The 2018 arrest of Joseph James DeAngelo, infamously known as the Golden State Killer, put genetic genealogy on the map. Investigators created a DNA profile of DeAngelo using crime scene evidence, and uploaded it to a public genealogy database people use to find relatives. From there, police were able to identify DeAngelo’s distant genetic connections and, using public records, build out a family tree to eventually zero in on him.
It was the first publicized instance of genetic genealogy being used to identify the perpetrator of a violent crime. By one estimate, more than 500 murders and rapes have been solved with the technique in the years since. And those are just the ones that have been announced by law enforcement agencies. Although it’s mainly been a tool for cracking years-old cold cases, genetic genealogy was recently used by police to arrest Bryan Kohberger for the November 2022 murders of four college students at the University of Idaho. (Kohberger has been charged but has not yet entered a plea.)
But the technique is controversial because it relies on commercial databases that were designed to help hobbyists do genealogy research, not assist police in investigating crimes. That’s why two genealogists, CeCe Moore and Margaret Press, have just launched a new nonprofit DNA database specifically designed to aid law enforcement. They’re hoping enough people will lend their data to the project, called the DNA Justice Foundation, for it to become a useful crime-solving tool.
Both of them believe that genetic data is a powerful resource. Moore is the lead genealogist at Parabon NanoLabs, a company that provides genetic genealogy and other DNA services for law enforcement agencies. She says her team’s work at Parabon has led to more than 265 positive identifications in criminal cases. Press is a cofounder of the DNA Doe Project, a California nonprofit volunteer organization that uses genetic genealogy to put names to unidentified crime victims and deceased missing persons. The group has identified more than 100 sets of remains.
“This entire field is reliant on two databases owned by private, for-profit companies,” says Moore, referring to GEDmatch and FamilyTreeDNA, which both allow law enforcement agency searches. With GEDmatch, users first take a test through 23andMe, AncestryDNA, or another genetics company and then upload the raw DNA file that’s generated by those services. FamilyTreeDNA is a testing service like 23andMe or Ancestry, but unlike them, it allows law enforcement to search its database of consumer data.
GEDmatch, started by an amateur genealogist in 2010, was acquired by San Diego-based forensics company Verogen in December 2019. In January, Verogen was bought by Qiagen, a Dutch genomics firm. FamilyTreeDNA, meanwhile, is a division of Texas-based Gene by Gene, which merged with Australian company myDNA in 2021. “In each case, the database was the crown jewel for that company. The data is what is so valuable,” says Press.
That these databases keep changing hands made Moore and Press nervous about what would happen to all that data and how it could be used by the new owners. Plus, they might lose a crucial tool if these companies were to suddenly shut down, restrict access to their databases, or up their prices for law enforcement use. “We wanted to have this alternative as an option,” Moore says.
Both GEDmatch and FamilyTreeDNA charge law enforcement $700 per uploaded DNA profile, according to data from Parabon and Intermountain Forensics. (GEDmatch and FamilyTreeDNA did not respond to inquiries from WIRED about their pricing.) Other genealogists have noted that this price has increased over the years. The DNA Justice Foundation plans to have low or no fees for law enforcement uploads. Moore and Press hope to raise enough money in donations to help cover the minimal costs associated with creating and running the database.
The two genealogists admit they’re starting their database from scratch. The more DNA profiles in a database, the better. So far, fewer than 200 people have uploaded their data to the DNA Justice Foundation, but Moore thinks they could get to 100,000 profiles—enough for the database to be useful—in a few months. At that point, Moore and Press think they would begin to allow law enforcement access.
By contrast, FamilyTreeDNA has around 2 million profiles in its database and GEDmatch has 1.8 million. However, those aren’t all accessible to law enforcement.
FamilyTreeDNA sets new accounts to automatically grant permission for law enforcement searches, although customers can later opt out. (The company didn’t respond to an inquiry about how many people have opted out.) With GEDmatch, users must proactively opt in to be included in these searches. On both sites, law enforcement investigators who upload the DNA profile of an unknown suspect are able to see the kind of information other users do: that person’s familial matches, including how much DNA they likely share, and the usernames and email addresses of those matches.
GEDmatch didn’t always give users this option. In May 2018, GEDmatch changed its terms of service to specify that law enforcement could use its database to investigate violent crimes. When the company introduced its opt-in system a year later, it created a default in which all existing users were opted out, and anyone who wanted to participate had to explicitly consent. That meant ongoing police investigations using GEDmatch were put on hold, because users’ profiles were suddenly unavailable. Initially, only a small percentage of users opted in, but a representative for Qiagen wrote via email that today more than 75 percent of new users choose to participate in law enforcement matching. (The representative didn’t say how many total profiles are available for these searches.)
That so many new users have opted in is a “result of significant investments in growing the tools available within the platform as well as enhancing the security and privacy controls of the database so that it meets regional- and state-level consumer privacy laws,” the Qiagen spokesperson wrote. “With the acquisition of Verogen, we hope to continue growing the utility of the database, and investing in our security and privacy capabilities so we can remain trusted stewards of our customers' kits.”
But GEDmatch acknowledges it can’t anticipate what will happen to its database in the future. On its terms of service page, the company states: “We cannot predict what the future holds for DNA or genealogy research. We cannot predict what the future will be for GEDmatch. It is possible that, in the future, GEDmatch will merge with, or operations will be transferred to other individuals or entities.”
Both GEDmatch’s and FamilyTreeDNA’s terms of service outline their policies for law enforcement use. But for many users, solving crimes is not their main motivator for signing up for these sites. Plus, not everyone reads the terms of service, and companies can not only change them at any time but may even break their own terms.
That’s why David Gurney, who helped draft the terms of service for the DNA Justice Foundation, wanted to make sure that users fully understand what they’re signing up for—a database whose sole purpose is aiding law enforcement. The site isn’t a consumer genealogy tool, and users don’t have access to their own matches. Law enforcement agencies can use the database only to investigate certain crimes, including murder, nonnegligent manslaughter, rape and sexual assault, abduction, robbery, aggravated assault, terrorism, and imminent threats to public safety. (These are similar to GEDmatch and FamilyTreeDNA’s terms.)
“I don't think anybody could agree to these terms of service and not understand what they're getting into,” says Gurney, an assistant professor of law and society and director of the Investigative Genetic Genealogy Center at Ramapo College in New Jersey.
Yet there are still risks in uploading your DNA data to any of these databases—even a nonprofit one. You or a family member could be swept into a criminal investigation just because you share a portion of DNA with a suspect. Genetic genealogists work with investigators to narrow down suspects based on factors like their presumed age and where they were living at the time of the crimes, but the leads they generate are just that: leads. And sometimes, leads are wrong. Before police arrested DeAngelo, they had identified another member of his family—who was innocent.
And there are security concerns. In 2020, GEDmatch reported that hackers orchestrated a sophisticated attack on its database. The breach overrode the site’s privacy settings, meaning the profiles of users who did not opt in for law enforcement matching were temporarily available for that purpose.
Jennifer Lynch, surveillance litigation director for the Electronic Frontier Foundation, a San Francisco-based digital rights group, doesn’t think a nonprofit DNA database is a panacea for these issues. “It doesn’t solve the fact that these searches are unconstitutional,” she says. The EFF and others have argued that genetic genealogy searches by law enforcement are violations of the Fourth Amendment, which protects US citizens against unreasonable searches and seizures. The group also opposes the surreptitious collection of DNA without a warrant.
“When law enforcement searches through these databases, they don't have an individual suspect in mind,” Lynch says. She likens it to a “fishing expedition,” since it’s most often used as a last resort in cases when investigators haven’t been able to generate any good leads. “Even though a technique might solve crimes, that doesn't mean that we should just look the other way on our constitutional rights,” Lynch says.
She also worries about a slippery slope: Right now, these databases limit police use to investigating violent crimes. But there’s nothing stopping them from changing their terms of service to allow law enforcement to investigate increasingly less serious crimes, eroding people’s privacy.
If the courts never take up the constitutionality of this technique, Lynch says, it will be important to implement laws that restrict its use. A few US states have already adopted regulations that limit the types of crime these databases can be used for or require police to obtain a search warrant to use them.
For now, Moore and Press are focusing on the public benefit of genetic genealogy. “If people support the idea of getting violent criminals off the streets and providing names to the unidentified and answers to their families, then they should seriously consider actively supporting us,” Moore says. “They could be the answer to a case being solved or a violent criminal being put behind bars.”
