A proposed GeneticSecurity.org analytical concept. These levels are not an external standard, validated risk model, or industry certification. Version 1.0 was prepared on September 19, 2026; an earlier public publication date has not been established.
Why it matters
A genetic disclosure is not necessarily bounded by the person or sample that was directly obtained. Because genetic information is relational, one person's data may reveal information about relatives. A population dataset may reveal group characteristics. Agricultural genetic data may affect an entire breeding line, germplasm collection, or crop population.
GER measures SCOPE, not severity.
A high GER event is not automatically more harmful than a low GER event. It means the possible exposure propagates farther from the directly affected genetic asset.
Proposed levels
Direct / Isolated
Exposure is effectively limited to the sampled individual, specimen, or genetic asset.
Examples: - A laboratory report containing one person's genotype is accidentally sent to the wrong person, with little additional family information. - A single non-reproductive microbial sample is exposed with no meaningful linkage to a wider resource set.
Immediate Kin / Direct Network
Exposure can reasonably reveal or help infer information about parents, children, full siblings, or immediately connected breeding relationships.
Examples: - A person's genotype reveals parent-child or sibling relationships. - Livestock parentage data exposes a closely controlled breeding pair or immediate pedigree.
Extended Kinship
Exposure can reasonably assist inference involving cousins, grandparents, aunts/uncles, extended pedigrees, or broader breeding lines.
Examples: - Genealogy matching identifies second- or third-degree relatives. - Pedigree data reveals a commercially important extended animal lineage.
Genealogical / Network Scale
Exposure can propagate through a large family tree, genealogy database, pedigree network, or connected genetic graph.
Examples: - A distant-relative match is combined with public records to narrow an unknown person's identity. - A compromised account exposes thousands of genetically connected profiles.
Population / Community Scale
Exposure can reasonably affect a defined population, ancestry group, tribe, cohort, rare-disease community, breeding population, regional genetic population, or similar group.
Examples: - Research data supports inference about a small Indigenous community. - A rare-disease cohort is re-identifiable because the population is unusually small. - A genetic dataset characterizes a highly specific regional livestock population.
Systemic Genetic Resource Scale
Exposure, manipulation, destruction, or loss can affect a large genetic-resource collection, species-level preservation program, nationally significant breeding resource, seedbank, germplasm repository, or other strategic genetic resource.
Examples: - Loss or corruption of a critical seedbank collection. - Manipulation of a national crop germplasm database. - Large-scale compromise of a repository supporting food-system genetic resilience.
How to use the scale
State who is directly exposed, which indirect relationships are plausible, why the proposed scope fits, and what remains unknown. A higher radius is not automatically a more severe harm. Never estimate indirect counts without evidence.
Worked example: one account, several relationships
Consider a hypothetical service where a user's profile displays relationships to other participants. If an unauthorized viewer obtains that page, the account owner is the entry point, but the information can concern more than one person. The assessment should describe the visible relationships and what they make reasonably inferable.
Now change the example: the page contains only an account name and no genetic or relationship information. The fact that it belongs to a genetics service would not justify the same relational classification. GER depends on the exposed asset and its connections, not the business category of the organization.
Record the boundary you chose
A score should come with a sentence explaining where the assessment stops. For example: “This classification covers the displayed family relationships; it does not assume access to other kits or private records.” Such a boundary makes comparisons more reliable and helps a later reviewer see which new evidence would change the result.
Avoid treating the scale as a head count. An extended family may contain fewer people than a small research cohort, yet the two can involve different kinds of relationships. The categories describe the nature and reach of exposure; the actual number, where known, belongs in a separate field.
Sources and provenance
The definition, levels, and scoring rationale originate in the GeneticSecurity.org implementation brief, version 1.0, dated September 19, 2026. External sources support the examples, not endorsement of this scale.
Classification methodology