Golden State Killer, DNA, and how we might be living in Minority Report

May 1, 2018May 1, 2018 Tony Tran

I got a great question from a reader named Cosima over the weekend that I want to share with you:

I know everyone is interested in DNA tests and ancestry, but we’re in a pretty interesting time when a lot of what we can do with genetics is a legal grey area. I mean, genes aren’t supposed to fall under patent law, yet they are being patented.

For example, are these companies going to share my genetic info with a third party? Am I still the owner of my genetic information once I share it with this company? (This is an important one since patent law has already made the lines blurry regarding “ownership” of genetic material).

AWESOME questions and with recent events in the news, it’s more relevant than ever.

I want to tackle Cosima’s two questions as I think it’s important that all genetic genealogists know what they’re dealing with when they purchase and leverage a DNA kit.

But first, some context.

Encyclopedia Brown and the open-source DNA cross-referencing tool

Last week, Sacramento law enforcement captured the Golden State Killer who, after raping 50 women and murdering 12, eluded authorities for 40 years.

While his capture is certainly something to celebrate, officials made a startling announcement the next day: They used information from consumer genealogy sites to find him.

More specifically GEDMatch.

GEDMatch is a powerful third-party DNA analysis tool that processes your raw autosomal DNA information and connects you with cousins in other DNA tests.

GEDMatch allows you to connect with cousins who tested with companies you didn’t AND do a deep analysis of your DNA and how it compares with others.

Investigators used DNA evidence collected from one of the Golden State Killer’s crime scenes and uploaded it into GEDMatch. This allowed them to find out exactly who he was related to.

Then they used simple inductive reasoning to figure out the rest, Sherlock Holmes style. They knew he was a man because of the nature of his crime and DNA sample. They also knew he was older. Eventually, this allowed them to nail down his potential identity: A seventysomething Sacramento man named Joseph James DeAngelo.

After that, it was simply a matter of collecting a sample of discarded DNA from him (used cutlery, cigarette butts, etc). And they found a perfect match.

This means investigators used the same methods we all use to connect with cousins, birth parents, and estranged family members to take a man into custody. 

This fact has shaken the genealogy community to its core. The big DNA testing companies (23andMe, AncestryDNA, Family Tree DNA, MyHeritage, etc) assure customers they haven’t released info to authorities — but it feels like a line in the sand has been crossed.

GEDMatch has since responded saying the following:

Amateur and professional genealogists alike are now left to contend with a messy fact: Law enforcement can leverage the same DNA analysis tools we use to find family members so they can find us. 

Yes, this is seems scary. And yes, this seems ripped straight out of Tom Cruise’s 2002 masterpiece Minority Report — but there’s more to it than that.

Let’s break down Cosima’s questions now to unpack this hairy situation.

Are DNA companies going to share my info with third parties?

Verdict: It’s complicated.

Big DNA testing companies such as AncestryDNA explicitly state that they won’t sell or share your data without your expressed consent.

“We do not sell your data to third parties or share it with researchers without your consent,” Ancestry.com said in a 2017 statement.

Their privacy page speaks more on this:

Ancestry does not share your individual Personal Information (including your Genetic Information) with third-parties without your additional consent other than as described in this Privacy Statement. In particular, we will not share your Genetic Information with insurance companies, employers, or third-party marketers without your express consent.

However, there are instances when they will share your information without your consent. And if you’ve used services like 23andMe or AncestryDNA, you might have agreed to this.

According to the privacy page, they might share your personal information to third parties if they need to:

• Comply with valid legal process (e.g., subpoenas, warrants);
• Enforce or apply the Ancestry Terms and Conditions;
• Protect the security or integrity of the Services; or
• Protect the rights, property, or safety, of Ancestry, our employees or users.

They continue saying, “If we are compelled to disclose your Personal Information to law enforcement, we will do our best to provide you with advance notice, unless we are prohibited under the law from doing so.”

And here’s the thing: There’s no way you can really tell what you’re giving DNA companies permission to do.

Or at least that’s what Hank Greely, director of the Center for Law and Bioscences at Stanford, asserts. “There’s no legal limit on what they could do than the agreement that you enter into with them which they may or may not choose to follow,” he says. “If they don’t follow it, the chance you would ever find out is very, very low.”

To me, this is borderline fear mongering. Of course, we don’t really know what they want to do with our genetic information outside of providing us with a fun topic of conversation at the office water cooler (“So my mom got me one of those DNA testing thingys…”).

So for now, the only thing we can do is trust that the DNA testing companies hold up their end of the agreement. Whether you trust them to do that is another discussion.

Not that this matters too much in the case of the Golden State Killer since they used GEDMatch to find him.

Am I still the owner of my genetic information once I share it with this company?

Verdict: Yes! But …

Luckily, you’re still the owner of your genetic information.

That said, fine print — as it is wont to do — muddies that.

Attorney Joel Winston read through AncestryDNA’s terms and conditions a while back and claimed that the contract gave the company, “a perpetual, royalty-free, world-wide transferable license to use your DNA.”

“With the this single contractual provision, customers are granting Ancestry.com the broadest possible rights to own and exploit their genetic information,” he continues horrifyingly.

Ancestry’s chief privacy officer Eric Heath pushed back on this assertion saying that the license is there to help the company give its customers what they want: DNA analysis.

“We need that license in order to move your data through our systems, render it around the globe, and to provide you with the results of our analysis work,” he says. After all, if they didn’t have the license, they wouldn’t be able to send your kits to DNA labs and pull your ancestry data from them.

“We have committed to our users that their DNA data is theirs,” he continues. “They own their DNA.”

For those who find this to be a dollop of cold comfort, maybe the fact that the 2008 Genetic Information Nondiscrimination Act helps guard consumers against discriminatory actions by employers and insurers when it comes to their DNA will help.

What about the Golden State Killer and GEDMatch?

One of the best thing about GEDMatch is how open it is. From famed genealogist CeCe Moore:

We have amazing citizen scientists who have built tools the companies have not been able or willing to provide. And we encouraged and demanded we have access to our raw data.

However, this met with reality when the Golden State Killer was discovered leveraging a tool we hold so dear. Not only that, but law enforcement likely worked with another genetic genealogists to find him.

“Because of the way this is done surreptitiously, there is also a lot of anger and backlash in our community,” says Margaret Press, a genetic genealogist who co-founded the DNA Doe Project, a nonprofit dedicated to identifying unidentified murder victims. “It’s going to be debated for a very long time in law and forensics and genealogy and everywhere you can imagine.”

Both Press and Moore say that there are genealogists making profiles on GEDMatch private since this happened. This only means one thing: It’s about to get much, much harder for genealogists to find family members in the future.

The discovery of Buckskin Girl

In 1981, a deceased woman was discovered in a ditch along an Ohio road. Authorities nicknamed her “Buckskin Girl” after the buckskin jacket she was discovered in.

And for decades, she was known as such. Her identity was a mystery to though it was clear that she had been murdered (as evidenced by the blunt trauma to her head and signs of strangulation on her neck).

That is until April 9, 2018 (two weeks before the Golden State Killer was captured) when a DNA analysis revealed her to be Marcia Lenore King of Arkansas. Investigators used DNA sequencing — the same kind we use in tests like AncestryDNA or 23andMe — to find her. Not only that, but they even uploaded her information into GEDMatch to find her relatives.

This wasn’t too controversial. In fact, many applauded this since it was used to find a victim rather than the culprit.

Why do I bring this up? To make one point: This isn’t as black and white as we think. There is a lot of potential for DNA tests to do good. There are also the situations where it toes the line.

A lot of people will have a knee jerk reaction, delete their DNA profiles, and protest DNA companies.

Others will simply roll their eyes at this and continue on their searches.

Do I think either are right? No. I think both are valid reactions. Because the fact is, we’re faced with a million of hairy choices every day. The only thing we can do is research and make an informed decision based on what we discover.

So I don’t necessarily think that there’s a wrong decision so as long as you do all you can to find out about the risks of what you do.

What do YOU think?

I’ve made my decision. What’s yours?

How do you feel about the developments of the Golden State Killer?

Were law enforcement authorities in the right to use GEDMatch to find the murderer?

Or should DNA companies be doing more to protect our genetic information?

Leave a comment down below or shoot me an email at tony@saigontosiouxcity.com. I’d love to hear your thoughts.