Exploring Investigative Genetic Genealogy: Privacy Concerns with the Key to Cold Cases

by Hannah Antonsen


INTRODUCTION

    Researchers, hobbyists, and historians have been tracing family lines and reciting the pedigree of nobility since the early days of civilization. First, before there were written records, genealogical information was transmitted only orally (Pine, 2021, para. 3). In this early stage, genealogies had to be remembered and recited in order to withstand the test of time. The art of writing gave way to the second stage, which meant that these oral histories were physically recorded. Most recently, as societal systems began to change and new classes of citizens began to emerge, family bloodlines started being traced not only through nobility, but in a way that included everyone ( para. 18). 
    The first direct-to-consumer, or DTC, genetic testing kits launched in the UK in 1996, and later that year a test became available in the United States that detected ovarian and breast cancer (Hogarth & Saukko, 2017, p. 1). In 2021, the American Medical Association estimated that over 100 million people have used a DTC genetic test and uploaded their raw genetic data to public databases (Henry, 2021, para. 1). Websites like Ancestry and 23andMe have made genealogy databases accessible to nearly anyone who is curious enough. It is no question that our genetic data contains sensitive, personal, and valuable information. And it would be hard to find anyone who does not believe that our genetic profile should be entitled to the greatest privacy protections available. But what if our genetic information could end up being used to find serial killers or identify unknown remains?
    Sixty-five years after his remains were found in a cardboard box, “The boy in the box,” was finally identified as four-year-old Joseph Augustus Zarelli (Jiménez, 2022). Using the technique known as Investigative Genetic Genealogy, detectives were able to use a DNA sample from the boy’s remains to track down some of his relatives and even find siblings of Zarelli who are still alive (Jiménez, 2022). This investigatory method employs the use of commercial databases that many people have used to determine their heritage and identify ancestors. For many users of these databases, they can think of nothing more exciting or rewarding than being involved in solving such a mystery. Many others feel unspeakably violated, realizing that the government can use such a private part of our identity without our explicit consent and even without our knowledge. 
    This is the conversation that was sparked largely by the identification and capture of the serial murderer and rapist Joseph DeAngelo, also known as the “Golden State Killer.” DeAngelo’s reign of terror dominated California in the 1970’s and 1980’s, and he ultimately was found to have killed at least a dozen people and committed, at minimum, 45 rapes (Brown, 2019, p.15). Once the details about the investigation emerged and the public learned how he was identified, interest in genetic genealogy exploded for consumers, law enforcement, and genealogists alike. In 2018, DeAngelo was identified using the genetic database hosted by GEDmatch (p.15). DNA left at a crime scene from 1980 was found to match the profile of a distant cousin of the offender that had been added to the site (p.15). Branch by branch, the family tree was constructed to ultimately reveal two brothers who would have been around the age and likely location of the suspect they were looking for. DeAngelo was finally arrested in 2018 at the age of 72 after he had evaded capture for decades (pp.15-16).  
    The layers of issues to investigative genetic genealogy—including the protections afforded in the United States Constitution, the personal nature of our genetic makeup, and the price of justice—are all important factors to consider when deciding where our society lands in this conversation. As these topics and more are discussed in this overview, it will become clear just how important this new investigative tool is, and the unfounded fears of compromised privacy will be debunked. 

AN OVERVIEW OF THE FORENSIC GENETIC GENEALOGY PROCESS

    Forensic genetic genealogy, or investigative genetic genealogy (also referred to as FGG or IGG, respectively), combines DNA testing with traditional genealogical research methods to generate leads in order to solve crimes and identify unknown remains. A broad understanding of the process that is followed will help provide a foundation from which we can ask well-informed questions and make educated decision about our rights when it comes to the privacy of our genetic information. 

DNA COLLECTION

    As is commonplace for many investigations, the IGG process begins at the crime scene. DNA analysis was first used in a criminal case in 1987, and since then it has become a cornerstone of investigative technology (Haddril, 2021, para. 2). If biological evidence is found at a scene, investigators collect it and preserve it for testing. If viable DNA evidence is recovered, the profile is first uploaded to the Combined DNA Index System, commonly known as CODIS. This national information repository is maintained by the FBI, and it allows state and local jurisdictions to compare DNA profiles with that of convicted offenders (“The Combined DNA Index System,” 2001). Each state determines the types of crimes that require an offender’s DNA to be added to CODIS. In Minnesota, individuals charged with committing or attempting to commit a felony offense are ordered to provide a biological sample for DNA analysis which then gets entered into the CODIS database (DNA analysis of certain offenders required,2022). The Investigative Genetic Genealogy process is only necessary if investigators are unable to locate a matching profile within the CODIS database. When that is the case, the IGG process begins the next step, where the unknown profile gets added to non-governmental sites that use DTC genetic tests and house DNA profiles. 

COMMERCIAL DATABASES AND RESEARCH

    Direct-to-consumer genetic testing provides users with information about their ancestry and connects them with relatives by suggesting possible matches based on percentages of shared genetic material. There are many reasons for users to request a genetic test, ranging from general curiosity, to locating a biological parent following an adoption, or even to obtaining information to assist in making healthcare-related decisions. Whatever the reason, millions of people around the world have chosen to submit DNA for genetic testing, and it has resulted in providing law enforcement with a powerful tool that gives them access to millions of otherwise unavailable DNA profiles. 
    After checking CODIS, investigators upload the unknown contributor’s DNA profile to one or more publicly accessible genetic databases, in hope of finding a relative that is close enough in relation to begin building out a family tree. Investigators do not expect that the suspect also happens to be genealogist hobbyist who sent off his DNA to 23andME to, for example, find out how much of his blood is German. While that would make the job infinitely easier, locating a second, third, or even fourth cousin is typically a sufficient starting place to begin researching (Brown, 2019, p. 18). For this leg of the investigations, trained genealogists, rather than law enforcement detectives, are typically employed to perform the tedious research needed to identify relatives and find familial connections. This process can become extremely time-consuming, as most people have approximately 1,0000 fourth cousins (p. 15). In the case of the Golden State Killer, it took four months of intensely dedicated research. Documents like birth and death certificates, marriage licenses, tax records, employment documents, and many other types of publicly accessible information were  all used to identify and link relatives. 
    Ultimately, researchers form a list of possible individuals to whom the unknown sample may belong which then gets narrowed down to a small number of people. Investigators use various factors including where the crime occurred, the believed age of the perpetrator, access to the victim, and any information from eyewitness accounts, which they then  compare with information found in their research to eliminate names one-by-one. Frequently, the potential candidates are limited down to a small group or a few siblings . At this point, investigators then move to the next step of forensic DNA analysis to confirm or eliminate the remaining individuals.

DNA COMPARISON & IDENTIFICATION

    The method that is used to obtain a DNA sample to compare to the unknown has been the subject of its own challenges in the legal system. If law enforcement feels that requesting a particular individual’s DNA presents too much of a risk, they may perform a surreptitious DNA collection—  or “trash pull.” In the case of California v. Greenwood (1988), the petitioner challenged the admissibility of evidence that was obtained in a search of his trash that was left out on the curbside for collection. In the 1988 ruling, the United States Supreme Court held that the Fourth Amendment does not prohibit warrantless search and seizure of garbage left for collection outside the curtilage of the home. Thanks to our federalist system, however, states are able to provide greater protections than those granted by the U.S. Constitution, and a number of states have now interpreted their own constitutions to require a warrant in surreptitious DNA collection scenarios. In the case of State v. Hemple (1990), defendants in two cases challenged the collection of their garbage by claiming to have a reasonable expectation of privacy.  Contrary to the United States Supreme Court, the Supreme Court of New Jersey held that under its state constitution, an individual does indeed have a reasonable expectation of privacy in garbage that is left at the curb and that a warrant is required for search, but not seizure of garbage.
   However, it is ultimately accomplished, law enforcement must obtain DNA samples from the individuals who remain possible suspects after they have completed the genealogical investigative research. Having done so, these profiles are compared directly with the unknown sample to find a match. If the unknown sample is positively identified, the arrest is made and they also perform a formal on-sight test so that there can be no viable challenges to the chain of custody of that DNA evidence.

GENETIC PRIVACY

THE FOURTH AMENDMENT

    Many people are surprised to learn that the United States Constitution does not use the word “privacy” in any of its language. However, most all American’s understand that out right to privacy is inherited through the Fourth Amendment which states: 

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. (U.S. Const. amend. IV)

Probable cause is the standard of proof that law enforcement is required to present in order to obtain a warrant that allows them perform searches and seizures. But do these protections extend to our DNA? Police do not need a warrant to collect DNA abandoned at a crime scene, but some question whether there should be a warrant requirement to upload that DNA to a public database to compare it to the profiles of millions of unknowing, innocent people.

THIRD-PARTY DOCTRINE

    The questions regarding DNA privacy are more complex than they may seem. Central to the issue of DNA privacy revolves around something known as the “Third-party Doctrine.” The third-party doctrine is founded on the principle that we do not maintain a reasonable expectation of privacy in information that is voluntarily shared with third parties. This notion was confirmed by the Supreme Court in the landmark cases of Smith v. Maryland, 442 U.S. 735 (1979), and United States v. Miller, 425 U.S. 435 (1976). The Third-Party Doctrine gives government agencies the ability to access third-party information without applying for warrant, which in turn means that the probable cause threshold is not a necessary burden. Admittedly, there are reasons to doubt whether courts would apply the third-party doctrine to DNA that has been added to commercial databases, as opposed to that which has been collected directly by investigators. The problem is that the wheels of justice turn slowly—much more slowly than our technology is advancing. 
    In a recent 5-4 decision handed down by the United States Supreme Court in Carpenter v. United States, 585, U.S. ___, 183 S. Ct. 2206 (2018), the court held that the government must obtain a search warrant before acquiring CSLI from a wireless carrier, even though that information seems to fall under the umbrella of data addressed by the Third-party Doctrine. CSLI, which refers to Cell Site Location Information, is the information maintained by cell phone service providers that identifies the location of a cell phone based on its position relative to nearby towers. If it is assumed that someone keeps his cell phone on his person at all times, the phone is essentially continually tracking his every movement. The reason for this ruling against precedent is the recognition by the court that other factors should be considered when determining when third party information should be protected. Placing information somewhere it can technically be accessed by another person may not be sufficient to have that information considered “shared,” and therefore unprotected (Brown, 2019, P. 25). In addition to the nature of the information, the court acknowledged that the type and volume of the information, in addition to the way it is shared is relevant to our expectation of privacy. Later in the opinion, the court acknowledged the way that cell phones have become so entangled with our lives and modern society that it seems nearly impossible to move through our lives without them. Whether or not someone may agree that navigating this digital age is impossible without having a cell phone, this does lead us to consider whether our genome, the very essence of our anatomy, may be entitled to extra protections as well. 
    Even in a hypothetical situation in which a third-party doctrine exception created warrant requirements for law enforcement to access and utilize genetic data that is not maintained by the government, other issues may prove this to be an ineffective remedy. When officers apply for a warrant, they must supply proof of probable cause. When it comes to the IGG process, the likelihood that searching a commercial DNA database will result in a viable lead is no more than a bet against probabilities. Based on this fact, the articulable probable cause would always be the same, resulting in warrants always being granted or never being granted. This awkward warrant issue is not the only one for consideration in the genetic privacy conversation. 

THE ADVERSARIAL SYSTEM

    Critics of IGG claim that the IGG process turns innocent family members into informants who land their relatives in jail simply by sharing a small amount of DNA. Is the government violating innocent people’s right to privacy by accessing their genetic information? The short answer is no. And controversially, even if they felt their rights were being violated, this does not affect a prosecuting agency’s ability to use this information in an investigation.
    The American justice system is an adversarial system which means that there are two parties, one party against the other party. A person’s constitutional rights always exist, but they can only be asserted against the government when there is a reason and a remedy, which is when a person who is accused of a crime has their rights violated. Someone who is not the defendant in a criminal trial does not have a reason to assert their rights because they are not being accused. This principle is referred to as “standing.” Standing is a party’s right to make a legal claim or seek judicial enforcement of a duty or a right (Blacks Law Dictionary,, 2019).  This is the reason why users of genealogy databases cannot assert that there has been a violation of Constitutional rights when their DNA is used to identify a murder suspect. In an adversarial system, challenges must come from the parties themselves, not from innocent family members who feel like silent witnesses. 

BEYOND THE CONSTITUTION

INTRUSIVENESS, COSTS, AND REWARDS

    Even when it can be conceded that Fourth Amendment protections do not apply to genetic information used in IGG, there are those who argue by citing other concerns about just how intrusive it may be to passively allow law enforcement unbridled access to genetic databases that were not designed for their use. Some ethicists have questioned whether the privacy costs are too high but overlooked because the potential gain is so great (Brown, 2019, p. 32). One extreme boasts that public safety and criminal justice are maximized by allowing complete genetic surveillance by government agencies. The other extreme touts complete autonomy over our genetic data without the concern that it will be accessed without our knowledge. This fear of losing control of our genetic data is likely founded on misunderstandings and a general ignorance surrounding our rights. 
    Is law enforcement’s use of publicly available databases really an ethical breach? If these databases were created to connect people with their relatives and inform them of their heritage, it is hard to argue that law enforcement shouldn’t be able to use them to perform this exact job in their efforts to protect the public and solve crimes. When civilian users sign up to a website like Ancestry, they do so assuming a certain amount of risk. Indeed, some users may learn troubling information when the results of their DNA test are returned. Revelations about one’s parentage, incestuous relationships, or births resulting from sexual assaults are all kinds of information one must be open to finding when using genetic testing services (Brown, 2019, p. 33). It is worth noting that using DTC genetic testing is completely voluntary, and the sentiment that law enforcement was not explicitly granted access by consent of the user is somewhat irrelevant, as those who have concerns can always choose not to participate in using these services. Uploading information to a publicly accessed website does not give the original owner of the information the ability to arbitrarily determine who can and who cannot use that information for one reason or another. 
    The public safety benefits and the closure given to families when their loved one’s cases are brough to justice must not be forgotten amidst arguments about privacy, the Fourth Amendment, and warrant requirements. When four young college students were murdered in an off-campus house in Moscow, Idaho in November 2022, investigators quickly closed in on Bryan Kohberger as the top suspect. Kohberger was arrested just the next month after having been identified using a combination of traditional investigative techniques (including cell phone data and video surveillance) in addition to IGG to link his DNA to the unknown profile found on a knife sheath at the scene (McShane, 2023 para. 4). It is impossible to say whether the swift identification and arrest saved other lives, but the important thing is that we did not have to find out it could have. Additionally, it should still be noted that as of this publication, Kohberger’s guilt or innocence has not yet been adjudicated. 

THE ISSUE OF “DECPTION”

    When the Golden State Killer was identified in 2018, many were shocked to find out that investigators used a publicly accessible database to locate his ancestors using his DNA. Even GEDmatch, the hosting site itself, was surprised to find out it was their own information system that had been used, and (upon learning so) the confidentiality agreement was updated to include language explaining that the site could be searched by law enforcement (Wickenheiser, 2019, para. 8). However, clandestine efforts by police are not an unknown or recent phenomenon. 
    Many states have case law that upholds the inclusion of evidence that was obtained through trickery. In the case of State v. Athan, 153 P.3d 27 (Wash. 2007), the Washington Supreme Court ruled that the defendant’s rights were not violated when law enforcement posed as attorneys to obtain his DNA by creating a fake law firm and requesting that he return mail an envelope that he licked to seal. The United States Supreme Court even ruled to reverse the suppression of evidence that was obtained by an undercover police officer posing as an inmate in the case of Illinois v. Perkins, 496 U.S. 292 (1990).
    The constitution does not have an amendment that grants us the right to have law enforcement agencies that never lie or use deceptive techniques in the course of performing duties, and to believe such a right should exist would greatly limit the power of law enforcement and protections that they provide to all citizens. In light of precedent, it is unlikely that investigators using an alias to upload DNA or working around a policy to access the profiles of “opted-out” users, will result in the suppression of evidence that is obtained using IGG techniques.

CURRENT PROTECTIONS AND GUIDELINES

PRIVACY POLICIES

    In the absence of Federal legislation to dictate when, how, and where IGG is to be used by law enforcement, most all protections afforded to consumers come from the companies themselves. As of 2019, GEDmatch.com issued a new policy that automatically opts users out of making their profile available to law enforcement, requiring them to affirmatively opt-in if they want their information available to assist investigations. By contrast, competitor FamilyTreeDNA began advertising its service as a way for citizens to help investigators solve crimes. Found in the “Learn More” tab, the site provides information educating its users on how their information can be used to aid in investigations while still maintaining privacy and security. Currently, most companies have a privacy policy almost identical to that found on the popular genetic database 23andMe.com which reads, “We will not release any individual-level personal information to law enforcement unless we are required to do so by court order, subpoena, search warrant or other requests that we determine are legally valid.” This is in addition to extensive user agreements that are required to be acknowledged by users of these services. 

DOJ INTERIM POLICY

    On September 24, 2019, the Department of Justice issued an interim policy titled, Forensic Genetic Genealogical DNA Analysis And Searching, that provides guidelines regarding the use of IGG as an investigative technique. A final policy was projected to be issued in 2020, but the COVID pandemic likely dislodged an official policy from governmental priorities. The interim policy outlines specific criteria that a case must meet in order for law enforcement to implement the use of IGG. The goal of the policy is to ensure that IGG is used responsibly in efforts to balance public safety with privacy. Some criteria that the policy addresses includes that the cases must involve violent, unsolved crimes and that the sample is likely from a putative perpetrator, or that the DNA is likely from a suspected homicide victim. Another pertinent section of the policy states that law enforcement must identify themselves to genetic genealogy services, and they are only to search sites that have given explicit notice to their users that law enforcement may use their sites. Lastly, the policy provides guidelines about the destruction of materials after the criminal prosecution has been completed. 
    The interim police guidelines do not address many of the concerns that people have surrounding IGG, but it is important to remember that these guidelines are incomplete and they are not ruling. No investigators or government agencies are required to follow this Department of Justice Policy, though many of the items outlined are already consistent with the process used most often. Since case law is only written when issues are litigated, and that process can take many years, the fastest was to ensure that the IGG process has meaningful, consistent, and specific laws governing its use, is going to come through legislation. According to the Investigative Genetic Genealogy Board in in 2023, Maryland, Montana, and Utah are the three states that have passed legislation regulating some aspects of IGG, but other states will soon likely join them.

STATE LEGISLATION

    In Maryland, IGG may only be initiated when a sworn affidavit is submitted and judicial authorization is given (Criminal Procedure,2023). The statute states the same requirements offered in the DOJ interim policy by requiring specific case criteria and notice provided to users that their information may be searched by law enforcement. More recently, in June of 2023, Montana enacted the Genetic Information Privacy Act which requires consent to use genetic data, implements security methods, and supports consumer control over access, deletion, and destruction of biological samples (Genetic Information Privacy Act, 2023). The act also includes a vague section stating that government agencies must only use genetic data pursuant to state law or through a valid search warrant starting on June 1, 2025. 
     “The Sherry Black Bill,” signed into law in Utah, provides similar requirements found in the interim policy and other state legislature that law enforcement must follow in genetic genealogy investigation procedures (Criminal Investigations and Technical Services Act,2023). The bill was named after murder victim Sherry Black, whose case went unsolved for ten years after her death in 2010 when she was murdered while working at the bookstore she owned (Sherry’s Case, 2023, para. 1). One investigator and a genealogy specialist began working on her case in 2018, and through the next two years they worked to identify the person who took Black’s life. Finally in 2020, her assailant was sentenced to life in prison without the possibility of parole. 
    As of 2023, the state legislation that has been passed is not particularly robust, but more so adds a small amount of protection, encourages transparency in investigations, and addresses the way that consumer data is managed. With the rapid technological advances of today, existing law can begin to feel stale and inadequate by leaving loopholes or gaps which could not be foreseen when old laws were written. Indeed, it is impossible to know how future technology will be included or excluded when laws are established. When technological advances like IGG are emerging, it is important that citizens are not caught up in fearmongering or clinging to misinformation that will ultimately result in greater danger to our communities. Many incorrectly believe that they are fighting for an increased protection of rights by opposing IGG, but they are not.

CONCLUSION

    Investigative Genetic Genealogy is undeniably a powerful tool, but certainly one that can leave people feeling confused and vulnerable from a lack of subject knowledge. So far IGG has revolutionized the investigation of cold cases and proved to be a great source of promise for future investigations. While many critics present legitimate concerns that deserve to be addressed, many of these fears are exaggerated and based on misinformation or misunderstanding. Secondary use of genetic information should certainly have restrictions, and an owner of DNA data deserves to know how their information can be found and by whom, but law enforcement agencies have thus far only used these resources to continue to protect and serve its citizens. For many cases, Investigative Genetic Genealogy is the last remaining hope that families may have in their search for answers, closure, or justice, and it would be the ultimate injustice to obliterate that hope based on poorly-informed, unfounded fears.


References

 

Tags
Investigative Genetic Genealogy
Privacy Laws
Genetic Testing