr. Selsavage. You know, first, there is a research consent2428that only 23 can use their data for research purposes, and2429there is a separate individual consent for using that data with2430third parties.2431    Mr. Min. Right. I understand that, but I am looking at your2432terms of service right now, and I do not see any specific2433language giving 23andMe any ownership rights to people's2434individual level genetic health information. Is that correct?2435    Mr. Selsavage. That is correct. Our customer data----2436    Mr. Min. Okay. Reclaiming my time. Under the section it is2437described as licensing and IP rights, your terms of agreement2438state that you get a license to use ``user content,'' which is2439described as information, data, things like that, that are2440generated by users of the service and transmitted to you. It2441goes on to say specifically, ``User content does not include2442genetic or health information.'' I take it from this and the2443fact that licensing rights for individual genetic or health2444data are not mentioned anywhere else in your terms of service,2445that you also do not receive a licensing right or royalty2446rights to people's individual genetic or health data. Is that2447correct?2448    Mr. Selsavage. I am not a lawyer, but, you know----2449    Mr. Min. You do not own it. You do not own the data2450individually of people. You can use it for some purposes, for2451research, if they consent to it, but you do not have an2452ownership right, isn't that? I think you just said that. Is2453that correct?2454    Mr. Selsavage. That is correct. Our customers own their2455data, and they control that data at all times.2456    Mr. Min. So, I want to re-ask the question. Could you share2457somebody's individual data, genetic data, with Goldman Sachs or2458Elon Musk or with the Chinese Government? Could you sell it to2459the highest bidder?2460    Mr. Selsavage. You know, our policies state that, you know,2461basically we can actually----2462    Mr. Min. Reclaiming my time. If I was really interested in2463the genetic data of Chairman Comer, could you sell? Could I buy2464Chairman Comer's data if he was a client at your service?2465    Mr. Selsavage. No, you could not.2466    Mr. Min. Why not?2467    Mr. Selsavage. Because we do not have the right to share.2468    Mr. Min. Because you do not own it, right? You do not own2469the rights to that. Could you sell the homes of your customers?2470Could you sell any other assets they owned? The answer is no,2471because you do not own that, right? So, you do not own people's2472genetic or health information. So, I guess I am really just2473wondering why you think you can sell this data at an individual2474level to a third-party company that is coming in. I know you2475are talking about protections on that data, but I am just2476wondering. I am not a customer of yours, but for those who are,2477including my constituents, why are you selling their genetic2478data when you do not own it?2479    Mr. Selsavage. You know, the terms of service and the2480agreements at 23----2481    Mr. Min. I looked at your terms of service, yes.2482    Mr. Selsavage. It mentioned that we can basically, in the2483event of a sale of the company, or a bankruptcy of the company,2484that the data can be transferred to the new company.2485    Mr. Min. Look, 23andMe, what you guys do, I think at your2486height, you seem like you are doing great things, but you fall2487into a clear regulatory gap here between HIPAA and GINA, as I2488think has been described. And I think this is one of those rare2489instances where my Republican colleagues and I all, we all2490agree on the problems that this raises, and I think it is clear2491that we need some kind of regulatory protection. So, I guess I2492am going to ask you, in the meantime, before we address this2493with law, I want to echo the point made by my colleague, Rep.2494Pressley, why won't you commit to what seems like a very2495reasonable and commonsense opt-in policy, given that you are2496about to sell people's individual level genetic data, very2497valuable information, very personal information. Why won't you2498commit to doing that? It seems like a very reasonable thing to2499do.2500    Mr. Selsavage. Congressman, we believe our customers have2501already consented to the transfer of their data through the2502consents that they signed up for when they signed up for the2503service. Second, we have provided the customers with notice of2504the bankruptcy, and we will be providing them with notice of2505who the company----2506    Mr. Min. Do you check every email you read?2507    Mr. Selsavage. I do not.2508    Mr. Min. I certainly do not, and we certainly might miss an2509email or several emails like this. And I would just encourage2510you to think about an opt-in policy because what you are2511describing right now is the transfer and sale of data that is2512very, very personal, and I personally find it very outrageous2513that you are not allowing people to opt in to this, not giving2514them that right, knowing that the open rates of your emails are2515probably very low. With that, I yield back.2516    Chairman Comer. The gentleman yields back. I hate to2517interrupt this good bipartisan hearing, but at the request of2518the witnesses, we are going to take a 5-minute bathroom break.2519When we return, Mr. Timmons will be asking questions. So,2520pursuant to the previous order, the Committee will stand in2521recess for 5 minutes.2522    [Recess.]2523    Mr. Higgins. [Presiding.] The House Committee on Oversight2524and Government Reform Full Committee hearing titled, ``Securing2525Americans' Genetic Information: Privacy and National Security2526Concerns Surrounding 23andMe's Bankruptcy Sale,'' is back in2527session.2528    The Chair recognizes Ms. Greene of Georgia for 5 minutes2529for questioning.2530    Ms. Greene. Thank you, Mr. Chairman. Ms. Wojcicki--I am2531sorry, I apologize--you co-founded 23andMe in 2006 and took the2532company public in 2021. Is that correct?2533    Ms. Wojcicki. That is correct.2534    Ms. Greene. And this is all about DNA, which we would call2535science. Is that right?2536    Ms. Wojcicki. It was really about how individuals can learn2537about their genetic information.2538    Ms. Greene. Right, but DNA and the study of it is science.2539Is that correct?2540    Ms. Wojcicki. It is about learning about their family,2541their ancestry, science, and their health risks.2542    Ms. Greene. Okay. So, it is science. Now in 2001, you2543reposted Dr. Raven the Science Maven, who reposted my post of a2544sign that I kept outside of my office that said, ``There are2545two genders: male and female. Trust the science.'' And the2546attack on this, which you reposted, so you must have agreed2547with them was, ``As a scientist with a transgender parent, I2548need you to sit down. You do not know the science or the2549history. You trust the science. Science draws a difference2550between sex at birth and gender identity. The systematic2551institutionalization of gender is a product of colonization.''2552What does colonization have to do with gender?2553    Ms. Wojcicki. I have not seen that in a long time. I do2554not----2555    Ms. Greene. You reposted it, though, so you must have known2556something about it. Also, 23andMe, the company that you led at2557the time or that you are still there and you are trying to buy,2558``Opponents of trans rights use the phrase 'trust the science'2559to make false claims about sex and gender. We support what the2560science actually says, accepting and affirming trans people has2561a positive impact on their health. Trust the science. Support2562trans health,'' which is really interesting because in DNA it2563shows that there are only two sexes, two genders, male and2564female, and that should be something that you are intimately--2565you know, you are very tied into that since you founded the2566company, co-founded the company, took it public, and you want2567to buy it again.2568    So, it is baffling that 23andMe, a company that specializes2569in DNA and people's very personal information and how God has2570designed human beings would support and continue to support the2571trans ideology, that this is something that can be changed.2572Have you ever seen any DNA or know of DNA that a biological2573male can give birth to a baby?2574    Ms. Wojcicki. No.2575    Ms. Greene. No. So, this is something that we know cannot2576be changed. That is scientific. That is the design of our DNA,2577and I do not understand, and I think most people do not2578understand, why 23andMe would take such a hard-left political2579position supporting trans rights. And here is what is the2580really weird part about it is. It says, ``This is one of the2581many reasons why we have been working to improve our products2582for trans and non-binary customers.'' I thought your product is2583helping people understand their DNA, linking themselves with2584family trees, so I cannot comprehend what kind of product258523andMe could give to people who identify themselves in some2586other way. That does not make a lot of sense.2587    Another thing that is hard to understand is, you know, the2588beauty of DNA is that it is a beautiful design. It is God's2589design down to the finest detail, a granular level of how we2590are made, but it also helps people link with their family2591trees. Yet, this is a letter that you put out after the SCOTUS2592ruling overturning Roe v. Wade, and you put out a letter very2593much against the ruling that the right should go back to the2594states. And you clearly put your own personal belief in here on2595the 23andMe social media that you are very much for the killing2596of the unborn, the killing of babies, which completely would2597destroy what your company is all about. How can we study DNA,2598how can we study people's lineage if one of the very co-2599founders, and who wants to own the company again, supports the2600murder of the unborn, the murder of God's design and the murder2601of God's creation, which we can link it to DNA?2602    And Mr. Chairman, I am running out of time, but I think2603that is 100 percent against the science, and I think it is 1002604percent against God. I yield back.2605    Mr. Higgins. The gentlelady yields back. The gentleman, Mr.2606Bell, is recognized for 5 minutes for questioning.2607    Mr. Bell. Thank you, Mr. Chair, Ranking Member, and our2608witnesses for being here today. And in Missouri, we are2609currently recovering from one of the largest natural disasters2610since 1959, which has left an impact statewide, with extensive2611damage to my district in the St. Louis region. As we recover2612from these storms, the threat of waste, fraud, and abuse2613lingers above the lives of the thousands of individuals2614impacted. These same individuals who are already exhausted and2615depleted from the mental turmoil and physical loss are now2616faced with the threat of fraud. Studies have suggested that2617individuals recovering from natural disasters are at a higher2618risk of being susceptible to scams. Many of these scams come in2619the form of imposters who are impersonating government2620officials, bank workers, or even FEMA employees, to acquire2621vulnerable information.2622    These fraudsters preying on these vulnerable communities2623use the tactic of acquiring individual's private information,2624like Social Security numbers, bank account numbers, and2625addresses, by posing as a resource to provide help but2626subsequently using the information obtained for their own2627personal gain. Ms. Hu, do you agree that access to this2628personal information poses a significant threat to Americans'2629livelihoods, especially those in vulnerable communities.2630    Professor Hu. Thank you, Congressman. I think that you are2631helping to elevate one of the critical issues about data2632privacy, and that is the way in which it can be exploited,2633particularly to those who are most vulnerable. And without2634comprehensive privacy laws or greater cybersecurity protections2635at the Federal level, I fear that we are going to continue to2636face these types of issues.2637    Mr. Bell. And since we were talking about privacy, I am2638going to go off my remarks for a second. To the previous2639questions, I do not really care what your positions are on2640abortion. What I care about is that a woman has a right to make2641a decision with her own body, that people have a right to make2642a decision with their own body and healthcare choices. So, what2643we have seen with 23andMe is a breach of privacy that has left2644many communities vulnerable to foster attacks ranging from2645identity theft to risk from exposure of genetic data. I agree2646and recognize the need for comprehensive legislation that2647ensures transparency in the collection and use of personal2648data, along with stronger security measures and protections2649when it is handled by corporations, but I also know that the2650threat of fraud and abuse does not just lie in our2651corporations, but amongst our very own government.2652    What we have been seeing over the last couple months is one2653of the largest fraudsters of them all, and his name is Elon2654Musk, who this Committee refuses to bring to this to a hearing2655to question. Musk, who has scammed the American people with2656false promises of efficiency and elimination of waste, fraud,2657and abuse has carried out the exact opposite. Musk and his DOGE2658team, or whatever you want to call them, have ransacked2659multiple Federal buildings under false pretenses, gathered2660sensitive and personal data and vanished, leaving others to2661pick up the pieces and rebuild. Sounds pretty similar to the2662tactics of disaster frauders to me.2663    It is our duty not only to hold corporations accountable,2664but also to hold anyone accountable who violates the privacy2665and safety of the American people. I will continue calling out2666and fighting back against fraudsters and protecting the2667individuals who need it most. Thank you, and I yield back to2668the Ranking Member.2669    Mr. Higgins. Does the gentleman yield his time back?2670    Mr. Bell. To the Ranking Member, yes.2671    Mr. Subramanyam. Thank you for that. I yield back.2672    Mr. Higgins. The gentleman yields. The gentleman from2673Arizona, Mr. Biggs, is recognized for 5 minutes for2674questioning.2675    Mr. Biggs. Thank you, Mr. Chairman, and thank the witnesses2676for being here. I want each of you to answer this question as2677succinctly as possible. Who owns the genetic information at267823andMe? Ms. Wojcicki?2679    Ms. Wojcicki. What we have said in the past is that you,2680you are the individual, always owns their genetic information.2681    Mr. Biggs. Okay. So, look, I am going to leave it right2682there. The owner, you have said, basically the person who2683submitted their genetic information. Mr. Selsavage?2684    Mr. Selsavage. The owner of the genetic information is the2685customer at 23andMe.2686    Mr. Biggs. You agree with that, Professor Hu?2687    Professor Hu. In their terms, they say that they can sell2688data.2689    Mr. Biggs. Okay. Yes. So, yes, not that they can sell, but2690that the actual ownership rights, and when you own it legally,2691you got a bundle of rights. And then I think, Mr. Selsavage,2692you said that there is a license for use, and, Ms. Wojcicki, I2693thought I heard you say that, too, that that somebody opts in,2694they are providing a license for use, either for research or2695other use. Is that fair? You are operating under license2696agreement at that point?2697    Mr. Selsavage. Our customers basically provide consent for2698us to use their data.2699    Mr. Biggs. Strike that. Let us hold on.2700    Mr. Selsavage. Okay.2701    Mr. Biggs. Let us not get funny with words. Are you given2702the license to use it?2703    Mr. Selsavage. Congressman, with all due respect, I am not2704a lawyer.2705    Mr. Biggs. Okay.2706    Mr. Selsavage. You know, I do know that our customers are2707always given the right to consent or remove that consent to use2708their data for research purposes.2709    Mr. Biggs. Okay. All right. So, we will leave it there for2710a second, and let us just get to liability because even in a2711license agreement, you can breach a license agreement, and even2712if someone provides consent, you can abuse a consensual2713arrangement. And the question is, who has liability at that2714point, and I would suggest to you, 23andMe does. Would you2715agree with that, Ms. Wojcicki?2716    Ms. Wojcicki. I am not sure I understand the question.2717    Mr. Biggs. If you guys, 23andMe, were to violate what2718apparently is not a license but some kind of consent agreement,2719you would have a liability for that, for failure to protect the2720markers?2721    Ms. Wojcicki. If 23andMe violated the consent, yes, then I2722would believe there would be an issue.2723    Mr. Biggs. Mr. Selsavage, you agree with that?2724    Mr. Selsavage. Yes, I believe 23andMe has a duty to uphold2725the consent that our customers have agreed to and that we have2726agreed to with them.2727    Mr. Biggs. Okay. Professor Hu?2728    Professor Hu. Then yes, in the breach litigation, I think2729the class action shows that there was liability.2730    Mr. Biggs. Right. And so, let us now compare to just2731national security for just a moment. Professor Hu, what2732specific vulnerabilities in our current laws allow this data to2733be exploited, the data we are talking about that 23andMe is2734sitting on?2735    Professor Hu. Yes. I am deeply concerned that if it is, you2736know, faced with foreign investor, which has already been2737brought up, whether or not there could be other ways in which2738there could be, once there is a breach, that it can fall into a2739foreign adversary's hands.2740    Mr. Biggs. Let us get back to the liability for just a2741second again because this is driving me crazy. As one who owns2742the genetic information--let us say I did--at any point you2743said I can withdraw consent. Can I order you to destroy that2744genetic information?2745    Mr. Selsavage. Yes, you can. Our customers always have the2746right of ownership. They can have complete control over their2747data. They can access it, and they can edit it.2748    Mr. Biggs. So, I am talking about, specifically, the sample2749as well as the data. Do you agree with that?2750    Mr. Selsavage. Yes. They can request a deletion of their2751data, which we will, and we would delete that data, and at the2752same time, if we had a saliva sample, which they agreed to have2753biobanked, we would destroy that as well.2754    Mr. Biggs. Professor Hu, Americans are really concerned2755about domestic surveillance programs. Believe me, FISA has been2756abused by our own government, et cetera. How can Congress2757prevent the U.S. Government from having unauthorized access to275823andMe's genetic data?2759    Professor Hu. I think that what we need is to expand HIPAA,2760and we need to expand GINA. We need to have greater, I think,2761protections and cybersecurity assurances.2762    Mr. Biggs. So, I am going to lay this at you. With the2763abuse of FISA that we have seen, and these are massive2764databases being accumulated on American citizens, and inquiries2765being made by the FBI without any kind of judicial authority,2766nor with consent of the individual, do you think, Ms. Wojcicki2767and Mr. Selsavage, that 23andMe has taken adequate protective2768measures to prevent incursion from any state or non-state2769actor? I mean, you know you had the problem where you were2770hacked. So, what have you done then to make sure that you are2771secure against even things like the U.S. Government? And as a2772compound question, have you ever received a request from the2773Federal government or any other governmental entity to have2774access to a particular DNA sampling that perhaps might be in2775your database?2776    Mr. Higgins. The gentleman's time has expired, but the2777witness will be allowed to answer the question.2778    Mr. Selsavage. Okay. I will take the second question first.2779You know, the company has published, you know, on our2780transparency page, which is a public page on our website, you2781know, requests that we have received from law enforcement with2782regard to DNA data that the company has held. At no time have2783we actually provided that data to law enforcement or other2784authorities. Second, you know, basically, after the2785cybersecurity incident, we have taken additional steps to2786secure the data that we have at 23andMe from both, you know,2787foreign actors or any type of threat actor, including, you2788know, providing additional encryption over the data, you know,2789hiring, putting in additional security measures. And for simple2790access to customer accounts, adding in two-factor2791authentication and requiring all our customers to reset their2792passwords and ensuring those passwords and usernames have not2793been used in other compromised websites.2794    Mr. Higgins. I thank the gentleman. Mr. Timmons from South2795Carolina is recognized for 5 minutes for questioning.2796    Mr. Timmons. Thank you, Mr. Chairman. I want to focus on2797the potential of your data being used for bioweapons. You have2798the second largest collection of DNA behind AncestryDNA. Is2799that correct?2800    Mr. Selsavage. That is correct.2801    Mr. Timmons. So, the internet says 25 million is what2802AncestryDNA has. You are at, what, 14 million, 15 million?2803    Mr. Selsavage. That is correct.2804    Mr. Timmons. And you agree that there is the potential that2805a rogue actor or an evil nation-state could use the genetic2806data that you or AncestryDNA has gathered to then create a2807targeted bioweapon that would target people of certain2808geographic locations, ethnicity. You could even do eye color.2809Is that scientifically possible? Would you agree? You are not a2810scientist, but----2811    Mr. Selsavage. Congressman, I am not a scientist, but I2812understand.2813    Mr. Timmons. Well, the research abounds, really, the last2814two decades, it shows that should a nation-state or a well-2815funded rogue actor be willing to engage in such atrocities,2816they could do that, and realistically, in order for that to be2817effective, they would need a very large amount of data from all2818over the planet. As you consider how this bankruptcy is going2819to be resolved, is that front of mind, or are you going to make2820sure that the vast amount of data that you have is not going to2821fall into the hands of an evil actor. Is that fair?2822    Mr. Selsavage. That is fair. First, let me say that as part2823of the bankruptcy process, the special committee of 23andMe has2824committed to ensuring that under no circumstances will we sell2825this data to any foreign adversary, including any enterprise2826controlled by China, Russia, Iran, Venezuela, North Korea, or2827any foreign adversaries to the United States. Second, you know,2828we have two final bidders in the auction process for 23andMe,2829both of those, TTAM Research Institute and Regeneron are2830American enterprises. Regeneron an American pharmaceutical2831company, a public company with $55 billion----2832    Mr. Timmons. Thank you for that. That is helpful. Before I2833go to Ms. Wojcicki, I want to point out that while every2834individual technically owns their data that you have, it is2835comical to think that that ownership is real, because the2836likelihood of even one percent of the individuals who have used2837your service asking you to delete their data is virtually zero.2838I actually did 23andMe, so I mean, while I do own my data and I2839could probably log in and try to figure out how to delete it, I2840am not going to do that. Nobody else that has used your2841business is going to. Ms. Wojcicki, when you were CEO, did you2842or your board ever consider the national security implications2843of selling licensing or sharing genetic data with research2844institutions abroad, including those in China?2845    Ms. Wojcicki. We talked about things like that extensively.2846    Mr. Timmons. And did any foreign actor attempt to purchase2847any data for research purposes or other?2848    Ms. Wojcicki. No.2849    Mr. Timmons. So, WuXi Heathcare Ventures was an investor.2850They had direct ties to the CCP and the PLA. Is that--they were2851just, we will give you money but we want to hear about what you2852are doing but we do not need any from that, is that fair?2853    Ms. Wojcicki. It was $150 million that we raised in that2854round. They were a $10 million investor. They had no board2855seat, no access.2856    Mr. Timmons. And your investors have no access to any2857information?2858    Ms. Wojcicki. No access to information.2859    Mr. Timmons. But they would get, I would imagine, industry2860updates that show progress?2861    Ms. Wojcicki. I do not have access to my records. I do not2862believe they were a large enough investor.2863    Mr. Timmons. Is it fair to say that AncestryDNA has2864continued to be successful versus 23andMe largely because they2865stayed focused on giving customers their ancestry history as2866opposed to 23andMe was, kind of, trying to engage in secondary2867lines of effort? Genetic testing to, kind of, help people2868understand potential health issues they could have? Is that2869where things might have gone wrong?2870    Ms. Wojcicki. Ancenstry.com actually has a very expensive2871monthly subscription to be able to look at old historical2872records. Versus 23andMe has really been about the acceleration2873of knowledge around human genetics for the benefit of all of us2874to be healthier.2875    Mr. Timmons. So, they were successful where you all have2876clearly failed because they just stayed true to the main2877business model and you all expanded, is that fair?2878    Ms. Wojcicki. I would say, our mission, since the2879beginning, was to help people access, understand, and benefit2880from the human genome. And that benefit has always been about2881the benefit of human health and that understanding. So, the two2882companies are incredibly different.2883    Mr. Timmons. Okay. Thank you, Mr. Chairman. I am out of2884time. I yield back.2885    Mr. Higgins. The gentleman yields back. The gentleman from2886Texas, Mr. Sessions is recognized. I stand corrected. Mr. Frost2887is recognized for 5 minutes for questioning.2888    Mr. Frost. Thank you, Mr. Chair. The Federal government2889must play a bigger role in protecting our personal data, not2890just from criminals or foreign adversaries, but from law-2891abiding American companies as well. 23andMe holds the genetic2892information of more than 15 million people and is one of the2893largest collections of human DNA in the entire world. They have2894complied with our very basic laws by not sharing data with2895insurance companies or law enforcement unless legally required,2896and providing some terms of service disclosures up front, but2897that is not enough.2898    Printed here is the terms of service and U.S. privacy2899policies that users review before opting in. It is about 202900pages. Buried in the privacy policy are the lines, ``If we are2901involved in a bankruptcy, your personal information may be2902accessed, sold, or transferred as a part of that transaction.''2903Mr. Selsavage, did I say it right?2904    Mr. Selsavage. That is correct.2905    Mr. Frost. Do you know approximately how many people read2906online terms of service that they agree to?2907    Mr. Selsavage. I do not, but, you know, one thing we did--2908--2909    Mr. Frost. It is about ten percent, less than ten percent.2910Less than ten percent of people will read the online terms of2911services that they agree to, according to the Pew Research2912Service. 23andMe customers are now panicking. Simple notice is2913not going to be enough. Professor Hu, why does our personal2914genetic information hold so much value in the open market?2915    Professor Hu. Thank you for that question, Congressman. I2916think that it is highly incentivized by the black market2917because of the way in which it can be exploited and the way2918that it can be used, especially in our AI age. I think that,2919increasingly, there is great value in that type of personal2920data that can then serve multiple purposes.2921    Mr. Frost. Why should consumers or people not want their2922information just available for purchase by the highest bidder?2923    Professor Hu. Well, I think, especially in this instance,2924it is so critical for us to look at the way in which we do not2925have a comprehensive system of protection. We have a very2926siloed system in the United States where we look at all of this2927individually within its field, but, really, the impact is2928integrated, and especially with AI technologies, we are going2929to see an increasing integration.2930    Mr. Frost. Yes. No, you are 100 percent right. I mean,2931Congress has failed to deal with this for a long time. How2932could 23andMe's bankruptcy proceedings lead to the release of2933people's private genetic information?2934    Professor Hu. Well, I have multiple concerns about whether2935or not, in the time of bankruptcy, whether the cybersecurity2936and the data protection protocols will be foremost. And I2937completely understand the commitments that have been made in2938the past, and they have been known as a very strong company in2939their data privacy and cybersecurity protections. But it is a2940time of chaos when you are in financial duress and when you are2941now transferring, potentially, the company to others, even if2942there are promises up front that you carry over those prior2943commitments, it is really uncertain, and I think that that is2944why people are panicking.2945    Mr. Frost. When it comes down to strengthening privacy2946regulation for our personal data that is held by corporations,2947what examples can we pull from in terms of state laws?2948    Professor Hu. Well, there are several states now that have2949very strong data privacy protections, and there are also states2950that are now leading the way in genetic privacy and biometric2951information privacy. And I think that if Congress were to help2952to understand how best to, you know, bring further protections,2953strengthening GINA, strengthening HIPAA, then I think that we2954could get much farther.2955    Mr. Frost. Are there any approaches that have not been2956tried yet?2957    Professor Hu. Well, I think that Colorado, for example,2958with their high-risk AI, you know, Consumer Protection Act, is2959a model of borrowing from the EU in looking at what types of2960technologies and what type of AI systems or data-driven systems2961are going to pose the greatest risk, and I think that is2962something that Congress could examine.2963    Mr. Frost. Yes. Genetic research has had lifesaving2964results, and large amounts of data can only assist in this2965work, but the loss of data privacy cannot be collateral damage2966for these breakthroughs and innovation must not mean surrender2967to corporate control. This is not about one company, but in the2968battle between people's data, privacy, and corporate profits,2969the people usually lose. And I hope that both my Democratic and2970Republican colleagues can agree that it is imperative and past2971time for Congress to step in on this. Thank you. I yield back.2972    Mr. Higgins. The gentleman yields back. The gentleman from2973Texas, Mr. Sessions, is recognized for 5 minutes for2974questioning.2975    Mr. Sessions. Mr. Chairman, thank you very much, and for2976this hearing today, most interesting on both sides.2977    Ms. Wojcicki, you and I met on 1/20/2015, up at the Rules2978Committee. I was Chairman of the Rules Committee at the time2979and covered much of the things that we are covering today with2980a different viewpoint, perhaps back then, although we2981understood that there were Members of the House, soon to be2982Senate, who did hold very dear thoughts about privacy and the2983things that would come with that.2984    I have three questions. The first one is, I assume, for2985anyone who can answer it, who is going to decide who gets the2986company? Is it the bankruptcy judge?2987    Mr. Selsavage. It is first a recommendation from the2988special committee of 23andMe to evaluate the two final bidders2989to ensure that there is a highest and best bid for the company.2990That recommendation will then be presented to the bankruptcy2991court for the bankruptcy court's evaluation.2992    Mr. Sessions. So, recommendation, and, theoretically, it2993could be of highest bidder. Is the bankruptcy judge then going2994to determine the remaining value of what happens in that2995disposition of the bankruptcy amount?2996    Mr. Selsavage. It is the bankruptcy court which will2997determine what happens with the proceeds from the sale, if that2998is what your question is.2999    Mr. Sessions. Thank you. Anyone disagree with that?3000    [No response.]3001    Mr. Sessions. Thank you. Data that is being held, I see the3002term often that might be reserved for the term research. This3003is used for research. Is there a corresponding value where a3004person, 23andMe, would ping back a person if they discovered3005that all of a sudden, something appeared in the marketplace3006that would correspond to some DNA markers that then 23andMe3007recognize, hey, we have a trial. We have an answer. We have3008dated information. Could we get you to take part in a trial? Is3009there a moving back from 23andMe to a person that was whose3010data you had?3011    Ms. Wojcicki. Yes. It is a great question. So, we actually3012call, this was the flywheel, is that when we set out the3013company, we wanted to create a research platform that was3014actually what we say, by the people, for the people, so that if3015the consented customers wanted to go and research a topic, that3016we could go and all collectively come together, input that3017information, research it, and then we would actually put that3018back to customers as a new report.3019    Mr. Sessions. So, this means to me that 23andMe has data3020and information specific to what might be new research or3021something that appeared in science, a trial, data, and3022information where you can link that back to the individual. And3023I had heard people, perhaps, though, and I could be wrong, this3024panel say there is no direct link back to a person. Is it based3025upon if a person opted into that, or do you have it even if3026someone did not opt in, a way that you could, as part of the3027service, tell them ten years later, 12 years later, hey, we3028believe on predictive analysis of what we have learned, you3029have something on the surface or deep in your DNA, we want you3030to be aware of something?3031    Ms. Wojcicki. So, it is a great question and two very3032different parts of the service. So, customers have the ability3033to opt in to research, and in that research part, the3034scientists are doing discovery.3035    Mr. Sessions. So, they would have had to have opted in in3036the beginning, and perhaps that was the value of 23andMe. At3037least it was in 2015 that you and I spoke about.3038    Ms. Wojcicki. They have the ability to opt in. We make a3039discovery. Once we have made a discovery, for instance, we have3040what is called polygenic risk scores on areas like type 23041diabetes. Once we say we have validated, we have the ability to3042predict, potentially, who is at higher risk for type 23043diabetes, we turn that into a report. And one of the features3044of 23andMe as a customer who is buying into the subscription is3045we continuously update your account with new information as it3046is coming.3047    Mr. Sessions. So, my point in saying this, and I am sorry3048to cut you off--I have got about one second left--there is a3049direct link that with the sale of 23andMe, you would have3050corresponding data specific to an individual. Thank you very3051much. I appreciate you being here today. I hope that this stuff3052is on a website, FAQ, frequently asked questions, or something.3053There are a lot of people that are here today talking about3054fear. I think fear is a very negative way to look at things. I3055think education is. So, I hope you are able to make sure, if3056you need to update it, that you are looking at that and3057appropriately answering questions perhaps that Members had3058today. Mr. Chairman, I want to thank you for the 29 seconds3059extra. I yield back my time.3060    Mr. Higgins. The gentleman yields. Mr. Crane, the gentleman3061from Arizona, is recognized for 5 minutes for question.3062    Mr. Crane. Thank you, Mr. Chairman. According to public3063reporting, individuals with Jewish and Chinese heritage were3064targeted in the hack. It happened a couple of years ago at306523andMe. Ms. Wojcicki, why were Chinese and Jewish individuals3066targeted during this hack?3067    Ms. Wojcicki. That is a great question. I do not believe it3068was specifically those individuals. It was definitely something3069that was reported in the media, and there were a lot of Jewish3070relatives that were in some of that information, but I do not3071believe it was necessarily a specific attack on those. It was3072the credential stuffing.3073    Mr. Crane. But didn't one of the individuals say that he3074would sell information about individuals with Jewish heritage?3075    Ms. Wojcicki. They did report that they said that.3076    Mr. Crane. Okay. Interesting. Having people's personal DNA3077profiles unsecured is obviously a very serious issue, could be3078used to develop bioweapons, force readiness analysis, Black3079Miller coercion, and pharmaceutical targeting. I noticed when3080Ms. Pressley asked if you would allow consumers who had3081submitted their DNA to 23andMe to erase their data from the3082site before the sale to a new buyer, neither of you could3083answer yes. I want to go into that for a second. Why could3084neither of you answer yes, if both of you claim that the end of3085it, the owners of the DNA, is actually your customers?3086    Mr. Selsavage. Our customers always have control over their3087data. You know, basically, they can access their data. They can3088edit their data. They can opt in or out of any research3089consent, and most importantly, at any time they so choose to,3090they can delete their data. In the case of----3091    Mr. Crane. Then why can't you answer Ms. Pressley's3092question that way? Do you remember that question, sir?3093    Mr. Selsavage. I do not remember the exact question she3094asked, but for our customers, you know----3095    Mr. Crane. Her question, sir, was will you give your3096customers the ability to opt back in before the sale to a new3097owner that they did not submit their data to?3098    Mr. Selsavage. I believe her question to me was will we3099give people direct notice to say that they can opt in or out of3100keeping their data. You know, what I am saying today is, at any3101time, and this has been the case since the founding of 23andMe,3102that customers can delete their data. It is an automated3103process. They simply go into their account, like, you know, go3104to the settings and they can click delete their data. It is an3105automated process. We delete all their digital data. And if3106they have biobanked the sample and consented to that, we3107destroy that sample, and we do that timely, and we have done3108that for every customer who requested us since, you know, since3109inception, including the large number of customers who3110requested deletion of their data since the bankruptcy.3111    Mr. Crane. How difficult is it to do that, Mr. Selsavage?3112    Mr. Selsavage. I think it is very simple. I mean, I think3113it probably takes somebody less than 5 minutes to go into their3114account, go to the settings, click ``delete my data,'' and for3115the company, it is an automated process.3116    Mr. Crane. Mr. Selsavage, you said you are very confident3117that American data will not wind up in the hands of a bad3118actor. Did you say that a few minutes ago?3119    Mr. Selsavage. I did, Congressman.3120    Mr. Crane. How can you make that claim when seven million3121users have already had their information stolen?3122    Mr. Selsavage. Congressman, you know, the cyber incident at312323 was very regrettable, and we have apologized for that to our3124customers. The data that was actually released in that3125cybersecurity incident was, you know, mostly DNA relative data,3126and while it is customer data that was revealed, we believe we3127have since, you know, enhanced the security at 23andMe where we3128always maintain that as a top priority for the company. And3129then second is through the sale process, we are ensuring that3130the sale of the company will not go to any company that is a3131foreign adversary to the U.S.3132    Mr. Crane. Ms. Wojcicki, did I say that right?3133    Ms. Wojcicki. Wojcicki. Yes, right.3134    Mr. Crane. Wojcicki, sorry. You said the same thing that3135you were very confident that data would not wind up in the3136hands of a bad actor. I mean, you have been in this space for a3137long time. You know hacks happen every single day. You know3138that many nation-states that are adversarial to the United3139States of America have very robust cybersecurity operations.3140How can you be confident when seven million of your customers3141have already had their data stolen?3142    Ms. Wojcicki. Just to reiterate, I am not part of the3143bankruptcy process other than the fact that I am an active3144bidder. During my time at the company, we did very proactive3145steps, for instance, like I mentioned, keeping the genetic3146information separate from all the identifiable information. So,3147we tried to create a structure where even if there was some3148kind of breach, that you would not be able to reconnect those3149and identify back to the individuals and who they were. So, in3150the cyber incident, it was, as Mr. Selsavage was saying, a lot3151of it was DNA relatives' names and small amounts of3152information, so it was mostly those names.3153    Mr. Crane. Okay. Thank you, Mr. Chairman. I yield back.3154    Mr. Higgins. The gentleman yields. I recognize myself for 53155minutes for questioning.3156    I think it is important to note, and as America observes3157this fascinating hearing, that digital data is not secure. You3158have reports of, according to my research, about 27 percent of3159Fortune 500 companies have had major data breaches. These are3160the wealthiest companies, the most advanced security systems.3161Data breach statistics show a significant increase in both the3162number of breaches and the number of records exposed within3163those breaches.3164    For example, in the United States, the number of data3165breaches increased from 447 in 2012 to over 3,200 in 2023. In31662023, 353 million individuals were impacted by data3167compromises, and globally, data breaches exposed over 8183168million data sets in the first quarter of 2024. It was3169intellectually unsound to discuss digital data as if it was3170secure, and therein lies the problem because, Ms. Wojcicki,317123andMe, congratulations on the success of the company. I am a3172Republican. I support free enterprise. Glad you had a good run,3173but let us talk about the issue right now because 23andMe began3174with a DNA swab, and that swab was sent in to a laboratory, I3175presume, 23andMe, and that laboratory analyzed that physical3176data and created a digital file. Is that correct?3177    Ms. Wojcicki. Yes.3178    Mr. Higgins. Okay. We are moving quickly. I am just3179summarizing here for the American people. You send in a swab.3180It is physical DNA that is received by a laboratory and3181transitioned to a digital file. At that point, America, no3182longer secure. And I need to only point to modern history and3183data breaches and digital theft, but let us move a little bit3184deeper into this consideration. In these laboratories in318523andMe, did you have Chinese nationals working, ma'am?3186    Ms. Wojcicki. So, 23andMe contracted with LabCorp.3187    Mr. Higgins. Yes, did you have Chinese nationals working in3188laboratories that were processing the DNA physical data and3189transitioning that data to digital files?3190    Ms. Wojcicki. So, Labcorp is a public company. It is one of3191the largest lab testing----3192    Mr. Higgins. Yes or no. Were there?3193    Ms. Wojcicki. I did not control their hiring.3194    Mr. Higgins. Would you believe me when I tell you the3195answer is yes? Yes, Chinese nationals. Listen to this, America:3196you sent in your DNA on a swab. No problem. That is cool to3197check your family history and your family tree, you know. I did3198it, too, but the expectation of privacy of your digital data3199was gone the moment you put that thing in the mail, and now3200Congress has to determine whether or not we are going to allow3201the abject sale of that data. And let me just say that we are3202going to draft legislation, Mr. Selsavage. We will draft3203legislation. I do not know if we will get it right because it3204is complex. I would estimate there will probably be a dozen3205different iterations of legislation covering DNA digital data3206control over the next decade, but Congress must act in response3207to this newly emerging threat because you are not just talking3208about 15 million people with 23andMe.3209    According to my research, over the course of 30 years, 153210million people become 100 million descendants. It is the same3211basic DNA profile, therefore subject to the same threat of3212biological weaponization of that DNA profile, and that DNA3213profile exists in the digital realm where we already3214acknowledge it is not secure. So, this body is going to create3215legislation, and that legislation will impact the sale of this3216data, so both of you have a stake. Quickly, ma'am and sir,3217advise this body, will you be available for consultation to3218this Committee as we work through what legislation will look3219like?3220    Ms. Wojcicki. I would be honored to help and participate3221however I can to help make sure that genetic----3222    Mr. Higgins. However, you can. Thank you, ma'am. Good sir?3223    Mr. Selsavage. And likewise, I would be happy to help.3224    Mr. Higgins. Professor Hu, we are going to need you. Will3225you be available?3226    Professor Hu. Absolutely.3227    Chairman Comer. Thank you. My time has expired. The Chair3228recognizes Mr. Gill for 5 minutes for questions.3229    Mr. Gill. Thank you, Mr. Chair.3230    Mr. Higgins. I stand corrected, Mr. Gill. I apologize. Ms.3231Crockett has arrived. Ms. Crockett is recognized for 5 minutes3232for questioning. I apologize, Mr. Gill.3233    Ms. Crockett. Thank you so much, Mr. Chair. Despite the3234messy breakup we all saw unfold last week between the world's3235richest billionaire and the world's pettiest billionaire, we3236cannot forget the damage Elon Musk and President Trump have3237done together to our government, national security, and3238Americans' privacy. Republicans are holding this hearing acting3239like they care about protecting your privacy, pretending like3240their President is not out there trashing privacy and3241cybersecurity laws to build profiles of Americans' sensitive3242information that could give him unparalleled power to control3243what we say and what we do. That is right. Whistleblowers have3244told the Committee that DOGE is carrying around ``backpacks3245full of laptops to combine protected data from different3246agencies and that DOGE is not notifying Americans that their3247data is being moved around even though they are required to do3248so by Federal law.'' Professor Hu, why do Federal laws like the3249Privacy Act and the Federal Information Security Management Act3250place safeguards around how the Federal government handles and3251uses Americans' data?3252    Professor Hu. Thank you so much, Congresswoman, for that3253question. I think that it is absolutely critical to see the3254urgency of this moment in history, that as we are asking325523andMe to exercise such care and moral obligation to safeguard3256our national security interests, that we also ask that of our3257own Federal government and that we look to the laws that we3258have, such as the Privacy Act and FISMA, as reasons why it is3259so critical, not only because of the history of potential3260abuses and misuses that we have seen in the past and also the3261vulnerabilities that led to the enactment of those laws, but3262because of the critical national security issues that are3263emerging, especially in light of AI warfare.3264    Ms. Crockett. Thank you so much. Professor Hu, let me ask3265you one more question. How does DOGE's haphazard and cavalier3266handling of American sensitive data present privacy and3267security risk?3268    Professor Hu. I think that what we really need to3269understand is that aggregation and that consolidation of data3270opens us up to a great deal of targeting and also the type of3271misuse and abuse of that data. And without making sure that we3272reinforce the systems that we have put in place previously and3273those specialists and experts that we had hired previously to3274safeguard those systems, we are really jeopardizing, I think,3275Americans' privacy.3276    Ms. Crockett. Yes, it seems like we decided to leave all3277our valuables in the car out where everybody can see it and the3278door is unlocked. That is what it feels like, but I digress.3279    Our Federal agencies are tasked with protecting3280cybersecurity and maintaining critical IT infrastructure that3281has been gutted by this Administration. Almost a thousand3282employees were fired or forced out of the Cybersecurity and3283Infrastructure Security Agency, better known as CISA, weakening3284America's cyber defenses. Professor Hu, how will these3285workforce cuts jeopardize our Nation's ability to protect3286Americans' data from cyberattacks?3287    Professor Hu. Yes. I think that we need to understand the3288critical role that these agencies and professionals, including3289CISA, the Cybersecurity and Infrastructure Security Agency of3290the Department of Homeland Security, the role that they play in3291making sure that they safeguard all of our critical3292infrastructure. And without the proper staffing, we are3293throwing ourselves into a great deal of jeopardy. And I think3294that we also need to recognize the potential conflict of3295interest here of those that are trying to dismantle these3296cybersecurity systems.3297    Ms. Crockett. Thank you so much. As another example,3298Trump's Acting Director of the Consumer Financial Bureau of3299Protection, which Trump is also trying to unconstitutionally3300dismantle, recently killed a bill that would have shielded3301Americans' sensitive information from data brokers. Instead of3302protecting Americans from companies that sell their address,3303email, phone number, financial data, political affiliation,3304religious beliefs, and other sensitive information, Trump is3305letting them run wild.3306    I would ask unanimous consent to enter into the record a3307Wired article titled, ``CFPB Quietly Kills Rule to Shield3308Americans From Data Brokers.''3309    Mr. Higgins. Without objection, so ordered.3310    Ms. Crockett. Thank you so much. Congressional Democrats3311and American people are rightfully concerned that their3312sensitive information is being used, abused, and pulled without3313regard to our Nation's privacy and information security laws.3314And we will not forget that just last week, Republicans made us3315wait more than half an hour while they scrambled to get their3316Members into this committee room for a hearing that they called3317yet did not bother to attend because Democrats had the votes to3318subpoena Elon Musk. If they agree with what Elon has done, why3319are they so scared to hear from Elon himself? Maybe now that3320Elon broke up with Donald, the Majority will finally join us in3321demanding answers from Mr. Musk's time within this3322Administration.3323    Let me tell you something. We have seen that this3324Administration has decided to go after students because of3325things that they have said. We have seen people get fired3326because they refused to pledge their loyalty to this daggone3327cult. This is absurd, and we do not need people being targeted.3328They are weaponizing us while at the same time making us very3329vulnerable to those that want to hurt us the most.3330    Now, listen, I never sent my DNA to anybody, so I do not3331know where I was stolen from. I am going to tell you right now,3332I did not do it because I was concerned because there is a3333history, especially when it comes to Black folks, with taking3334our stuff. So, I did not do it. So now, I sit here clueless3335about my heritage. But I tell you that having a hearing on this3336issue brings about all of those worst fears for me, though, the3337fact that our data is just out there and our personal3338biographical information. So, I am just going to ask any and3339everyone around the science world so that we can make sure that3340we move forward in this country, when it comes to science, we3341got to make sure that we are protecting people's information as3342we are trying to move forward, whether it is AI, whether we are3343talking about things such as our genes or otherwise. Thank you3344so much, and I yield. Thank you so much, Mr. Chair.3345    Mr. Comer [Presiding]. The Chair recognizes Mr. Gill from3346Texas.3347    Mr. Gill. Thank you, Mr. Chair, and thank you for holding3348this hearing on a very important topic, which is data privacy.3349But I have got a couple of other things that I want to talk3350about while we are here, related to this. Ms. Wojcicki, is that3351how you pronounce it?3352    Ms. Wojcicki. Yes, Wojcicki.3353    Mr. Gill. Wojcicki. Okay. Thank you for being here and3354taking the time. 23andMe has really, over the past few years,3355gone out of its way to show how woke it is, and one of the3356things that it has been promoting, amongst many others, is a3357variety of different pronouns. Here is a tweet that you guys3358put out in June 2021. I just want to ask you, what does E mean3359as a pronoun? It is E.3360    Ms. Wojcicki. To be honest, I am not sure.3361    Mr. Grill. Okay. Do you know what M means as a pronoun?3362    Ms. Wojcicki. I am also not sure.3363    Mr. Gill. Okay. Don't you think it is important to know3364what these mean? In this post you wrote, or somebody on your3365comms team wrote, that using the correct pronouns impacts trans3366people's health, can reduce the risk of depression and suicide.3367That is a pretty serious claim. It seems like if you are going3368to demand people use these pronouns, you would know what they3369mean, right?3370    Ms. Wojcicki. I delegate. 23andMe had a lot of people. We3371had six, seven people.3372    Mr. Gill. Right. You were CEO though, right?3373    Ms. Wojcicki. I was CEO, but it does not mean I can oversee3374every single post.3375    Mr. Gill. Well, this is a very, very politically charged3376post that you guys put out. I would think that you would have a3377view on that. Can you tell us what is the difference between ZE3378and XE? One of them is ZE and one is XE?3379    Ms. Wojcicki. I am not up to speed on that.3380    Mr. Gill. Okay. Does it concern you that not understanding3381this might increase the risk of depression and suicide amongst3382trans people?3383    Ms. Wojcicki. I support my research team that felt that,3384you know, it is important for us to be inclusive of everybody3385and it was very much grounded.3386    Mr. Gill. I agree, but it does not seem very inclusive if3387you do not know what they mean, right?3388    Ms. Wojcicki. I respect the social team and the research3389team that put that post together.3390    Mr. Gill. But you do not know what any of these pronouns3391mean, but you guys are promoting it?3392    Ms. Wojcicki. I assume it is different ways people like to3393be referred to.3394    Mr. Gill. What about HIR? What does that mean?3395    Ms. Wojcicki. I do not know either.3396    Mr. Gill. What about FAE/FAER, F-A-E/F-A-E-R.3397    Ms. Wojcicki. Again----3398    Mr. Gill. You would agree these are pretty unusual things,3399wouldn't you?3400    Ms. Wojcicki. I think they represent a lot of the diversity3401in this country.3402    Mr. Gill. Okay. I am trying to understand the diversity and3403I am asking you what they mean. I will give you one more3404chance. Do you know what ZE, HIR, XE, XEM, FAE, FAER, E, EM3405mean?3406    Ms. Wojcicki. I do not.3407    Mr. Gill. Okay. Does that concern you that you do not know3408it? According to your own post here, understanding these and3409using the correct pronouns would improve your product for trans3410and non-binary people. It seems like this is directly related3411to the product.3412    Ms. Wojcicki. Again, it was the social team and the3413research team that felt strongly around putting----3414    Mr. Gill. Well, you were CEO, so you cannot pawn off3415responsibility to somebody else here. What about bathroom3416access? On 23andMe's website--I have got it up here on my3417phone--there is a 23andMe blog and there is a little subheading3418about bathroom access. Is it still 23andMe's official position3419that men should be using women's restrooms?3420    Ms. Wojcicki. I am not at 23andMe anymore.3421    Mr. Gill. Okay. Was it while you were at 23andMe?3422    Ms. Wojcicki. I think we had non-gendered bathrooms as3423well.3424    Mr. Gill. Well, that is not what this is referring to. This3425is referring to laws that seek to force, in your own words,3426force trans individuals to use a restroom that does not3427correspond to their gender identity. While you were there, was3428it 23andMe's position that men should be using women's3429restrooms?3430    Ms. Wojcicki. I think our position was just to make sure3431that we are applicable to laws.3432    Mr. Gill. This is not in reference. This is actually3433against laws that would stop people from using the wrong3434restroom.3435    Ms. Wojcicki. Yes.3436    Mr. Gill. So, this is actually against laws.3437    Ms. Wojcicki. I do not have that post in front of me, so I3438cannot comment specifically.3439    Mr. Gill. Was it 23andMe's position while you were there3440that children should be trans'd because that is on this website3441as well.3442    Ms. Wojcicki. I do not know specifically what you are3443referring to.3444    Mr. Gill. I can read you a little bit about it: ``supports3445gender-affirming healthcare, such as hormones and surgery for3446trans youth.''3447    Ms. Wojcicki. I think 23andMe referred specifically to some3448of the pediatric guidelines.3449    Mr. Gill. Sounds to me like you took a genetics company,3450which you built, and congratulations for doing that, and turned3451it into a woke social justice organization. You want to run3452away from that now. It does not sound like you even knew what3453you were talking about at the time. You do not know what any of3454these pronouns mean and now realize that this is politically3455not very popular. It says a lot about where your convictions3456were and what you meant here. So, thank you, Mr. Chairman.3457    Chairman Comer. Thank you. And just one last question3458before we go to a brief closing statement. I am sorry, go3459ahead.3460    Mr. Min. Thank you, Mr. Chair. I just will note that3461several of our Republican colleagues spent so much time talking3462about trans, and this is the Oversight Committee. This is a3463hearing about genetic information. I think it is fair to say3464that a number of my Republican colleagues seem obsessed with3465trans issues as opposed to, say, things like the corruption we3466are seeing in our government, the illegal removals and3467deportations of citizens and people here on permanent residence3468and permanent green cards and student visas.3469    But this is an important hearing because Americans do3470deserve to know what the sale of 23andMe will mean for their3471sensitive genetic data. While 23andMe's privacy policies3472currently allow customers to delete their data from the3473company, the next buyer of 23andMe could do away with these3474types of safeguards for its 15 million customers. Despite3475today's testimony from the current and former CEO of 23andMe,3476customers' visibility into their data, where it may be sold,3477and what the company's third-party partners do with it is3478extremely opaque.3479    In addition, it is clear that no comprehensive Federal data3480exists to limit companies like 23andMe from selling their data3481to third parties. The collection and storage of copious amounts3482of sensitive personal information, whether it is in 23andMe's3483database or in the Federal databases containing Americans'3484sensitive information, creates a clear target for hostile3485actors. Sensitive data can be subject to exploitation both for3486national security purposes, whether it is the CCP, Russia, or3487other foreign adversaries, or for consumer exploitation,3488including by data brokers and advertising and market analytics3489providers.3490    Our Nation's Federal laws have not kept up with3491technological advances or the potential threats from malicious3492and foreign actors. Americans need strong oversight and3493stronger laws to bolster our national security, our private3494security, and our privacy protections to make sure that our3495sensitive data remains safe. If Americans were scared about3496what 23andMe might do with their data, they would be really3497scared if they thought about what DOGE and the Trump3498Administration are already doing with this data. congressional3499Republicans cannot continue to ignore the Trump3500Administration's blatant attacks on and destruction of critical3501security and privacy protections across the government. This3502Trump Administration has conducted mass terminations of3503critical Federal IT experts, chief information officers, and3504other technology professionals, while also removing many of the3505inspector generals that are meant to ensure good processes.3506DOGE, meanwhile, has seized unauthorized access of Americans'3507data, disregarding longstanding cybersecurity practices and3508existing data privacy laws. And thanks to a brave3509whistleblower, we know that here on the Oversight Committee,3510Democrats learned that DOGE is reportedly creating a master3511database of sensitive information from across all Federal3512agencies, an apparent violation of existing privacy and3513cybersecurity protections that ensure that this data cannot be3514exploited or misused.3515    But here on this Committee, unfortunately, the Majority is3516just ignoring this all and sacrificing our rights to data3517privacy and security all to shield Elon Musk, Donald Trump, and3518their cronies from accountability. And again, I want to3519reiterate the fact that so many of our colleagues in this3520hearing focused on trans issues. They attacked the trans3521community. I am not sure what that is about when we are talking3522about privacy. We are faced with real and clear threats to our3523privacy. This hearing raised some of them, but we ought to be3524thinking about the threats to our federally held privacy as3525well. Congress has to open our eyes and address the threats in3526front of the American people much better. I yield back.3527    Chairman Comer. Before I close, Ms. Wojcicki, there are3528news reports and rumors that Oracle and Executive Chairman3529Larry Ellison is the backer in your bid to acquire 23andMe. Are3530you aware of these rumors?3531    Ms. Wojcicki. I have read some news reports.3532    Chairman Comer. Is Oracle the company backing?3533    Ms. Wojcicki. The current bid is exclusively from me.3534    Chairman Comer. Is exclusively what?3535    Ms. Wojcicki. Is exclusively from me.3536    Chairman Comer. All right. So, you are buying your own3537company out of bankruptcy exclusively?3538    Ms. Wojcicki. I am trying very hard.3539    Chairman Comer. Wow. Very good. Okay. Well, I think that3540this was a very productive hearing.3541    I want to thank our witnesses who are here today. I think3542it is very clear there is bipartisan concern that Americans'3543sensitive genetic data could end up in the hands of bad actors.3544We have heard commitment from the two witnesses from 23andMe3545today that that will not happen. We will be watching that very,3546very closely. And as the bankruptcy proceeding moves forward3547and more information is known about the state of the company,3548then this Committee will continue to conduct its investigation3549and continue to be transparent with the American people on what3550we find and do everything in our ability to see that America's3551private data is protected from bad actors.3552    So, with that, all Members have five legislative days3553within which to submit materials and additional written3554questions for the witnesses, which will be forwarded to the3555witnesses.3556    Chairman Comer. If there is no further business, without3557objection, the Committee stands adjourned. Thank you all.3558    [Whereupon, at 1:26 p.m., the Committee was adjourned.]35593560                          [all]