Regulating genetic biohacking

Just as the popularization of computers in the late 1970s and early 1980s gave rise to computer hacking, the recent accessibility and affordability of relatively easy—and widely hyped—genome editing technologies and resources has spurred interest in genetic “biohacking,” molecular genetics experiments performed outside institutional laboratories by individuals who may have little formal scientific training. While regulation of the work of professional scientists and traditional scientific institutions is robust—yet still faces serious scrutiny in the wake of He Jiankui’s genome editing experiments on Chinese twins (1)— regulation of genetic biohacking has received far less attention. This is true even though genetic biohacking, like traditional scientific research, is likely to produce a range of innovations while posing a number of risks to public health. Here, we explore these risks and the consequences of understanding that some instances of regulatory failure for biohacking are inevitable. And, where they are not, we suggest that agencies, policy makers, and private parties have the opportunity to improve oversight of genetic biohacking using the tools they currently possess.

Genetic Biohacking

Experiments to modify genetic expression that once required specialized training and substantial investments in equipment and reagents can now be conducted for a few hundred dollars and with a basic instruction manual. Genomic sequencing can be done using portable pocket devices, some of which cost less than a plane ticket. The rise of direct-to-consumer testing services has also resulted in individual access to raw genetic data, fueling a variety of health, wellness, ancestry, and relative identification services that offer to interpret those data.

As these technologies go mainstream, some individuals have begun conducting genetic experiments outside of traditional scientific labs, such as those associated with universities, research institutions, and regulated corporate entities. Some of these experiments have involved humans, although thus far, they appear to be limited to self-experimentation with one’s own body—an activity that has an ancient pedigree in traditional medical research.

The motivations of these genetic biohackers, some of whom lack any formal training in biology, are diverse and often complex. Some appear to be motivated by normative beliefs in a “right to do science.” Others place a high value on bodily autonomy or creative expression—a right to experiment on themselves or use genome editing for expressive purposes. Some view biohacking as a means of self-care, where, for example, they experiment with alternatives to (sometimes expensive) regulated drugs. Still others harbor views that traditional scientific institutions are poor regulators of themselves or are slow and needlessly cumbersome. And some, frankly, are moved by anti-government sentiments.

Reflecting these diverse motives, recent reports of genetic biohacking include a broad array of experiments: genetic modification of bacteria, yeast, plants, nonhuman mammals—and also humans in the form of genetic self-experimentation. This includes, for example, self-injecting homemade genetic material in attempts to change the expression of muscle growth factors to improve strength or to treat diseases like HIV or Herpes (2). Where self-experimentation is undertaken by groups who coordinate their efforts, these activities can begin to look like decentralized clinical trials. Some biohackers might also attempt to experiment on others. Although there are no documented instances of this to date, biohackers have reported (and expressed concerns about) being approached by individuals asking for help treating their own or their family members’ health conditions. Genetic biohacking of this sort—experimentation on oneself and others—pose public health risks. These include interventions with poor safety or efficacy; a lack of true informed consent; and the introduction and uptake of unsafe and unproven “therapies” into commerce. The democratization of genetic biohacking exacerbates these public health risks because many experiments make use of easy-to-obtain materials and equipment purchased from companies that cater to the do-it-yourself (DIY) market or freely provided by other biohackers.

There are other emerging areas of DIY science that do not focus on molecular genetics, such as neurohacking and self-manufacture of traditional pharmaceutical products, that similarly raise public health concerns. Genetic biohacking, however, is especially easy, affordable, and a particularly popular and promising form of DIY science that poses unclear but potentially serious or far-reaching risks. These include, for example, sick individuals foregoing known, effective treatments in the hope of cheaper and unproven DIY genetic interventions or, at an extreme, harmful germline modifications. As has been the case for “alternative” cancer treatments and autologous stem cell transplants, hype and access to biological reagents have the potential to pose significant public health concerns. Genetic biohacking communities, therefore, should be an important focus for regulating DIY science.

Government Regulation

As biohacking has become more prevalent—and public—scholars, ethicists, and regulators have voiced concerns that government oversight may be absent or inadequate to address the risks that these activities may pose. Indeed, biohackers sometimes work in private, whereas traditional research is conducted in teams overseen by institutions. Biohackers generally do not obtain ethical review of their work in contrast to traditional biological research. And because biohackers are often self-funded, they are not typically accountable to private or agency funders, like their traditional, professional counterparts.

Contrary to the conventional wisdom, however, genetic biohacking does not occur in a legal or ethical “wild west.” (1) In the United States, there are a number of laws and regulations that appear to be relevant. We focus on the U.S. regulatory landscape because the United States is a popular site for genetic biohacking and the home of the earliest community laboratories. Unlike some European countries, the United States does not ban genome editing conducted outside of licensed laboratories, although it is not unlikely that such a ban would be proposed if it is discovered (as it was with Dr. Jiankui) that some genetic biohackers have crossed generally observed lines of ethics or safety. Our objective is to help U.S. regulators better prepare for that day. Although our recommendations may not precisely translate to other countries because each jurisdiction has a unique regulatory system and philosophy, they, nevertheless, may be broadly informative of potential regulatory responses.

The Food and Drug Administration (FDA), for example, has extensive power to regulate public health impacts of genetic biohacking, with jurisdiction that reaches further than many biohackers realize. In many circumstances, the things used by genetic biohackers—such as raw biological materials, traditional drug products, and DIY CRISPR kits—are, by statute, FDA-regulatable drugs. Other articles, such as human gene therapy products, also come within FDA’s purview over biologics (3). Moreover—and contrary to popular belief—money need not always change hands for an item to fall within FDA’s jurisdiction, a wrinkle important for biohackers who freely provide or exchange materials (4). This view of FDA’s authority was bolstered in November 2017 when, in response to concerns about individuals using DIY CRISPR kits for self-experimentation, the agency stated that “any use of CRISPR/Cas9 gene editing in humans [is] gene therapy” and therefore subject to regulation (5).

FDA has yet to vigorously enforce its power in this area. To date, it has not taken public enforcement action against any biohackers conducting genome editing. But this is consistent with FDA’s flexibility to exercise “enforcement discretion” in deciding which violations merit formal action given limited enforcement resources. Genetic biohacking may also make it practically difficult for FDA to identify violations that do occur, especially when committed by individual experimenters or small-scale biohacking communities.

Nonetheless, this does not mean new or more powerful regulations are warranted. Where FDA has chosen not to formally wield its enforcement power, the agency still has a role in community engagement—education, warning, and standard-setting for activities that pose public health risks and that otherwise fall within its purview. An important function of the agency is to encourage communication and disclosure for traditional, commercial research (6). Through its longstanding role in assessing drugs and biological products, FDA is the government regulatory agency equipped with the expertise to assess the safety and effectiveness of genetic biohacking. FDA involvement, therefore, may help realize the promise of genetic biohacking through guiding biohacking efforts toward interventions that live up to the communities’ hopes.

Although FDA has begun to show interest in genetic biohacking—as evidenced by its November 2017 statement and the participation of officials in a 2018 “bio-citizen” workshop hosted not by the agency but by the Woodrow Wilson Center (5,7)—the agency has seemingly not yet taken the reins through a proactive effort to deeply engage with or understand biohacking communities. Given some biohackers’ continued confusion about FDA’s authority over their work, the agency might begin by clarifying the boundaries of its jurisdiction, in lay terms and in sufficient detail to cover diverse biohacking activities, while seeking feedback from biohacking communities on how FDA could best exercise its authority in this space. This would provide biohacking communities more certainty about where they stand and potentially encourage new and innovative biohacking activities that might have been deterred by uncertainty about FDA enforcement. At the same time, these activities will help the agency avoid repeating the mistakes it made with the stem cell industry, where the rapid expansion of clinics offering unproven interventions to patients is attributed to years of uncertainty around the scope of FDA jurisdiction and limited agency engagement. The agency also could draft guidances about typical genetic biohacking experiments and identify staff as points of contact for those engaged in genetic biohacking who would like to communicate with the agency. FDA’s lack of current engagement is a shame—but not one that merits revamping of the agency’s powers.

A similar approach has thus far proved successful for other federal authorities in different contexts. The risks posed by biohacking to “bioterrorism,” for example, have been the subject of study by the U.S. Federal Bureau of Investigation’s (FBI) Biological Countermeasures Unit. (8) To police the threat of biohacking-mediated bioterrorism, and in contrast to the FDA’s work, the FBI has developed strong relationships with community labs, where some genetic experimentation is occurring.

Efforts at community engagement should focus on the potential public health harms posed by genetic biohacking, such as adverse effects from the administration of homemade gene therapies, contamination of the environment from poorly kept genetic reagents (such as viral vectors), and the forgoing of traditional treatments in favor of DIY experimental ones. Specific risks (and potential benefits) of genetic biohacking involving humans will depend on the context of their use. Thus, assessment should include, for example, ascertaining whether a homemade genetic intervention is intended as a therapy for a disease with no known treatment, a disease for which there are known effective treatments, or for some other purpose, such as an enhancement or aesthetic use.

Private Regulation

Genetic biohacking is also potentially subject to U.S. laws that are enforced by private rather than government actors. These may fill some of the gaps in public regulators’ ambit (9). Patent owners, for example, can impose ethical restrictions on licensees, such as the Broad Institute’s licenses for its CRISPR patents to Bayer (formerly Monsanto), with conditions that Bayer avoid research activities that are potentially harmful to public health, including tobacco research and germline editing (10). Such license restrictions can—and should—be used to police commercial manufacturers of genome-editing kits and reagents popular in biohacking communities, just as they have previously been used to prevent activities that pose national security, environmental, or public health risks (11). Even without a license in place, patent owners can enforce restrictions through threats of patent infringement litigation against any recalcitrant biohackers or manufacturers of biohacking products. A similar model was proposed as an attempt to restrict use of “gene drive technology,” inheritable versions of CRISPR designed to drive a specific allele through generations of a population (12). Beyond patents, people injured by genetic biohacking materials could potentially bring tort law claims against biohackers and component suppliers to seek compensation for their injuries. A person injured while using a DIY CRISPR kit, for example, would likely be able to sue the seller of the kit—a potentially strong deterrent to marketers of unsafe biohacking materials.

Apart from these legal mechanisms, some biohacking communities have adopted their own ethics restrictions, which, even if not intended to do so, might indirectly avoid harms to public health caused by genetic biohacking. The International Genetically Engineered Machine (iGEM) Competition, for example, requires its participants to comport with a strict program of bioethics (13). The International Gene Synthesis Consortium—a group of commercial suppliers of genetic materials—developed protocols for screening orders and verifying customers in an effort to prevent dangerous uses. For example, protocols may instruct suppliers to decline orders for delivery to home addresses or post office boxes (9). Although this is an important effort, some biohackers have nonetheless devised ways to pass such screening by, for instance, registering businesses for the purpose of obtaining institutional addresses.

Another example of self-governance is community labs’ adoption of safety policies, which often include standards detailed in the cornerstone of biosafety practices in the U.S., the Biosafety in Microbiological and Biomedical Laboratories guidance document. These policies include restrictions on experimentation in humans, one of the riskiest forms of genetic biohacking with the largest potential negative consequence to public health. A grant-funded effort spearheaded by North Carolina State University is currently underway to understand and improve on community labs’ safety policies with guidance from biosafety officers established in three labs. Analogously, a code of ethics adopted in 2011 by an organization of DIY biologists, DIYbio.org, remains an important touchstone for experiments. (14)

Given that many biohackers who conduct work at home are also members of community labs (15), their safety policies have the potential to go a long way in promoting safety in genetic biohacking. Outside the norms of community labs and traditional scientific institutions, many who engage in biohacking activities nonetheless rely on each other for materials and information, providing a positive downstream effect to community labs’ ability to police the conduct of biohacking communities. These collaborations might also encourage transparency between biohackers affiliated with community labs and those outside the community lab niche.

Like government regulation, private governance of this sort is important and laudable but not a perfect or comprehensive solution. Private actors may not be inclined to regulate conduct that poses few risks to them, even if safety risks to others are numerous, obvious, and serious. In other cases, the social stigma of violating community norms may simply be an ineffective deterrent. Additionally, community labs’ private governance efforts only weakly reach genetic biohacking communities focused on human experimentation or in locations where community labs are absent.

Moving Forward

The existence of public and private governance mechanisms to mitigate the public health risks and encourage the innovative potential of biohacking—even if currently infrequently used—means that regulators can better implement these mechanisms rather than rely on new ones to be grafted into law. For example, calls for bans on biohacking, such as those from a consumer advocacy organization in Australia, go too far. The tools for public and private regulators to manage biohacking’s public health risks are largely already available. But they must be used better.

As with other issues pertaining to public health, this also means that the future of regulating biohacking lies not only in more stringent policing, but in better education of its participants and a realistic understanding that violations will be inevitable. Education would help private actors understand the risks posed by certain forms of biohacking and appreciate FDA’s role in both consumer protection and fostering innovation (6). Likewise, public regulators, such as FDA, would benefit from engaging with stakeholders to better understand genetic biohacking activities, its participants’ perspectives, and biohacking communities’ potential for self-governance—much as it already does with the pharmaceutical industry. Even with limited enforcement resources, agencies like FDA have an opportunity to advance public health by working with biohacking communities as their practices and norms are being developed—and before potentially problematic norms of risk, secrecy, and mavericks become widespread.

No government or private policy will ever achieve perfect compliance, even in traditional scientific settings—as He’s experiments painfully demonstrate. There will always be “rogue actors” who may maintain connections with their institutional communities even after being “caught” (1). Striving for perfect compliance comes with substantial burdens, including throttling the development of new technologies, expending scarce enforcement resources, and facing political backlash. Appreciating this should allow policy makers and regulators—both public and private—to understand that different genetic biohacking activities will pose different risks and should merit different approaches, and to tailor existing regulatory mechanisms to mitigate genetic biohacking’s risks while amplifying its potential.