If you’ve uploaded your DNA to a genealogical database to find relatives or ancestors or used a DNA testing service that keeps a database, you too could get an email asking you to help in a police investigation. For now, it depends on which company you used.
GEDmatch is one consumer database that explicitly allows law enforcement access. It does not provide DNA testing itself, but allows users to create an account for free, upload their raw DNA from companies like 23andMe or Ancestry, and search for genetic relatives in the database.
Founded in 2010, GEDmatch was originally a tool for amateur and professional genealogists. So it came as a surprise to founders Curtis Rogers and John Olsen when police said they used the database in the Golden State Killer case. Shortly after that revelation, GEDmatch updated its terms of service to allow law enforcement to use the database to investigate homicides and rapes. Police rushed to use the database for dozens of these cases.
The public also seemed eager to help law enforcement solve crimes. After the arrest of the Golden State Killer, DNA uploads to GEDmatch jumped from 1,500 a day to 5,000 per day, Rogers said in November 2018. By that time, GEDmatch had 1.2 million DNA profiles in its database.
But in May 2019, public sentiment seemed to shift. GEDmatch was criticized for granting an exception to Utah police who wanted to use the site to help identify the suspect of a violent assault, which GEDmatch didn’t allow under its terms of service. Critics worried it would open the door to the use of genetic genealogy for even more crimes — possibly even less serious ones.
In response, GEDmatch changed its terms of service again so that users had to proactively opt in to let law enforcement match DNA from suspects or victims to their profiles. Now police can’t search GEDmatch’s entire database — just for matches among users who have opted in. The move gave users more control over how their genetic data could be used, but it also made GEDmatch a lot less useful to police. But when it changed these rules, GEDmatch also expanded the range of violent crimes that law enforcement could use its database for, including murder, non-negligent manslaughter, aggravated rape, robbery, and aggravated assault.
Since then, only around 200,000 users out of a total 1.3 million have opted in to allowing their profiles to be used by law enforcement, according to GEDmatch. In December, the site was acquired by San Diego–based forensic science company Verogen, which said it plans to make the database easier to search and ensure data is being protected, but that GEDmatch’s terms of service will remain the same.
“Giving consumers the choice about whether they wanted their information to be used for law enforcement purposes drastically reduced the utility of that website for law enforcement,” Hazel says. “We’ve seen law enforcement move to the one company that has fully embraced its role in collaborating with law enforcement.”
That company is FamilyTreeDNA, a direct-to-consumer genetic testing firm similar to Ancestry and 23andMe that has around 2.5 million DNA profiles in its database. Last year, Buzzfeed News revealed that the company was working with the FBI to solve violent crimes. The company had recently amended its terms of service to allow law enforcement to use it to identify suspects of homicides, sexual assaults, and child abductions, as well as to help identify the remains of a victim.
Connie Bormans, lab director at FamilyTreeDNA, told OneZero that law enforcement has contacted the company “hundreds of times,” and that it will likely happen more often as police score more successes with genetic genealogy. The company allows police to see only relative matches to the DNA profile they upload, which is the same as what any other user would see. They are not given free rein to search any profile in the database.
“Law enforcement doesn’t get special treatment,” Bormans says. “They don’t see anyone’s genetic data. They’re interested in the matches.”
All new FamilyTreeDNA users and most existing ones are automatically opted in to law enforcement matching, though you can opt out, and about 3% of users have chosen to do so, Bormans says.
MyHeritage, another popular DNA testing company that provides genealogy and ancestry reports, says law enforcement is “strictly prohibited” from using its service unless there is a court order. The company, however, allows anyone to upload their raw DNA file to the website to get free DNA matches, so it’s possible that police could create fake profiles to try to match with you.
If you’ve used the most popular testing-only services, Ancestry or 23andMe, your DNA is safe from law enforcement — for now. Both companies are holding out against police use of their massive genetic databases. Ancestry has about 16 million DNA profiles in its database, while 23andMe has about 10 million. Since 23andMe was founded in 2006, it has received seven requests from law enforcement to access genetic data, according to a transparency report the company posted in February. To date, Ancestry and 23andMe have not allowed law enforcement to access customer genetic data, but they may soon be forced to do so.
In a transparency report released in January, Ancestry revealed that the company received one request seeking access to its DNA database through a search warrant. “Ancestry challenged the warrant on jurisdictional grounds and did not provide any customer data in response,” the company said.
But nearly half of Americans think law enforcement should be able to use personal DNA to investigate crimes, and some might be willing to relinquish some privacy if it means helping catch violent offenders. DNASolves, a new database launched in November by Houston forensic genomics company Othram, was designed with these people in mind. Unlike GEDmatch and FamilyTreeDNA, the site is specifically meant to aid in criminal investigations. If you upload your DNA to this database, it won’t show you any genealogical information about other users, but it will show law enforcement any relative matches to the samples they upload. In other words, there’s no benefit to users other than the possibility that their DNA could be used to catch a criminal.
“Instead of running into these issues of whether you’ve properly asked users for consent, why not make a database that’s primarily for law enforcement? That way, there’s no question about whether or not a person wants to get involved,” says David Mittelman, CEO and founder of Othram. Mittelman didn’t want to give an exact number of how many people have joined the database so far, but he says it’s in the several thousands.
He likens DNASolves to neighborhood watch programs that rely on a small group of people who aim to make communities safer. He says there are plenty of people who want to help police to help find criminals, even if they could implicate a relative. “People are willing to give up some amount of privacy if it’s paired with a good.”