Story by Virginia Hughes for the New York Times
New laws in Maryland and Montana are the first in the nation to restrict law enforcement’s use of genetic genealogy, the DNA matching technique that in 2018 identified the Golden State Killer, in an effort to ensure the genetic privacy of the accused and their relatives.
Beginning on Oct. 1, investigators working on Maryland cases will need a judge’s signoff before using the method, in which a “profile” of thousands of DNA markers from a crime scene is uploaded to genealogy websites to find relatives of the culprit. The new law, sponsored by Democratic lawmakers, also dictates that the technique be used only for serious crimes, such as murder and sexual assault. And it states that investigators may only use websites with strict policies around user consent.
Montana’s new law, sponsored by a Republican, is narrower, requiring that government investigators obtain a search warrant before using a consumer DNA database, unless the consumer has waived the right to privacy.
The laws “demonstrate that people across the political spectrum find law enforcement use of consumer genetic data chilling, concerning and privacy-invasive,” said Natalie Ram, a law professor at the University of Maryland who championed the Maryland law. “I hope to see more states embrace robust regulation of this law enforcement technique in the future.”
Privacy advocates like Ms. Ram have been worried about genetic genealogy since 2018, when it was used to great fanfare to reveal the identity of the Golden State Killer, who murdered 13 people and raped dozens of women in the 1970s and ’80s. After matching the killer’s DNA to entries in two large genealogy databases, GEDmatch and FamilyTreeDNA, investigators in California identified some of the culprit’s cousins, and then spent months building his family tree to deduce his name — Joseph James DeAngelo Jr. — and arrest him.
Ms. Ram subsequently published an article in a law journal calling on Maryland lawmakers to act against the practice. Granting police access to a suspect’s genome, she argued, including markers of sensitive health information, was akin to an unreasonable search, which is banned by the Fourth Amendment. In 2019, she testified to a state House committee after a delegate, Charles Sydnor, who is now a state senator, introduced legislation that would have banned the method outright.
The ban did not pass. But it prompted discussions with legal experts, public defenders, prosecutors and police officers that led to a compromise bill, which passed unanimously this term in the state House and Senate.
“This bill strikes a balance between this very important technology to identify people that do the very worst things to our Marylanders, yet it balances that against the privacy concerns and the trust that we need from the public,” John Fitzgerald, the chief of the Chevy Chase Village Police Department, testified to the Maryland House Judiciary Committee in February.
But some experts said that the law could put a damper on the technology’s use in Maryland. For one thing, the law states that by 2024, genealogists working on such cases must be professionally certified — a credential that does not yet exist.
Another sticky provision: Investigators may use only genealogy companies that have explicitly informed the public and their customers that law enforcement uses their databases, and that have asked for their customers’ consent to participate. Currently, customers of GEDmatch and FamilyTreeDNA are given a choice about whether to participate in these searches. But the companies provide little information about what those searches entail, and the opt-in settings are turned on by default.
“We know well that most people do not read these kinds of forms closely,” Ms. Ram said. “This is likely to generate unwitting inclusion rather than actual consent.”
Unlike 23andMe and Ancestry, which have kept their immense genetic databases unavailable to law enforcement without a court order, GEDmatch and FamilyTreeDNA are eager to cooperate. If other states do not follow Maryland’s lead, it seems unlikely that either company would make changes that would shrink the pool of DNA profiles available for these searches. Both companies said in statements that they had no plans to update their policies.
“If the rest of the nation doesn’t have that requirement, why would they bow to Maryland’s needs?” said Paul Holes, a critic of the bill and a retired cold-case investigator who was on the team that found Mr. DeAngelo. “Now they’re serving the greater good at the expense of one state.”
In the three years since Mr. Holes’s team found Mr. DeAngelo, likely several hundred cases, many of them decades old, have been solved nationwide with genetic genealogy. The method has been used to solve crimes, exonerate the innocent and find the names of unidentified remains. The Defense Department may use the technique to identify World War II soldiers.
In some cases, customers may never know that the DNA markers they have uploaded into a database are being used by the police to identify culprits — or that using the database may bring trouble to their relatives. In 2018, police in Orlando, Fla., asked a woman for a DNA test, telling her that they believed she was related to a dead person they were trying to identify. She complied, only to find out that they were investigating her son, who was subsequently arrested and charged with murder.
In other cases, detectives might surreptitiously collect the DNA of a suspect’s relative by testing an object that the relative discarded in the trash.
Maryland’s new law states that when police officers test the DNA of “third parties” — people other than the suspect — they must get consent in writing first, unless a judge approves deceptive collection.
Investigators cannot use any of the genetic information collected, whether from the suspect or third parties, to learn about a person’s psychological traits or disease predispositions. At the end of the investigation, all of the genetic and genealogical records that were created for it must be deleted from databases.
And perhaps most consequential, Maryland investigators interested in genetic genealogy must first try their luck with a government-run DNA database, called Codis, whose profiles use far fewer genetic markers.
Mr. Holes said that this part of the law could have tragic consequences. For old cases, he pointed out, DNA evidence is often highly degraded and fragile, and every DNA test consumes some of that precious sample. “In essence, the statute could potentially cause me to kill my case,” he said. And given the speed that DNA technology evolves, he added, it is unwise for a law to mandate use of any particular kind of test.
But other experts called this provision crucial, because the potential privacy breach is far more severe for genetic genealogy, which gives law enforcement access to hundreds of thousands of genetic markers, than it is for Codis, which uses only about two dozen markers.
These searches are “the equivalent of the government going through all of your medical records and all of your family records just to identify you,” said Leah Larkin, a genetic genealogist who runs a consulting business in the San Francisco Bay Area that is largely focused on helping adoptees and others find their biological relatives. “I don’t think people fully appreciate how much is in your genetic data.”