as neither C25 nor A26 is recognized specifically. Although 3′hExo can remove the last three nucleotides of the SL (9), further degradation is not possible because the 3′-end of the shortened SL can no longer reach the active site of 3′hExo in the ternary complex ( Fig. 3B) , thereby explaining how SLBP protects histone mRNAs from excessive trimming by 3′hExo. Besides recognizing the SL RNA, another function of SLBP is the recruitment of U7 snRNP and stabilization of its interaction with the histone pre-mRNA for 3′-end processing (fig. S1) (23, 29). The 20 residues immediately C-terminal to the RBD of SLBP are required for this processing (29). These residues are present in the recombinant SLBP used in the current structural studies, but they are disordered. A second region required for processing is located in helix aB of the RBD, especially the Tyr-Asp-Arg-Tyr motif ( Fig. 1B and  fig. S6 ), where mutation of the Asp and Arg residues to Gln and Cys, respectively, did not affect binding but abolished processing (23). Our structure shows that these two regions are likely located close to each other ( fig. S6 ) and therefore also identifies a surface feature of SLBP that is involved in histone pre-mRNA 3′-end processing (fig. S14). Sharing sequencing data sets without identifiers has become a common practice in genomics. Here, we report that surnames can be recovered from personal genomes by profiling short tandem repeats on the Y chromosome (Y-STRs) and querying recreational genetic genealogy databases. We show that a combination of a surname with other types of metadata, such as age and state, can be used to triangulate the identity of the target. A key feature of this technique is that it entirely relies on free, publicly accessible Internet resources. We quantitatively analyze the probability of identification for U.S. males. We further demonstrate the feasibility of this technique by tracing back with high probability the identities of multiple participants in public sequencing projects. S urnames are paternally inherited in most human societies, resulting in their cosegregation with Y-chromosome haplotypes (1-5). Based on this observation, multiple genetic genealogy companies offer services to reunite distant patrilineal relatives by genotyping a few dozen highly polymorphic short tandem repeats across the Y chromosome (Y-STRs). The association between surnames and haplotypes can be confounded by nonpaternity events, mutations, and adoption of the same surname by multiple founders (5). The genetic genealogy community addresses these barriers with massive databases that list the test results of Y-STR haplotypes along with their corresponding surnames. Currently, there are at least eight databases and numerous surname project Web sites that collectively contain hundreds of thousands of surname-haplotype records (table S1). The ability of genetic genealogy databases to breach anonymity has been demonstrated in the past. In a number of public cases, male adoptees and descendants of anonymous sperm donors used recreational genetic genealogy services to genotype their Y-chromosome haplotypes and to search the companies' databases (6-9). The genetic matches identified distant patrilineal relatives and pointed to the potential surnames of their biological fathers. By combining other pieces of demographic information, such as date and place of birth, they fully exposed the identity of their biological fathers. Lunshof et al. (10) were the first to speculate that this technique could expose the full identity of participants in sequencing projects. Gitschier (11) empirically approached this hypothesis by testing 30 Y-STR haplotypes of CEU participants in these databases and reported that potential surnames can be detected. [CEU participants are multigenerational families of northern and western European ancestry in Utah who had originally had their samples collected by CEPH (Centre d'Etude du Polymorphisme Humain) and were later reconsented to participate in the HapMap project.] However, these surnames could match thousands of individuals, and the study did not pursue full re-identification at a single-person resolution. Our goal was to quantitatively approach the question of how readily surname inference might be possible in a more general population, apply this approach to personal genome data sets, and demonstrate end-to-end identification of individuals with only public information. We show that full identities of personal genomes can be exposed via surname inference from recreational genetic genealogy databases followed by Internet searches. In all cases in which individuals were studied who had donated DNA samples, the informed consent statements they had signed stated privacy breach as a potential risk and the data usage terms did not prevent re-identification. Representatives of relevant organizations that funded the original studies were notified and confirmed the compliance of this study with their guidelines (12). As a primary resource for surname inference, we focused on Ysearch (www.ysearch.org) and
Gymrek et al. REF showed that genomic information can be used to infer an individual's surname.
Identifying Personal Genomes by Surname Inference
Science
Science
Computer Science Medicine