Law Enforcement’s Use of DNA Ancestry Websites and Why Your Consent May Not Matter

Sarah Eskreis

A staggering amount of people trace their ancestry through online genealogy service providers to learn more about themselves and their heritage. See, e.g., Ancestry Company Facts, Ancestry.com (last visited Jan. 19, 2019) (Ancestry.com alone boasts testing 10+ million people since May 2012, making their database the largest in the world). There appears to be an innate desire for people to understand their culture and embrace their heritage as an important part of forming their identity. Just as there are individuals who want to know where they come from, there will also always be individuals who want their genealogy kept private. Some privacy advocates believe that sites such as Ancestry.com, 23andMe, and many others can contribute to invasions of privacy. See Avi Selk, The Ingenious and ‘Dystopian’ DNA Technique Police Used to Hunt the ‘Golden State Killer’ Suspect, Wash. Post.com (Apr. 28, 2018). In the past few years, law enforcement officials have been using online genealogy service providers in criminal investigations to match potential suspect’s DNA through family members who have submitted their own DNA to these websites. Id. Ancestry.com and 23andMe have taken action; however, smaller familial DNA websites, such as GEDmatch, are openly releasing the genetic information within their database to law enforcement. Id. This article will discuss how law enforcement has been using this information, what Ancestry.com and 23andMe have done to protect user information, and some potential conflicts that may arise from smaller DNA websites handing over genetic material to the police.

Police arrested Joseph James DeAngelo, the suspected Golden State Killer responsible for “at least a dozen murders and 50 rapes in the 1970s and 80s,” after using familial DNA searching. See Fiza Pirani, Can Police Legally Obtain your DNA from 23andMe, Ancestry?, AJC.com (last updated May 11, 2018). Familial DNA searching (FDS) is defined as a “deliberate search of a DNA database conducted for the intended purpose of potentially identifying close biological relatives to the unknown forensic profile obtained from crime scene evidence.” Samuel D. Jr. Hodge, Current Controversies in the Use of DNA in Forensic Investigations, 48 U. Balt. L. Rev. 39, 49 (2018) (citing Allison Murray et al., Familial DNA Testing Current Practices and Recommendations for Implementation, 9 Invest. Sci. J. 1, 2 (2017)). The genealogy website GEDmatch confirmed that law enforcement used their website’s database to zero in on DeAngelo. See Megan Molteni, The Key to Cracking Cold Cases Might be Genealogy Sites, Wired.com (June 1, 2018, 7:00 AM). Since news of DeAngelo’s arrest broke, “the open-source database [GEDmatch]—which houses nearly a million voluntarily contributed genetic profiles—changed its terms of service to explicitly allow law enforcement to use it, either to identify the remains of a deceased individual or identify a perpetrator of a violent crime.” Id. Furthermore, “the site has experienced a serious uptick in uploads, with emails flooding in about how people want to donate their DNA to help catch dangerous criminals.” Id.

However, not every genealogy website has taken GEDmatch’s approach. Both Ancestry.com and 23andMe have openly stated that they will only provide law enforcement with users’ genetic information when they receive a court order. See Pirani, supra. Both companies have stated that they have refused several requests from law enforcement in the past. Id. Neither company has indicated that they will open up their databases for investigative use in the near future. Ultimately, both companies have been adamant about protecting user data. Id.

FDS still has “little legislative regulation” with “no standards on a national level to provide guidance on how states should proceed in developing policies for these searches.” See  Hodge, supra, at 52. Many argue that GEDmatch is opening the door for preventing false convictions and for catching criminals who have committed heinous crimes. In the majority of cases, this is true. Id. at 42 (stating that “genetic identification is considered more accurate than fingerprint recognition.”). However, without legislative guidance, those who submit their DNA to these websites are putting innocent family members at risk for exposure. Id. at 52. For example, Micheal Usry committed no crime. See id. at 51. He was suspected of killing a woman solely based on the fact that he produced violent films. Id. His father’s DNA was taken from the Ancestry.com database, which incorrectly indicated that a family member committed the crime. Id. Despite this information, Michael Usry’s DNA did not match the DNA found at the scene of the crime. Id. His harrowing experience “focused attention on the delicate balance between an individual’s right to privacy and public safety.” Id.

Competing views raise legitimate issues of importance. As legislative bodies begin to sift through competing interests, it is difficult to predict an outcome. One state may consider an individual’s right to privacy in their DNA worthy of the utmost protection. Another state may consider law enforcement’s duty to pursue crime to the fullest extent of the law a prevailing interest. Only time will tell.