Health minister downplays risks of data breach but experts say discussion of BGI must consider human rights concerns
Experts and human rights groups have raised new concerns about the Chinese company at the centre of Andrew Forrest’s Covid-19 testing deal following California’s reported rejection of its equipment due to security concerns.
The Australian government announced in late April that it had accepted 10m Covid-19 tests manufactured by the Beijing Genomics Institute, purchased in a $200m deal brokered by Forrest, the mining billionaire, and his philanthropic arm, the Minderoo Foundation.
Last week, the Washington Post reported that California had rejected use of BGI Covid-19 tests based on security concerns, in part motivated by a one-page US intelligence report warning the company “may be vulnerable to Chinese influence”.
It followed a report last month by the Australian Strategic Policy Institute (ASPI) that found a BGI subsidiary, Forensic Genomics International, was linked to what it described as a “DNA dragnet” involving multiple companies, which collected DNA data from millions of men and boys with no serious criminal history.
The report found the BGI subsidiary partnered with Chinese police to help build genetic databases.
“This program of mass DNA data collection violates Chinese domestic law and global human rights norms,” the report said. “And, when combined with other surveillance tools, it will increase the power of the Chinese state and further enable domestic repression in the name of stability maintenance and social control.”
Previous reports have suggested BGI had involvement in providing gene technology used to surveil the Uighur ethnic minority in Xinjiang province.
BGI has denied any involvement in any human rights abuses or any involvement in the Xinjiang surveillance.
BGI’s presence in Australia has prompted a complicated debate. On the one hand, testing capacity during the pandemic is critical, and the company is well-known, has a global footprint, and no complaint has been made to the health department about the quality of its testing.
Experts also say there is only a very low risk that the genetic data used in the Covid-19 testing process could be used inappropriately, and intelligence agencies have provided advice to the Australian government to limit any data security risk.
A BGI spokeswoman said the company had “no access to any private health information of Australians”.
“BGI only provides the products and know-how for Covid-19 testing, but does not receive, process or manage patient data,” she said. “The labs in Australia are operated entirely by local staff according to national regulations.”
The health minister, Greg Hunt, has also downplayed the risks of any data security breach, and said the BGI tests had been “critical for supporting the significant increase in testing in Victoria”.
“The extent of BGI’s involvement with existing Australian laboratories will be limited to the installation of Covid-19 pathology testing platforms and training of staff,” a spokesman said.
But La Trobe University’s James Leibold, one of the authors of the ASPI report, said the discussion about BGI must be balanced with the clear ethical concerns posed by its operations in China.
“The bigger issue, and the one that I think really that’s thrown up by the Californian decision, is the ethics of this company,” Leibold said.
He expressed concern that the company may operate “under a different set of ethical standards than most of the biotech companies in the liberal west”.
“It’s one of those things where you have to balance up ethical concerns with security concerns, economic concerns, and public health concerns. Admittedly it’s a complicated series of issues to work through, but I think it’s important that we raise the ethical and security concerns so that they’re considered here in Australia.”
Yves Moreau, a globally recognised expert on computational biology with the University of Leuven in Belgium, believes the main value of BGI’s Covid-19 business is to “gain a foothold” in the diagnostic market for other businesses, including its prenatal screening business, NIFTY, and genome sequencing business.
BGI claims to have tested five million pregnant women through its prenatal screening business, and Moreau said the privacy protections are weak.
Genome sequencing was even more problematic, he said.
“I am not convinced that it is possible to guarantee that a copy of the data generated by BGI’s sequencing services in western countries will not end up in China, although I am not claiming it already has,” he said. “Service level agreements and privacy regulations are of limited relevance if you cannot prove that the data was sent to China.”
“If actual privacy (not just on paper) cannot be guaranteed for patients and customers, BGI might pose an unacceptable strategic risk.”
Human Rights Watch’s senior China researcher, Maya Wang, said her organisation was concerned about “the large amount of sensitive personal data” BGI was collecting, both in China and globally.
“We are also concerned about its reported close ties to the Chinese government, which has spent enormous efforts to amass people’s data for mass surveillance and behavioural engineering purposes,” she said. “While Australia has relatively strong privacy laws, China has no effective privacy safeguards against state surveillance.”
A BGI spokeswoman said the company had never provided gene technology for surveillance in Xinjiang.
“We have never been involved in the collection, storage or analysis of personal genetic information with the potential for or the purpose of violating human rights for special regions or groups,” she said. “It has not been in the past, nor will it be in the present and the future.”
It has previously described security concerns about its technology as wrong and lacking evidence. The company told the Washington Post the Covid-19 testing system it deployed in the US made it “impossible for us to have access to patient data”.
The company said it “does not condone and would never be involved in any human rights abuses”, and that it had a “long track record in applying strict ethical standards and protection of data privacy and security”.
The company also insists it is not owned or funded by the Chinese government.
“It is owned by co-founders and core employees,” the spokeswoman said.
The spokesman for Hunt said normal accreditation standards would cover the laboratories using BGI tests, including standards that “address ethical practice, including consent and privacy of patients’ information”.
He also said the government was not “aware of any proposals for further testing in Australia by the company”.