Science

Genealogy companies could struggle to keep clients data from police

After police used DNA sleuthing techniques to arrest a teenage suspect in Utah accused of assault, a public genealogy website shut off most police access in May, following public outcry. That move by GEDMatch to protect the privacy of its users could backfire, some experts warn, creating more privacy issues, not fewer.

Forensic genetic genealogy — the use of genetic databases by police to find potential suspects through family members DNA — first caught attention as a crime-fighting tool in April 2018. Thats when police used it to identify Joseph James DeAngelo as the suspected Golden State Killer, an elusive serial killer who terrorized California with multiple murders, rapes and assaults in the 1970s and 80s (SN Online: 4/29/18).

That case opened the door for other investigators, and in the year since, the technique has been used to charge at least 50 people, including three women, with murder or rape in cases involving more than 90 victims. Jury selection is set to begin June 11 in the trial of William Earl Talbott II. He was one of the first people arrested after a genetic genealogy search, and is accused of killing a young Canadian couple in 1987 (SN: 6/23/18, p. 11). At least three other people tracked down through genetic genealogy searches have already been convicted of their crimes and sentenced to between 80 years and life in prison.

Most of those cases were solved when police matched a portion of crime scene DNA to that of a suspects distant relatives in GEDMatch, a free genealogy website where people can upload DNA data. Genetic genealogists then used birth, death and other records to build family trees that gave investigators leads to follow. Finally, the surreptitious collection of suspects DNA from discarded cigarettes, napkins, cups and other items led investigators to make the arrests.

About this story[hhmc]

Why are we doing this story?

In May, the genetic genealogy database GEDMatch changed its privacy settings so that a persons DNA is by default not available for law enforcement searches. That opens the question of how personal privacy should be balanced against the value of DNA databases for crime solving.

Where did the idea for this story come from?

From a conversation with a genetic genealogist. She said that restricting access to the database may encourage police to seek warrants or subpoenas to search databases held by private companies.

What more do you want to know about the story?

It will be interesting to see how the courts weigh law enforcement needs with Fourth Amendment rights protecting against unreasonable search and seizure.

— Tina Hesman Saey

Whats this box? Learn more about it and our Transparency Project here. Can you help us by answering a few brief questions?

For about a year, GEDMatch has allowed police to search its database of genetic information in rape and murder cases. The case of the Utah teenager was neither. The 17-year-old boy is charged with aggravated assault and burglary for allegedly breaking into a church and choking an elderly organist to unconsciousness in November. Police sought permission to search the DNA database for matches to blood left on a broken window and doorknob at the crime scene.

“It was an extremely violent crime,” GEDMatch cofounder Curtis Rogers says. “A woman was left for dead. I was convinced that … other people were probably in danger.” Rogers decided to allow the search, which led to the teens arrest.

The GEDMatch decision to give police access to its data in the assault case — made without informing the databases users — sparked concern among some users and privacy experts that the website was on a slippery slope toward rampant law enforcement searches, potentially even in minor, nonviolent crimes. After that outcry, on May 18, the database made police access harder by setting all user accounts to a default excluding law enforcement searches. If users want to allow police searches, they can opt for that in their account settings.

“We were not trying to handicap law enforcement,” Rogers says. “What we were trying to do, in the long run, was to make the whole field of genetic genealogy stronger” by assuaging privacy concerns.

In fact, at the same time that Rogers and his partners included the opt-in option, they also adopted a broader definition of violent crimes in the sites terms of service, to include nonnegligent manslaughter, robbery and aggravated assault. That allows police to use the technique in a wider variety of cases.

When data access gets shut down[hhmc]

For some, the change in GEDMatchs access terms was abrupt and frustrating. Genetic genealogist CeCe Moore, for example, had just helped to close a 23-year-old murder case by searching GEDMatch using badly degraded DNA.

 Police announced the new suspects arrest on May 16, raising hopes that genealogy databases could help solve even older cold cases. Only 61 percent of the DNA that Moore had analyzed, extracted from a decades-old semen specimen, was even readable. Yet she and a fellow genealogist were able to point police to a suspect whose DNA matched that at the crime scene. But before Moore could download all of the data she would need to describe her process in a scientific paper, her GEDMatch access was denied.

The cutoff was “one of the biggest shocks of my life,” says Moore at Parabon NanoLabs, based in Reston, Va. Parabon has been involved in most of the genetic genealogy cases over the last year. Though now essentially blocked from conducting new database searches, the company still has more than 100 cases that were already in the works.

In the two weeks following the switch, about 40,000 of GEDMatchs more than 1.2 million profiles were set to allow law enforcement searches, Rogers says. Thats not nearly enough people to make searches worthwhile, Moore says. Some data will never be recovered. Deceased people, for instance, wont be able to opt in for police access. “Well never see that data again,” she says. “Its like burning libraries” to remove those DNA profiles.

For genetic genealogy to work in tracking down suspects, searches should ideally find matches to second or third cousins or closer relatives. The closer the relationship to the suspect, the easier it is to build a family tree (barring unforeseen circumstances such as false paternity, adoption or other difficulties). The more people in a database, the likelier it is to find a close match.

More distant relatives, such as fifth cousins and beyond, may lead to false matches, says Deborah Kennett, a genealogist at University College London, who laid out some of the problems with genetic genealogy and possible solutions in a study in the August 2019 Forensic Science International. With fewer people in a database, distant matches would be more common and could send investigators on fruitless wild goose chases or expose innocent people to unnecessary police attention.

Now what?[hhmc]

Police arent likely to give up the investigative tool, though.

“We have fully demonstrated the power of genetic genealogy over the course of the last year,” Moore says. “Its not going to go away now.”

Blocking access to GEDMatch could simply drive police to the other main public genealogy website, FamilyTreeDNA. The company has said it will allow police access to its database of more than 2 million DNA profiles. But Parabon, the main forensics company that police have worked with to do these searches, cant access that data, because of technical incompatibility between testing methods, a FamilyTreeDNA spokesperson says.

Another forensic genetic genealogy company, Bode Technology, of Lorton, Va., hasnt had the same difficulty searching FamilyTreeDNAs data, a Bode spokesperson says. So law enforcement agencies could switch to Bode, or another company for help in investigations, but many have established ties with Parabon already.

What experts really worry about is that police may seek warrants to access all of GEDMatchs data. And if police do begin writing such search warrants, “I dont see why they would stop at GEDMatch,” Moore says.

For instance, the company AncestryDNA has more than 15 million peoples DNA in its database, and 23andMe has more than 10 million customers. Last year, researchers calculated that a database of about 3 million people would allow for the identification of virtually any American of European descent (SN Online: 10/12/18). With access to those two companies databases, Moore says, “wed be solving cases every day.”

Such genetic records of those and other DNA testing companies include information far beyond whats contained in DNA fingerprinting, used since 1987 by police in matching a suspects DNA to that from a crime scene. That process, which involves cRead More – Source
[contf] [contfnew]

science news
[contfnewc] [contfnewc]

Related Posts