DNA databases are boon to police but menace to privacy, critics say

Nearly two years after the arrest of the suspected Golden State Killer revitalized DNA forensics, some state lawmakers around the country are pushing to stop or restrict police searches of genetic code databases.

Other lawmakers, meanwhile, want to make it even easier for police to use the technique, known as investigative genetic genealogy, to catch criminals.

Inspired by the capture of the alleged Golden State Killer, police across the United States are uploading crime-scene DNA to GEDmatch and other databases where purchasers of genetic testing kits from companies such as 23andMe and Ancestry can share their DNA in hopes of finding long-lost relatives.

Arrests have been made in dozens of cases -- many that had been considered cold. Advocates of the practice tout the ability to find people who committed horrible crimes and exonerate those who did not.

“I believe, 100%, that DNA is the greatest tool ever given to law enforcement to find the truth, whatever that is,” said Anne Marie Schubert, independent district attorney of Sacramento County, California, where the suspected Golden State Killer was arrested.

But law enforcement’s use of the DNA databases has opened another front in the growing battle over digital privacy. Should third parties -- in this case, police -- have access to personal data people generate by using consumer technology? And should investigators be allowed to use the technique to solve all crimes, or only the most violent ones?

Americans are divided on whether police should use investigative genetic genealogy to solve crimes, according to a recent study released by the Pew Research Center. (The Pew Charitable Trusts funds the center and Stateline.) In a June survey of more than 4,200 U.S. adults, 48% said they were OK with DNA testing companies sharing customers’ genetic data with police. A third said it was unacceptable, and 18% were unsure.

“What we have right now we can call the Wild West. There aren't a lot of rules on the ground,” Natalie Ram, an associate professor of law at the University of Maryland, said in an interview. “State legislatures are one of the best-situated bodies to engage in rule-making in this area.”

This year lawmakers are starting to do just that.

A state representative in Utah introduced a bill that would ban genetic genealogy searches by police. A Maryland lawmaker introduced a bill to regulate searches — after a proposal last year to ban them failed. In New York, a state senator has proposed a policy to allow the searches. A Washington state proposal would allow only searches requested through a valid legal process.

And three direct-to-consumer testing companies have formed a coalition and are lobbying Congress for federal oversight to restrict police access to their databases and protect consumer privacy.

Schubert expressed skepticism about legislative proposals cropping up.

“If they want to weigh in on it, that’s fine, as long as they understand what it is, how it works and what it does and doesn't do,” she said. “It shouldn't be a race to see who can be the first to ban it or vice versa.”

How it works

The man accused of being the Golden State Killer, Joseph James DeAngelo, was arrested after investigators uploaded crime-scene DNA to online genealogy database GEDmatch, matched it partially to his great-great-great-grandparents, built family trees of relatives and eventually traced it to him. Police obtained surreptitious samples of DeAngelo’s DNA to confirm the match.

After DeAngelo’s arrest, Schubert started a nonprofit with a few other law enforcement figures called the Institute for DNA Justice. They aim to educate the public about investigative genetic genealogy. And they encourage people to upload their DNA to GEDmatch or FamilyTreeDNA, another open database, to help police.

Schubert said police don’t get behind-the-scenes, unlimited access to peruse DNA databases, despite what many people believe. Instead, investigators upload a DNA profile and get a list of matches and partial matches like the average user, she said in an interview.

The rest is traditional police work: using leads to narrow down the matches to a person who fits the description of the suspect, gathering a surreptitious sample and comparing it with the crime scene DNA profile.

“It is a blend of science and traditional law enforcement,” she said.

More than 15 million people worldwide had undergone direct-to-consumer DNA testing by early 2018, according to a report from the journal Science. Researchers estimated that 60% of searches of a database with 3 million U.S. residents of European descent could lead to a third cousin or closer match.

By the end of 2019, GEDmatch’s database had been used to solve at least 70 U.S. violent crimes. Verogen, a forensic genomics company, bought GEDmatch in December, and said that the use of its database as a crime fighting tool — for people who share DNA and opt in to police searches — would continue.

Forensics company Parabon Nanolabs has relied on public databases such as GEDmatch to identify 83 crime suspects and 11 homicide victims since May 2018, when it began offering genetic genealogy service to law enforcement agencies, said Paula Armentrout, the company’s vice president, in an email. The company charges law enforcement $1,500 to process DNA and another $3,500 for the genealogy research time.

GEDmatch faced criticism last year when a BuzzFeed investigation revealed the company allowed police to upload a DNA profile to investigate an aggravated assault. The website, which was started by a DNA hobbyist, previously restricted police searches to homicide and rape cases. GEDmatch changed its policy so that users had to opt in to law enforcement searches.

About 1.4 million people have profiles on GEDmatch, and more than 200,000 have agreed to law enforcement searches of their DNA, according to Verogen spokeswoman Kim Mohr. 

“We support responsible use of consumer genetic databases by law enforcement and would not be in favor of legislation that prohibits such searches of people who have opted in,” Mohr said in an email.

The privacy debate

The Utah bill would bar law enforcement from performing genetic genealogy searches in consumer databases. The sponsor, Utah state Rep. Craig Hall, a Republican, was not available for an interview.

But Michael Melendez, policy director of Libertas Institute, a free-market think tank based in Lehi, Utah, that helped Hall craft the bill, said traditional consent and warrant models don’t apply to DNA databases.

“You won't see a warrant for an entire town to knock on everyone's door and search everyone's house,” Melendez said. “In the same sense, with a digital DNA database, we don’t believe you can go in and just get a warrant to do a mass search.”

But the Utah Cold Case Coalition, a three-year-old nonprofit that helps people dig into cold cases and advocates for genetic genealogy searches, opposes the bill.

The group’s director, an attorney named Karra Porter, started it after the family of 6-year-old Rosie Tapia, who was raped and murdered in 1995, asked her for help. (The case remains unsolved.)

In a few months, Porter’s group plans to open a lab called Intermountain Forensics in Salt Lake City and provide at-cost DNA tests including genetic genealogy tests for law enforcement, Porter said. 

Even if Hall’s bill, which is in committee, becomes law, Porter said her lab will be fine: The lab already has potential clients from other states. But, she added, “We’re going to have a whole lot of unsolved rapes and murders in our state because of this bill, if it goes through.”

Ram, the Maryland professor, acknowledges that DNA databases are useful to police. The question, she said, is whether the investigative advantages outweigh the threat to people’s privacy.

“There's no doubt that law enforcement could solve more crimes if they could have more access to more people all the time,” Ram said. “Privacy is an essential human good. It's necessary for human flourishing and for liberty.”

Ram testified in support of a bill to ban genetic genealogy searches proposed by a Maryland lawmaker last year. The bill died in committee.

The same lawmaker, Democratic state Sen. Charles Sydnor III, introduced a new bill this session to regulate searches instead. The measure would limit law enforcement’s use of genetic genealogy databases to felony cases including homicide, rape and burglary.

“I had never looked at it in that respect, of people who had committed violent crimes,” Sydnor said in an interview. “This is cutting-edge stuff. We’re all trying to figure it out.”

In New York, a state senator is again proposing a policy that would allow searches in cases of violent crimes where “all other investigative leads have been exhausted.” State law allows police to do only what’s called a familial search, or a search for a partial DNA match, in the state DNA database.

“When I hear of major crimes being solved in other states and our law enforcement officials do not have the same ability,” Republican state Sen. Phil Boyle said, “I want to make sure New York law enforcement officials have all the tools they need.”

The Washington state bill is similar but aimed at consumer companies. The bill, proposed by state Rep. Shelley Kloba, a Democrat, would require direct-to-consumer genetic testing companies to follow a legal process before giving genetic information to law enforcement without customer consent. 

Could the feds go first?

Proposals to define when police can use DNA searches align, at least in part, with the federal legislation a trio of big player DNA companies — Ancestry, 23andMe and Helix — support. 

The companies formed a group called the Coalition for Genetic Data Protection to push to require police to follow a “valid legal process,” such as a court order or warrant, to search consumer databases, according to coalition Executive Director Steve Haro, who is also a principal at Mehlman Castagnetti Rosen & Thomas, the Washington, D.C., lobbying firm that runs the coalition.

According to their privacy policies, the three companies block law enforcement searches unless legally required.

But in practice, not even the legal threshold has been enough: “These companies will exhaust all legal measures to ensure their customer privacy is protected,” Haro said.

For example, last year Ancestry received a warrant seeking access to its database but challenged the warrant on jurisdictional grounds and didn’t provide information, according to its transparency report.

“With something as important as consumer privacy,” Haro said, “it deserves to be dealt with at the federal level with one comprehensive piece of legislation.”

The coalition registered to lobby members of Congress about a year ago, according to disclosure records.

The U.S. Department of Justice released an interim policy in September for law enforcement using forensic genetic genealogy: Use it as a last resort and with caution, the guidelines say.

The eight-page policy sets case eligibility (a violent crime with no matches in the federal DNA database CODIS or unidentified human remains). It also requires the work to be done in a special lab. Final guidelines are expected this year. 

But including a line — in any policy — for use “as a last resort” still leaves a lot of room for interpretation, said David Kaye, an emeritus law professor at Penn State University who writes about the admissibility of scientific evidence in court. 

“It’s politically appealing to say, ‘I’m only going to use it as a last resort,’” he said in an interview. “The thing is you, you’re still left with saying what cases fall into that.”

The Justice Department policy is “at least better than nothing,” said Christopher Slobogin, director of Vanderbilt Law School’s criminal justice program. He has studied the Fourth Amendment and privacy issues for 30 years.

Aside from a few cases related to privacy, there haven’t been many court decisions directly applicable to genetic genealogy, Slobogin said. They could come, as DNA databases grow and so do genetic genealogy-related arrests. He thinks the best guidance will come from parameters set by the courts and filled in with state legislation.

“It’s possible that ultimately the same rule ought to apply across the country,” Slobogin said. “At the same time, barging in with a federal law might be a little premature.

“That’s the reason we have 50 states,” he said. “We can experiment a bit.”

This article was first posted to Stateline, an initiative of The Pew Charitable Trusts.