How private is your DNA on ancestry websites? Questions emerge after family of ‘Golden State Killer’ unwittingly led to his arrest
A man believed to be the notorious ‘Golden State Killer’ was arrested after his family members put their DNA online; how secure is your information on such sites?
Millions of people are doing it – packing up samples of their saliva and mailing it off to an online genealogy company to analyse their DNA and help trace their family tree. Any without knowing it, they may be helping law enforcement crack difficult cases.
A partial DNA match with an unidentified relative of Joseph James DeAngelo on a genealogy website led to DeAngelo’s arrest as the suspect in the notorious Golden State Killer case in California, the Sacramento County District Attorney’s Office said on Thursday.
Investigators recently found a “familial DNA match” to a sample collected years ago at a crime scene linked to an attacker known variously as the Golden State Killer, the Original Night Stalker and the East Area Rapist.
The family link then led the Sheriff’s Department to DeAngelo’s home on a quiet middle-class street in Citrus Heights, where they obtained a direct DNA sample from him after following him and picking up an unidentified object he discarded, according to Sheriff Scott Jones.
When that sample came back as a hit for a series of crimes, DeAngelo was arrested.
Sacramento County District Attorney Anne Marie Schubert declined to detail how her office obtained the relative’s DNA profile or accessed a genealogy database, raising questions about the privacy of personal genetic information on websites.
“I haven’t come across this before,” said John Roman, a senior fellow at research organisation NORC at the University of Chicago. Roman is a forensics expert and studied the use of DNA in criminal investigation in 2005-09 in Orange County and Los Angeles.
“If that’s how the match was obtained, then I would think there would be court battles to come.”
Colleen Fitzpatrick and Margaret Press, who run a non-profit organisation called the DNA Doe Project, said one of DeAngelo’s relatives may have shared DNA results with one of several public DNA matching websites, where people upload genetic data in search of biological parents or other long-lost relatives after obtaining results from a commercial site.
The Sheriff’s Department then could have gone to one of those sites, loaded DNA information from Golden State Killer crime scenes and found partial matches.
“It’s like working a puzzle,” Press said. “It’s painstaking.”
Typically, genetic database searches by law enforcement are limited to those arrested or convicted of crimes.
California became the first state to authorise such familial line testing in 2008, but it has strict limits. Searches can be requested only when law enforcement has a suspect, and the DNA is only tested against databases containing samples from people arrested or convicted of felonies.
The FBI maintains that system, but each state manages its own DNA database. In California, it’s maintained by the California Bureau of Investigation.
The California Attorney General’s Office on Thursday said it had run 192 familial searches since 2007 in 108 cases.
California expanded whom it collects DNA samples from in a 2004 ballot measure that was approved by 62 per cent of voters.
Proposition 69, called the DNA Fingerprint, Unsolved Crime and Innocence Protection Act, allowed law enforcement to collect DNA from any person arrested on felony charges or arrested for a misdemeanour but having a felony record.
The person doesn’t have to be charged or convicted for the sample to be taken. The law sparked legal challenges and consternation from privacy advocates who feared it went too far – especially since those ultimately not convicted of crimes are not automatically removed.
The California Supreme Court in April upheld the law.
Familial testing has successfully led to arrests in 10 cases in California, including the so-called Grim Sleeper in Los Angeles.
In May 2016, the “Sleeper”, Lonnie Franklin Jnr, was convicted of 10 counts of first-degree murder for decades-old crimes in southern California.
A familial DNA match led to the arrest of Sacramento’s “Roaming Rapist”, Derek Sanders. He attacked women and two teenage girls between 1998 to 2003.
Investigators eventually homed in on him after getting a partial DNA match with his brother – a convicted rapist with DNA in the system. Sacramento County sheriff’s deputies followed him to a fast-food restaurant and collected his garbage to obtain a DNA sample from a straw he had used. That sample matched DNA from the crime scene.
Sanders was sentenced to 396 years to life in 2014.
The California Attorney General’s Office said Thursday that it had run available DNA in the Golden State Killer cases through familial searches of its databases, but never had a hit.
Mehul Anjaria, a DNA criminology consultant in Los Angeles, said using familial DNA has its limits. “Only the closest of relatives are helpful,” he said. “Certainly parents and biological siblings, those are good. Beyond that, it gets trickier and trickier.”
But it can also be fruitful. A 10 per cent match indicates two people are cousins. A 50 per cent match signifies they’re either siblings or have a parent-child relationship, Fitzpatrick said.
Anjaria said the use of private genealogy customers’ genetic materials could raise privacy and civil liberty problems. Someone mailing a saliva swab probably expects the genetic results will be kept private, he said.
The major genealogy companies say they don’t freely share customers’ DNA information with law enforcement, but they may comply with subpoenas and court orders to turn over the materials. Others promise to fight for customers’ privacy. Those policies are spelt out on the companies’ websites.
“It’s our policy to resist any law enforcement inquiries with all legal and practical means at our disposal,” said Andy Kill, spokesman for 23andMe. “We have had a handful of inquiries over the years, and have never given customer information to law enforcement officials.”
Ancestry, 23andMe and MyHeritage said they had no involvement in the DeAngelo case. The DA’s office hasn’t said which companies were connected to the investigation, other than to say there was more than one.