16 November 2019 | New Scientist | 23T
HE announcement by
California police in 2018
that they had arrested a
suspect in the Golden State Killer
case, a series of murders, rapes and
burglaries in the 1970s and 1980s,
came with a sting. The suspect
had been identified in part using
data that members of the public
had uploaded to the personal
genomics database GEDmatch.
People add their genetic data
to such sites in the hope of tracing
long-lost relatives, biological
parents and so on. Most wouldn’t
expect their genomes to be
accessed by the police. Yet officials
in the US have used “investigative
genetic genealogy” in more
than 100 cases. Earlier this year,
at-home genetic testing company
FamilyTreeDNA apologised for
failing to tell its users it was
sharing data with the FBI.
The attraction of such databases
JOSto law enforcement is clear. Just
IE^ F
OR
D
Comment
Views
The columnist
Annalee Newitz
on Facebook’s threat
to democracy p24Letters
Some solutions
to the minimoon
conundrum p26Aperture
A giant baobab tree
hollowed out to
store water p28Culture
Disturbing show
weighs the impact
of a 24/7 world p30Culture columnist
I want an AI-driven
role-playing game,
says Jacob Aron p323 million profiles from a particular
population will generate a match
with a third cousin or closer for
90 per cent of DNA samples.
With a match, police can use
public records to build out family
trees and home in on people who
fit the suspect’s age, location and
even physical appearance. The
Golden State Killer case involved
a tree with thousands of members.
These DNA searches jeopardise
privacy in several ways. It takes
only a relatively small number
of profiles to effectively waive the
genomic privacy of hundreds of
millions of people. An investigator
who looks at the records of dozens
of people linked by biology – even
if they aren’t linked to each other
in the real world in any way – will
learn a lot of private information,
with the obvious potential for
abuse. To help build out family
trees, police have in some cases
even collected biological materialfrom non-suspects without
alerting them, such as by taking a
discarded coffee cup. This material
can then be retained in police
databases as “abandoned” DNA.
GEDmatch initially defended
its practice of allowing access
by law enforcement by arguing
that information in its database
was open to any member of the
public. After its users baulked,
it switched to a default opt-out
from such access, encouraging
users to opt back in.
In a new twist, last week police
in Florida obtained a warrant to
search all GEDmatch’s opted-out
profiles, causing disquiet among
direct-to-consumer genomic
testing firms. Such services
hold the data of millions of
people who have had their
genomes screened, whether for
genealogical or health reasons.
A big company like 23andMe,
which described GEDmatch’sapparent lack of challenge to the
Florida warrant as “disturbing”,
may put up a vigorous fight if
pressured to share its data.
However, US privacy laws are
anaemic – and smaller, less
well-resourced companies may
prove more attractive targets.
More controls are urgently
needed. The 21st Century Cures
Act, enacted by the US Congress
in 2016, created a legal protection
known as a “certificate of
confidentiality” to prevent law
enforcement from accessing
sensitive information collected
to advance medical knowledge.
Similar protection could be
extended to recreational genetics.
Some US states have begun to
talk about regulating or banning
investigative genetic genealogy.
The Department of Justice is
currently receiving comments
on an interim policy that has a
promising, although incomplete,
set of regulatory restrictions. For
now, though, consumers worried
about genetic privacy have few
choices: opt for a service based
outside the US; choose one with
a well-resourced legal team that
seems committed to its users’
privacy and hope for the best;
or forego such services altogether.
But if your fourth cousin once
removed made a different choice,
that apparent power to decide is
probably meaningless. ❚Beware the genetic sting
Users of genetic testing services need to think carefully about who
might gain access to their most intimate data, says Erin MurphyErin Murphy is at New York
University and is author
of Inside the Cell: The dark
side of forensic DNA