Consumer genetic-testing services are wrestling with a new threat to users’ privacy: detectives hauling a dragnet through their DNA.
In April, investigators arrested a suspect in the decades-old case of the “Golden State Killer” after sifting through online genetic data. The arrest has set off one of the most vigorous debates about privacy in the digital age.
A growing number of services say they can use a simple swab of a person’s genetic material to find long-lost family members or detect early warning signs of disease — and millions of users have eagerly shared their samples.
Illustration: Yusha
However, there has been little public discussion of where that data are stored, how they will be used beyond its initial applications and who can access them.
To help track down the alleged Golden State Killer, investigators matched DNA from a crime scene to genetic data belonging to the suspect’s relatives that were posted on an open-source genealogy Web site.
Those methods have raised questions about how the growing and often public repository of people’s most intimate data could be used by authorities.
“We all want a serial killer caught,” said CeCe Moore, a genetic genealogist who often appears on television shows such as Dr Oz and Finding Your Roots. “But what other applications could it be used for that maybe we would not be so in favor of?”
Questions about how personal data should be handled and how they might be abused are being asked more often and more urgently.
Facebook has been trying to reassure users that they have control over how their data are shared.
Last month, a woman in Oregon said an Amazon Echo device recorded a private conversation and shared it with one of her husband’s contacts.
From payment apps to smart thermostats to personal digital assistants, software and devices are collecting more data about people than ever.
For online DNA services, the privacy issues have become entangled with guilt and innocence.
With more and more Americans logging on to genealogy Web sites, the services have become vast repositories of DNA — and a potential trove for law enforcement agencies attempting to resolve languishing investigations.
In some cases, investigators have combed through genetic material without informing the hosting companies.
In the Golden State Killer case, police uploaded crime-scene data to GEDmatch.com to search for family members of the suspected murderer and rapist.
Two hobbyists who run the site, a publicly searchable platform that lets users post raw genetic-data files to try to find distant relatives, said that the authorities never contacted them.
“Criminal court cases thus far have treated DNA data like a fingerprint,” said Jennifer Lynch, a senior attorney with the Electronic Frontier Foundation, adding that judges have not found genetic information to be protected under the fourth amendment to the US constitution, which bars unreasonable search and seizure. “There are no meaningful protections, and we need them.”
In criminal cases, DNA evidence is sometimes misused or misinterpreted.
However, the implications of such DNA dragnets could extend beyond murder cases. Following the California arrest, some members of the genealogy community raised the possibility that, for example, police might use genetic data pulled from the Web to track down women who had illegal abortions, as they did in the case of an abandoned fetus in Georgia this year.
“The police are just going ahead and doing this without any oversight,” said Debbie Kennett, a British genealogist who has authored several books on the subject.
Kennett said that users should have a right to determine how their DNA data are used.
Investigators have said that despite the availability of much more genetic information online, tracking suspects using DNA is still costly and labor-intensive.
In the Golden State probe — even in GEDmatch’s database of a million people — the closest familial matches to the suspect were third cousins, said Paul Holes, a cold-case detective who helped crack the case.
“That is a huge undertaking,” Holes said. “It took us four months of genealogy work to eventually find the two top people that fit our offender’s profile.”
Holes said the amount of quality DNA needed to run the same tests many genealogy sites perform is often hard to come by when dealing with what is left behind at a crime scene.
Such tests are also more extensive and expensive than those tests crime labs perform.
Parabon NanoLabs, a Virginia-based forensic DNA company, told Bloomberg that it charges law enforcement officers about US$5,000 to run such a test.
“It’s not something you’re going to do on a burglary or a petty theft,” said Holes. “It is going to be on your major, major homicide cases, because it is so manpower-intensive. It is tough, tough work.”
The tension between consumers’ expectations of digital privacy and the needs of law enforcement has swelled as more people adopt technology that can suck up ever-more-personal information, often without users being aware that it is happening.
In 2016, Apple refused a request from the FBI to unlock an iPhone recovered from one of the perpetrators of a mass shooting that killed 14 people in San Bernardino, California.
The company said investigators were asking to create a back door that could be exploited by hackers, a move that could tarnish its closely guarded reputation for security.
“The United States government has demanded that Apple take an unprecedented step, which threatens the security of our customers,” chief executive officer Tim Cook said in a statement at the time. “We oppose this order, which has implications far beyond the legal case at hand.”
Some of the largest genetic-testing companies have staked out positions similar to the stand taken by Apple, promising to safeguard consumer information from investigators.
“We treat law enforcement inquiries, such as a valid subpoena or court order, very seriously,” 23andMe privacy chief Kate Black said in an interview. “23andMe policies prohibit our voluntary cooperation with law enforcement in order to protect our customers’ privacy. To date, we have successfully challenged the law enforcement requests we’ve received.”
Police searches are not the only privacy threat to such data.
Large-scale hacking incidents at Home Depot, JPMorgan Chase & Co and Anthem have also shaken consumers.
DNA sites are not immune to such intrusions: Israel-based MyHeritage last week said that 92 million accounts were compromised.
Ultimately, in the Apple case, investigators found their own way into the disputed iPhone, spending US$900,000 on a tool to crack it.
In the case of DNA sites, no extraordinary measures might be necessary, as such services as GEDmatch, MyHeritage and Family Tree DNA allow investigators to view voluntarily posted data, including files from services like 23andMe and Ancestry that do not permit users to upload material from other sources.
The only things now governing how police might use consumer genealogical databases are the terms of service.
CeCe Moore is revered as a pioneer in using DNA to help adoptees locate their birth parents.
In one episode of the television show Finding Your Roots, she found evidence that rapper LL Cool J’s mother was adopted, and she introduced him to his biological grandmother.
She is now turning her talents to catching killers.
To help find a suspect in a long-dormant Washington murder investigation, Moore was able to use DNA evidence she found online to connect with a relative of the killer almost immediately.
Moore said GEDmatch revealed two people that appeared to be second cousins of the killer, whose DNA police believe they discovered at the crime scene.
The cousins, though, were not from the same branch of the family tree, so Moore needed to identify the missing link connecting them.
Moore reconstructed the cousins’ family trees, digging through census records, newspaper archives and social media for a common ancestor.
An obituary she found late one weekend night revealed that the two trees had converged in a marriage. It turned out that the wedded couple had several daughters and one son. The son seemed to be the only person with the right mix of DNA for a match. Moore forwarded the suspect’s name to police.
“When I’m researching, you kind of get to know the family, to get a sense of them,” she said. “I felt very bad knowing [these people] were going to find out their brother likely murdered a young couple.”
Investigators have found genealogy sites to be great tools and are looking at using them in as many as 30 additional cases, said a spokesperson for the Shohomish County Sheriff’s Office in Washington state.
For one family, the moment brought closure after three decades. For another, it was the beginning of a nightmare they had probably never imagined.
“When I found that obituary, it was a very heavy moment,” Moore said. “I think I probably cried.”
Amid the privacy debate, genealogy sites are already giving rise to a new breed of criminal investigators.
A few weeks before the Golden State Killer case made headlines, a nonprofit group called the DNA Doe Project that works with local police departments used GEDmatch to identify a 1981 Ohio murder victim who had previously been known only as the “Buckskin Girl.”
DNA Doe crowdfunds many of its cases. Last month, on the heels of the Golden State Killer arrest, it decided to try crowdsourcing data, too.
In a recent case known as the “Belle in the Well,” an unidentified victim appeared to mainly have DNA matches on GEDmatch in a three-state area surrounding Cabell County, West Virginia.
On Facebook, DNA Doe encouraged people who live in those regions to upload their raw DNA file to GEDmatch. The Utah Cold Case Coalition has put out a similar call for citizens to donate their DNA information to solve murders.
The American Civil Liberties Union has cautioned against sharing such information.
“All of these companies should make clear that the genetic material they collect from users is not available to serve as legal proof and that law enforcement cannot use their services to test prisoners and arrested individuals or to conduct investigations,” the union’s Vera Eidelman wrote in an op-ed in the Washington Post. “Otherwise, the public may have to choose between accessing the benefits of genetic science and maintaining its privacy rights.”
Moore had long thought she might use her knack for tracking down birth parents to hunt for murderers.
However, she was not sure the close-knit genealogy community would approve.
“That all changed when the Golden State Killer case got so much publicity and such positive reaction,” Moore said.
She signed on as the head of genetic genealogy for Parabon NanoLabs.
Parabon had also read the case as a green light and asked GEDmatch for permission to start digging through its data for leads in dozens of cold cases.
It did not take long to get a hit: On May 18, police arrested a suspect in a 1987 Washington double murder after Moore sniffed out new leads on GEDmatch.
Nevertheless, others in the field fear what might be coming.
“There is actually no control over genealogists who are doing this type of search,” Kennett said. “CeCe Moore is really, really good, but once the floodgates are open, there’s a potential for genealogists who are not ethical to cause a lot of harm.”
Because much of what former US president Donald Trump says is unhinged and histrionic, it is tempting to dismiss all of it as bunk. Yet the potential future president has a populist knack for sounding alarums that resonate with the zeitgeist — for example, with growing anxiety about World War III and nuclear Armageddon. “We’re a failing nation,” Trump ranted during his US presidential debate against US Vice President Kamala Harris in one particularly meandering answer (the one that also recycled urban myths about immigrants eating cats). “And what, what’s going on here, you’re going to end up in World War
Earlier this month in Newsweek, President William Lai (賴清德) challenged the People’s Republic of China (PRC) to retake the territories lost to Russia in the 19th century rather than invade Taiwan. He stated: “If it is for the sake of territorial integrity, why doesn’t [the PRC] take back the lands occupied by Russia that were signed over in the treaty of Aigun?” This was a brilliant political move to finally state openly what many Chinese in both China and Taiwan have long been thinking about the lost territories in the Russian far east: The Russian far east should be “theirs.” Granted, Lai issued
On Tuesday, President William Lai (賴清德) met with a delegation from the Hoover Institution, a think tank based at Stanford University in California, to discuss strengthening US-Taiwan relations and enhancing peace and stability in the region. The delegation was led by James Ellis Jr, co-chair of the institution’s Taiwan in the Indo-Pacific Region project and former commander of the US Strategic Command. It also included former Australian minister for foreign affairs Marise Payne, influential US academics and other former policymakers. Think tank diplomacy is an important component of Taiwan’s efforts to maintain high-level dialogue with other nations with which it does
On Sept. 2, Elbridge Colby, former deputy assistant secretary of defense for strategy and force development, wrote an article for the Wall Street Journal called “The US and Taiwan Must Change Course” that defends his position that the US and Taiwan are not doing enough to deter the People’s Republic of China (PRC) from taking Taiwan. Colby is correct, of course: the US and Taiwan need to do a lot more or the PRC will invade Taiwan like Russia did against Ukraine. The US and Taiwan have failed to prepare properly to deter war. The blame must fall on politicians and policymakers