Millions of Americans have bought into the exciting new world of consumer genealogy, sending spit-filled tubes to DNA-testing websites that offer to help them discover their family history.
But the massive haul of DNA data, popularized by companies such as 23andMe and Ancestry.com, also has become a powerful weapon for police hoping to solve enduring mysteries, including, at times, by using the genetic data of unwitting volunteers.
The capture this week of a man whom police believe to be the “Golden State Killer” — who became a suspect only when police matched crime scene DNA to a distant relative on a genealogy website used to map family trees — has highlighted the consumer DNA industry’s growing role in reenergizing cold cases and reshaping justice in the digital age.
But the hyper-personal data’s use in public policing also has inflamed concerns that people don’t truly understand the power of what they’re handing over: the building blocks of identity, both for themselves and their families. And, in some cases, they’re giving police the keys to linking their loved ones to evidence that could convict them.
The Golden State Killer had mystified authorities for a generation, carving a trail of unsolved crimes across California that included at least a dozen killings and 45 rapes. But the case, police say, was ultimately cracked with help from GEDmatch, a barebones genealogy database of volunteered DNA samples whose operators say they didn’t realize it was being used in the criminal investigation.
Police, armed with DNA evidence that was of limited use to investigators in the 1970s and 1980s, were able to compare the genetic material with the data on the website. That data pointed them to distant relatives of Joseph James DeAngelo, 72, a former police officer and retired mechanic. As they followed the family tree, they found DeAngelo, who matched the age and description of a potential suspect and also happened to live in areas near where the notorious crimes occurred. They followed him.
Discarded DNA that police recovered from DeAngelo matched the DNA from the crime scenes, authorities said. Four decades after the first crimes, and three decades after the killer went dormant, they made an arrest.
Former Sacramento County sheriff’s detectives Richard Shelby and Carol Daly, two of the original investigators on what was also known as the East Area Rapist case, were gobsmacked by the techniques used to capture the man they had trailed long ago.
Daly likened those days to “the Dark Ages,” when he placed calls via pay phone, filed reports via typewriter and “dusting for prints was the big thing” in criminal investigations.
“It’s revolutionary,” Shelby said. “It’s one of the best crime-fighting tools to come in a long, long time.”
But criminal-justice and privacy experts questioned how people who have gotten their DNA tested online would react to the possibility that their choice could someday lead police to their relatives — or themselves.
“Even the people who consent by uploading their DNA often don’t imagine the ways their information will be used,” said Erin Murphy, a New York University law professor who researches forensic technology. “They aren’t really thinking through the implications of creating this treasure trove of data that can be mined.”
DeAngelo was arrested Tuesday, and jurisdictions across California began charging him in the string of crimes this week. He appeared in a Sacramento County courtroom on Friday afternoon, dressed in an orange jumpsuit and pushed in a wheelchair, speaking only briefly in a quiet rasp.
Consumer genealogy sites such as 23andMe and Ancestry.com sell DNA testing kits, often cheaper than $100, to millions of customers wanting detailed information on their family, lineage and ethnicity. The services offer privacy controls for user data but can also help connect users with possible long-lost relatives.
The service police used, GEDmatch, does not sell testing kits, but its users — amateur hobbyists and professional researchers — can upload DNA profiles provided by other sites. GEDmatch’s database now includes roughly a million distinct DNA sets.
Representatives from 23andMe and Ancestry.com on Friday distanced themselves from the open-source firm, saying they do not share data publicly and will not share information with law enforcement unless legally compelled.
Some company officials voiced concern that episodes like these could impact users’ trust in the consumer DNA ecosystem, citing focus groups where customers said they were nervous that their DNA could be shared with insurance providers, their employers or the police.
But the companies, leaders of the young consumer-genealogy industry, have served as the top contributors to the vast landscape of publicly available online DNA data. “It’s thanks to the advertising budgets of 23andMe and Ancestry that so many millions of people are coming into genealogy for the first time,” said Blaine Bettinger, a professional genealogist in New York.
GEDmatch’s privacy policy says its tools are “for comparison and research purposes” and encourages people to think closely about what they’re providing. “In the end, if you require absolute privacy and security, we must ask that you do not upload your data to GEDmatch,” its policy states.
Curtis Rogers, a GEDmatch co-founder, said in a statement that while “we were not approached by law enforcement or anyone else about this case or about the DNA, it has always been GEDmatch’s policy to inform users that the database could be used for other uses.”
Searching through the DNA of relatives to find suspects — also known as familial DNA — has long been controversial. Ten states allow familial searching within their borders, while the practice is banned in Maryland and the District.
But there is no such law for private DNA sites. Kenneth Mains, founder of the American Investigative Society of Cold Cases, said he had “personally run DNA markers through many genealogical sites in order to help move a case forward.”
“Any resource that helps investigators solve the 200,000-plus cold cases in the United States needs to be utilized,” Mains said. “As an investigator, you will take that lead.”
Prosecutors say they see the private genealogical databases as an investigative gold mine, and they worry that privacy concerns could block them from the breakthroughs needed to track down future predators.
“Why in God’s name would we come up with a reason that we not be able to use it, on the argument that it intrudes onto someone’s privacy?” said Josh Marquis of the National District Attorneys Association. “Everything’s a trade-off. Obviously we want to preserve privacy. But on the other hand, if we’re able to use this technology without exposing someone’s deepest, darkest secrets, while solving these really horrible crimes, I think it’s a valid tradeoff.”
Some legal experts compared the use of public genetic databases to the way authorities can scan other personal data provided to third-party sources, including telephone companies and banks. Others suggested further scrutiny as the amount of publicly available DNA multiplies.
“The law often lags behind where technology has evolved,” said Barbara McQuade, a University of Michigan law professor and former U.S. attorney. With DNA, “most of us have the sense that that feels very private, very personal, and even if you have given it up to one of these third-party services, maybe there should be a higher level of security.”
The use of the genetic database could open up avenues for investigators probing other cold cases, but it left numerous questions unanswered, including how many other DNA samples from innocent people had been inspected by police, Murphy said. She also questioned whether users who had submitted their DNA knew of the data’s ramifications. “Even if [users are] content with making that trade-off with their personal data, they’re also making that trade-off with their extended family, their children, their children’s children,” she said. “And they’re not just making it for 2018, but for 2020 and 2040, when data from the genome could be used in all sorts of different ways.”
Before the DNA breakthrough, the Golden State Killer case had long stymied detectives. Sacramento District Attorney Anne Marie Schubert said investigators had worked for years trying to learn the source of the DNA recovered from one of the crime scenes.
When DeAngelo, then under surveillance, discarded an unidentified item containing his DNA, detectives grabbed it. On April 20, they tested it against the DNA taken from one of the crime scenes. It was a match.
Schubert was out to dinner that Friday evening when her phone rang. “Are you sitting down?” Chief Deputy District Attorney Steve Grippi asked her. “I probably said a few times with some expletives that he better not be kidding me,” Schubert said. After a second DNA test and match, police arrested DeAngelo at his home on Tuesday.
Schubert defended the work, although she nodded to the privacy concerns likely to emerge as a result.
“I’m sure those questions will be raised through this court process,” Schubert said. “I also know that we are sitting here today with an individual in custody for probably one of the most significant serial cases of all time.”
Berman, Harwell and Jackman reported from Washington. The Washington Post’s Avi Selk contributed to this report.
