How Genetic Genealogy is Used in Cold Cases by Law Enforcement

On September 11, 2020, the Ohio Attorney General’s Office announced the formation of a “Cold Case Unit,” which would be tasked to help solve cold case homicides and unsolved sexual assault cases in Ohio.[1] In its press release announcing the new unit, the Ohio Attorney General’s Office indicated that “strategies offered will be customized to each cold case,” including genetic genealogy research.[2]

“Genetic genealogy” has long been used by adoption researchers to help adopted children connect with their unknown biological family members. “Genetic or forensic genealogy combines direct-to-consumer DNA tests—like those purchased through 23andMe or Ancestry.com—with the age-old hobby of tracing a family tree with public records, such as birth certificates and land deeds.”[3] The technique relies on the principle that, if you go back far enough in history, everyone is related, and therefore has thousands of relatives. Assuming that an average family has 2 to 3 kids, then a typical person would—statistically speaking—have nearly 200 third cousins, 950 fourth cousins and 4,700 fifth cousins. If a genealogist can find a cousin of an unidentified suspect who has left behind DNA at a crime scene, then they can use old school family trees, along with law enforcement resources, to track down the potential sources of that DNA.

Most publicly available DNA databases online (such as 23andMe) prohibit law enforcement from comparing the DNA profile of an unknown suspect to the DNA profiles contained in its database without a search warrant or court order. However, genetic genealogists involved in the “Golden State Killer” knew that one of the DNA databases commonly used to solve adoption cases—GEDmatch—had much looser Terms of Service and customer agreements, thereby providing to law enforcement a means of “working around” the Fourth Amendment’s constitutional protections.[4]

GEDmatch Explained

Anyone with a raw DNA file (also referred to as a “GEDmatch uploadable SNP profile”) can upload their DNA test results (usually from direct-to-consumer DNA testing kits such as 23andMe) into a database and compare the uploaded DNA results with those from people who have tested at other companies. A raw DNA file (or “GEDmatch uploadable SNP profile”) is a plain text computer file that lists out several hundred thousand SNPs (“snips”), also known as “markers.” A raw DNA file does not contain a person’s entire genome; instead, it includes the SNPs/markers which contain the known common genetic variations between humans.

GEDmatch is a free, online, third-party DNA profile comparison database. GEDmatch processes autosomal DNA data files from different testing companies and other sources to enable effective comparisons between DNA kits. The DNA file output (data and format) may differ slightly from different sources, so GEDmatch facilitates the direct comparison of all uploaded DNA kits.

After a raw DNA file (GEDmatch uploadable SNP profile) is processed and uploaded into GEDmatch’s database, it is assigned a unique “Kit number.” This is essentially a “reference number” that GEDmatch gives to any DNA profile uploaded into its database. The same DNA profile can be uploaded into GEDmatch multiple times by multiple users; however, each time the same DNA profile is uploaded into GEDmatch, it is assigned a different “Kit number.”

After a DNA profile is uploaded and assigned its unique “Kit number,” a user can compare the DNA profile from one kit to all DNA kits that have been uploaded in GEDmatch’s DNA database. A GEDmatch user can search for “matches” to a particular kit by typing that kit number in GEDmatch’s “one-to-many comparison tool.” GEDmatch will then search its DNA database and generate a list of all kits that have some amount of shared DNA segment(s) with that particular kit number. The length of those shared DNA segments is measured in “centiMorgans,” with the general proposition being that the “longer” the shared segment of DNA (i.e., the more “centiMorgans”), the more closely the sources of those two DNA kits are related. GEDmatch also provides email addresses for the person who uploaded the raw DNA file to allow for contact between potential relatives.

Law Enforcement Use of Genetic Genealogy Research

Dubbed the “Golden State Killer,” law enforcement believed the same man was responsible for 12 murders and 45 rapes of women across California between 1976 and 1986.[5] Although law enforcement had been able to obtain DNA evidence that it believed belonged to the person who was responsible for those offenses, they could not match him to one of the million convicts, offenders, and arrestees in the FBI’s national DNA database, CODIS.[6]

With the help of a genetic genealogist, law enforced compared the crime scene DNA in the Golden State Killer case against GEDmatch’s publicly accessible DNA database, which contains hundreds of thousands of DNA profiles of persons who had voluntarily uploaded their own (or that of another person(s)) DNA profile into GEDmatch—albeit, likely in hopes of discovering their relatives or ancestors.[7]

Although the DNA profile of the Golden State Killer had not been uploaded into GEDmatch’s database, the DNA profile of a distant relative of the Golden State Killer had been. Thus, when the DNA profile recovered from the crime scene of one of the Golden State Killer cases was uploaded into GEDmatch, law enforcement was alerted to this distant relative’s profile because that person’s DNA partially matched the evidence related to the Golden State Killer.[8]

After that distant relative was identified, law enforcement’s suspect pool of millions was whittled down to just a single-family group. Law enforcement then relied upon traditional investigative tools and techniques to narrow in on one suspect: Joseph James DeAngelo— a 72-year-old former police officer who lived within a few miles of several of the attacks.[9]

Fourth Amendment Concerns and GEDmatch

Courts have long recognized that a person has a legitimate expectation of privacy in his or her bodily fluids, including more narrowly his or her DNA.[10] Indeed, “[o]ne can think of few subject areas more personal and more likely to implicate privacy interests than that of one’s health or genetic makeup.”[11] Accordingly, the Fourth Amendment to the United States Constitution and Article I, Section 14 of the Ohio Constitution impose a high bar on the State for collecting DNA from a free person (usually, through an oral swabbing).

Informed consent is the essential underpinning of ethical DNA testing and results-sharing. All persons who test have the right to make their own individual choices about testing and about the uses to which their DNA results will be put—including its use by law enforcement to fish for suspects in criminal investigations. Most users of genealogy services such as GEDmatch have uploaded their genetic information in order to find relatives, learn about ancestors and get insights into their health, not anticipating that the police might one day search for killers and rapists in their family trees.

Warrantless searches of the genetic database GEDmatch do not merely affect persons who have voluntarily chosen to upload their DNA into the GEDmatch database. Indeed, such searches affect huge swaths of the population, including those who have never taken a DNA test. Because of the nature of DNA, every criminal is likely to have multiple relatives in every major genealogy database. Indeed, as of November 2019, GEDmatch’s database had approximately 1.2 million users.[12]

Thus, after the methods the genetic genealogists used to the solve the Golden State Killer case were disclosed, concerns about the unique constitutional privacy issues associated with law enforcement’s use of GEDmatch in such manner were raised. Indeed, while courts have held that publicly shared information by an individual can be acquired by law enforcement without a warrant and used against that individual in a criminal prosecution, “genetic genealogy research” presented an entirely novel constitutional privacy issue. This is because an individual could be implicated in a crime because an extended family member—not the individual himself—had uploaded their DNA profile to a DNA database without the consent or knowledge of anyone else in their family.

GEDmatch attempted to address these growing constitutional concerns on May 18, 2019. GEDmatch set all DNA kits that were currently included in its DNA database to “opt-out” of law enforcement matching by default.[13] If a GEDmatch user wanted their DNA kit to be available to law enforcement for matching purposes, the user had to expressly “opt-in” to law enforcement matching for that kit.[14]

This change meant that law enforcement had access to a much smaller DNA database on and after May 18, 2019 than it did prior to May 18, 2019. This is because AdvanceDNA would only be able to compare the DNA profiles of unknown suspects to the kits of users who had logged in to their GEDmatch account and affirmatively “opted” their DNA kit “in” to law enforcement matching. If a user took no action, then his or her kit would not be available for law enforcement matching purposes after May 18, 2019.

To facilitate continued DNA kit matching amongst its non-law-enforcement users, GEDmatch changed its Terms of Service on May 18, 2019 to require that any DNA profile uploaded for “law enforcement matching purposes” be so designated at the time it is uploaded into GEDmatch.[15] Thus, if a DNA profile was uploaded into GEDmatch for non-law-enforcement-matching purposes, that DNA profile could be compared to all other DNA profiles in GEDmatch’s DNA database. If the exact same DNA profile was uploaded for law enforcement matching purposes, however, then it could only be compared to DNA profiles that had expressly “opted in” to law enforcement matching after GEDmatch changed its Terms of Service on May 18, 2019.

From this author’s July 2020 conversations with GEDmatch’s general counsel, as of July 9, 2020, 1.45 million kits have been uploaded to GEDmatch’s database. However, at that time, only about 270,000 of those kits had “opted in” to law enforcement matching.

At any point, a user can choose to delete his DNA kit from GEDmatch’s database, to change his privacy settings, and/or to “opt-out” of law enforcement matching if he had previously “opt-in.” Concerningly, then, a law enforcement agent could upload a DNA profile for “non-law-enforcement-matching purposes,” compare that DNA kit to all DNA profiles—not just those persons who have “opted-in” to law enforcement matching—in GEDmatch’s database (in violation of GEDmatch’s Terms of Service), develop a family group with potential suspects, and delete the improperly uploaded DNA kit. From there, traditional law enforcement techniques could be used to investigate potential suspects developed from that improper genetic genealogy search. Critically, then, if a suspect were developed in such manner and ultimately charged criminally by the State, it is unlikely that defense counsel would even be able to discover that such improper genetic genealogy investigation ever occurred.

Law Enforcement’s Collection of Involuntarily Shed DNA Material

And still, after a potential suspect (or suspects) in a family group is identified using genetic genealogy, law enforcement often employs other extremely invasive DNA-related investigative techniques.

The Supreme Court has held that people have no reasonable expectation of privacy in garbage left out for collection because they thereby expose their trash to any member of the public.[16] The Court has similarly held that people have no Fourth Amendment privacy or property interest in items they abandon.[17]

People shed their DNA constantly, and unknowingly, in a wide variety of ways. Despite the sensitivity of the information that can be obtained from a person’s DNA, humans cannot avoid leaving behind carbon copies of their entire genetic code. In less time than it takes to order a coffee, most humans shed nearly enough skin cells to cover an entire football field.[18] Indeed, the only way to avoid leaving a trail of one’s DNA in public and private spaces would be to never leave home.

Law enforcement has relied upon the “voluntarily abandonment” line of cases to seize—without a warrant—an item likely to contain the suspect’s unavoidably shed DNA material (such as a coffee cup lid or cigarette butt) that has been discarded by the suspect in the public. After surreptitiously seizing that item, law enforcement will take that item to a crime lab so that the suspect’s DNA material can be extracted, profiled, and analyzed. Once a DNA profile is developed of the suspect from the DNA material on the recovered item, law enforcement is then able to compare the suspect’s DNA profile to the DNA profile of the crime scene evidence to determine whether the two profiles match.

[1] Ohio Attorney General Dave Yost Announces Formation of Cold Case Unit, Ohio Attorney General (Sept. 11, 2020), https://www.ohioattorneygeneral.gov/Media/News-Releases/September-2020-(1)/Ohio-Attorney-General-Dave-Yost-Announces-Formatio (last visited Nov. 20, 2020).

[2] See id.

[3] Genetic Genealogy Can Help Solve Cold Cases. It Can Also Accuse the Wrong Person, Nsikan Akpan, PBS News Hour (Nov. 7, 2019), https://www.pbs.org/newshour/science/genetic-genealogy-can-help-solve-cold-cases-it-can-also-accuse-the-wrong-person.

[4] She Helped Crack the Golden State Killer Case. Here’s What She’s Going to Do Next, Heather Murphy, N.Y. Times (Aug. 29, 2018), https://www.nytimes.com/2018/08/29/science/barbara-rae-venter-gsk.html.

[5] The Ingenious and ‘Dystopian’ DNA Technique Police Used to Hunt the ‘Golden State Killer’ Suspect, Avi Selk, The Washington Post (Apr. 28, 2018), https://www.washingtonpost.com/news/true-crime/wp/2018/04/27/golden-state-killer-dna-website-gedmatch-was-used-to-identify-joseph-deangelo-as-suspect-police-say/.

[6] See id.

[7] See id.

[8] See id.

[9] See id.

[10] See, e.g., Schmerber v. California, 384 U.S. 757, 770, 86 S.Ct. 1826, 16 L.Ed.2d 908 (1966); State v. Emerson, 134 Ohio St. 3d 191, 2012-Ohio-5047, 981 N.E.2d 787, ¶ 18. Indeed, given the “vast amount of sensitive information * * * [that] can be mined from a person’s DNA,” courts have recognized that all individuals have “very strong privacy interests” in that information. United States v. Amerson, 483 F.3d 73, 85 (2d Cir. 2007); see also Maryland v. King 569 U.S. 435, 481 (2013) (Scalia, J. dissenting) (noting the “vast (and scary) scope” of DNA collection); State v. Medina, 102 A.3d 661, 691 (Vt. 2014) (DNA “provide[s] a massive amount of unique, private information about a person that goes beyond identification of that person”); People v. Buza, 413 P.3d 1132, 1152 (Cal. 2018) (court was “mindful of the heightened privacy interests in the sensitive information that can be extracted from a person’s DNA”). Therefore, the extraction of an individual’s DNA sample and “the creation of his DNA profile constitute[] a search for Fourth Amendment purposes.” United States v. Davis, 690 F.3d 226, 246 (4th Cir. 2012).

[11] Norman-Bloodsaw v. Lawrence Berkeley Lab., 1355 F.3d 1260, 1269 (9th Cir. 1998); see also United States v. Davis, 690 F.3d 226, 239 (4th Cir. 2012) (holding that “extract[ing] and test[ing]” a suspect’s DNA constitutes a search).

[12] Your DNA Profile is Private? A Florida Judge Just Said Otherwise, Kashmir Hill and Heather Murphy, N.Y. Times (Nov. 5, 2019), https://www.nytimes.com/2019/11/05/business/dna-database-search-warrant.html.

[13] See, e.g., GEDmatch Implements Required Opt-In for Law Enforcement Match, DNAeXplained (May 19, 2019), https://dna-explained.com/2019/05/19/gedmatch-implements-required-opt-in-for-law-enforcement-matching/; Jon Schuppe, Police Were Cracking Cold Cases with a DNA Website. Then the Fine Print Changed, NBC News (Oct. 23, 2019), https://www.nbcnews.com/news/us-news/police-were-cracking-cold-cases-dna-website-then-fine-print-n1070901; GEDmatch.com Terms of Service and Privacy Policy (May 18, 2019), available at https://localtvwiti.files.wordpress.com/2019/11/15-gedmatch-privacy-policy.pdf.

[14] See id.

[15] See id.

[16] California v. Greenwood, 486 U.S. 35, 40 (1988).

[17] See Abel v. United States, 362 U.S. 217, 239 (1960) (no warrant required for police to seize items a suspect left behind in a hotel room after checking out); Hester v. United States, 265 U.S. 57, 58 (1924) (no Fourth Amendment seizure when police obtain jug containing moonshine whisky after suspect abandoned the jug).

[18] See Erin Murphy, Inside the Cell: The Dark Side of Forensic DNA 5 (2015).