Investigative genetic genealogy is a technique used by law enforcement to identify suspects in criminal investigations. It involves uploading a crime scene DNA profile to one or more genetic genealogy databases with the object of identifying a suspect’s relatives and, eventually, locating the suspect in the family tree. The prospect of a government database containing the DNA of every citizen taken at birth no longer lives only in science fiction. Law enforcement has realized that a version of that dystopia already exists in the proliferation of data contained in consumer genealogy databases governed by fuzzy legal standards and vested with profound ethical questions.

1. Introduction

On April 24, 2018, Joseph DeAngelo Jr. was charged with eight counts of first degree murder. Known as the Golden State Killer, the Visalia Ransacker and the Night Stalker, he eluded California investigators for decades. Although the police had the unknown killer’s DNA, it didn’t match anyone in the FBI national database. Then, investigators began looking somewhere else – GEDmatch, a genealogy service that collects DNA samples voluntarily given by its customers. (here) Like other genealogy sites, such as Ancestry and 23andMe, consumers submit their DNA to locate relatives or find more information about the origins of their ancestors. Investigators found a DNA sample that was a partial match to the Golden State Killer.

Although that person was not the Golden State Killer, investigators had a place to begin. As research progressed through the family tree, one name popped up: Joseph DeAngelo Jr. He was a former police officer who lived in the area of the killings when they happened. On June 29, 2020, Mr. DeAngelo pleaded guilty to multiple counts of murder and kidnapping. On August 21, 2020, he was sentenced to life imprisonment without parole in a plea bargain that involved the admission of other crimes, including rapes, thus saving him from the death penalty.

On May 17, 2018, William Talbott II was arrested by Washington state police and charged with the 1987 murder of a Canadian couple travelling from Saanich, British Columbia, to Seattle. The body of Tanya van Cuylenborg had been found in a rural ditch and the remains of Jay Cook were located two days later. She had been shot and he was strangled to death. (here) At Mr. Talbott’s trial, Det. James Scharf of the Snohomish County Sheriff’s Office took six minutes on the stand to describe how a semen sample and investigative genetic genealogy led to two second cousins of the suspect and then to the defendant.

In an article titled Genealogy Sites Have Helped Identify Suspects. Now They’ve Helped Convict One. published in the July 1, 2019, edition of The New York Times, Heather Murphy described the privacy and ethical debate that erupted in the wake of the DeAngelo and Talbott cases. (here) Proponents of unregulated access to genetic genealogy sites by law enforcement argue that if users join an “easily searchable site”, they relinquish control over their genetic information and how it may be used. They have no reasonable expectation of privacy. However, it is well established in Canadian constitutional law that control is not a prerequisite for a valid privacy interest which I discussed in previous posts to On The Wire. (here and here)

Should consumers of genetic genealogy sites, then, have the right to make informed decisions about how their DNA, the most personal of information, is used by these sites? Should third parties, such as the police, have access to this data without a warrant? And should the police be allowed to use the technique to investigate all crimes, or only the most serious ones? Professor Natalie Ram of the University of Maryland, Carey Law faculty, a bioethicist and leading advocate of legislative reform, has described the legal landscape as akin to the Wild West. (here)

2. Reasonable Expectation of Genetic Privacy

In a paper titled Genetic Testing and Privacy (here), the Privacy Commissioner of Canada described the reasonable expectation of genetic privacy as comprised of two elements: (a) the right not to have others know one’s possible genetic “destiny”; and, (b) the right “not to know” about oneself. The ethical principle of autonomy suggests that one should have meaningful physical and psychological control over oneself. Any form of mandatory genetic testing and the reporting of results to oneself or others violates the principle of autonomy and thus threatens the right to privacy. (at pp. 30-1)

(a) The Right Not to Have Others Know

Whether to disclose genetic traits is a decision for the individual alone – a fully informed decision that is freely made. The state and its agents should have no right to inspect the genetic information in the individual human genome without consent. A free and informed decision is the overarching fundamental principle irrespective of whether there is “a perceived good for society or for the person flowing from the testing.”

(b) The Right Not to Know Oneself

The individual should have a right of privacy that protects him or her “from the information that their own bodies can yield.” The individual should not be forced, through mandatory genetic testing, to learn about traits or disorders even if it may alert them to the need for treatment. They should not be forced to learn about conditions that may cause them discrimination, suffering or premature death. Canadian society does not force knowledge on the individual in other similar circumstances – there is no obligation to be tested for cancer, heart disease or high blood pressure. Similarly, there should be no obligation to learn one’s possible genetic destiny.

The opinion of the Supreme Court of Canada in Reference re Genetic Non-Discrimination Act (here) released on July 10, 2020, considered the constitutionality of federal legislation that criminalizes compulsory genetic testing, compulsory disclosure of test results and non-consensual use of test results in a broadly-defined context. It arguably falls under the first element of the Privacy Commissioner’s paradigm. The objective of the Genetic Non-Discrimination Act (here) is to protect individuals’ control over their personal information disclosed by genetic tests in the area of contracting and the provision of goods and services. It does not address the genetic privacy issues that arise in the context of consumer genealogy sites.

The language employed in the Privacy Commissioner’s paper, published in 1995, is derived from s. 8 of the Canadian Charter of Rights and Freedoms that protects the individual against unreasonable search or seizure. The test of reasonable expectation of privacy is the analytical tool used by the judiciary in determining the constitutionality of a search or seizure by the police. The application of the test in the context of mandatory genetic testing is equally suitable in the context of consumer genetic genealogy sites. It is significant that the Privacy Commissioner viewed genetic privacy as moored in s. 8 because the issue of whether it is a “principle of fundamental justice” under s. 7 of the Charter arises in the constitutional jurisprudence.

In 1995 the Canadian Parliament enacted amendments to the Criminal Code under which a provincial court judge could issue a warrant authorizing a police officer to obtain a biological sample from a suspect for the purposes of forensic DNA analysis in the investigation of certain designated offences such as murder, sexual assault and human trafficking. In R. v. S.A.B. (here), Justice Anne Russell of the Alberta Court of Appeal highlighted “the serious concerns and consequences relating to the granting of a warrant which will authorize any interference with bodily integrity and privacy”. She emphasized that the fundamental individual rights of privacy, autonomy, dignity and bodily integrity are at the heart of both ss. 7 and 8 of the Charter.

On further appeal to the Supreme Court of Canada, however, Justice Louise Arbour described the rights of the individual as “the rights […] to control the release of personal information […] as well as the right to dignity and physical integrity.” (here) Although the courts in S.A.B. were considering the search and seizure of DNA from a suspect pursuant to a warrant based on reasonable grounds (probable cause), the reasoning is equally applicable in the context of an investigative seizure from a consumer genetic genealogy database. Justice Arbour held that the principles of fundamental justice under s. 7 implicated by a DNA search and seizure are more appropriately considered under s. 8.

3. Recent Developments in Maryland and Montana

Maryland and Montana have recently passed the first statutes in the United States restricting access by law enforcement to consumer genealogy databases. (here and here) The Maryland statute is the broader of the two covering more than forensic genetic genealogy searching (FGGS). The search of a genetic genealogy database requires judicial authorization and imposes strict limits on when and under what conditions the police may conduct genealogy searching. Searches are limited to cases of murder, rape, felony sexual offences and criminal acts that present “a substantial and ongoing threat to public safety or national security.” Law enforcement officers must certify to the court that they have tried searching state-run DNA databases such as the Combined DNA Index System (CODIS), that they have pursued other reasonable investigative leads and that those searches failed to identify anyone. And FGGS may only be used if the target database provided explicit notice to users about law enforcement searches and sought user consent.

The Montana statute is brief, only two pages, and requires government entities to obtain a warrant “issued by a court on a finding of probable cause” to obtain results from a consumer DNA database. The statute defines a “Familial DNA search” broadly as one that uses “specialized software to detect and statistically rank a list of potential candidates in the DNA database who may be a close biological relative to the unknown individual contributing the evidence DNA profile.” This is exactly what a site like GEDmatch does. The statute also embraces sites like Ancestry and 23andMe that do their own genotyping because it covers “Lineage testing” which is defined as including “single nucleotide polymorphism [SNP] genotyping to generate results related to a person’s ancestry and genetic predisposition to health-related topics.”

Professor Ram, who promoted the Maryland statute, said the new laws demonstrate that people across the political spectrum find law enforcement use of consumer genetic data “chilling, concerning and privacy-invasive” in an interview with Virginia Hughes of The New York Times. (here) In a post to the Electronic Frontier Foundation blog (here), Jennifer Lynch endorsed the statutes as “a step in the right direction” although EFF maintains that genetic genealogy searches are dragnets and should never be allowed. “[I]n using FGGS, officers are rifling through the genetic data of millions of Americans who are not suspects in the investigation and have no connection to the crime whatsoever,” Ms. Lynch said. And the Innocence Project based in New York described the Maryland statute as “historic legislation” (here) that also gives people in wrongful conviction cases the right to seek judicial approval for the use of forensic genetic genealogy testing to help prove their innocence.

4. Conclusion

In 2019, Antonio Regaldo, the senior editor for biomedicine at MIT Technology Review, estimated that 26 million users had added their DNA to the four leading commercial ancestry and health databases – Ancestry, 23andMe, GEDMatch and MyHeritage. (here) By this year, the Ancestry database alone had grown to over 27 billion historical records. (here) We are in the midst of a “DNA gold rush” in which private corporations are building massive databases that are available as search engines for longevity research and pharmaceutical development. (here) Although the protection of genetic privacy by state initiative is out of the gate in the United States, there appears to be no equivalent law reform movement in Canada. Based on the new statutes in Maryland and Montana, the following features of any proposed statutes are regulatory imperatives in the context of investigative genetic genealogy.

First, a genetic genealogy site must obtain the express consent of its users to the disclosure of their genetic data. Second, an agent of the state must obtain prior judicial authorization based on reasonable grounds (probable cause) to gain access to a consumer genealogy database. Third, forensic genetic genealogy searching must be restricted to the investigation of serious crimes. Fourth, law enforcement must establish that other investigative procedures (searches of government-run databases) have been tried and failed. The last requirement is analogous to the statutory precondition of investigative necessity in wiretap authorizations and video surveillance warrants. The requirement of investigative necessity must be a statutory minimum in the deployment of highly invasive investigative tools.