The Golden State Killer Is Tracked Through a Thicket of DNA, and Experts Shudder - The New York Times

Genetic testing services have become enormously popular with people looking for long-lost relatives or clues to hereditary diseases. Most never imagined that one day intimate pieces of their DNA could be mined to assist police detectives in criminal cases.

Even as scientific experts applauded this week’s arrest of the Golden State Killer suspect, Joseph James DeAngelo, 72, some expressed unease on Friday at reports that detectives in California had used a public genealogy database to identify him. Privacy and ethical issues glossed over in the public’s rush to embrace DNA databases are now glaringly apparent, they said.

“This is really tough,” said Malia Fullerton, an ethicist at the University of Washington who studies DNA forensics. “He was a horrible man and it is good that he was identified, but does the end justify the means?”

Coming so quickly on the heels of the Cambridge Analytica scandal, in which Facebook data on more than 70 million users was shared without their permission, it is beginning to dawn on consumers that even their most intimate digital data — their genetic profiles — may be passed around in ways they never intended.

“There is a whole generation that says, ‘I don’t really care about privacy,’” said Peter Neufeld, a co-founder of The Innocence Project, which uses DNA to exonerate people who were wrongly convicted. “And then they do, once there is a Cambridge Analytica. No one has thought about what are the possible consequences.”

The trail of the Golden State Killer had gone cold decades ago. The police had linked him to more than 50 rapes and 12 murders from 1976 to 1986, and he had eluded all attempts to find him.

In the years since, scientists have developed powerful tools to identify people by tiny variations in their DNA, as individual as fingerprints. At the same time, the F.B.I. and state law enforcement agencies have been cultivating growing databases of DNA not just from convicted criminals, but also in some cases from people accused of crimes.

The California police had the Golden State Killer’s DNA and recently found an unusually well-preserved sample from one of the crime scenes. The problem was finding a match.

But these days DNA is stored in many places, and a near-match ultimately was found in a genealogy website beloved by hobbyists called GEDmatch, created by two volunteers in 2011.

Anyone can set up a free profile on GEDmatch. Many customers upload to the site DNA profiles they have already generated on larger commercial sites like 23andMe.

The detectives in the Golden State Killer case uploaded the suspect’s DNA sample. But they would have had to check a box online certifying that the DNA was their own or belonged to someone for whom they were legal guardians, or that they had “obtained authorization” to upload the sample.

“The purpose was to make these connections and to find these relatives,” said Blaine Bettinger, a lawyer affiliated with GEDmatch. “It was not intended to be used by law enforcement to identify suspects of crimes.”

But joining for that purpose does not technically violate site policy, he added.

Erin Murphy, a law professor at New York University and expert on DNA searches, said that using a fake identity might raise questions about the legality of the evidence.

The matches found in GEDmatch were to relatives of the suspect, not the suspect himself.

Since the site provides family trees, detectives also were able to look for relatives who might not have uploaded genetic data to the site themselves.

On GEDmatch, “it just happens they got lucky,” said Dr. Ashley Hall, a forensics science expert at the University of Illinois in Chicago.

23andMe has more than 5 million customers, and Ancestry.com has 10 million. But the DNA in databases like these are relevant to tens of millions of others — sisters, parents, children. A lot can be learned about a family simply by accessing one member’s DNA.

“Suppose you are worried about genetic privacy,” Ms. Murphy said. “If your sibling or parent or child engaged in this activity online, they are compromising your family for generations.”

DNA profiles can be held indefinitely, and the data can be handed over to police who have warrants or subpoenas. You may never commit a crime. But how should you feel if your DNA was used to locate a distant relative who did?

On a Facebook page dedicated to genealogy, hobbyists debated this new use of DNA data.

“I’ll volunteer to give my DNA and out any of my cousins who may be rapist/murderers. So much drama over nothing,” wrote Stu Pike, who said he had used GEDmatch to track down relatives.

But others expressed outrage. “My relatives consented for their data to be used for genealogy but not for criminal investigations,” wrote Leah LaPerle Larkin, who adjusted her settings to make sure her family’s data was private on the GEDmatch site.

“I’ve had many sleepless nights the last few years, realizing that it’s coming,” CeCe Moore, a genetic genealogist, said of the possibility that an online site might be used to identify a suspect.

The founder of DNA Detectives, a group that helps adoptees find their biological parents and reunite long-lost relatives, Ms. Moore said that she has been approached numerous times by law enforcement asking her help in solving murder and rape cases.

She declined, she said, “because I was still wrestling with the ethical questions of using genealogy databases for criminals.”

It’s not clear how often law enforcement turns to burgeoning DNA databases. Andy Kill, a spokesman for 23andMe, said the company has “had a handful of inquiries over the course of 11 years,” and that no data were “given out in any circumstance.”

It is unlikely that the apparent success of the method in the Golden State Killer case will spur a rush to use genealogy databases to solve crimes.

“Using a database of this kind will generate an extraordinary number of leads, and running them all down using both nongenetic and genetic information requires a lot of police power,” Ms. Murphy said. “So I doubt it will be run of the mill any time soon.”

But it clearly is time for a wider discussion about law-enforcement access to stored DNA, Mr. Neufeld said. “What really needs to happen is for ethicists, lawyers and minorities likely to be disproportionately affected to think of the unintended consequences of this genetic data.”