Federated Access in Plain English: Analyse Genomic Data Without Moving It

Why Data Often Cannot Move

The default assumption in most data-engineering workflows is straightforward: collect the data, bring it to your compute environment, and run your analysis. In genomics, that assumption breaks down for reasons that are legal, practical, and increasingly non-negotiable.

National genomics programmes such as Genomics England, the Swiss Personalized Health Network, and the All of Us Research Program in the United States operate under legal frameworks that restrict or prohibit the export of raw sequence data beyond defined jurisdictional boundaries. These restrictions are not merely contractual preferences. They are codified in national legislation, institutional review board conditions, and data-access agreements that carry enforceable penalties for non-compliance.

Beyond legal constraints, the practical challenges are substantial. Whole-genome sequence data for a single individual typically occupies 100 to 200 gigabytes in compressed form. A research cohort of ten thousand individuals represents petabytes of transfer volume. Moving this data across networks is slow, expensive, and creates copies that multiply the attack surface for data breaches.

Data sovereignty adds a further dimension. Many European biobanks operate under the principle that genomic data generated from a national population is a sovereign asset. Even where GDPR would permit a cross-border transfer under adequate safeguards, institutional policy may prohibit it as a matter of principle. The data stays where it was generated, full stop.

What "Federated" Actually Means

Federation, in the context of genomic data access, refers to a specific architectural pattern: rather than moving data to compute, compute moves to data. The researcher defines an analysis pipeline, a sequence-alignment workflow, a variant-calling algorithm, a statistical model, and submits that pipeline to the data custodian's environment for execution. The pipeline runs against the data in place. Only the results, which are typically orders of magnitude smaller than the input data, are returned to the researcher.

This is sometimes described as "compute-to-data" or "bring your code to the data." The critical distinction from a governance perspective is that the raw sensitive data never crosses an organisational boundary. The data custodian retains physical and logical control over the sequences at all times.

Controlled Pipelines

Federation does not mean arbitrary code execution on someone else's data. The pipelines that a researcher can submit are constrained. The data custodian typically maintains an approved list of analysis tools, container images, and workflow definitions. A researcher's submission is validated against this list before execution begins. Unapproved tools are rejected. This prevents data exfiltration through covert channels embedded in custom code and ensures that only validated, reproducible analyses are performed.

The pipeline approval process itself is a governance artefact. It requires the data custodian to evaluate whether a proposed analysis is consistent with the consent under which the data was collected, whether the outputs could enable re-identification, and whether the computational resources required are proportionate to the research question.

GA4GH Standards: The Interoperability Layer

The Global Alliance for Genomics and Health has developed a suite of technical standards that make federated access operationally viable across institutions that run different infrastructure stacks. Two standards are particularly relevant to understanding how federation works in practice.

Data Repository Service (DRS)

DRS provides a uniform interface for locating and retrieving data objects regardless of where they are physically stored. A DRS identifier resolves to a set of access methods, which might include HTTPS URLs, cloud-storage signed URLs, or references to on-premises storage systems. The key abstraction is that the researcher's pipeline does not need to know the storage implementation. It requests a DRS object, and the DRS server returns an access path that works within the custodian's environment.

For federated access, DRS serves a dual purpose. It provides the pipeline with a stable reference to the data it needs to process, and it provides the governance layer with a single point at which access decisions are enforced. Every data retrieval goes through the DRS endpoint, which can log the request, verify permissions, and apply rate limits.

Passports and AAI (Authentication and Authorisation Infrastructure)

GA4GH Passports solve the identity and permission problem that arises when a researcher from one institution needs to access data held by another. A Passport is a digitally signed token that encodes claims about the researcher: their institutional affiliation, their ethics approval status, the datasets they are authorised to access, and any conditions attached to that access.

When a researcher submits a federated query, their Passport is presented to the data custodian's authorisation service. The service evaluates the claims against its access policy. If the claims are sufficient, the query proceeds. If not, the query is rejected with an indication of which claims are missing. This process is automated, eliminating the weeks-long manual review that previously characterised cross-institutional data access.

"The GA4GH Passport specification enables a researcher's permissions to travel with them across institutional boundaries, without requiring each data custodian to maintain its own user directory."

GA4GH Data Use and Researcher Identities Work Stream

What Must Still Be Governed

Federation eliminates the need to transfer raw data, but it does not eliminate governance obligations. Several areas require active management even when the data never leaves its custodian's environment.

Identity and Access

The research organisation must maintain a trustworthy identity for each researcher who will submit federated queries. This means institutional identity providers must issue credentials that are current, that reflect the researcher's actual role and ethics approvals, and that can be revoked promptly when a researcher changes role or leaves the organisation. Stale credentials are a governance risk even in federated models.

Output Review

The results returned from a federated query may themselves contain sensitive information. Aggregate statistics computed over a small cohort can enable re-identification. Model parameters trained on genomic features can, in some circumstances, leak information about the training data. Output review, whether automated or manual, is a necessary control to ensure that returned results do not violate the privacy constraints that motivated federation in the first place.

Logging and Auditability

Every federated query must be logged by both the requesting organisation and the data custodian. These logs must capture what pipeline was submitted, which datasets were accessed, what results were returned, and who authorised the query. The logs must be tamper-resistant and retained for a period consistent with the regulatory framework governing the data. In practice, this means five to ten years for most European genomics programmes.

Approval Workflows

Not every federated query should be automatically approved. High-risk queries, those that access large cohorts, that use novel analysis methods, or that combine data from multiple custodians, may require human review before execution. The research organisation must implement approval workflows that route these queries to appropriate reviewers and capture the approval decision as part of the audit record.

When Federation Is Not Enough

Federated access is not a universal solution. Some analyses require iterative access to raw sequences in ways that are impractical through a query-submission model. Training deep-learning models on genomic data, for example, may require thousands of passes over the same sequences with different hyperparameters. Submitting each training epoch as a separate federated query is operationally infeasible.

In these cases, the appropriate approach is to bring the data into a controlled environment under D-04 governance, the most restrictive tier in our data classification model. Federation and in-platform analysis are not competing approaches. They are complementary tiers in a governance model that matches the access pattern to the control level. Federation applies when query-based access is sufficient. In-platform analysis applies when it is not. The governance framework must accommodate both.