Is your DNA safe?
A private company was thanked by cops for helping identify a suspect in the Faith Hedgepeth case. But is law enforcement’s use of public DNA databases ethical? This is the N&O’s special report.
Genetic testing kits give users a fun look into the past.
But what could be at stake in the future is cause for concern among privacy advocates.
When people think of genetic testing kits, they typically think of companies like 23andMe or Ancestry.com.
These companies allow you to spit into a tube and mail off your DNA-rich saliva. They report back with information about who your family is, where they’re from, famous relatives and, with an upgrade, genetic markers indicating possible diseases you may have inherited.
This alone concerns organizations like the American Civil Liberties Union.
Vera Eidelman, staff attorney for the ACLU’s Speech, Privacy and Technology Project, said people need to think about the wealth of information they’re giving up.
She said DNA testing could expose family secrets, adoptions, infidelities, early risk of mortality and diseases that a couple could pass to their children.
“All of that information is quite personal and sensitive,” Eidelman said.
Enough so that 23andMe warns consumers to think about the possible implications of using their product and what that would mean for their lives.
Concerns don’t stop there.
Once a person receives their DNA results from genetic testing companies, they have the option to upload those results into public DNA databases like Family Tree DNA and GEDmatch.
How law enforcement uses DNA testing
Investigators have been partnering with Parabon NanoLabs in Reston, Virginia, to match DNA found at crime scenes to DNA found in the public databases.
When officers in North Carolina find DNA at crime scenes, they typically take the sample to the State Crime Lab and have scientists search a federal DNA database known as the Combined DNA Index System, or CODIS, to see whether it matches that of someone law enforcement has come across before.
If they don’t get a hit, they can look for a close relative, such as a sibling, but that’s it. That’s considered a familial DNA search.
Attorney General Josh Stein said authorities began using this type of search two years ago but have not yet been successful.
If CODIS comes back with nothing, the DNA is useful to tell officers only whether the suspect is a male or female.
But CeCe Moore of Parabon NanoLabs takes DNA profiles left at crime scenes and searches public databases for matches.
Ancestry.com, 23andMe and My Heritage DNA bar law enforcement from use, Moore said.
However, users of those services often upload the results to public DNA databases, opening up a wider field to finding family members.
Moore said genetic genealogy isn’t held to the same laws as familial DNA testing because it’s done with DNA that was voluntarily uploaded into public databases and not DNA taken by law enforcement.
Moore uses GEDmatch and Family Tree DNA for her searches. GEDmatch has around 1.5 million users, and Family Tree DNA has about 1.25 million users.
But the portion Moore has access to is far smaller.
Concerned about privacy issues, Moore said she would work only with databases that allow people to opt-in or opt-out of having their DNA used by law enforcement.
“If you do this, if you put your DNA in the two databases, we can use it for law enforcement,” Moore said. “So if you’re not comfortable with that, you shouldn’t put it in those databases or you should opt-out of law enforcement matching options.”
Moore dismissed other privacy concerns — such as employers or life insurance companies using a person’s DNA against them — are just fear-mongering.
“There’s also a lot of perceptions about what we do, so I spent a lot of time trying to educate, so people understand I’m not digging into anyone’s DNA,” Moore said. “They’re not looking at their health conditions. I can’t — I don’t get access to their actual DNA file or code.”
Moore said what she receives is a list of people who match a suspect’s DNA.
Building a family tree
The list includes whatever a person puts as their name and their email address.
Moore is able to cast a wider net on her DNA searches and find more distant relatives.
“If I’m lucky, I’m going to get a second cousin,” Moore said. “Second cousins share about 3% of their DNA with each other, and second cousins share great-grandparents.”
Moore said she then works to figure out who the parents and grandparents are, using public records like obituaries and birth, death, church and census records.
Moore said she tries to work back to the 1940s because that’s the earliest time of publicly available census records. Census records remain private until 72 years pass.
If Moore gets lucky, a family has already uploaded their family tree online.
“It can be really time-consuming just figuring out who’s this DNA contributor,” Moore said. “Who’s their parents or their grandparents? And then connecting into those more traditional genealogical records.”
Moore said she’ll build out family trees for 12 to 30 of the top matches to the suspect’s DNA until she can find patterns of overlap.
“If I can find multiple people on that match list to share DNA with my unknown suspects who have common ancestors, then I know that common ancestor also should be in the family tree of my unknown,” Moore said. “I build what I call genetic networks. Say matches one, three and five share DNA with my suspect and with each other: They all have a common ancestor in their family tree. If I can figure out who the common ancestor is between one, three and five, that tells me one piece of my suspect family tree.”
Then she will see that matches four and six don’t match one, three and five, so they become a different part of the suspect’s family tree.
She then builds out the family tree trying to find all of its members and tries to find where a relative from the first line marries someone with the second line and whether they had a child together. She said that creates a triangulation, and any of the children or grandchildren could be the suspect.
“I need to find that one person or set of siblings who are related to all of those top matches, who descend from both sets of common ancestors — or five genetic networks, which makes it even more specific,” Moore said.
Getting police involved
Moore said she would never take the first match she comes across from a public database search and develop a suspect.
“I need a web of matches,” she said. “I need a dozen or so matches that are all pointing me in one direction. I’m not going to just choose one person to point me in the right direction.”
She said once she narrows it down to a suspect or a group of siblings, she lets police know.
If she can’t narrow her search, she writes a report with what she has found and the data she needs and then officers backtrack to see whether family members are willing to upload their DNA into the databases.
If they don’t, she said, she moves on to the next person on her list that might help her identify the suspect.
Moore said her work with law enforcement can take anywhere from days to years. Once she confirms a suspect on her end, law enforcement has to go back to traditional routes through the state crime lab to ensure her suspect matches the DNA.
She said her job is to help narrow down possible suspects and cut down on the time and resources some officers would spend trying to go from dozens of suspects into one.
“What I give them is just a theory; they have to do their due diligence, they have to investigate that person and decide whether they think I’m right or wrong,” Moore said. “And then they can’t arrest until they’ve got a DNA match to their traditional forensic profile.”
This story was originally published October 17, 2021 6:00 AM.