91av

THE Golden State Killer terrorised California with a spree of murders, rapes and burglaries between 1974 and 1986. Then the killer went quiet, and the case went cold. But on 24 April 2018, the Sacramento Police Department arrested Joseph James DeAngelo, an ex-police officer, in connection with the killings. His DNA led them to him – and sparked a growing ethical debate.

The detectives identified DeAngelo after uploading DNA evidence from a 1980 Golden State Killer rape case to GEDmatch, a website that lets people trace lost relatives by adding genetic information to a genealogy database. Among the 1 million users of the service, the detectives found several relatives of the killer. All were third cousins, so shared at least one set of great-great-grandparents with the Golden State Killer. Building out the family tree, they used the killer’s location and approximate age to narrow the suspect list.

Although 1 million sets of DNA might seem too small a sample to find one person – considering the US population is 325 million – the investigators only needed a little luck. Yaniv Erlich of genetic ancestry company MyHeritage and his colleagues calculate that a database with genetic info on just 5 million people would be large enough to find a third cousin match for almost any white person in the US, because most people on consumer genetic databases fall into this ethnic group.

The team hunting the Golden State Killer is one of a number of groups turning to genetic ancestry to solve mysteries. Colleen Fitzpatrick at the non-profit DNA Doe Project has been using GEDmatch to find relatives of unidentified victims. “We didn’t know they were doing the same thing we were until we saw the news,” she says. “It was an idea whose time had come.”

“Every year has been a record year for people uploading genetic data to consumer sites”

Parabon NanoLabs, a biotechnology firm in Virginia, also joined the fray after DeAngelo was arrested.

All these groups use units called centimorgans to measure the similarity between two strings of DNA. One centimorgan is on average 1 million base pairs – the linked As and Ts, and Cs and Gs of our genetic code. The more closely related two people are, the more centimorgans of DNA match up (see “graphic”).

Genetics firm 23andMe has found that . “You take a random person and this person becomes a beacon that illuminates, say, 300 people – their third, second and first cousins,” says Erlich. “In a population of 250 million Caucasians, it doesn’t take so much to illuminate everyone.” In other words, genetic information relating to the majority of the US population is on these databases, even though few have signed up. The legal ramifications of this are only now becoming clear.

Neither privacy law nor property law is well-adapted to dealing with genetic data, which is unavoidably shared among many people, says Natalie Ram at the University of Baltimore, Maryland. You could treat it like property held by married couples, she says – one partner can’t give away shared property without the other person’s permission. But genetic information is so widely spread that it would be impossible to coordinate consent from everyone who shares your DNA.

The situation is evolving, but law enforcement won’t want to give up this powerful tool. Police databases built with DNA analysis hold only about 20 genetic markers. With genotyping for genealogy, hundreds of thousands of markers are put to use, says CeCe Moore, a genetic genealogist at Parabon Nanolabs, who has helped solve seven cases since DeAngelo was arrested. And not just historical cases (see “The genetic case files”).

“After the Golden State Killer case, every law enforcement agency sat up and took notice,” she says. “I still have a long list of cases waiting for my attention.”

Ethical issues

Consumer genetics services have been available for some time, so why are police just starting to exploit them? Before this year, GEDmatch wasn’t large enough to find distant relatives, Moore says, and it is the only database that allows access for this kind of work. Firms like 23andMe and – others big enough to run such a search – don’t allow police to upload forensic profiles.

Curtis Rogers, co-founder of GEDmatch, says that the use of his database in the Golden State Killer case came as a surprise. “I spent two weeks not sleeping, trying to figure out the ethics of this situation. Do we ensure that the privacy of all our users is protected? Or do we go after murderers who make Jack the Ripper sound like a choir boy?”

In the end, he says, GEDmatch doesn’t have the legal resources to prevent the site being used this way. “We could have published a statement that says we require a court order for police to use our site, but it’s only words,” he says. “They could go ahead and do it, and they probably would.”

Since the use of GEDmatch in the Golden State Killer case came to light, the website has updated its terms of service to inform users that their data could be used in a similar fashion. And last week, firms including 23andMe and on how they will respond to law enforcement requests for data.

“Some of my colleagues in genetic genealogy don’t approve of my choice to work with law enforcement,” Moore says. She says she had been approached to do such work before, but waited until GEDmatch updated its rules. “I don’t want to use the DNA of anyone who doesn’t want it used in these cases,” she says.

Despite uniquely identifying you, DNA records are considered in US law to be de-identified information that can be given to the police without a court order. And law enforcers are likely to want to gather DNA from other sources, given the success with GEDmatch. Some US states allow DNA samples to be taken from anyone who is arrested, even if they are not charged with a crime. Taking part in a research trial could also mean signing away your genetic data. And even if you don’t do these things, someone you are related to might. “Every year has been a record year for people uploading genetic data to these consumer sites. It goes up exponentially,” says Erlich.

The consequences of familial databases stretch beyond criminal investigations. Undercover operatives could be revealed, and egg and sperm donors could be unmasked without their knowledge or consent.

Of course, there are upsides. Holocaust survivors and adopted people have tracked down long-lost relatives, and families have been given answers about deceased loved ones. We now need to decide where to draw the line.

“If the person arrested is the Golden State Killer, bringing him to justice is a significant victory,” says Ram, but a wish to solve crime cannot override privacy, she adds. If police push the use of genetic data too far, there may be a backlash against genetic research and testing.

“I come down on the side of the families of the victims,” Moore says. “This could also work as a deterrent. If we stop one crime, that would be worth it.” She says people can still choose to use a consumer genetics company that doesn’t share data with police.

But none of us can avoid it for long. If a distant relative puts their DNA online, yours is out there too, whether you like it or not. Trying to go back and change that now is futile, Fitzpatrick says.

This article appeared in print under the headline “Family-tree forensics”