Over the past few years, the online DNA database GEDmatch has become a powerful tool for solving cold cases. Founded in 2010 to help adoptees and genealogy enthusiasts find biological relatives, the site shot to prominence in 2018 after California police said GEDmatch led them to a suspect in the decades-old Golden State Killer case.
The open-source site allows anyone to upload their raw DNA file generated from genetic testing firms like 23andMe and Ancestry. Then, they can search for other users who share their DNA. Police use the site to upload DNA found at crime scenes, look for matching relatives, then do traditional genealogy to zero in on a suspect. The database contains around 1.5 million DNA profiles uploaded by 1.1 million users. A recent technical glitch, however, threatens to undermine users’ trust in the site.
Your DNA Test Could Crack a Cold Case
Consumer DNA databases are a powerful new tool for police but raise privacy concerns
onezero.medium.***
On January 14, a technical snafu at GEDmatch caused previously deleted user data to be restored for two days. It’s the second security incident the database has experienced in less than a year. In July 2020, hackers accessed the database and exposed more than a million users’ profiles.
GEDmatch users have to give permission for their profiles to be used in law enforcement searches, but the breach overrode whatever privacy settings users had selected and made their profiles temporarily visible to all other users, including police. It’s not known what the hackers were after.
Verogen, the San Diego-based forensic genomics company that owns GEDmatch, told Future Human that the latest incident wasn’t a data breach or a hack. “There was a minor technical issue when we recently made an update to the GEDmatch database,” a company spokesperson said in an email, adding that only a small number of users were affected. While DNA files — what the company calls “kits” — briefly reappeared in some users’ accounts, the data wasn’t compromised in any way.
In a January 20 email to affected users, Verogen CEO Brett Williams explained how the technical glitch happened. When Verogen bought GEDmatch in December 2019, the company was required by the European Union’s General Data Protection Regulation to store certain information separately. Verogen says it was allowed to merge that information back into its main database, and in doing so on January 14, the error occurred. Now that the database merger is complete, the company says users’ deleted information has been permanently removed.
“Rest assured that the unique nature of this incident ensures that an error of this type will not happen in the future. If you wish to delete kits, they will be permanently deleted,” Williams said in the email. “Verogen or GEDmatch do not keep copies of the information, and the information is never sold to a third party.”
Despite the company’s assurances, the glitch doesn’t instill confidence that users have full control over their own data. Users who delete their DNA files from GEDmatch clearly don’t wish to use the database anymore, for whatever reason. The possibility that your information could reappear — without your consent — after you took the proper steps to remove it is, quite frankly, alarming. And it raises serious questions about whether DNA databases like GEDmatch retain users’ data in perpetuity.
The Era of DNA Database Hacks Is Here
A major data breach shows genetic information is vulnerable to attack
onezero.medium.***
In another recent development, GEDmatch quietly changed its terms of service and privacy policy this month. Effective January 11, law enforcement can use the entire database of 1.5 million DNA profiles — rather than just the 350,000 who have opted in — to search for matches to unidentified remains. Users still have to opt in if they want to make their profiles available to law police investigations seeking to identify suspects of certain violent crimes.
This may not seem like a big deal. Many people would agree that identifying John and Jane Does is a worthy cause. On Facebook, the DNA Doe Project, a California nonprofit that seeks to put names to anonymous remains, praised the move.
But the change takes away some amount of consent from its users in how their data can be used by police. Now, users don’t have a choice in whether their profiles can be used in these cases, which include unidentified newborn remains. In these cases, the babies’ mothers are often the perpetrator, and police typically identify the mother in order to identify the baby. Thus, the case becomes a suspect case. In December, I wrote about the ethical complexities of these cases, which usually involve women and girls who are unmarried, scared, and without the resources to care for a child. Some users may not want their DNA data being used to arrest a distant family member accused of such a crime.
It’s not the first time GEDmatch has bent its own rules. At first, GEDmatch only allowed police to use the site to investigate homicides and r****, as well as to help identify anonymous remains. But in May 2019, it expanded the types of crimes to include aggravated assault and robbery. Privacy experts warned of a slippery slope toward police using the genealogy site to investigate increasingly less serious crimes and erode people’s genetic privacy in the process.
When Verogen bought GEDmatch in December 2019, genealogy enthusiasts were hopeful that the company would take privacy and security seriously. Williams vowed to enhance protections, given that computer scientists had previously revealed serious vulnerabilities in the site. Now, Verogen will have to double down on its commitment to users if it wants to keep them. And as a company that caters to law enforcement, it needs all the users it can get to remain useful to police. The more people in the GEDmatch database who opt in to law enforcement matching, the better chance police have at identifying a suspect. But there’s a risk that people could leave the site if they don’t feel like their data is being protected or used in a way that they’ve consented to.
The latest GEDmatch debacle is an important reminder that companies can change their terms of service at any time and can never completely guarantee the privacy and security of your data.
The New York Times