What Cops Are Doing With Your DNA

Listen to this episode

S1: Morning, everybody. For those of you that don’t know, my name is Anne Marie Shubert. I’m the district attorney of Sacramento County.

S2: I remember watching this press conference. It was April of twenty eighteen, and the D.A. came out to make her announcement. She’s standing in front of a crime lab surrounded by a bunch of cops. And she was there to say that finally, almost cinematically, investigators had found the Golden State killer, this man who had terrorized California throughout the 70s and 80s.

Advertisement

S1: There were upwards of 50 rapes, 12 murders, crimes that spanned 10 years across at least 10 different counties.

S2: Decades had passed. Law enforcement hit dead ends and then regrouped. Amateurs on the Internet swapped theories. And then after more than 40 years, they got him. And they’ve done it by putting his DNA profile on genetic genealogy Web sites.

S1: It is fitting that today is national DNA day. We found the needle in the haystack

S2: and it was right here in Sacramento. And Joseph James D’Angelo was arrested, pleaded guilty, and he’s serving 26 life sentences. And his case was billed as a triumph for crime solving and genetic genealogy. And it marked a seismic shift in how investigators use DNA in cold cases. Do you remember what you thought when you heard that genetic genealogy had been such a big part of that case?

Advertisement
Advertisement

S3: I was really intrigued because I have a biology background before I went to law school, and I never thought that you would sort of come together in this way.

Advertisement
Advertisement
Advertisement

S2: That’s Nila Bala. She’s a senior attorney at the Policing project at NYU Law School, and she studies how technology and Policing come together.

S3: It was really fascinating to me that it had been harnessed in this manner that I mean, I knew DNA was used to solve cases. Right. That’s been the case for a long time. But suddenly this this entire database was opening up so many possibilities for solving cold cases.

S2: Later, Nila began to realize that there were issues with the D’Angelo search Cops had IDed the wrong person. At first. They search two commercial DNA databases covertly. They even created a fake user profile. From Miller’s point of view, police were using this technology with no real safeguards.

Advertisement

S3: This really is the wild, wild West. There aren’t any rules or regulations in guiding law enforcement on when to use this technology and how to use it.

S2: Now, more and more people agree with her, including lawmakers in two states, Maryland and Montana. They’re rethinking what law enforcement should be able to do with consumer DNA databases. Today on the show, when Cops want a peek inside your genetic family tree, should anything stop them? I’m Lizzie O’Leary and you’re listening to what next? TBD, a show about technology, power and how the future will be determined. Stick around. From. Genetic genealogy might sound complicated, but it’s not all that different from building a basic family tree. You just do it by comparing DNA instead of last names or a common great grandparent. Nila Bala says that the number of companies offering personal DNA testing has exploded in the past few decades.

Advertisement
Advertisement

S3: So the idea is that if you set your DNA into a company like twenty three and me or Ancestry.com, you’d get some results, including of raw DNA file, and then if you wanted to find more family members, you could upload it to an open source database. These databases have people who’ve sent their DNA to lots of different services, like 20 through me and Ancestry.com and put them all together in one place.

Advertisement
Advertisement
Advertisement

S2: And then when you add in the crime piece, what happens?

S3: Yeah, so the way it works for crime solving purposes is there’s a lot of cold cases in this country, right? There’s DNA that’s sitting that they’ve tried to use the government databases to see if they could find a match, but they have been unsuccessful. And what law enforcement is doing is they’re sending in this sample that they have that they haven’t identified into these open source databases and uploading that information and seeing if it pings off of anybody who’s in the system already.

Advertisement

S2: I think people who have maybe watched CSI or listened to a true crime podcast might have this idea that a DNA profile is infallible and complete. And one of the things that I find interesting about genetic genealogy is that it takes DNA. That is not a perfect match. Can you sort of explain that difference a bit? Because it feels like it’s at the heart of a lot of this.

S3: So the way genetic genealogy works is let’s say you get that raw DNA file from 23 and me or Ancestry.com, it’s going to look at quite a significant part of your genome that determines things like hair color or if you’re going to get a certain disease, which is I just mentioned, different from the government databases that use non coding portions of your DNA. So there’s a lot more information encapsulated in a 23 and me type DNA test. And it’s it’s not looking for a perfect match, but it’s going to search and see if there are certain segments that match and even small partial matches are going to be generated by that search. And then it’s really up to the individual to do the work of figuring out if that match means anything.

Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

S2: We started out by talking about the Golden State killer, and he was located by using the site GEDmatch. I wonder if you could explain what makes GEDmatch different from Ancestry.com 23 and any other kind of direct to consumer genealogy sites?

S3: GEDmatch is different because it’s open source. Or you could even say crowdsourced if you’d like. The idea is that individual users can take their raw file no matter where they initially got that saliva sample processed and upload it. GEDmatch was started as a hobby really in 2010. One of the gentlemen who started it was Curtis Rogers, and he was just really interested in this this family tree kind of building out and realized a lot of other people were interested as well. And it only became the crime solving tool a couple of years ago, around the time of the Golden State killer case. And it’s very rapidly become used for that as as one of its main features.

Advertisement

S2: How did law enforcement and when did they get interested in in using this opensource DNA technology?

S3: Right around 2018. So right around when the Golden State killer case occurred. And then from then we saw a rapid growth. And now I would say, you know, we’re talking a hundred and fifty, probably two hundred cases that have been solved using this technology. So I think police officers realized that the databases the governments keep are fairly limited in many states. You have to be convicted of a felony before you’re in that database versus these open source databases. A couple of years ago, a research paper in science estimated that 60 percent of white Americans could be identified and now it’s probably upwards of 90 percent, given how many more people have taken tests and uploaded their DNA since that paper was published.

Advertisement
Advertisement
Advertisement
Advertisement

S2: So it’s possible that that someone like me, I’ve never put my DNA into a consumer facing database, but I know I have relatives who were genealogy hobbyists that I could be identified in some way by by familial DNA and one of these databases.

S3: Yeah, it’s not only possible, but it’s likely. That’s that’s the shocking privacy piece to it. Right. That’s why I think everybody should be concerned or be thinking about this issue. Even if you personally haven’t spit into a tube and sent in your saliva sample and gotten your DNA, there might be somebody in your family who has. And that’s enough to to build out a family tree and track you down.

Advertisement

S2: Like Nila said, it’s estimated that around 90 percent of white Americans can now be identified through one of these sites. So it makes sense that law enforcement would want to use them and several of the companies allow them to do so without court approval or users knowing what’s happening after the Golden State killer case was solved and police use of genetic genealogy took off, there’s some evidence that Cops started to push the envelope in how they use this data. One important case happened in Centerville, Utah. In twenty nineteen, an elderly woman was alone in a locked church playing an organ, and someone broke in and assaulted her, choking her nearly to death. Investigators working on the case wanted to use GEDmatch as database to test some blood found at the crime scene. So they went to the company’s co-founder, Curtis Rogers.

Advertisement

S3: The terms of service were very clear that GEDmatch would only be used by law enforcement for murder and rape. But the law enforcement officers in this case approached the head of Deathmatch, asked if he would make an exception and allow them to process the DNA in this unsolved assault. And he agreed. And of course, like once. We might say, hey, great, they found the person involved in this really bad assault,

Advertisement
Advertisement
Advertisement

S2: but the little lady was assaulted and

S3: it’s like you can’t think of a case that might be more compelling to bend the rules on. Right. But the other issue is, well, I suppose twofold. One is it went against the terms and conditions that users expected, which meant that in a way, their DNA was being used in a way they hadn’t consented to. Right. But the other thing that this case highlights is that one man, Curtis Rogers, was able to change the way that law enforcement were using DNA technology rather than a democratic process. Determining when this technology should be used in

S2: this case in Utah feels to me a bit like an inflection point, like Cops are really starting to look at this technology in some ways that maybe your basic user isn’t aware of.

S3: Yeah, there was actually an outcry after this Centerville case that I described because people felt dismayed that their privacy hadn’t really been regarded by this company and that they hadn’t had warning about what was going to happen. It’s such a unique issue where it’s not just your privacy, it’s this other distant cousins privacy. In some ways we call it like the fourth party issue because there’s this other person out there who hasn’t even put their DNA into the system and they can be implicated as well. Because even if me as a user, I know that my information is going in GEDmatch I click the box and say, yes, law enforcement can use my information that feels on above board. But what about, you know, my third cousin? Like, do they know that their information essentially is out there as well? Because my DNA and their DNA are linked to.

Advertisement
Advertisement
Advertisement
Advertisement

S2: When we come back, states start to put the brakes on how law enforcement can use this technology. The Golden State killer case was a watershed moment for genetic genealogy. It was hailed as a triumph of science and diligent investigating, and it was. But the technology is not without flaws. Innocent people have been wrongly identified through these databases. And as we mentioned earlier, Cops can often search them without court approval. Just last month, two states passed laws pushing back on that, Montana and Maryland. You know, in Maryland, this is a Democratic sponsored law, in Montana, it’s Republican, I find it particularly interesting that there does not seem to be one clear partisan position on this issue.

S3: Yeah, I think that’s right. I think it’s a bipartisan measure because I think people across both parties want that Democratic transparency, their privacy being protected. I can certainly see some libertarian minded and conservative folks saying I don’t want the government, you know, in my business or in my DNA without me knowing. I can see some liberals saying I want to make sure that law enforcement, I know what they’re doing, I know how they’re using my information and that they’re truly only using this for the most heinous cases. The instinct that our DNA is sacred and private and we want it protected is is a universal one, as is the tendency to want to solve crimes. Like we all want that as well, and we want to be safe. So these laws strike a nice balance because they don’t ban the technology, they just make clear how it be used.

S2: Nila says if you take a close look at the new Maryland legislation, gives you a clue about the gaps in the current system,

Advertisement
Advertisement
Advertisement

S3: the way that it would work in Maryland, is that that last step before you actually follow someone around and collect their DNA right now under the Supreme Court Fourth Amendment doctrine, that’s not considered a search or seizure. And so there is right now no Fourth Amendment protection for that piece. But under Maryland’s law, a law enforcement officer would have to go to a judge or magistrate and actually say, I want to collect DNA from this person and essentially get a warrant for that. You will also have to go to a judge or magistrate to let them know that you’re actually going down this road and uploading that sample that you have been identified into the database and and make sure that you’ve exhausted other possibilities and ways of solving this crime. Additionally, the Maryland law says that the DNA data and the file that you create needs to be essentially managed and destroyed once the crime has been solved, which makes a lot of sense. So we

S2: can’t hang out there on the database for

S3: years. Exactly. And that was one of the things I was really concerned about, too, because we know that DNA isn’t like your credit card, right? You can’t just change it if you get hacked or if you have identity theft or DNA is integral to who you are. And so if it gets in the wrong hands, I mean, there could be like a parade of horribles that we can imagine, including someone like holding your DNA for ransom or pretending to be your long lost relative and asking money from you. So so it’s definitely really important to make sure this information is secure and that it’s not in the hands of the wrong people.

Advertisement
Advertisement
Advertisement

S2: You study where Policing and technology come together. And every time I do an interview about laws, law enforcement and tech, I’m struck by the fact the technology just moves so much faster than the lawmaking process. What do you think the the future of Policing and genetic partnerships is going to be? And is there ever any way that the lawmaking process can keep up with it?

S3: I will say I think the lawmaking process can keep up a lot faster than the courts. So a lot of folks have been waiting for the Supreme Court and federal courts and state courts to weigh in on this issue. And they’ve been disappointed because the pace at which the court moves is a lot slower.

S2: For example, it wasn’t until 2018 that the Supreme Court ruled that Cops need a warrant to try to figure out a location from your cell phone records. That was a landmark case known as Carpenter

S3: to prior to Carpenter. If you shared your cell phone phone calls with your cell phone company, then it was considered that you were sharing it and you didn’t have a privacy interest in the government could get could get that information. But it took it took a long time to get that decision. And you can see different permutations and iterations of that same kind of privacy violation where there hasn’t been a search or seizure under the Fourth Amendment. But at the same time, the government, through its ability to surveil people on an unprecedented level, can collect so much information about you. They can basically get a picture of exactly who you are and what you’re doing right. And so, if anything, I think legislators, both at the state level and even at the municipal level, can be faster to respond to technology than a court can.

Advertisement
Advertisement
Advertisement

S2: Yeah, I guess I wonder how you view genetic genealogy in comparison to, say, using drones, facial recognition technology, license plate scanning, the kinds of things that law enforcement is adopting more and more often.

S3: So the similarities are that all of these technologies create these sort of dragnets where you just get so much information that you can assemble a picture of what someone is doing, as opposed to sort of the olden days where it was really based on. Individualized suspicion like that was detective work, and I think tonight, genealogies example, where you have one point five million profiles and you put in your DNA and you can actually get information based on that. But you have no idea in that one point five billion what’s going to happen or what the family tree is going to look like until you get a match. I think right now the Fourth Amendment is not very good at regulating or creating clarity for any of these technologies because of what I just described. They’re not based on individualized suspicion. They’re not based on doing a search of one person.

S2: I think a lot of people might listen to this and say, well, I’ve never committed a crime, I’m not, you know, lurking in in people’s windows, what’s wrong with saying, yeah, sure, I’ll sign up? Yeah, sure. Law enforcement can can use my information.

S3: Yeah, I think that’s the same argument. People make a generally about the criminal justice system, like, oh, I’m innocent. I have no problem with surveillance, I have no problem with the police doing pretty much anything because I’m innocent. But, you know, privacy goes deeper than that. The idea of privacy and being able to lead a flourishing, thriving human life is that there are sectors of your life that the government can’t see into where you can develop yourself as a human being and as a person. But more than that, I’ll say you may never have done anything wrong. And yet, knowing what I know about the criminal justice system, you could still be arrested, you could still be prosecuted, and things could still happen to you because humans make mistakes. People think DNA is infallible just because it’s DNA. But human beings are involved at every step of the process from collecting data, processing it, and, of course, identifying whose DNA to process in the first place. Those are human decisions. And I am hopeful that this kind of framework, the framework that Maryland and Montana used in creating this law, could actually be a useful framework for a lot of different technology, not just genetic genealogy.

Advertisement
Advertisement
Advertisement

S2: Nila Bala, thank you very much.

S3: Thank you so much for having me.

S2: Nila Bala is a senior staff attorney at the Policing Project at NYU Law. That is our show for today. TBD is produced by Ethan Brooks and this week were edited by Tori Bosch and Alicia Montgomery. TBD is part of the larger What Next family. And it’s also part of Future Tense, a partnership of Slate, Arizona State University and New America. And I want to recommend you listen to Thursday’s episode of What Next? It’s about how the covid vaccines may not actually protect immunocompromised people, someone with an autoimmune disease. I found it particularly fascinating. All right. Mary Harris will be back in your ears on Monday. I’m Lizzie O’Leary. Thanks for listening.