Genealogy companies could struggle to keep clients’ data from police

After police used DNA sleuthing techniques to arrest a teenage suspect in Utah accused of assault, a public genealogy website shut off most police access in May, following public outcry. That move by GEDMatch to protect the privacy of its users could backfire, some experts warn, creating more privacy issues, not fewer. 

Forensic genetic genealogy — the use of genetic databases by police to find potential suspects through family members’ DNA — first caught attention as a crime-fighting tool in April 2018. That’s when police used it to identify Joseph James DeAngelo as the suspected Golden State Killer, an elusive serial killer who terrorized California with multiple murders, rapes and assaults in the 1970s and ’80s (SN Online: 4/29/18).

That case opened the door for other investigators, and in the year since, the technique has been used to charge at least 50 people, including three women, with murder or rape in cases involving more than 90 victims. Jury selection is set to begin June 11 in the trial of William Earl Talbott II. He was one of the first people arrested after a genetic genealogy search, and is accused of killing a young Canadian couple in 1987 (SN: 6/23/18, p. 11). At least three other people tracked down through genetic genealogy searches have already been convicted of their crimes and sentenced to between 80 years and life in prison.

Most of those cases were solved when police matched a portion of crime scene DNA to that of a suspects’ distant relatives in GEDMatch, a free genealogy website where people can upload DNA data. Genetic genealogists then used birth, death and other records to build family trees that gave investigators leads to follow. Finally, the surreptitious collection of suspects’ DNA from discarded cigarettes, napkins, cups and other items led investigators to make the arrests.

For about a year, GEDMatch has allowed police to search its database of genetic information in rape and murder cases. The case of the Utah teenager was neither. The 17-year-old boy is charged with aggravated assault and burglary for allegedly breaking into a church and choking an elderly organist to unconsciousness in November. Police sought permission to search the DNA database for matches to blood left on a broken window and doorknob at the crime scene.

“It was an extremely violent crime,” GEDMatch cofounder Curtis Rogers says. “A woman was left for dead. I was convinced that … other people were probably in danger.” Rogers decided to allow the search, which led to the teen’s arrest.

The GEDMatch decision to give police access to its data in the assault case — made without informing the database’s users — sparked concern among some users and privacy experts that the website was on a slippery slope toward rampant law enforcement searches, potentially even in minor, nonviolent crimes. After that outcry, on May 18, the database made police access harder by setting all user accounts to a default excluding law enforcement searches. If users want to allow police searches, they can opt for that in their account settings.

“We were not trying to handicap law enforcement,” Rogers says. “What we were trying to do, in the long run, was to make the whole field of genetic genealogy stronger” by assuaging privacy concerns.

In fact, at the same time that Rogers and his partners included the opt-in option, they also adopted a broader definition of violent crimes in the site’s terms of service, to include nonnegligent manslaughter, robbery and aggravated assault. That allows police to use the technique in a wider variety of cases.

When data access gets shut down

For some, the change in GEDMatch’s access terms was abrupt and frustrating. Genetic genealogist CeCe Moore, for example, had just helped to close a 23-year-old murder case by searching GEDMatch using badly degraded DNA.

Police announced the new suspect’s arrest on May 16, raising hopes that genealogy databases could help solve even older cold cases. Only 61 percent of the DNA that Moore had analyzed, extracted from a decades-old semen specimen, was even readable. Yet she and a fellow genealogist were able to point police to a suspect whose DNA matched that at the crime scene. But before Moore could download all of the data she would need to describe her process in a scientific paper, her GEDMatch access was denied.

The cutoff was “one of the biggest shocks of my life,” says Moore at Parabon NanoLabs, based in Reston, Va. Parabon has been involved in most of the genetic genealogy cases over the last year. Though now essentially blocked from conducting new database searches, the company still has more than 100 cases that were already in the works.

In the two weeks following the switch, about 40,000 of GEDMatch’s more than 1.2 million profiles were set to allow law enforcement searches, Rogers says. That’s not nearly enough people to make searches worthwhile, Moore says. Some data will never be recovered. Deceased people, for instance, won’t be able to opt in for police access. “We’ll never see that data again,” she says. “It’s like burning libraries” to remove those DNA profiles.

For genetic genealogy to work in tracking down suspects, searches should ideally find matches to second or third cousins or closer relatives. The closer the relationship to the suspect, the easier it is to build a family tree (barring unforeseen circumstances such as false paternity, adoption or other difficulties). The more people in a database, the likelier it is to find a close match.

More distant relatives, such as fifth cousins and beyond, may lead to false matches, says Deborah Kennett, a genealogist at University College London, who laid out some of the problems with genetic genealogy and possible solutions in a study in the August 2019 Forensic Science International. With fewer people in a database, distant matches would be more common and could send investigators on fruitless wild goose chases or expose innocent people to unnecessary police attention.

Now what?

Police aren’t likely to give up the investigative tool, though.

“We have fully demonstrated the power of genetic genealogy over the course of the last year,” Moore says. “It’s not going to go away now.”

Blocking access to GEDMatch could simply drive police to the other main public genealogy website, FamilyTreeDNA. The company has said it will allow police access to its database of more than 2 million DNA profiles. But Parabon, the main forensics company that police have worked with to do these searches, can’t access that data, because of technical incompatibility between testing methods, a FamilyTreeDNA spokesperson says.

Another forensic genetic genealogy company, Bode Technology, of Lorton, Va., hasn’t had the same difficulty searching FamilyTreeDNA’s data, a Bode spokesperson says. So law enforcement agencies could switch to Bode, or another company for help in investigations, but many have established ties with Parabon already.

What experts really worry about is that police may seek warrants to access all of GEDMatch’s data. And if police do begin writing such search warrants, “I don’t see why they would stop at GEDMatch,” Moore says.

For instance, the company AncestryDNA has more than 15 million people’s DNA in its database, and 23andMe has more than 10 million customers. Last year, researchers calculated that a database of about 3 million people would allow for the identification of virtually any American of European descent ( SN Online: 10/12/18 ). With access to those two companies’ databases, Moore says, “we’d be solving cases every day.”

Such genetic records of those and other DNA testing companies include information far beyond what’s contained in DNA fingerprinting, used since 1987 by police in matching a suspect’s DNA to that from a crime scene. That process, which involves creating a profile of 20 different segments of repetitive DNA known as STRs (for short tandem repeats), reveals no information about the individual beyond the genetic fingerprint.

Genetic genealogy, however, is drawn from hundreds of thousands of genetic variants called SNPs (for single nucleotide polymorphisms). The technique can give away details about a person’s appearance, medical conditions and possibly even predisposition to mental health problems.

The distinction between the two approaches may not be fully understood by court officials and lawmakers, says Erin Murphy, a law professor at New York University Law School. Yet “no one is requiring law enforcement to get permission to do new, and potentially incredibly invasive forms of genetic testing,” she says. “There’s a lot to worry about with this unfettered testing.”

Police have worked with forensic DNA experts at Parabon to use SNPs to draw sketches predicting suspects’ hair and eye color and sometimes facial features (SN: 12/12/15, p. 24). “Nobody gave them explicit permission to do facial images,” Murphy says. “So what’s the huge leap from SNPs for facial recognition to SNPs for behavioral traits that are pertinent to an investigation?”

So far, no one has done that, but once police have taken that step, it sets a legal precedent for doing it again, she says.

Public response

While some people were upset about genetic genealogy databases allowing police to poke around, evidence suggests that the public actually supports DNA searches in violent crime cases.

It has been five months since FamilyTreeDNA announced to customers that law enforcement could search the company’s database to identify suspects in cases of murder, rape or kidnapping, or to identify remains of deceased people. Yet only 1.6 percent of users have chosen not to allow police searches of their DNA, a company spokesperson says. Allowing access is the company’s default.  

A public survey conducted in May 2018 suggested strong public approval for police searches when solving violent crimes. Of the more than 1,500 people questioned in the survey, 91 percent said such searches should be allowed for violent crimes; 89 percent said they would allow it for investigations into crimes against children; and 91 percent were in favor of searches to identify missing persons. But for nonviolent crimes, such as car theft or drug possession, only 46 percent said DNA database searches should be allowed, researchers reported in October in PLOS Biology.

That survey was conducted before more controversial cases in which women were charged with murder for allegedly abandoning newborns decades earlier. Three such arrests have already been made, one in South Dakota in March, in South Carolina in April and, most recently, in Ohio on June 6.

The survey also didn’t present possible risks, such as having a suspect’s DNA relatives named in police reports. Those people could be considered “genetic informants” and be subject to retaliation from a suspect’s friends or gang members, Kennett says.

And most people don’t realize that DNA searches aren’t the most intrusive part of these investigations, Kennett says. Genealogists dig through family records, and police follow potential suspects and rummage through garbage to grab DNA samples.

There’s a way to solve that: Some people have suggested creating a universal DNA fingerprint database for law enforcement to use.

“If everyone’s in the database,” Kennett says, “the police don’t have to take DNA from innocent people, put people under surveillance, go trawling through people’s social media accounts and family trees to uncover all sorts of uncomfortable family secrets — who’s divorced, who’s had illegitimate children — and all those intimate details of life.”