Limitations to the Police Use of Geneology Databases

[BillTre]

In a first (reported in Science mag news article), The US Dept of Justice has developed new rules concerning when police can use Geneology DNA databases in efforts to solve crimes.
This is intended to deal with privacy issues of the large number of Americans that might be tracked in this way.

The DOJ interim policy, which takes effect on 1 November, is intended to “balance the Department’s relentless commitment to solving violent crime and protecting public safety against equally important public interests,” such as privacy and civil liberties, a press release states. The policy says “forensic genetic genealogy” should generally be used only for violent crimes such as murder and rape, as well as to identify human remains. (The policy permits broader use if the ancestry database’s policy allows such searches.) Police should first exhaust traditional crime solving methods, including searching their own criminal DNA databases.

 

[russ_watters]

In a first (reported in Science mag news article), The US Dept of Justice has developed new rules concerning when police can use Geneology DNA databases in efforts to solve crimes.
This is intended to deal with privacy issues of the large number of Americans that might be tracked in this way.

This disappoints and concerns me. My concern is that the policy is internally inconsistent, which may make it ripe for a court challenge.

...the inconsistency is differing rules based on severity of crime. The Bill of Rights tends to be absolutely/uniformly applied.

 

[StatGuy2000]

This disappoints and concerns me. My concern is that the policy is internally inconsistent, which may make it ripe for a court challenge.

@russ_watters , when you talk about the policy being internally inconsistent, are you specifically referring to the broader use of ancestry databases if their policy allows such searches (as paraphrased from the quote in the original post)?

I'm also wondering whether perhaps a better approach is to not use ancestry DNA data at all unless police departments can make a compelling case before a judge that using such data is critical in a crime investigation, and only after exhausting all other avenues. This is not all that different in my mind from police and prosecutors seeking search warrants.

 

[russ_watters]

@russ_watters , when you talk about the policy being internally inconsistent, are you specifically referring to the broader use of ancestry databases if their policy allows such searches (as paraphrased from the quote in the original post)?

I realize I was vague: see my edit.

 

[gmax137]

I have never had one of those DNA tests done so I don't know what is in the "contract." I assume it says something like "we can do whatever we want with your sample and results." In that case I don't see how anyone who sends in a swab has an expectation of privacy.

 

[BillTre]

I think @russ_watters put his finger on two interesting issues :

1) Thresholds among Different Kinds of Crimes for what is permissible evidence (the "internal inconsistency").
Perhaps there are similar rules for other classes of evidence. I don't know.

2) Privacy/Expectation of Privacy.
Seems like a medical record in a way (biological information on your body) and therefore one might think it would be treated like one.
Not sure what that means WRT the police searching your medical records in different situations, since I don't know police medical records evidence rules.
On the other hand, if one signs up to free up your info for police use in some way (perhaps with your own limits to what kind of crimes it is used for), then your info should be available for appropriate uses.

In other cases:

to not use ancestry DNA data at all unless police departments can make a compelling case before a judge that using such data is critical in a crime investigation, and only after exhausting all other avenues. This is not all that different in my mind from police and prosecutors seeking search warrants.

A search warrant approach makes sense, but I don't think (based on my long experience of watching TV detective shows/movies) a search warrant will penetrate into medical or lawyer restrictions.

 

[Bystander]

I have never had one of those DNA tests done so I don't know what is in the "contract." I assume it says something like "we can do whatever we want with your sample and results." In that case I don't see how anyone who sends in a swab has an expectation of privacy.

My impression has been that the "results" become "patented property" of the company doing the sequencing, and therefore are "public record" and not/no longer covered by the fourth amendment; hence the legal foo-farah.

Seems like a medical record in a way (biological information on your body) and therefore one might think it would be treated like one.

If the sequencing is done for medical purposes (cancer treatment?), one legal treatment, for vanity purposes, the other legal status, public record.

 

[gmax137]

Seems like a medical record in a way (biological information on your body) and therefore one might think it would be treated like one.

I'm skeptical. Anyone here who has had the test done? From the USA? Did you sign a HIPAA release? If they don't make you sign the release then they aren't treating it as a medical record.

As a side note, in the criminal case I read about the genetic data was from a relative of the murderer, like his great grand-niece or something like that. So, they had the bad-guy's DNA but no way to link it to anyone until they found a blood relative in the Ancestry database.

 

[Vanadium 50]

Russ, I assume you don't have a problem using this for identifying human remains.

As far as varying standards for varying crimes, many jurisdictions have classes of offenses: US Federal, for instance has 5 classes of felonies and 3 of misdemenor. Would you consider an application applied consistently within these classes to be OK? (i.e. "this can only be used for Class A and B felonies".)

 

[StoneTemplePython]

I have never had one of those DNA tests done so I don't know what is in the "contract." I assume it says something like "we can do whatever we want with your sample and results." In that case I don't see how anyone who sends in a swab has an expectation of privacy.

So this misses the mark

As a side note, in the criminal case I read about the genetic data was from a relative of the murderer, like his great grand-niece or something like that. So, they had the bad-guy's DNA but no way to link it to anyone until they found a blood relative in the Ancestry database.

and this hits it... the issue, e.g. in Golden State killer case, is extended family genes are 'close enough' that when your cousins, etc. submit to 23and me or whoever, they are in effect waiving your right to privacy here (supposing it exists) without your consent. It's hard to feel bad for the Golden State killer but that case is spooky for a few different reasons...

 

[Borg]

It's called a Familial DNA Search.

Familial DNA searching (sometimes referred to as "familial DNA" or "familial DNA database searching") is the practice of creating new investigative leads in cases where DNA evidence found at the scene of a crime (forensic profile) strongly resembles that of an existing DNA profile (offender profile) in a state DNA database but there is not an exact match. After all other leads have been exhausted, investigators may use specially developed software to compare the forensic profile to all profiles taken from a state's DNA database to generate a list of those offenders already in the database who are most likely to be a very close relative of the individual whose DNA is in the forensic profile.

In addition to the above, police departments have also been using publically available DNA from other registries like 23andme which has greatly increased their ability to find a person. At this point, it is highly likely that if the police are trying to find you with a familial DNA search, they will find you.

 

[gmax137]

they are in effect waiving your right to privacy

Interesting point. I'll have to ponder that.

 

[Borg]

Another one gets a new home in prison curtesy of a familial DNA search. Once they were pretty sure, the police followed him around until he threw away a straw that he used.

https://www.nbcwashington.com/news/...-of-Lifeguard-at-Virginia-Pool-563289462.html

 

[StatGuy2000]

Something I had not considered until now is whether the genealogical DNA databases are actually considered "public" from a legal standpoint.

Isn't it the case that the majority of the genealogy DNA databases are essentially collected and stored/curated by private companies such as 23andMe, AncestryDNA, MyHeritage?

If so, then I'm wondering if the DNA data thus collected would be considered the intellectual property of said companies, and thus police will need a court order to have access to these data anyways. Unless there is some prior agreement between the companies and the police granting them special access to such data.

 

[bhobba]

Interesting topic.

Personally having worked as a programmer for the Australian Federal Police, most people do not know it, but at the time there was a computer system we developed and maintained called link analysis. The way it worked is as police go about their daily work they take note of tons of seemingly irrelevant information - such as the registration numbers of all the cars near a house they visited while being called out for say noise disturbances. The program then analysed, following these links to see if it could come up with a person of interest in some investigation. Many, probably even most, were false leads, but any lead is better than none. Famously one of our most prominent citizens was under investigation this way and somehow the media got a hold of it and there was hell to pay. He was cleared and it all died down.

Still this was nearly 40 years ago now and the technology and sophistication of such tools has only gotten better. The police keep all sorts of information about citizens they are totally unaware of. Its not publicized much in the hope the public doesn't rebel against it. I think the DNA issue is simply a small part of a much wider 'concern' that the public is unaware of - and DNA when the police can get is stored and used - but it part of a lot more information that is kept. Personally I have zero worries about it - but that's just me because I worked with the police on such systems and know its value in law enforcement and keeping society safe. But we live in a democratic society and its the citizenry that needs to decide this one via the democratic process. We already have a backlash against companies like Google doing similar things to target advertising, and even influence political campaigns. A Data Scientist at a university near where I live was able to accurately predict the outcome of the last Federal Election here in Aus by looking at Twitter posts. All the polls said Labor (similar to US Democrats) would win but the Libs (similar to the US Republicans) had a surprise victory. They interviewed him and he was very off hand about it - polls do not really reveal what people think because it depends somewhat on how you frame the question. His analysis removes that defect.

Thanks
Bill

 

[russ_watters]

Russ, I assume you don't have a problem using this for identifying human remains.

Of course not. Maybe I'm being unclear here: I'm in favor of using genealogy databases in crime fighting. My concern was strictly regarding the creation of what I see as bad regulations that leave the results vulnerable to legal challenge.

As far as varying standards for varying crimes, many jurisdictions have classes of offenses: US Federal, for instance has 5 classes of felonies and 3 of misdemenor. Would you consider an application applied consistently within these classes to be OK? (i.e. "this can only be used for Class A and B felonies".)

No, that's not the issue at all. The issue is that privacy doesn't have classifications, or rather that you can't apply severity/class of crime when determining if privacy may be violated.

Police can either search the trunk of your car (or house) or they can't, based on having probable cause/warrant or not. They can't decide to search based on believing there could be a body in it but decide not to search based on their being an ounce of pot in it. Probable cause doesn't have grades for severity of crime. "But judge, I know I was only supposed to be looking for things in plain sight, but this is a murder case, so I think it is ok that I opened a locked door."

 

[russ_watters]

I'm skeptical. Anyone here who has had the test done? From the USA? Did you sign a HIPAA release? If they don't make you sign the release then they aren't treating it as a medical record.

This is the internet -- the privacy statement is here, and no, there is no HIPAA form, because DNA isn't medical records:
https://www.ancestry.com/cs/legal/PrivacyForAncestryDNATesting

 

[gmax137]

This is the internet

It took me a minute to figure out what you meant by that. You're right, I was being lazy (asking rather than looking for myself).

 

[Vanadium 50]

The issue is that privacy doesn't have classifications, or rather that you can't apply severity/class of crime when determining if privacy may be violated.

So the internal inconsistency you talk of is an undesirable feature, but even if it were fixed, you'd still object on privacy grounds. Do I have your position correct?

Let's explore this a bit more. Suppose the only use of DNA is after it was expressed. Suppose it was known that the killer had a specific blood type. Would it be acceptable to you to use the suspect's parents' blood types?

Would it be acceptable to you to use this during an investigation, even if it were not admissible? Or is this the fruit of the poisonous tree?

 

[russ_watters]

So the internal inconsistency you talk of is an undesirable feature, but even if it were fixed, you'd still object on privacy grounds. Do I have your position correct?

Still no. Maybe if I cut out everything else in that post it will be more clear:

I'm in favor of using genealogy databases in crime fighting.
[emphasis added]

I'll try it another way too: if people are willing to freely provide their genetic heritage data to millions of total strangers (via a corporate intermediary) I don't think it should be a problem if one of those total strangers is a actually profile uploaded by a police officer.

 

[Vanadium 50]

So, what do you think of the following. OK or not?

1. Suspect gives his DNA to a database; police then use it against him. (Presumably OK)
2. Suspect does not give his DNA to a database, but family members do. Police use this DNA as evidence against the subject.
3. Nobody gives their DNA to a database, but family members give the police their DNA "to exclude them". The police then use this against the subject, who (under advice of counsel) refused to provide his.
4. Nobody gives their DNA to a database, but family members are compelled to give their DNA to the police. Since they are not suspects themselves, the 5th amendment doesn't apply. The police again use this against the subject, who (under advice of counsel) refused to provide his.

 

[Rive]

Police use ... DNA as evidence against the subject.

I'm not too familiar with the legal system there, but for me the key of the issue seems to be the legal framework for getting the DNS of an actual suspect without consent: some work for a judge, like a search warrant or so.
The part about the genealogy database and all that feels like a poor smoke screen for the straw-hunting cops.
I won't think that just having a given set of relatives alone would qualify for making anybody a suspect.

 

[BillTre]

So, what do you think of the following. OK or not?

1. Suspect gives his DNA to a database; police then use it against him. (Presumably OK)
2. Suspect does not give his DNA to a database, but family members do. Police use this DNA as evidence against the subject.
3. Nobody gives their DNA to a database, but family members give the police their DNA "to exclude them". The police then use this against the subject, who (under advice of counsel) refused to provide his.
4. Nobody gives their DNA to a database, but family members are compelled to give their DNA to the police. Since they are not suspects themselves, the 5th amendment doesn't apply. The police again use this against the subject, who (under advice of counsel) refused to provide his.

Another possible scenario I have recently heard of is:

5. That the police get DNA by legal but surreptitious means, like following the suspect around until he/she uses a straw and discards it (which they then grab). Something like this was in the news and so presumably legal (but without consent).​

​

​

I won't think that just having a given set of relatives alone would qualify for making anybody a suspect.

Depending on the specifics of the DNA involved, getting DNA from a set of relatives could provide strong evidence for identifying a specific suspect. Statistically, it could finger the suspect very specifically.

 

[Vanadium 50]

I won't think that just having a given set of relatives alone would qualify for making anybody a suspect.

The killer leaves blood behind, and it's type, um, T-negative. A very rare blood type - one person in a million have it. The killer refuses to let the police type his blood, but they know his father was T-negative from military records. Can they use this as evidence or not? Can they use this evidence to get a warrant to search for more evidence?

 

[gmax137]

Can they

In the US?

nor shall be compelled in any criminal case to be a witness against himself

pretty clear to me, but I'm an engineer not a judge...

edit: further googling shows in the US, it varies by state. surprising. but as suggested, this is a question for judges not physicsforums

 

[BillTre]

Here is a NY Times article that provides an update on this issue.

A detective has obtained a warrant to gain access to GEDmatch, which was very restrictive to police access.

In July, he asked a judge in the Ninth Judicial Circuit Court of Florida to approve a warrant that would let him override the privacy settings of GEDmatch’s users and search the site’s full database of 1.2 million users. After Judge Patricia Strowbridge agreed, Detective Fields said in an interview, the site complied within 24 hours. He said that some leads had emerged, but that he had yet to make an arrest. He declined to share the warrant or say how it was worded.

Detective Fields described his methods at the International Association of Chiefs of Police conference in Chicago last week. Logan Koepke, a policy analyst at Upturn, a nonprofit in Washington that studies how technology affects social issues, was in the audience. After the talk, “multiple other detectives and officers approached him asking for a copy of the warrant,” Mr. Koepke said.

 

[russ_watters]

So, what do you think of the following. OK or not?

1. Suspect gives his DNA to a database; police then use it against him. (Presumably OK)
2. Suspect does not give his DNA to a database, but family members do. Police use this DNA as evidence against the subject.
3. Nobody gives their DNA to a database, but family members give the police their DNA "to exclude them". The police then use this against the subject, who (under advice of counsel) refused to provide his.
4. Nobody gives their DNA to a database, but family members are compelled to give their DNA to the police. Since they are not suspects themselves, the 5th amendment doesn't apply. The police again use this against the subject, who (under advice of counsel) refused to provide his.

I'm ok with all except possibly the last one. The "not a suspect" part is an odd criteria to me.

 

[gmax137]

Suspect does not give his DNA to a database, but family members do. Police use this DNA as evidence against the subject.

I don't think is what actually happens. The prosecutor does not go into trial saying, "the DNA evidence shows the killer is this (family member's) great uncle. This man (the suspect) is her great uncle. Therefore he did the killing."

Rather, the family member's DNA helps the police identify the suspect; once they "know" who to look into, their further investigation produces the actual evidence which is then used "against the subject."

 

[Ygggdrasil]

MIT Technology Review has an interesting article that argues that these geneology databases pose a national security threat:

If a foreign counterintelligence agency grabbed a million American DNA profiles, that country could use genetic genealogy to identify the true identity of American spies or diplomats, locate their relatives, or discover genetic kompromat like unacknowledged children. Since other countries don’t have such databases for the US to steal, the risk would not be symmetric.

https://www.technologyreview.com/s/...h-golden-state-killer-security-risk-hack/amp/
The article also notes that security researchers recently found and disclosed various security vulnerabilities to the GEDMatch site that the police used to ID the Golden State Killer. The site, run by five part time volunteers, notes that they have no way of knowing whether their databases have been compromised and the small organization likely does not have the resources to ensure its data is secure from professional, government-sponsored hackers.

Just because the US decides on guidelines for the use of genetic information does not mean that other governments around the world will follow.

 

[BillTre]

Well, that's an interesting twist.

 

[Bystander]

US decides on guidelines for the use of genetic information

DNA was used in a rather high profile "operation" just recently (no further information is permitted per PF guidelines) that suggests "symmetry/assmmetry of risks" is open to some debate; my apologies to MIT.

 

[StatGuy2000]

MIT Technology Review has an interesting article that argues that these geneology databases pose a national security threat:

https://www.technologyreview.com/s/...h-golden-state-killer-security-risk-hack/amp/
The article also notes that security researchers recently found and disclosed various security vulnerabilities to the GEDMatch site that the police used to ID the Golden State Killer. The site, run by five part time volunteers, notes that they have no way of knowing whether their databases have been compromised and the small organization likely does not have the resources to ensure its data is secure from professional, government-sponsored hackers.

Just because the US decides on guidelines for the use of genetic information does not mean that other governments around the world will follow.

It's an interesting argument, and is certainly something that private firms specializing in genealogy databases need to seriously consider in terms of their cybersecurity.

 

[StatGuy2000]

Here is a NY Times article that provides an update on this issue.

A detective has obtained a warrant to gain access to GEDmatch, which was very restrictive to police access.

Without knowing more about the scope of the warrant or its wording, it is difficult to know the extent of the precedent this would pose.

All the same, I personally have no issue with law enforcement agencies using data from genealogy databases so long as they can demonstrate that they can provide justification to do so, by applying for a search warrant, signed off by a judge (as the detective mentioned in this NY Times article has done).

 

[sysprog]

So, what do you think of the following. OK or not?

1. Suspect gives his DNA to a database; police then use it against him. (Presumably OK)
2. Suspect does not give his DNA to a database, but family members do. Police use this DNA as evidence against the subject.
3. Nobody gives their DNA to a database, but family members give the police their DNA "to exclude them". The police then use this against the subject, who (under advice of counsel) refused to provide his.
4. Nobody gives their DNA to a database, but family members are compelled to give their DNA to the police. Since they are not suspects themselves, the 5th amendment doesn't apply. The police again use this against the subject, who (under advice of counsel) refused to provide his.

The Supremes have decided that freedom of speech and of the press are inclusive of rights to not speak or print.

That would presumably include not giving up your DNA without a warrant.

For me. it matters how badly we want a particular bad guy (e.g. Golden State Killer) -- if he's a serial rapist/killer or as bad or worse then I favor bending the rules -- in Chicago there was a guy who was running a dope spot at an el station, and I didn't much care when I, on my way to a nearby grocery store, would at times see him and his associates plying his/their trade. I deplore the associated self-destruction being facilitated, and I especially detest pushers, but in general I sadly let such things not command much of my attention. But when this horrible bad guy had some other horrible bad guys hold down a homeless guy, and the leading bad guy poured gasoline on the poor homeless guy, and then lit the guy on fire, burning him to death (it was presumably premeditated -- people don't generally walk around carrying a full 3-gallon gasoline container just on happenstance), I became infuriated, and resolved to go hunting against at least the primarily instigatory horrible bad guy (I was the Assistant Director of a martial art school in the neighborhood and I was thinking about a Civilian Marine Unit giving that horrible bad guy a new address 8 miles East into Lake Michigan), but then the Chicago Police ramped up and got him first.

 

[gmax137]

That would presumably include not giving up your DNA without a warrant.

That was my initial thought as well, but it is more complicated than that. State laws vary but many states can compel DNA sample once they have arrested you. And the US Supremes said that was OK; I believe in a case involving the Maryland state laws.