After 40 years and more than 12 murders and 45 rapes, law enforcement in California recently made an arrest in the Golden State Killer case. The arrest came as a result of investigators using an undercover identity to gain access to a genealogy database and then entering a sample from the killer. The sample came back as connected to a relative who had entered their DNA in the database. A family tree on the same site—GEDmatch—led to the suspect/arrestee after four months of further investigation. GEDmatch is a website whose main purpose is to help relatives find each other. Its use for law enforcement investigation is causing controversy among privacy professionals and criminal defense lawyers. As a result, this is the type of new and powerful technology lawyers need to understand.
Currently there are four major companies offering DNA genealogy matching services. They are Ancestry.com, 23 and me, Family Tree DNA, and GEDmatch. Submission of a sample can be as simple as spit and send, only requiring a small sample of saliva. The person submitting the sample may not be aware of all of the possible ramifications of submitting their DNA to these databases. In the case of the Golden State Killer, law enforcement believes the submission of DNA by a relative led them to the killer.
Some will say, “So be it: he has no standing to challenge the search of someone else’s DNA.” But it’s not so easy. When a person submits a sample, he or she waives certain privacy rights under the terms of service on most of the genealogy database sites. Individuals do not and cannot waive the privacy rights, if any, of their relatives, who are by necessity exposed by their submission.
So, there are issues of privacy law, standing, and the possible use of deception in the access of such databases for criminal investigations. These issues will have to be worked out in the courts and legislatures. We are experiencing a parallel legal course with the issues surrounding the investigative use of social media, and there may be lessons to be gleaned from that area of law. Meanwhile, it is important that lawyers understand the myriad issues raised by this technology. Clients who submit DNA as a lark are not only exposing the genetic links of self and family, but they are also opening a whole area of medical disclosure issues.
DNA can be used to identify genetic deficiencies, predisposition to certain diseases such as Alzheimer’s, and pre-existing conditions. The results of tests may be sought by health insurance companies, employers, life insurance companies, and others who can’t even be imagined at this point in time.
We urge lawyers and bar associations to take the lead in giving guidance to practitioners and clients about the issues raised by this new forensic technology. The privacy and ethics advisories related to forensic use of social media are a good place to start but won’t answer all the intricate questions raised by the simple act of spit and send.