by Craig Klugman, Ph.D.

This week I was on a panel discussing the topic of genealogical searching—running a DNA sample found at a crime scene against criminal, public and commercial DNA databases with the goal of not finding a suspect, but to find a relative of the suspect. This familial searchinvolves the National DNA Index System (NDIS) and investigative genealogy, which is looking in commercial (e.g. 23andMe, Ancestry) and public (GEDMatch) DNA databases for a familial match. The latter is what was done in the Golden State Killer case.

In most states, when a person is convicted of a crime, their DNA is uploaded to NDIS, which currently has nearly 18 million records. There are few national guidelines or laws to determine what goes into the national database, as the information is uploaded by the states, and they have a patchwork for laws and rules with the vast majority having little guidance. One problem with NDIS and local criminal DNA systems is that the data is skewed toward certain populations that have a higher conviction rate: predominantly minority and people of lower socioeconomic status. To combat this social injustice, it makes sense to want to expand to a more expansive set of data, which exists in the commercial and public DNA databases. They attract more Caucasian, middle- and upper- socioeconomic participants. Thus, these more expansive searches would seem to solve a social justice problem.

Investigative genealogy is particularly interesting from a bioethics perspective because the data here was given by people with the intent of (a) entertainment, (b) find missing family members (they may have been adopted, a child of a donor gamete, or suspect a parent is not a biological parent), (c) learn about their health, or (d) learn about their family’s origin. They may not have realized they were agreeing to law enforcement searches, or that by uploading their DNA, they could implicate their 300 closest relatives in a crime. This raises a host of ethical issues including privacy, transparency, who controls DNA, genetic literacy, consent, and harms.

The use of commercial and public DNA databases falls under a user agreement—a contract meant to protect the company’s intellectual property. Most of these entities recently added language permitting law enforcement searches. 23andMe’s user agreement now states that they will disclose your information to law enforcement with a court order, or government inquiry, or to protect its own interests. Ancestry says they will not give your information to law enforcement unless compelled to. GEDMatch now states that your data may be used for investigative searching: If you disagree, you can delete your information but that is difficult since any links or comments would not be removed (like Facebook—you can never remove all of your information). These agreements are long, and unlikely to be read thoroughly. GEDMatch has a 9 pages agreement; 23andme’s is 19 pages plus a 27-page privacy policy.

The benefit of such searches is to solve a crime and to provide closure to the family of a victim. These techniques can also identify the remains of soldiers returned after a war has ended (as is being done with the recently returned bodies from North Korea) or to reunite children forcibly separated from their parents by the U.S. government.

But the risks to this search may indeed outweigh the benefits. First, consider the invasion of privacy. The goal here is to find a partial match to a person not suspected of a crime. This requires looking through many people’s information to find that match. It would be like the police going through every house in your town because someone in that town was related to a potential suspect. The only guilt a target of this search has is being related to someone whose DNA was found at a crime scene.

There are other harms to this sort of search: Privacy is a civil liberty; being under suspicion is stressful—the anxiety of thinking your DNA file could be searched at any time; or a family could experience a social stigma that someone in your family might be. Another concern is the assumption that “family” means DNA. No one considers co-raising, adoption, fostering, or other arrangements where family is a social, not biological choice. What about unintended outcomes: the child whose father is not the biological parent and no one knows?

There are problems with genetic misconception: Because of shows like CSI where the DNA is definite (they always get their person), jurors may believe that a DNA match is an exact science, when it is actually quite complicated (how many alleles are tested for one; quality issues, contamination problems for another). But when an expert gives testimony, jurors are more likely to believe them because it is “science”. Thus, there have been cases of jurors finding a person guilty when there was no other evidence pointing to them.

Of course, this all assumes that the labs and systems work as they claim. The New York Times posted an article last week about a study that sent DNA samples to 108 labs looking for matches. The samples included a red herring, an innocent person. Seventy-four of the labs matched the innocent’s person DNA at the scene. There are problems with varying standards, less than rigorous lab certification programs (with lots of conflicts of interest), and a lack of understanding of secondary DNA transfer. These problems raise issues of nonmaleficence: Are innocent people going to jail because of problems with the analysis or with explaining the analysis to jurors? Should we be doing this if even one innocent person spends decades behind bars? Or is sentenced to death row?

Since this technology exists and has been used, it is a bell that cannot be unrung. While NDIS is surrounded with rules, regulations, and procedures as to when and how it can be used, commercial and public databases exist in a wild west—there are few rules. Two approaches are available: Regulate law enforcement’s use of these programs or regulate the databases (companies) themselves.

All investigative genealogy efforts should only be done transparently (unless a court orders it to be closed) with notification to the DNA donor of who, when, where, and how the records were searched. Currently, 23andMe and Ancestry state that they will inform when your record is searched, unless a court forbids notification (it could tip off the suspect). GEDMatch offers a public report of law enforcement searches: In 2017, they received 34 requests and complied with 31 of them.

Another suggestion is to require a court order for these searches: After all, a court order is needed to look into your cell phone. Companies and law enforcement agencies could establish committees that would review applications for the search and provide oversight. For example, the UK has the National DNA Database Ethics Group and California has established the Familial Search Committee. Some states limit investigative searching to only serious crimes (murder, sexual assault, terrorism). Companies could set up a choice for people to opt in or opt out when they upload their DNA.

Do we value personal privacy more or solving crimes more? If the former than investigative genealogy on public and commercial databases ought to be regulated. If the latter, then we should be getting DNA samples from every single person in the country. How about taking it when people enter the country for the first time, how about for every newborn, how about when you get a marriage license, or a driver’s license. As you can see this latter choice sends us down a slippery slope to a place where each person in the US is mandated to give a sample, even if we have to tie them down to get it. Clearly this is a violation of ethical (and perhaps legal) privacy. As we stand at the crest of a new age of DNA identification, it is important that we are proactive in setting up the system of oversight because doing nothing threatens us all.

Disclosure: I have not had my DNA tested and do not plan to do so.