In April 2023, the FBI issued an unusual advisory. It did not warn of a crime nor announce an investigation. Instead, it told people to delete their own data from a company that had just filed for bankruptcy. The company was 23andMe. The data was genetic.
This is not what law enforcement agencies do. They prosecute wrongdoing and enforce judgments. They do not typically issue consumer advisories about the legal outcomes of insolvency proceedings. When they do, it means something specific: that the legal outcome and the right outcome have diverged and the institution has no mechanism to close the gap.
Nobody at 23andMe did anything wrong in the conventional sense. The founders built something with genuine idealism. They set out to democratise genetic information, accelerate research, give individuals access to data that had previously required clinical gatekeeping. The governance promise was considered and public: your data belongs to you, will not be sold, and is protected. People believed it. Many of them contributed something intimate on the basis of that belief. Not a name or an email address. Their genome.
The company followed its governance. When the liquidity crisis arrived, the executor followed the law. A bankruptcy court sees assets and distributes them to creditors. This is what bankruptcy courts do, and the 23andMe executor did it correctly. The FBI saw what the court was about to do and issued a warning, because what the court was doing correctly was also plainly wrong and no legal instrument existed to say so.
This is not a story about bad actors. It is a story about a missing category.
What actually existed at 23andMe was not a database. Or rather, it was a database, but that description misses the object that mattered. What existed was coordination, or a coordination commons to be more precise. It was a trust relationship between contributors and a platform, through which people had voluntarily produced something of extraordinary value. The data did not precede the trust. The trust produced the data. Strip the trust relationship and you do not have an asset. You have bytes whose provenance, consent, and meaning were entirely constituted by the activity that generated them.
When the coordinator failed, the commons dissolved. That is what should have happened to the data. It should have become legally inert. More precisely, it should have reverted to the people whose trust created it, because without them it would not exist and without their ongoing consent it has no legitimate use. Instead it was treated as property, because property is the closest available legal category, and the law had nothing else to offer.
The FBI warning is the clearest evidence we have that even law enforcement can perceive this gap, even though they cannot name it. Something was wrong. The mechanism that produced the wrongness was entirely legal. The agency reached for the only instrument it had because no legal object existed corresponding to what had actually been violated.
We do not have a category for assets that are produced by trust relationships and should not survive the dissolution of those relationships. We have property, contract, privacy regulation, but none of them capture this commons. None of them could protect it when the coordinator failed, because none of them recognise it as the thing that needs protecting.
The moralising that followed is worth examining, because it is doing something specific.
The coverage ran its familiar arc. Revelation, outrage, expert commentary, proposed legislation, quiet resolution, forgetting. Each stage performed accountability without producing it. By the time the story dropped from the news cycle, the frame had been set: a particular company, a particular founder, a particular regulatory gap to be closed. The design survived. The lesson being drawn, to the extent any lesson was drawn, was: don’t build DNA databases. Which is an unfortunate conclusion, because genomic data cooperatives are precisely the kind of infrastructure that could accelerate understanding of complex disease, hereditary conditions, and population health. We may have frightened ourselves out of building something genuinely valuable because we lacked the category to build it safely.
This is what the moralising apparatus does. It converts a structural outcome into a cautionary tale about a specific application. The structure survives intact. The next platform launches with the same architecture and fresh good intentions, and the cycle is available to run again with different data.
The structure that survives are governance promises that are moral rather than architectural. Commitments that hold while the founding conditions hold and have no answer to the question of what happens when they don’t. The promise was real and the intentions were good, but the architecture assumed that good intentions, once established, would persist through whatever conditions followed. This is not governance; it’s hope, formalised.
Jonathan Goodman, in his recent work on cooperation and competition, makes a point that is useful here. We did not evolve to be cooperators or defectors, but with the capacity for both and with the intelligence to behave cooperatively under observation and defect when the cost is low enough. His conclusion is that cooperation is not a trait to be assumed but a context to be designed. The architecture of the context determines the behaviour, not the character of the participants.
The 23andMe case extends this further than Goodman goes. The failure was not individual defection. Nobody waited for an opportunity and took it. The failure was that the governance design had no structural existence independent of the goodwill of the founding conditions. When those conditions changed the governance promise had nothing underneath it except the ordinary operation of insolvency law. The context collapsed, and with it the behaviour that the context had been producing.
What Goodman’s framework implies, but does not yet reach, is that designing the context means more than aligning incentives or raising the costs of defection. It means ensuring that the objects that governance is meant to protect have legal and structural existence. A coordination commons that has no recognised existence in law cannot easily be protected by law. It will be treated as the nearest available category — property, contract, data — and those categories will not hold it correctly under pressure.
This is the structural void. Not a regulatory gap that better legislation could close, though legislation would eventually need to follow. A categorical absence. The coordination commons, the shared capacity through which people create something together that none of them could create alone, and which belongs to the relationship rather than to any party within it; does not exist as a legal object. It has no standing. When it is threatened, there is nothing to enforce.
The FBI saw this. It did not have the language for it. The advisory it issued was the institutional equivalent of pointing at something that should be there and finding nothing.
Every governance system that relies on good intentions holding under pressure is building on that absence. The intentions can be entirely genuine. The people involved can behave with complete integrity throughout. And the outcome can still be wrong, because the architecture had no answer to the moment when the conditions changed, when the coordinator failed, when the incentives reversed.
We live, largely, in that architecture. We have built governance systems sophisticated enough to generate genuine trust and productive enough to create things of real value, while leaving the thing that made them valuable with no existence that the law can see or protect.
That is not a failure of character. It is one of category.
This is not an isolated incident. In 2022, the cryptocurrency lender Celsius Network filed for bankruptcy. Users had deposited funds under the reasonable belief that the platform held them in trust. A bankruptcy court ruled otherwise. They ruled that the terms of service had transferred legal ownership of those assets to Celsius, making them available to creditors. The trust relationship users believed they were participating in had no legal existence. The community response was telling: an entire ecosystem adopted the folk warning “not your keys, not your coins”. This is a piece of vernacular law invented to describe a categorical gap that the legal system couldn’t fill. Different domain, different data, identical structure. A coordination commons producing something of value, a coordinator failing, and the law reaching for the nearest available category while the people whose trust created the value stood at the back of the creditor queue. Nobody committed fraud. The architecture had no answer and a community had to invent its own language for a problem that shouldn’t have needed one.
There is an epilogue to the 23andme story, and it is instructive.
Anne Wojcicki resigned as CEO of 23andMe the day it filed for bankruptcy. She resigned strategically, so she could bid for it as an independent party. She then established a nonprofit, TTAM Research Institute, and bought the company back through the bankruptcy proceedings for $305 million, outbidding Regeneron Pharmaceuticals. The data stayed with its founder. The original commitments were honoured. Customers retained the right to delete their data, to opt out of research, to trust the platform they had trusted before.
The outcome was good, for now but the mechanism was not governance. It was a personal correction to a systemic failure that still exists. It was funded by the value extracted during the years the system appeared to be working. The nonprofit structure protects the asset from the next bankruptcy court. It does not protect it from the next crisis, which will likely arrive without a founder wealthy enough to repeat the manoeuvre.
The good outcome will be reported as the system working, but it is the opposite. It is the system being rescued from itself by an act of individual good will that cannot be generalised, legislated, or relied upon. The next commons to fail in a bankruptcy court will not have a founder willing and able to buy it back. It will have creditors, a trustee, and the nearest available legal category.