June 11, 2019
The genealogy database that helped authorities track down the alleged Golden State Killer and dozens of other suspects has changed a key policy over privacy concerns, a move that could hamper future criminal investigations.
GEDmatch, which has more than 1 million genetic profiles in its database, is now asking users whether they want to allow police to access their DNA information. Previously, law enforcement could search profiles in the database unless a customer explicitly opted out.
Co-founder Curtis Rogers said the change was made after the site received significant criticism last month when it allowed Utah police to use the database while investigating a violent assault. Prior to the change, GEDmatch had allowed police to use its data only for rapes and homicides.
"We feel that this was an ethical issue and we really had to give people the choice," Rogers said. "I can't imagine why people wouldn't opt in. We are extremely pro law enforcement."
Many users on GEDmatch aren't consistently active and therefore might not know there's been a change in the rules. Last week the website began an email campaign to users, urging those who don't object to police searches to opt in.
Law enforcement agencies have increasingly relied on GEDmatch after it was used to find a man suspected of killing at least 12 people and raping scores of women in California between 1976 and 1986. A distant relative of the alleged Golden State Killer had uploaded DNA into GEDmatch. The genetic profile partially matched crime-scene evidence, indicating the person was related to the anonymous suspect who had eluded capture for four decades. From there, investigators built out that person's family tree, which led to the arrest last year of a 72-year-old former police officer.
But excitement over the powerful new forensic tool soon gave way to privacy concerns. One genealogy-loving person sharing his or her data could expose a whole family tree to law enforcement, and perhaps lead to the arrest of a relative they didn't even know.
Bowing to those concerns, GEDmatch made the change to its terms of service three weeks ago. Since then, 50,000 users have opted in to let police search their profiles. That's not nearly enough to make the database useful, said CeCe Moore, a genetic genealogist who has helped investigators solve dozens of cases. Since the change, profiles uploaded by Parabon NanoLabs, the company she works for, haven't matched with any usable DNA relatives.
"It's basically useless now," said Moore. "Our work on any new cases is significantly stalled."
The new roadblock highlights the precarious nature of a new paradigm where a third cousin you've never met might lead to your arrest. There are no warrants required for police to search GEDmatch. Deciding who may or may not access the data is solely the responsibility of Rogers and his co-founder, genealogy hobbyists who never imagined GEDmatch would one day be the crux of dozens of criminal investigations.
"There has to be some ethical and regulatory oversight of law enforcement use of genealogy databases," said Debbie Kennett, a genealogist and author. "GEDmatch should not be forced into the position of making difficult ethical decisions which have implications for millions of people."
Another genealogy website, FamilyTreeDNA, allows police to seek matches from crime-scene DNA samples it submits when investigating a homicide, sexual assault or kidnapping. That site is about the same size as GEDmatch's, so police may shift investigative efforts there. Parabon has solved more crimes with genetic genealogy than any other entity, but FamilyTreeDNA hasn't allowed Parabon to use its database.
It was genetic genealogy that identified the man who raped 79-year-old Carla Brooks in 2018. Her son Barton Brooks, 47, said he's shocked by the privacy debate.
"If my fourth cousin gets caught because of my DNA, that's his problem. He shouldn't have committed a crime," Barton Brooks said.
Without law enforcement access to GEDmatch, he said, other victims may not ever get the closure his mother did.
"They had completely exhausted traditional police detective work," said Brooks. "If it wasn't for GEDmatch, he never would have been caught."