Police collect DNA data from people they believe have given up (2023)

CeCe Moore, oneThe actress-director turned genetic genealogist spoke at Ramapo College in New Jersey in late July. Propelled to the National Stage by the Popular PBS Show “find your rootsMoore gave the keynote address at the inaugural Ramapo Conference of Forensic Genealogists, one of only two U.S. higher education institutions offering instruction in this field. It was a new era, Moore told the audience, a turning point for solving crimes, and they were on the ground floor."We made this tool that can do a lot," he said.

Genealogists like Moore search for relatives and build family trees just like traditional genealogists do, but with a twist: They work with law enforcement agencies and use commercial DNA databases to find people who can help them identify unknown human remains or wanted criminals. DNA at the crime scene.

The field exploded in 2018 after thatto arrestJoseph James DeAngelo as the infamous Golden State Killer, responsible for over a dozen murders across California. DNA evidence collected from a 1980 double homicide was analyzed and uploaded to a commercial database; a hit on a distant relative helped a genetic genealogist build an extensive family tree that eventually merged into DeAngelo. Since then,hundredsCold cases were solved with this technique. Moore, one of the top evangelists in the region, claims to have personally helped close more than 200 cases.

The practice is not without controversy. It involves assessing the genetic information of hundreds of thousands of innocent people in search of the perpetrator. And its practitioners work without significant obstacles, apart from "temporary" guidelines.Publishedby the Ministry of Justice in 2019.

The past five years have been like the "Wild West," Moore admitted, but she was proud to be a founding member.Council for Accreditation of Genetic Genealogy Research, which develops professional standards for professionals. “This incredibly powerful tool comes with a huge responsibility,” he solemnly told the audience. The practice relies on public trust to convince people not only to upload their personal genetic information to commercial databases, but also to allow the police to review that information. If you're doing something you wouldn't want on the front page of the New York Times, Moore said, you should probably reconsider what you're doing. "If we lose public trust, we lose this tool."

Despite these words of caution, Moore is one of the few high-profile genetic genealogists to have exploited a loophole in a commercial database called GEDmatch that allows them to look up the DNA of people who have expressly chosen not to share their genetic information with police.

The loophole, which a source revealed to The Intercept, allows genealogists working with law enforcement to manipulate search fields within the DNA matching tool to trick the system into displaying exempt profiles. In communications reports reviewed by The Intercept, Moore and two other forensic genetic genealogists discussed the loophole and how to activate it. In a separate communication, one of the genealogists described concealing the fact that her organization performed identification using the exclusion profile.

The posts are a disturbing example of how genetic genealogists and their law enforcement partners, in their quest to complete criminal cases, are circumventing privacy rules set by DNA database companies to protect their clients. It's not yet known how common these practices are, in part because police and prosecutors have fought to keep details of genetic testing from being released to suspects. As commercial DNA databases grow and the use of forensic genetic genealogy as a crime-fighting tool increases, experts say the genetic privacy of millions of Americans is at risk.

Moore did not respond to The Intercept's request for comment.

"If we can't trust these professionals, we certainly can't trust the authorities."

For lawyer and DNA expert Tiffany Roy, the fact that genetic genealogists have been allowed access to private profiles (while preaching ethics) is troubling. "If we can't trust these professionals, we certainly can't trust law enforcement," he said. “These investigations have serious consequences; this includes people who have never been suspected of committing a crime.” At the very least, law enforcement should have a warrant to conduct a genetic pedigree study, he said. “Anything less is a serious invasion of privacy.”

Wild West

Forensic genetic genealogy grew out of the direct-to-consumer DNA testing craze that started a decade ago. Companies like 23andMe and Ancestry offered DNA testing and a database where results could be uploaded and searched across millions of other profiles, giving consumers a powerful new tool to explore their heritage more deeply through genetics.

It didn't take long for corporate genealogists to realize that this information could also be used to solve criminal cases, especially if they went missing. While the arrest of the Golden State Killer drew national attention, it wasn't the first case to be solved through forensic genetic genealogy. Two weeks earlier, genetic genealogists Margaret Press and Colleen Fitzpatrick joined officials in Ohioto publishThanks to that "pioneering work," authorities were able to identify the young woman whose body was found by the side of the road in 1981. Formerly known as the "Deerskin Girl" because of the handmade sweater she wore, Marcia King was named after her genetic heritage. . genealogy. "Everybody Said It Wasn't Possible", Pressproverb.

The type of consumer DNA data used in forensic genetic genealogy is very different from what is uploaded to theCombined DNA Index System, or CODIS, a decades-old network operated by the FBI. The DNA entered into CODIS comes from people convicted or arrested for serious crimes and is often referred to as "junk" DNA: short pieces of unique genetic code that contain no individual characteristics or health information. "It doesn't tell us what someone looks like. It doesn't tell us anything about her parentage or her phenotypic traits,' Roy said. "It's a string of numbers, like a phone number."

In contrast, DNA tests offered by direct purchase companies are "most sensitive," Roy said. “It tells you about your background. It tells you about your relatives and your ancestors, and it tells you about your susceptibility to disease.” And it goes a long way: While CODIS searches the DNA of people already identified by the criminal justice system, commercial databases have the potential to search the DNA of everyone else.

People can upload their test results to any number of databases; There are currently five major trading portals. Ancestry and 23andMe are the biggest players in this space, with databases containing roughly 23-14 million profiles. Individuals must test companies to access their databases; they also do not allow DNA results obtained from another testing service. BothOriginG23jjdeny the police and genetic genealogists who work with them access to your data for crime-fighting purposes. "We do not allow law enforcement to use the Ancestry service to investigate crimes or identify human remains" without a valid court order, according to Ancestry's privacy policy. Two companies cater regularlytransparencythe reportdocumentationLaw Enforcement Requests for User Information.

MyHeritage, which hosts about 7 million DNA profiles, also prohibits police investigations but allows people to upload DNA results obtained from other sources.

And then there isDNA family treeGGEDmatch, which allows police access but gives users the option to turn it on or off. With both, anyone can upload and have their DNA resultsupwardsmore than 1.8 million profiles. But neither company routinely publishes the number of customers who opt out, said Leah Larkin, a veteran California genetic genealogist and privacy advocate. On his website, Larkin writes about topics in this area, including forensic genetic genealogy, which he does not deal with.DNA-nerd. Larkin estimates that there are approximately 700,000 GEDmatch profiles. He suspects there are even more included in FamilyTreeDNA; Opting in is the default option for the company's US customers and "it's not clear how to opt out".

But even disabling police investigations doesn't guarantee a profile won't open: A loophole in GEDmatch gives users who work with law enforcement agencies a backdoor to access protected profiles. A source showed The Intercept how they could exploit the legal loophole; It wasn't an obvious weakness or a weakness that could be caused by accident. Instead, it was a backdoor that required experience with various platform tools to open.

GEDmatch's parent company, Verogen, did not respond to a request for comment.

Secret with votes

In forensic genetic genealogy circles, the loophole in the GEDmatch has long been an open secret, sources told The Intercept, finally coming to light at a Ramapo College conference in late July.

Roy, a DNA expert, gave a presentation entitled "On the Stand," a guide for genealogists on what to expect when called to testify in a criminal case. There was a clear and simple theme: "Don't lie," Roy said. "As long as you get caught in a lie, it will be difficult for people to use your work."

As part of the session will be David Gurney, Ramapo Professor of Law and Society and DirectorUniversityto ariseCenter for Genetic Genealogical Research, joined Roy in a sham interrogation of Cairen Binder, the genealogist who runs the centercertificate program.

Gurney simulated direct questions and led Binder through a series of friendly questions. Did you have access to DNA evidence or genetic code during your investigations? No, she replied. Could he see everyone who had uploaded the DNA into the databases? No, he said, only those who chose police investigation.

Roy, playing the role of the opposing attorney, was direct in his cross-examination: Was Binder aware of the loophole in the GEDmatch? And she used it? Yes, Binder said. "How often?" Roy asked.

"Fist," Binder replied. "Maybe a dozen."

Binder's replies quickly reached a private Facebook group for genetic genealogy enthusiasts, prompting a response from the DNA Doe Project, a volunteer organization run by Press, one of the women who identified the Deerskin Girl. Before joining Ramapo College, Binder worked for the DNA Doe Project.

In a statement on the Facebook group, Pam Lauritzen, the project's director of communications, said the loophole was a result of changes GEDmatch made in 2019, when unsubscribing was made the default option for all profiles. "While we knew the intent of the change was to make banned users inaccessible, some DNA Doe Project volunteers continued to use reports that allowed access to banned profiles," he wrote. That practice was not “encouraged or discouraged,” he continued. Still, he argued that the access was somehow "compliant" with GEDmatch's terms of service, which at the time promised that DNA uploaded for law enforcement purposes would only be matched against users who opted in, and that the loophole the law had been closed 'for years'. . back."

It was an interesting statement, especially considering that Press, co-founder of the group, was among the genealogists who discussed the GEDmatch loophole in documents reviewed by The Intercept. In 2020, he described the DNA Doe project using an opt-out profile for identification and coming up with ways to keep it a secret.

The press referred questions from The Intercept to the DNA Doe Project, which declined to comment.

In July 2020, GEDmatch was hacked, briefly including all 1.45 million profiles in the database in police matches; at the time BuzzFeed Newsreporteddecided to participate only 280,000 profiles. GEDmatch was shut down "until we are absolutely sure user data is safe from potential attacks," says VerogenwroteOn Facebook.

After the hack, Verogen asked a genetic genealogist named Joan Hanlon to beta test a new version of the site. According to transcripts of the conversation reviewed by The Intercept, Press and Moore, a featured speaker at Ramapo's conference, discussed with Hanlon his tricks for accessing disabled profiles and whether the new website blocked all backdoor access. It wasn't like that. It's not clear if anyone told Verogeno; As of this month, the back door was still open.

Hanlon did not respond to The Intercept's request for comment.

In January 2021, GEDmatch changed its terms of service to allow anyone to participate in searches involving unidentified human remains, making the backdoor irrelevant to genealogists who only work on DIY cases, but not to those who work with authorities to identify perpetrators of violent crimes.

Neokrivene method

Exploiting the loophole in the GEDmatch isn't the only example of genetic genealogists and their law enforcement operatives being quick and loose to follow the rules.

Law enforcement officials have used genetic genealogy to solve crimes that don't qualify for genetic testing under the company's terms of service and Justice Department guidelines, which say the practice should only be reserved for violent crimes such as rape and murder if already the other is 'reasonable'. used. research failed. In May, CNNreportedabout a US Marshal who used genetic genealogy to solve a decades-old Nebraska prison break. There is no jailbreak exception to the eligibility rule, Larkin said in aalreadyon your website. "In this case, forensic genetic genealogy should not have been used in the first place."

"In this case, forensic genetic genealogy should not have been used in the first place."

A month later, Larkin wrote about another rape, this time in a California case. The FBI and the Riverside County Regional Homicide Unit identified a 1996 murder victim using the MyHeritage database, in explicit violation of the company's terms of service, whichclarifythat use of the database for law enforcement purposes is "strictly prohibited" without a court order.

"This case is an example of 'noble partisanship'," Larkin saidwrote, “in which researchers seem to think their target is so valuable that they could break existing rules to protect others.”

MyHeritage has not responded to a request for comment. The Riverside County Sheriff's Office referred questions to the Riverside County District Attorney's Office, which declined to comment on the ongoing investigation. The FBI also declined to comment.

Violations even came from DNA testing companies. In 2019, Curtis Rogers, co-founder of GEDmatch, unilaterally made an exception to the terms of service, without notifying the site's users, to allow police to search for a suspect in a Utah attack. It was a tough decision, Rogers.He saidBuzzFeed News, but the case in question "was as close to murder as it gets."

The breaches appear to have extended to Ancestry, which prohibits the use of your DNA data for law enforcement purposes unless the company is required by law to provide access. Genetic genealogists told The Intercept they are aware of instances where genealogists working with law enforcement have given AncestryDNA test kits to potential relatives of suspects (known as "specific tests") or asked clients to access pre-existing accounts as a way to unlock -restricts files.

An Ancestry spokesperson did not respond to questions from The Intercept about attempts to disclose DNA data to law enforcement through a third party. Instead, in a statement, the company reiterated its commitment to protecting the privacy of its users. "Protecting the privacy of our customers and properly managing their data is Ancestry's top priority," the statement said. The company has not responded to additional questions.

The genetic genealogy work in the Golden State Killer case also proved questionable: The rift that led to DeAngelo came after genealogist Barbara Rae-Venter uploaded DNA from the double murder to MyHeritage, according toLos Angeles Times. Rae-Venter told the Times that she had not informed the company of what she was doing, but that her actions had been approved by Steve Kramer, then the attorney for the FBI's Los Angeles branch. "In his opinion, the police have a right to go where the public goes," Rae-Venter told the newspaper.

How widespread these practices are may never be fully known, in part because police and prosecutors try to shield routine genetic testing from court oversight. They claim that what they get from the forensic genetic genealogy is just a clue, such as information provided by an informant, and is exempt from disclosure to defendants.

This is exactly what is happening in Idaho, where Bryan Kohberger is awaiting trial in 2022.killof four students.For monthsthe state did not disclose that it used forensic genetic genealogy to identify Kohberger as a suspect. possible causestatementIn methodically presenting the evidence the police brought to his door, he conspicuously omitted any mention of genetic genealogy. Kohberger's defense team asked to see the genealogy-related documents as it prepared for the October trial, but the state declined, saying the defense was not entitled to any information about the genetic genealogy it used to solve the case.

Prosecutors said it was the FBI that conducted the genetic genealogy and that few documents were produced in the process, leaving little to hand over. But also the stateargumentthat he couldn't hand over the information because the family tree the FBI had created was extensive — including "names and personal information ... of hundreds of innocent relatives" — and it was necessary to protect the privacy of those people. Depending on the state, you may not even need to declare which genetic database (or databases) you used.

Kohberger's lawyers argue that the state's position is preposterous and prevents them from ensuring that the work to find Kohberger was correct. “The state seems to recognize that companies give personal information to the government and that those companies and the government would suffer if the public found out,” said one of Kohberger's lawyers.wrote. "The government's statement implies that the databases searched may be specifically limited to police forces, which explains why they are reluctant to disclose their methods."

The hearing on this matter is scheduled for August 18.

"The Search for All of Us"

Natalie Ram, a law professor at the Carey School of Law at the University of Maryland and an expert on genetic privacy, believes that forensic genetic genealogy is one giant fishing expedition that falls short of the Fourth Amendment's requirement of specificity: that police investigations should be targeted and based. on individualized suspicion. Finding a match to the crime scene DNA by sifting through millions of genetic profiles is the opposite of the goal. Forensic genetic genealogy, according to Ram, is "basically a quest for all of us, every time we do it."

While proponents of forensic genetic genealogy say the people they seek voluntarily upload their genetic information and choose to allow authorities access to it, Ram and others aren't so sure that's the case, even though the professionals hold abide by the terms of service. If the consent is truly informed and voluntary, "then I think it would be ethical, legal and permissible for law enforcement to use that DNA…to identify people who volunteered," Ram said. But that's not who is being identified in these cases. They are rather relatives, and sometimes very far away. “Our genetic associations are unintentional. They are deeply restrained. They are involuntary like almost nothing else. And they are also immutable,” he said. “I can withdraw from my family and my siblings and deny them information about what I in my life doe. And yet his DNA is informative about me."

Jennifer Lynch, general counsel to the Electronic Frontier Foundation, agrees. "We are compromising the privacy of others when we try to upload our own genetic data," he said. “You cannot give permission to someone else. And you just can't claim you've agreed to have your genetic data stored in a database if your brother uploaded the data, or if it's someone you don't even know is related to you."

So far, efforts to restrict this practice as a violation of the Fourth Amendment have run into some problems. For example, a person whose arrest was based on genealogical grounds may have been harmed by a genealogical fishing expedition, but has no right to sue; in the strictest sense, his DNA was not sought. Conversely, a third family member whose DNA was used to identify a suspect may sue but find it difficult to prove that he or she was harmed by the search.

If police target suspects violating a company's terms of service — using databases that prevent police investigations — it "raises some serious Fourth Amendment questions" because no expectation of privacy has been abandoned, according to RAM . Obviously, discovering such violations would require disclosure of the information in court, which is not happening.

Currently, the only real regulators of this practice are the database owners: private companies that can change ownership or terms of service without notice. GEDmatch, which at least once relaxed its demands to accommodate police, was founded by two genealogy hobbyists and later sold to the biotech company Verogen, which was acquired last winter by another biotech company, Qiagen. Experts like Ram and Lynch worry about the implications of so much sensitive information being held by for-profit companies that police can easily misuse. “Platforms are the most powerful regulators we have for most Americans right now,” said Ram. The police “regulate in a way, depending on what they are doing. They tell us what they are willing to do based on what they actually do," he added. "But by the way, it's like the police make their own rules, so it's not a very diverse group of stakeholders."

For now, Ram said, the best way to regulate forensic genetic genealogy is legislation. In 2021, Maryland legislators passed a lawcomprehensive lawquit the practice. Requires police to obtain a court order before conducting a genetic genealogy test (declaring that the case is a qualifying violent crime and that all other reasonable investigations have failed) and to notify the court before DNA testing collect evidence to confirm that the suspect has been identified through genetic genealogy. is in fact the probable author. Police are currently using covert methods to collect DNA without judicial oversight: sifting through someone's garbage, for example, looking for items believed to contain biological evidence. In the case of the Golden State Killer, DeAngelo was involved with DNA from discarded tissue.

Maryland law also requires police to obtain the consent of any third party whose DNA could help solve the crime. In the Kohberger case, police searched his parents' trash,waste collectionwith DNA that the lab believed belonged to Kohberger's father. In a famous case in Florida,the police liedto the suspect's parents to obtain a DNA sample from the mother, telling him they were trying to identify the person found dead who they believed to be her relative. These methods are prohibited by Maryland law.

MontanaGUtahThey have also passed laws governing forensic genetic genealogy, though none are as strict as Maryland's.

Solve the crime before it happens

The rise of direct-to-consumer DNA testing and forensic genetic genealogies raises another question: the looming reality of a de facto national DNA database that can identify large segments of the U.S. population, whether or not those individuals have your genetic information supplemented. In 2018, researchers were led by the former Chief Scientific Officer of MyHeritagepredictedthat a database of about 3 million people can identify nearly 100 percent of American citizens of European descent. "This database is to be expected for some third-party websites in the near future," they concluded.

“Suddenly we have a national DNA database and we have never had a discussion about whether we want that in our society.”

"All of a sudden we have a national DNA database," says Lynch, "and we've never had any discussion about whether we want that in our society." The national database is in "private hands," he added.

By the time people started to worry about it as a political issue, it was "too late," Moore said during his speech at the Ramapo conference. "At a time when the vast majority of the public was learning about genetic genealogy, we were quietly building this incredibly powerful human identification tool behind the scenes," he said. "People laughed and said, 'Oh, hobbyists… you do your genealogy, you do your adoption,' and we got to build this tool without any intervention."

Moore previously advocated incorporating forensic genetic genealogy into the research process. He argued that this would allow the police to focus more quickly on the guilty and save innocent people from unnecessary government surveillance. He even told the audience that he believes forensic genetic genealogy could help eradicate crime. “We can stop criminals,” he said. "I really believe we can stop serial killers and serial rapists."

"We are an army. We can do it! So repeat me,” Moore said before singing along to the crowd. "No more serial killers!"

Update: August 18, 2023 3:55 PM ET

Following the publication of this article, Margaret Press, founder of the DNA Doe Project, published astatementin response to The Intercept's revelations. Tisak acknowledged that between May 2019 and January 2021, the organization's leaders and volunteers used GEDmatch tools that provided access to DNA profiles excluded from police investigations, which she described as a "software bug." The press stated:

We have always been committed to complying with the Terms of Service of the databases we use, and we take our responsibilities to our related law enforcement agencies and medical researchers very seriously. In retrospect, it is clear that we failed to consider the critical need of the public to have confidence that their DNA data will only be shared and used with their consent and under the restrictions of their choosing. We should have reported these bugs to GEDmatch and stopped using the affected reports until the bugs were fixed. Instead, on that first day, when we discovered that all profiles were set to unsubscribe, I discouraged our team from reporting them. Now I know I was wrong and I regret my words and actions.