Cops Aren't Just Submitting DNA Samples To Genealogy Services; They're Also Obtaining Customer Info

from the buyer-beware-etc. dept

Thu, May 3rd 2018 3:38pm — Tim Cushing

Recently, a genealogy service provided law enforcement with the information they needed to locate a murder suspect they'd been hunting for over forty years. GEDMatch admitted it was the service investigators used to find a familial match to DNA samples it had taken from crime scenes. This revelation led people to question how private their DNA data was when shared with genealogy services. The answer is, of course, not very, what with the purpose of these services being the matching of DNA info from thousands or millions of unrelated individuals.

Police created a fake account to submit the sample they had and received matches that allowed them to narrow down the list of suspects. This was combined with lots of other regular police work -- combing public records and obituaries for living relatives near the locations the crimes occurred -- to gradually hone in on Joseph James DeAngelo, who is believed to have murdered twelve people and committed at least 51 rapes.

But there was more to this than the DNA search at GEDMatch. Investigators had also used a service called FamilyTreeDNA to look for possible matches. The public database maintained by the company apparently helped investigators narrow down the list of suspects. Peter Aldhous of Buzzfeed has more details.

From DNA collected from crime scenes, [investigator Paul] Holes knew 67 genetic markers on the killer’s Y chromosome. Every three months or so, he would check in Ysearch for matches. The subpoena was made when a profile containing just 12 genetic markers — including one that’s unusual among men of Western European ancestry — matched with the killer’s sample.

This subpoena demanded customer information for the person who had submitted matching DNA. Investigators were able to obtain payment info which led them to someone researching their family tree. This led to another sample -- and another dead end. The woman's father had a sample taken by investigators but the test cleared him of suspicion.

That subpoenas can be used to pierce the minimum of privacy given to customers by companies should come as no surprise. These have been used for years to demand subscriber info from service providers in both civil and criminal cases.

That being said, people may now approach DNA services a bit more cautiously. While companies may offer some assurances about personal info being protected, the nature of the business is sharing DNA markers and allowing your personal DNA structure to be matched against submissions by complete strangers… which will also include law enforcement investigators.

Any service that requires payment and personal info will be approached by law enforcement. In most cases, a warrant won't be needed. The Third Party Doctrine lowers protections for customers, making warrants mostly unnecessary. While some companies may push back more than others when law enforcement demands info, in most cases the government will get what it's seeking.

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: dna, genealogy, golden state killer, joseph deangelo, privacy, subpoenas
Companies: familytreedna, gedmatch

28 Comments

If you liked this post, you may also be interested in...

Reader Comments

Subscribe: RSS

View by: Time | Thread

Anonymous Anonymous Coward (profile), 3 May 2018 @ 1:53pm

Just how do these things work?
I wonder how the police went about submitting their DNA samples. One would think that a normal user would send in some biological material, blood, cheek swab, something which the service would then run a DNA test on. What did the police do, send in their evidence and request that any unused portions be returned? Or did they send in the DNA listing from the reports they received after their own labs did the testing? Did the online lab not notice something fishy in the samples or information sent? The police, apparently created an account and at the very least suggested it was their DNA sample or profile that was sent.
[ link to this | view in chronology ]
- Anonymous Coward, 3 May 2018 @ 4:07pm
  
  Re: Just how do these things work?
  I like to imagine they submitted it something like:
  Suspect Doe1
  
  So if your DNA company of choice lets you know of a match with a relative last name Doe, be afraid.
  [ link to this | view in chronology ]
- Coyne Tibbets (profile), 3 May 2018 @ 10:26pm
  
  Re: Just how do these things work?
  DNA can be multiplied, that's what PCR is about. They take the original sample and PCR some of it to make a lot of copies, which could then be submitted to the service. Just dip a swab and send it in. The lab at the service might notice that the sample is a little odd, but they're not in business to reject odd samples.
  [ link to this | view in chronology ]
- mhajicek (profile), 4 May 2018 @ 5:48am
  
  Re: Just how do these things work?
  What I want to know is whether they sent the DNA sample through the US Postal Service. If so that would be mail fraud, which is a federal crime.
  [ link to this | view in chronology ]
  - mvelikonja (profile), 4 May 2018 @ 6:55am
    
    Re: Re: Just how do these things work?
    Law enforcement and licensed private investigators are permitted, in a lawful investigation, to use undercover techniques, such as using covert identities..
    [ link to this | view in chronology ]
Mason Wheeler (profile), 3 May 2018 @ 2:01pm

So you're saying people might think twice about subscribing to a service like this, because they might end up under investigation if they're a close DNA match for a suspect and then immediately be cleared once a better test shows you're not the guy they're looking for afterall?

Yeah, nobody would want something like that to happen! *rolls eyes*
[ link to this | view in chronology ]
- MargeBouvier (profile), 3 May 2018 @ 4:05pm
  
  Re:
  Or perhaps you end up under suspicion because you're a close match and end up being falsely charged and your life is turned upside down trying to clear your name.
  
  But that's crazy, that could never happen!
  
  Personally, I just don't trust anyone to maintain my privacy well enough, and I've got enough personal data floating around in cyberspace.
  [ link to this | view in chronology ]
  - This comment has been flagged by the community. Click here to show it
    
    Anonymous Coward, 3 May 2018 @ 7:38pm
    
    WELL, WELL. Another day, another 40 mo gap, 1 per year ZOMBIE!
    MargeBouvier or SandraF for the first 3; 7 TOTAL comments with 40 month gap, begun Jan 12th, 2011!
    
    Yes, ANOTHER devoted to the site over SEVEN YEARS, but only just for once-a-year thrill of being blandly supportive!
    
    Here's the basic flaw, kids: no matter how many of these pop up, they CANNOT be seen as normal!
    
    And less believable if supposedly female: any names here implying female is exactly so credible as on Ashley-Madison. Just a lure of boobs for boobs.
    [ link to this | view in chronology ]
    - Ben (profile), 4 May 2018 @ 5:26am
      
      Re: WELL, WELL. Another day, another 40 mo gap, 1 per year ZOMBIE!
      Infrequent commenting is not a crime (nor a civil suit waiting to happen), it's long been known as 'lurking' and is tremendously common on lots of forums. Get a life, AC.
      [ link to this | view in chronology ]
    - I.T. Guy, 4 May 2018 @ 5:53am
      
      Re: WELL, WELL. Another day, another 40 mo gap, 1 per year ZOMBIE!
      Go back to YouTube wiLLie.
      [ link to this | view in chronology ]
  - mvelikonja (profile), 4 May 2018 @ 11:13am
    
    falsely accused with DNA test
    OF course police could end up with false matches; it has happened many times. This is why the DNA privacy rules need to be tightened up, ASAP.
    [ link to this | view in chronology ]
- Anonymous Coward, 3 May 2018 @ 5:38pm
  
  Re:
  
  they might end up under investigation if they're a close DNA match for a suspect and then immediately be cleared once a better test shows you're not the guy they're looking for
  
  The history of false convictions does not fill me with hope. Nevermind that your life could be completely fucked up before you're able to prove your innocence, even if you're never convicted, or that you'd be selling out your family for minor personal benefits.
  [ link to this | view in chronology ]
- Coyne Tibbets (profile), 3 May 2018 @ 10:44pm
  
  Re:
  People are so blase about contacts with law enforcement.
  
  It would probably change your opinion a bit if you were dragged out of your workplace (or wherever), hauled to the police station, and forced to give a DNA sample, and locked up to wait for the results; guilty until proven innocent.
  
  Where did I get that? Well how do you think this part proceeded: "The woman's father had a sample taken by investigators but the test cleared him of suspicion." Did you think the officers just asked nicely to drop by, at some convenient time, at the home of a suspected serial rapist/murderer, to ask nicely for a DNA sample? And kindly let him stay at home, to give him a good opportunity to flee, while they waited for results?
  [ link to this | view in chronology ]
- Anonymous Coward, 4 May 2018 @ 7:35am
  
  Re:
  
  because they might end up under investigation if they're a close DNA match for a suspect and then immediately be cleared once a better test shows you're not the guy they're looking for afterall? Yeah, nobody would want something like that to happen! rolls eyes
  
  No, nobody wants to be falsely suspected. It's already happened once that we know if and it wasn't exactly a picnic for Michael Usry Jr. even though he was innocent. He was suspected chiefly because his father was a close match in a database, and he got to stress about it for more than a month before they cleared him. Then got to wonder for another two and a half years about it being a relative of his before more testing cleared anyone closely related to him.
  
  That's with the police being relatively polite about the whole thing, and with him not being in a particularly sensitive position as far as his career. The police didn't go off half-cocked and throw him in jail while they investigated. He wasn't a teacher or a doctor or in some other sensitive job where merely being suspected of rape and murder would hurt him. So he ultimately came out of it with nothing more lasting than his name being connected to a brutal murder when you google it. He got off quite lucky compared to their other suspect in the case, who was coerced into a false confession despite not matching the DNA at the scene.
  
  So like I said no, nobody wants that. Just the time required for testing prevents someone from being "immediately" cleared, and no one wants to be falsely suspected and hauled in for questioning by cops who might not be too friendly to the person who they suspect might be a brutal criminal.
  [ link to this | view in chronology ]
Anonymous Coward, 3 May 2018 @ 3:59pm

So the police can demand a list of all the people the service has tested who have a particular genetic marker, and then check out each person one by one?
[ link to this | view in chronology ]
PlagueSD (profile), 3 May 2018 @ 4:28pm

and this is EXACTLY why I'll never use any of these "genealogy" services...
[ link to this | view in chronology ]
- carlb, 4 May 2018 @ 6:52am
  
  Re: and this is EXACTLY why I'll never use any of these...
  Oh, but therein lies the rub. If I take this test, am I giving them a copy of my Y chromosome? Or am I giving them a copy of my dad's Y chromosome? Or his dad's Y chromosome?
  
  And, if this DNA in fact belongs to my ancestors, did these ancestors give their informed consent for this to be used in interstate commerce, law enforcement or anything else?
  
  Worst case, the test comes back today saying that I actually belong to the mailman and tomorrow Daddy, feeling really disgruntled, goes postal - making me and my DNA evidence.
  [ link to this | view in chronology ]
Anonymous Coward, 3 May 2018 @ 4:38pm

Imagine the one stop shop for law enforcement once Facebook gets into the DNA business
[ link to this | view in chronology ]
Anonymous Coward, 3 May 2018 @ 5:14pm

Not Just Law Enforcement
My concern, while is for the potential law enforcement abuse, is more with Insurance companies who will utilize information in ways which may be less than clear. Sure, they cannot raise your specific rates or deny coverage (outright), but who is to say they won't raise the rates your employer must pay when they have several persons with specific health related genetic markers. And we all know that every employer will absorb those rates fully and not pass them along to you, right? Right?
[ link to this | view in chronology ]
- Coyne Tibbets (profile), 3 May 2018 @ 10:54pm
  
  Re: Not Just Law Enforcement
  Or refuse to hire you because you are "in-valid", as in Gattaca?
  [ link to this | view in chronology ]
Anonymous Coward, 3 May 2018 @ 5:47pm

and who thinks the government isnt behind these genealogy services.. imagine the uproar if the feds said they were creating a national dna database.. but not a peep if ppl think its a private business..
[ link to this | view in chronology ]
ECA (profile), 3 May 2018 @ 6:45pm

pRIVACY??
Anyone remember a few of the Privacy things we USED to try to do..
EXCEPT...
If you wanted a magazine...It got sold over and over.. then we got ALLOT MORE MAIL..we didnt want.
Then there is the LAw about your Social Sec, number...THAT WAS NEVER TO BE USED BY CORPS....

PCH sent my mother a Card to check the net with..
It was designed to collect her EMAIL ADDRESS..

Every place wants my email..What a way to Collect data, and NOT ask for a SS#..
1 good data breach...and?? We have had HUNDREDS OF BREACHES..
[ link to this | view in chronology ]
dadtaxi, 3 May 2018 @ 11:38pm

Unauthorised access
"Police created a fake account"

Hold on. wasn't there some sort of law passes about breaking terms of service being unauthorised computer access? Something about Bradley Manning and the CFAA?
[ link to this | view in chronology ]
- Ben (profile), 4 May 2018 @ 5:30am
  
  Re: Unauthorised access
  I'm just waiting for some smart lawyer for the accused to realise that some of the evidence leading to his arrest was obtained unlawfully... that kind of technicality has never, ever, ever worked to get someone out of all sorts of dodgy scrapes with the law.
  [ link to this | view in chronology ]
Ninja (profile), 4 May 2018 @ 7:11am

Because of course they would. We'll see mandatory DNA sampling sooner or later. Oh wait, it is already happening around the world.
[ link to this | view in chronology ]
Anonymous Coward, 4 May 2018 @ 8:21am

"The only winning move is not to play." - WOPR
<EOM>
[ link to this | view in chronology ]
Oregoncharles, 5 May 2018 @ 11:42am

Y-chromosome DNA matches
This doesn't make sense:
"From DNA collected from crime scenes, [investigator Paul] Holes knew 67 genetic markers on the killer’s Y chromosome. Every three months or so, he would check in Ysearch for matches. The subpoena was made when a profile containing just 12 genetic markers — including one that’s unusual among men of Western European ancestry — matched with the killer’s sample.

This subpoena demanded customer information for the person who had submitted matching DNA. Investigators were able to obtain payment info which led them to someone researching their family tree. This led to another sample -- and another dead end. The woman's father had a sample taken by investigators but the test cleared him of suspicion."

Women don't have a Y chromosome (lucky them). So it doesn't follow, and calls the whole account into question.
[ link to this | view in chronology ]
mvelikonja (profile), 5 May 2018 @ 11:53am

Y chromosome
It does make sense. The article says that Holes reached out to the contact who had a Y-DNA match with the killer. The contact was a woman (the administrator of the DNA test). It was her father who matched. the police requested that her father take an additional DNA test, which she coordinated.

Many of the tests on DNA sites are administered by another person. I administrate about 20 DNA kits on various sites.
[ link to this | view in chronology ]