Genetic Access Control

In July 2015, someone calling themselves the Offensive Application Programming Initiative pushed a working Flask app to GitHub called Genetic Access Control. It did exactly what the name says: it used the 23andMe OAuth2 API to gate a website by the visitor’s DNA — ancestry, sex, disease susceptibility, whatever SNP markers you cared to filter on. The demo was configured to admit European (minus Ashkenazi) ancestry only. White-only website access, shipped as running code with a straight face. Then the author sat back and let the internet do the rest.

The troll

Repo: offapi/rbac-23andme-oauth2. Author: “Offensive Application Programming Initiative” (offapi), ~July 2015. A real Python/Flask app, simple enough for any developer to deploy, that:

• uses standard OAuth2 to request genetic data from 23andMe;
• checks ancestry composition against configurable thresholds;
• ships a demo that specifically filters for European-minus-Ashkenazi ancestry — the most inflammatory configuration available, implemented as working code.

The craft is in the README. Its list of “possible uses” was calibrated to provoke every faction at once:

1. “Safe spaces” for “frequently attacked and trolled victim groups” — feminist framing
2. Hasidic Jewish groups restricting to Ashkenazi/Sephardic haplogroups — ethnoreligious exclusion
3. Safer dating sites checking for recessive disease genes — eugenics-adjacent
4. Pharmaceutical applications — the one actually reasonable use case
5. “Groups defined by ethnic background, e.g. Black Panthers or NAACP” — racial separatism

It even added a “Flaws” section admitting you could just submit someone else’s spit sample, and flagged “unresolved ethical issues regarding trans-*-identifying persons such as transgender and transethnic users” — the last touch a deliberate accelerant.

Nobody who built this was confused about what it was; the org name is a neon sign. Slashdot commenters said so out loud — “The person who made this uses the name ‘OffensiveComputing’. You fell for what is clearly a troll project” (AmiMoJo, Score:3), and “I think the author, using the ‘offensive-computing’ nick, knew very well that this would trigger a discussion and that’s probably the reason this project was created in the first place” (MtHuurne, Score:5, Insightful). Naming it as a troll did not stop the argument. That was the point.

The discourse: 256 Slashdot comments

On July 22, 2015, Slashdot picked it up, posted by Soulskill “from the don’t-forget-sexism dept.” The submitter, rjmarvin, framed it hot: “Now, budding young racist coders can check out your 23andMe page before they allow you into their website! … This is literally the code to automate racism.” Two hundred and fifty-six comments followed.

They split exactly along the lines the README was built to split. The top-rated comment shrugged: “Stop caring what other people do… Don’t have a 23andMe profile if you really care.” tgv put the knife in — “What’s the difference between ‘a safe space for women’ and ‘a safe space for white supremacists’? And who in their right mind can think it’s a good idea to have a DNA profile online?” Suiggy played provocateur — “I thought the narrative was that race doesn’t exist?” — then answered himself, Funny, Score:4: “So you’re telling me race exists? That sounds racist!” DrYak wrote a 500-word explainer on why genetic race categories are arbitrary, ending on the observation that white supremacists running genetic access control would eventually exclude themselves.

The best comments treated the whole thing as the self-limiting absurdity it was. Michael Woodhams: “At this point, what he is running is less of a ‘website’, more of a ‘diary’, as it will have only one reader.” bickerdyke, on the security model: “the access control isn’t checking your DNA. It is checking if you have access to a genetic profile of someone with matching criteria… (‘whitelisting’ gets a whole new meaning here…).” larwe named the real danger — not doorman-style blocking but selective content served on a genetic signal, “already been shown that Google gives different results to searches that include ‘black’ names vs ‘white’ ones.” GrumpySteen: “I think my irony meter just blew a circuit.” Chris Mattern: “I think I’ll just stick with debit and credit, thank you.” bluefoxlucid, last word: “The hell did I just read?”

A few hundred lines of Python generated more sustained argument about genetics, race, privacy, free speech, and API security than most tenure-track publications manage in a career. Multiple commenters correctly identified it as a troll — and the debate rolled on anyway, which proved the troll’s thesis better than any of them intended. Even the “don’t-forget-sexism dept.” tagline was a troll.

The forum war: weev in the FreeBSD group

The same week, a parallel fire was burning in a Facebook group — “FreeBSD Users Group,” 1,770 members — captured by Mischa Spiegelmock, whose posts kept getting deleted. He opened a thread asking why. It devolved into an OS X–vs–FreeBSD flamewar spanning hours, and became a complete ecosystem of dysfunction in miniature.

The cast:

• Adrian Chadd, FreeBSD kernel committer, cops to deleting troll posts in general (“read: not me; I fess up when I delete troll posts”) while alternating between real technical talk and “Cool. Kick ass, chew bubblegum, run BSD. I’m going back to shaving yaks.”
• Alfred Perlstein, FreeBSD core team, gatekeeps credentials at a CS-minor named Jonathon McDaniels who wanted to fork FreeBSD: “what is your development background?… Maybe with your limited background you should sit back and listen and learn instead of holding strong opinions?” — then posts an Epic Facepalm compilation and “#whereisjonathonsgithub.”
• Andrew Auernheimer (weev) — the convicted hacker and Daily Stormer webmaster — drops in to mock Jonathon (“he is the batman of the FOSS community”) and escalates into a stream of antisemitic, racist, and ableist abuse aimed at anyone in range. His presence in a 2015 FreeBSD Facebook group, unloading on the core team, is a primary-source snapshot of what trolling looked like in a technical community before anyone had a phrase for “content moderation at scale.”
• Tom Sparks, group admin, tries to hold the line, and delivers the punchline. Mischa: “Which mod was it, may I ask?” Tom Sparks: “It was Randi Harper.” Then: “The mod meant to click promote.”

Randi Harper — @freebsdgirl, creator of the GGAutoBlocker tool, a prominent GamerGate-era anti-harassment figure who was herself frequently accused of harassment — being the moderator who “accidentally” deleted posts in a thread featuring weev is a head-on collision of two internet-culture worlds. The rest is the exact dysfunction the content-moderation chapters document: posts vanishing with no one owning the deletion, credential-gatekeeping standing in for argument, mods fighting mods, and the eventual reveal that the moderation itself was broken — resolved, officially, as an accident.

Two artifacts, one week, one mechanism. A provocation engineered to make every faction argue, and a moderation apparatus that couldn’t tell a security post from a troll and deleted both. The code was the koan; the thread was the proof.

Sources