Evidence: well sourced. Imported from the supplied 65-Case Master Edition, dated September 19, 2026. Source links and classifications are retained as an attributed case account; import is not an independent source review.
Case at a glance
- Case number
- 024
- Date / range
- 2008
- Sector
- Re-identification and inference
- Genetic asset
- A public genome with a redacted APOE region
- Security principle
- Correlated-Data Leakage
Event summary
James Watson withheld the APOE region from his public genome because of its association with Alzheimer disease risk, but researchers showed that nearby correlated variants could still support inference. Deleting the secret field may not delete the secret.
Source: pubmed.ncbi.nlm.nih.gov — James Watson's Redacted APOE Region source 1.
Source: pmc.ncbi.nlm.nih.gov — James Watson's Redacted APOE Region source 2.
The case in context
The Watson example concerns selective disclosure. Withholding one region of a genome did not necessarily remove the information needed to infer something about that region, because visible variants could remain correlated with the hidden data. The researchers did not disclose his status.
Redaction therefore needs to consider relationships between fields, not merely whether the sensitive field is absent. This is a privacy lesson rather than a diagnosis: inferred genetic risk does not establish disease or destiny. A release should be assessed for what its remaining information supports, including in combination with outside reference data.
Acquisition and processing
public genome with narrow redaction → correlated flanking variants → statistical inference → sensitive genotype risk
The sequence of events
- public genome with narrow redaction
- correlated flanking variants
- statistical inference
- sensitive genotype risk
What became inferable or exposed
A public genome with a redacted APOE region
James Watson withheld the APOE region from his public genome because of its association with Alzheimer disease risk, but researchers showed that nearby correlated variants could still support inference. Deleting the secret field may not delete the secret.
Affected parties and consent
- Direct parties
- The publicly described genome donor
- Indirect parties
- Relatives and connected participants may be relevant where the asset contains relationship information.
- Direct count
- Unknown / not assigned
- Indirect count
- Unknown / not assigned
- Consent status
- Permission to contribute a record does not settle what may be inferred about a nonparticipant or relative. Public availability and authorization for a particular use should be distinguished.
Security dimensions
Confidentiality
The confidentiality question concerns a public genome with a redacted apoe region. Exposure and further inference must be distinguished from the fact of collection or availability.
Integrity
The integrity question is whether the described material, permissions, processing, or interpretation can be relied upon. Correlated-Data Leakage identifies the particular boundary examined here.
Availability
Access and continuity are assessed for the described event; potential effects are not presented as confirmed outages or losses.
Provenance
The relevant chain follows a public genome with a redacted apoe region through the stages shown below. Missing public detail is not proof that internal records did not exist.
Consent, persistence, and relational exposure
Consent
Permission to contribute a record does not settle what may be inferred about a nonparticipant or relative. Public availability and authorization for a particular use should be distinguished.
Persistence
Later reuse depends on the actual asset and links to other records; no future misuse is asserted.
Relational exposure
Relatives and connected participants may be relevant where the asset contains relationship information.
Case-specific assessment
confidentiality high; integrity unaffected; consent complex because publication was voluntary but selective; persistence high.
GeneticSecurity.org analysis
Genetic Exposure Radius
No single level is assigned where the supplied dossier gives a range, conditional outcome, or broad institutional consequence. The affected parties and proposed assessment are shown separately.
Confidence: not assigned. Classification: GeneticSecurity.org analysis.
Genetic Persistence Risk
Persistence depends on the specific biological material or information retained. A potential effect is not treated as an observed genomic disclosure.
Confidence: not assigned. Classification: GeneticSecurity.org analysis.
Genetic Provenance Integrity
A numeric provenance level is not inferred from the existence of a source or court record. It requires evidence of the relevant custody and processing controls.
Confidence: not assigned. Classification: GeneticSecurity.org analysis.
Proposed classification and its limits
Suggested GER: GER-1/2 because APOE information may matter to relatives. Suggested GPR: GPR-5. GPI: not central.
These are proposed classifications from the supplied case dossier. Conditional scores describe an assumed exposure; they are not evidence that it occurred. A single numeric value is left unassigned when the asset or outcome is not sufficiently bounded.
What this case does not prove
The example does not establish an Alzheimer diagnosis, a predetermined outcome, or perfect genotype inference.
Mitigations and lessons
- Correlation-aware redaction
- Privacy threat modeling before release
- Family-impact counseling
- Controlled rather than public access
- Periodic reassessment as reference panels improve
Primary sources
Secondary sources
No additional source listed. See the evidence notes for limitations.
Policy and standards
Genetic Security Policy and StandardsReview and correction history
Source edition: September 19, 2026. Imported case account; no substantive corrections recorded.
Correction policy and logCite this case
GS-CASE-024. The Gene He Hid: Why Genomic Redaction Is Hard. GeneticSecurity.org. https://geneticsecurity.org/cases/024-watson-apoe-genome-redaction-failure/