DNA genealogical databases are a gold mine for police, but with few rules and little transparency

Orlando police Det. Michael Fields was sure he had the break he needed right in front of him to close in on a serial rapist: a list of people whose DNA partially matched the man he hunted.

Then the list disappeared.

After a year of criticism from privacy advocates and genealogy experts, the owner of a popular DNA-sharing website had decided law enforcement had no right to consumer data unless those consumers agreed.

“It was devastating to know that there’s information out there,” Fields said. “It wasn’t fair.”

So he persuaded a judge to grant him access to the entire database, the genetic records of more than 1 million people who never agreed to police search. It was the first court order in the nation for a blanket consumer DNA search, kept secret from those whose genetic code was involuntarily canvassed.

Genealogical databases are a potential gold mine for police detectives trying to solve difficult cases.

But law enforcement has plunged into this new world with little to no rules or oversight, intense secrecy and by forming unusual alliances with private companies that collect the DNA, often from people interested not in helping close cold cases but learning their ethnic origins and ancestry.

A Times investigation found:

• There is no uniform approach for when detectives turn to genealogical databases to solve cases. In some departments, they are to be used only as a last resort. Others are putting them at the center of their investigative process. Some, like Orlando, have no policies at all.
• When DNA services were used, law enforcement generally declined to provide details to the public, including which companies detectives got the match from. The secrecy made it difficult to understand the extent to which privacy was invaded, how many people came under investigation, and what false leads were generated.
• California prosecutors collaborated with a Texas genealogy company at the outset of what became a $2-million campaign to spotlight the heinous crimes they can solve with consumer DNA. Their goal is to encourage more people to make their DNA available to police matching.

There are growing concerns that the race to use genealogical databases will have serious consequences, from its inherent erosion of privacy to the implications of broadened police power.

In California, an innocent twin was thrown in jail. In Georgia, a mother was deceived into incriminating her son. In Texas, police met search guidelines by classifying a case as sexual assault but after an arrest only filed charges of burglary. And in the county that started the DNA race with the arrest of the Golden State killer suspect, prosecutors have persuaded a judge to treat unsuspecting genetic contributors as “confidential informants” and seal searches so consumers are not scared away from adding their own DNA to the forensic stockpile.

After L.A. County prosecutors filed two counts of murder against a man linked to a pair of decades-old cold cases by connecting the suspect through a genealogy match, Dist. Atty. Jackie Lacey refused to provide details of the genetic work — including the commercial genealogy service used. Similar genealogy searches remain sealed elsewhere in California, Texas and Florida.

“They’re afraid that if the public finds out what we’re doing, we won’t be allowed to do it anymore. So the solution is, ‘Don’t tell the public,’” said Erin Murphy, a former defense attorney who teaches law at New York University and has become an outspoken critic of what she says is open season on consumer DNA.

DNA for decades has been law enforcement’s slam dunk, an invaluable tool to identify human remains and put killers and rapists at the scene of the crime. But until a year ago, searches for unknown suspects were limited to the partial “junk DNA” of felons and criminal suspects held in government-supervised databases.

That changed dramatically in April 2018 when a team of investigators in Sacramento County announced they had matched 38-year-old crime-scene DNA with the killer’s relatives on a public genealogy site. The arrest of former police officer Joseph James DeAngelo, now charged with 13 murders and awaiting trial, unleashed a wave of consumer DNA hunts across the United States.

The Times found consumer DNA used to declare closure of 66 cases. They involved 14 suspected serial killers and rapists and unsolved crimes going back to 1967, but also the remains of a miscarriage pulled from a sewer and the hunt for a man sneaking into bedrooms. Forensic labs claim to have closed more than a dozen other cases.

“It is probably one of the greatest revolutions, at least I would say, in my lifetime as a prosecutor,” said Sacramento County Dist. Atty. Ann Marie Schubert. “But it is a difficult, evolving topic because there are privacy interests at stake and in an area that’s unregulated.”

Government DNA databases for a decade have allowed crude familial searching that can identify a suspect’s parent, child or sibling. But the full chromosomal information held by private services can identify those who share 1% of DNA and are five or more generations removed. Merging that with other consumer data, researchers then can identify relatives two and three generations removed.

Those consumer databases contain genetic code of some 26 million Americans, and so many of European descent that scientists say in a few years they’ll be able to identify every Anglo-Saxon American through family DNA.

“There are a whole bunch of stressed-out white guys right now,” Schubert quipped.

But critics say police searches invade the privacy of those who submitted their DNA strictly out of curiosity about their ancestry, and their relatives who didn’t even consent to that.

Suspects in the Golden State Killer case and most of those that followed were pinpointed by identifying DNA relatives on GEDMatch, a no-frills DNA registry popular with genealogists and adoptees seeking their birth parents. At least twice, GEDMatch allowed police access in cases that ultimately did not meet its policies, and at least once police conducted their hunt without permission using a fake account.

The nation’s two largest genealogy services, Ancestry and 23andMe, say they do not grant law enforcement access to their consumer data. But a third, smaller company, FamilyTreeDNA, openly permits law enforcement use except for those customers who specifically opt out.

Few safeguards protect the genetic profiles of millions of consumers on genealogy sites.

Familial DNA searches of the past, done on those within the FBI’s national criminal database, were restricted, and California’s Department of Justice required case-by-case oversight by an independent committee. The private lab in Virginia handling the bulk of public gene-matching cases argues consumers don’t require the same level of protection because they voluntarily mailed in their DNA.

What oversight exists is inconsistent. A U.S. Justice Department policy that went into effect this month limits consumer DNA searches to violent crimes — and strictly as a tool of last resort.

Prosecutors in a handful of California counties, including Los Angeles, Sacramento, Orange and Ventura, this spring created their own more lenient rules. Sacramento and Ventura permit consumer searches before all other leads have been exhausted, and in the case of Ventura County, the crime involved does not have to be violent.

Sacramento prosecutor Schubert said the rules guard against uses that might backfire and restrict DNA searches even further.

“I don’t want some cop out there doing genealogy on a car [burglar],” Schubert said. “We’re identifying people through other people. ... I recognize there are privacy rights.”

But most police agencies are like Orlando, which has no DNA policy. Det. Fields said he was guided by “common sense” in the two cases he has searched consumer DNA — the July hunt for a serial rapist, and a 2018 arrest of a man for the unsolved murder of a college co-ed.

Fields had spent half a dozen years looking for leads in the 2001 murder of Christine Franke. A Virginia based forensics service, Parabon Nanolabs, used DNA found on Franke’s body to predict the race and facial characteristics of her killer. But Fields could get no further until the day Sacramento announced its arrest of the suspect in the Golden State Killer case.

Parabon called Fields offering to replicate the methods to look for Franke’s killer.

“I said, absolutely,” the detective recalled. “Parabon turned that case around overnight and came up with two family matches, actually three, immediately.”

What Parabon provided were GEDMatch accounts of two second and third cousins of the suspected killer — the same information any other user of the DNA registry would see. The results show the number of genome locations that match, with each match called a centimorgan. A mother and son would share about 3,400 centimorgans; a suspect’s second cousin once removed might have 123 in common.

Field’s team then used traditional genealogy to trace those relatives back to a common ancestor from the 1890s. They then built out a huge family tree of every descendant of that ancestor, and started going down the branches.

But eight branches had no DNA, so investigators asked 15 people to provide it. Fields declined to say how these people were convinced. The defense lawyer for the man Fields subsequently arrested said it was by lying.

“They went to Georgia, said there was an African American female murdered who was more than likely related to them,” said Orlando lawyer Jerry Girley. Relatives were told that by providing their DNA, Girley said, “their loved one could rest in peace.”

Instead, Orlando police days later arrested the son of one of the elderly women tested.

“She is devastated,” Girley said.

“Give them an inch, and they’ll take it to Mars,” he said. “I tell people, ‘Don’t put your DNA in the system.’ (Police) see it as a side door around the 4th Amendment.”

The suspect in that case, Benjamin Lee Holmes, has pleaded not guilty. He is jailed awaiting trial, which is set for next year.

Researchers at Baylor College of Medicine found more than 90% of those polled online favored police access to consumer DNA when it comes to murder cases.

“None of us want violent criminals roaming the street,” said medical ethicist Amy McGuire, one of the Baylor researchers and also an advisor to FamilyTreeDNA.

But the Baylor study found public support for DNA searching dropped to 34% when the crimes were not violent and police wanted the names of account holders.

GEDMatch at first allowed law enforcement searches only for violent crimes. But GEDMatch permitted gene matching for a teen who broke into a Utah church, assaulting a woman in the process. And it helped police in Texas hunt for a man creeping into women’s bedrooms.

The bedroom intruder had slipped into 14 apartments, stealing nothing but sometimes touching a sleeping woman while masturbating. College Station police hired Parabon Nanolabs in Virginia, which used DNA from one break-in to identify a cousin on GEDMatch.

The arrested man is charged with second-degree burglary, a crime that does not meet GEDMatch’s restricted use policy. But Parabon’s chief genealogist, CeCe Moore, said the case was presented to the company as a sexual assault.

“We wanted to catch him before it escalated,” said College Station Officer Tristan Lopez. Like most law enforcement departments, the police agency would not provide details of that DNA hunt.

Moore said Parabon has opened about 300 DNA searches and that the lab has solved almost 100 cases — though arrests have not yet been made in several dozen of those cases.

In reaction to growing privacy concerns, GEDMatch in May closed its database to law enforcement unless users specifically agreed to opt in.

By then Fields had moved on to a second case — an unsolved rape — and had already seen early results on GEDMatch identifying relatives of the suspected rapist. Rather than lose that list with the policy change, he secured a warrant to the entire database. The search remained a secret for four months, until Fields revealed it at a law enforcement conference, encouraging other agencies to conduct DNA matching.

The warrant does not completely undermine efforts to ensure privacy, said GEDMatch co-founder Curtis Rogers.

“The protection offered by having a court review is better than no protection at all,” he said.

Critics did not agree, and said the repeated policy breaches and global search warrant show how easily privacy falls away.

“There’s always a danger that things will be used beyond their initial targets, beyond their initial purpose,” said Vera Eidelman, a DNA expert for the American Civil Liberties Union. She pointed to the way DNA searches at first limited to convicted felons now span the mothers, brothers, uncles, grandparents and cousins twice removed of people who simply want to know if they are German or a Viking.

FamilyTreeDNA lab manager Connie Bormans bristles at any use of the word ‘searching.’ Police see no more than any other user — just the account name and contact information a user provides — unless they get a warrant. She has turned away law enforcement efforts that don’t meet the company’s permitted-use rules.

Bormans said she can’t envision a scenario where the familial search would backfire. “It is only a tool,” Bormans said. “There is no way that they will get a profile and arrest someone solely on the profile.”

But in California early this year, police investigating the 1995 rape of a 9-year-old schoolgirl in Lake Forest and a 1998 rape of a jogger in the same town used FamilyTreeDNA to identify not one, but two suspects. They were identical twins, sharing the same DNA. Both brothers were jailed until undisclosed additional evidence led to freedom for one and rape charges against the other. The Orange County district attorney’s office and Sheriff’s Department did not respond to requests for additional information about the basis for the arrests. The district attorney subsequently adopted a DNA searching policy that precludes arrests based on family matching alone.

Legal scholars said it is only a matter of time before courts weigh in on the privacy of DNA.

Only one of the 66 DNA-derived cases identified by The Times has gone to trial — a Washington man convicted of killing a Canadian couple in the 1980s — and the defense lawyer there agreed not to challenge the GEDMatch work that led police to her client.

In 27 other cases, the accused perpetrators either were already dead, confessed or pleaded guilty. Prosecutors in Virginia and California have asked judges to treat the DNA as a “genetic informant.”

Schubert’s office is blocking disclosure of the DNA trail that led to the arrest of two accused serial rapists from the 1980s and 1990s. Her attorneys told one judge that secrecy must extend beyond the names of relatives whose DNA was examined to the names of the companies providing that information — keeping it secret even from defense lawyers.

Schubert’s staff successfully argued such disclosure might “result in a backlash against that site resultingin a tightening of restrictions on the site or use of the site.”

They added: “If individuals in society stop wanting to enter DNA in consumer genealogical databases for fear their privacy is not being protected, then law enforcement loses a powerful technique to solve crime.”

Concern about losing access to the DNA brought two California prosecutors to Texas.

Public records show Schubert and Orange County assistant prosecutor Jennifer Contini met on a Sunday in June with Bennett Greenspan, the CEO of FamilyTreeDNA. They sought his help in expanding the DNA available to police, including a campaign to convince consumers to share their genetic data.

“We both really feel that we ought to start an ‘I’m in campaign’” Schubert wrote to Greenspan the next day. “Jennifer and I thought perhaps something like ‘I’m in for Freedom and Safety’ ... or ‘I’m in for Safety and Freedom’ might be an idea for a tag line.”

The FamilyTreeDNA executive offered the help of his public relations company to arm Schubert with “compelling content.”

“We need to provoke the question in a way that we will be able to provide the reasonable answer,” Greenspan wrote.

Less than a month later, the Institute for DNA Justice was born.

The nonprofit has announced a $2-million campaign. Registration papers identify Schubert as its CEO and Ventura County Dist. Atty. Greg Totten as chief financial officer. There is no direct link to FamilyTreeDNA, but inquiries by The Times to the law firm handling the papers were forwarded to FamilyTreeDNA’s media relations firm. A spokeswoman for the media firm said its work for FamilyTreeDNA and the nonprofit are separate, though performed by the same people.

The Orlando cop who bypassed GEDMatch’s privacy policy is nonplussed by the concerns over privacy and public buy-in.

“It’s Big Brother, but Big Brother’s been here for decades,” Fields said. “Everyone’s trying to focus in on this because it’s DNA, but it’s no different than anything else that we do in our everyday lives. Police with a piece of paper and the judge can override almost anything.”