Two States Pass Laws Limiting Law Enforcement Access To Private DNA Services

from the catching-up-with-the-cops-who-have-already-caught-up-with-the-tech dept

One of the more recent opportunities for law enforcement in the Third Party Doctrine space has been DNA databases. A number of companies offer on-demand DNA testing, allowing users to check themselves for potential markers that could indicate susceptibility to diseases or just to figure out where they fit in in the world by linking them to distant relatives they may not be aware of.

Since users are sharing this potentially-sensitive info with DNA companies and other users, law enforcement illogically thought they wouldn't mind sharing it with cops. At least one company believed this as well, informally deputizing its user base as involuntary providers of DNA evidence.

A whole lot of Wild Westing ensued. Some investigators used subpoenas, believing it was third party data that carried no expectation of privacy. Others used warrants, but used them to access the entire contents of third party DNA databases. Cops even created fake accounts to upload DNA samples to find matches in cases that had gone cold.

This mostly-voluntary patchwork of legal paperwork/legal theories is now being codified into something coherent and subject to at least some judicial oversight. As the New York Times reports, two states have recently passed laws governing the use of private companies' DNA databases by law enforcement.

Beginning on Oct. 1, investigators working on Maryland cases will need a judge’s signoff before using the method, in which a “profile” of thousands of DNA markers from a crime scene is uploaded to genealogy websites to find relatives of the culprit. The new law, sponsored by Democratic lawmakers, also dictates that the technique be used only for serious crimes, such as murder and sexual assault. And it states that investigators may only use websites with strict policies around user consent.

Montana’s new law, sponsored by a Republican, is narrower, requiring that government investigators obtain a search warrant before using a consumer DNA database, unless the consumer has waived the right to privacy.

The Maryland law is obviously the stronger of the two. It would steer investigators away from more law enforcement-receptive sites like FamilyTreeDNA, which opts users into sharing information with law enforcement by default. It would also prevent investigators from creating fake accounts to perform DNA searches, unless specifically approved by a judge.

It also mandates destruction of information obtained from DNA databases at the conclusion of investigations. And, perhaps most importantly, it forces investigators to utilize the government-owned DNA database (Codis) before approaching private third parties.

The Montana law is better than nothing, but it still needs more work. While it does erect a warrant provision, it allows that to be waived if the "consumer" consents to the search. Given that most databases attempt to link people by DNA, consent given by one person has the potential to subject lots of other people to searches they never agreed to.

But these are both positive steps. Just another 48 states to go. The relentless advance of technology often has cops claiming they're being left behind, outpaced by criminal early adopters. But the opposite is more often true. Law enforcement moves quickly to take advantage of new tech, rushing out ahead of court precedent and legislation to exploit tech advances legislators could never have anticipated. And when the loopholes begin closing, law enforcement will switch back to complaining about the "loss" of its lawless spaces. For now, two states are better protected than the rest of the nation. Hopefully, more legislatures will recognize this is an issue they can no longer ignore.

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: dna, dna databases, maryland, montana, third party doctrine