
New federal rules limit police searches of family tree DNA databases - bookofjoe
https://www.sciencemag.org/news/2019/09/new-federal-rules-limit-police-searches-family-tree-dna-databases
======
tareqak
I think if law enforcement uses these DNA databases then their entire
department should be required to submit each officer’s DNA and that of their
immediate family members too. If prosecutors or defending attorneys want to
use these databases, then the same should go for them. If a judge admits the
use of DNA evidence for a case, then the same goes for them. Politicians by
virtue passing these laws should get that same treatment.

Maybe the way to solve this issue is for law enforcement to be required to
mail a letter to everyone who is in the database that they are a suspect in
whatever crime being investigated each time law enforcement executed or
delegates the execution of a search query. I mean that is how search works:
you search everything or you compute hash functions on everything to avoid
searching everything, but you’ve effectively tested whether or not everyone in
the database is the suspect.

On a slightly different topic, how well are these DNA databases secured and
maintained? A person’s DNA might not change, but the corresponding entry in
the DNA database is subject to theft, manipulation, and data corruption.
What’s stopping the presumption of innocence until proven guilty becoming the
presumption of innocence until the DNA database reports a match? Arguably,
people should treat DNA databases with the same level of suspicion and concern
as some view electronic voting: absolutely vulnerable and absolutely abusable
until repeatedly proven to be not sufficiently many times.

~~~
blotter_paper
Resampling DNA before conviction would fix the specific issue of the digital
record being subject to tampering, I kind of assume this is done already.

The real nightmare is that we might be right around the corner from DNA being
writable to the extent that you could make mock DNA to plant at a crime-
scene/evidence-locker, and there might be a couple awkward decades where the
courts believe the FBI when they claim to have found DNA matches (just like
that time they systematically pretended they could identify hairs, and
convicted people of murder based on hairs that were literally from dogs in
some cases). We'll catch on eventually if they try it, but it would suck for
those of us convicted on falsified evidence. I wouldn't be so paranoid about
that possibility if they hadn't lied about the dog hairs for decades.

~~~
Terr_
> right around the corner from DNA being writable

Why bother when it's trivial to _copy_ existing DNA? The evildoer just needs
to get a tiny sample from someone who'd made a decent frame.

Sure, then you've got the problem of how to create a DNA-bearing artifact
that'll fool forensics -- a spilled puddle of pure chromosomes would be weird
-- but that'd be true in either case.

~~~
rtkwe
I've read a couple books where the opposite was done. Intentionally dump huge
amounts of DNA into the area to make any tracing pointless. One amusing and
gross way was vacuuming bus seats for the material.

~~~
Nadge
Reminds me of a scene in The Town - they were going to rob a bank, and they
collected whole bags of hair from a barbershop floor, and spread it during the
robbery.

~~~
michjedi
Wouldn't that be quite useful for police?

They may be able to pinpoint a location - the barber where all the DNA matches
go to have a haircut, and a time - soon after all those with majority DNA in
the pile of hair went to the Barber's. Then they can analyse who was in the
area around the time and find a person involved.

~~~
jdironman
My thoughts exactly. The only true way is to appear to have never been there
forensically, leave no sort of evidence. Security through obscurity only works
in some instances.

~~~
greedo
There was a murder in Nebraska where crime scene was liberally cleaned with
bleach to obliterate DNA evidence. Still no conviction despite a lot of
circumstantial evidence. This was partially compounded by older DNA technology
that destroyed the sample while processing it.

~~~
inetknght
> _This was partially compounded by older DNA technology that destroyed the
> sample while processing it._

Can you point to current DNA tech which doesn't destroy the sample while
processing it?

~~~
brokenmachine
For PCR you only need a super-tiny bit, then you can amplify it as much as you
want. I guess you're still technically destroying that tiny bit, but it hardly
makes a difference when you only need a few molecules.

------
RcouF1uZ4gsC
>The value of these websites for law enforcement was highlighted last year
when Joseph DeAngelo was charged with a series of rapes and murders that had
occurred decades earlier. Investigators tracked down the suspect, dubbed the
Golden State Killer, by uploading a DNA profile from a crime scene to a public
ancestry website, identifying distant relatives, then using traditional
genealogy and other information to narrow their search. The approach has led
to arrests in at least 60 cold cases around the country.

It seems like a pretty big loss if these types of cases cannot be solved in
the future.

~~~
svnpenn
As distasteful as it might be, you have to draw the line somewhere.
Warrantless searches of every home and vehicle in the country would probably
solve a lot of crimes too. Do you want to shred the USC to make that happen?

~~~
astura
The database that police use is GEDMatch, it's an opt-in database run by
volunteers that people upload their DNA to for the sole purpose of being
findable by their DNA.

GEDMatch doesn't even do the DNA testing themselves.

~~~
smnrchrds
> _people upload their DNA to for the sole purpose of being findable by their
> DNA_

They are not making just themselves findable by DNA. They are making their
extended family findable by DNA, and I don't imagine they have gotten the
whole family's consent before doing so.

~~~
cortesoft
Why would you need your family's consent to submit your DNA? The law doesn't
work like that, just because they info can be used against someone else.

I can post on Facebook that I was with you at a certain time and a certain
place; I don't need your permission even though law enforcement might use that
to find you. Or if I post a picture of us at a baseball game, I don't need
your permission just because it could be used to find out you were somewhere.

~~~
Tepix
Because it affects them

~~~
cortesoft
A lot of things effect other people, doesn't mean you need their permission.

If I thought a relative of mine was a criminal, and went to the police, and
said "I think my cousin committed a crime, check my blood"

Would that be ok?

~~~
vkou
Depends on the culture.

Some suffer from strong taboos against snitching on family members.

Some suffer from an overabundance of civic duty.

------
mauvehaus
New Hampshire Public Radio put out an amazing podcast about a murder that went
unsolved for decades. A lot of effort by a lot of people went into unraveling
the stories and identifying the victims, but genetic genealogy was pretty key.
In the later episodes they also talk a bit about the question of unrestricted
access and the consent of people in the databases.

If you're interested in how powerful the techniques are (or are simply
interested in how a very cold case was finally broken open), I'd highly
encourage you to check out Bear Brook:

[https://www.bearbrookpodcast.com/](https://www.bearbrookpodcast.com/)

I hope I've kept this vague enough to avoid giving anything away for anybody
who wants to go listen. It really is worth your time.

~~~
nine_k
How powerful is the tech is good to know.

What is the rate of false positives, and how do we know it, is of vital
importance.

~~~
mauvehaus
The question of false positives isn't something they covered, but I wonder the
same thing. I'd love to hear more about it.

------
a254613e
I don't understand the privacy concerns and most of the comments here. I see
these DNA database searches as an amazing tool to find criminals and not in
any way privacy infringing. And I wish it was more widespread, ideally
everyone being required to submit their DNA.

Some arguments I'm seeing:

* "Privacy": I don't see this more private than the information contained on a driver's license. It also does not expose anything that's not otherwise already available to the police. I don't see the difference (when it comes to privacy) between DNA and a fingerprint that you have to provide when getting ID/drivers license.

* "False positives": Yes, they'll probably happen. But even if we go with that assumption there are additional ways to exclude most of them. And those that can't be excluded get tested for an exact match and/or additional evidence. This is no different than being a suspect in any other way.

* "False convictions": As far as I understood it this will just be used to narrow down potential suspects, not to get a conviction.

* "Police will lie do anything to convict the person just based off of this evidence": That's a separate topic that needs to be addressed, but not by reducing tools and forbidding technology that can narrow down and find suspects.

Under worst case scenario is being a false positive result and maybe talking
to the police (if you were in the same city, your age was correct, you were
around/close to area of the crime) and providing exact DNA sample so much
worse than the fact that "The approach has led to arrests in at least 60 cold
cases around the country."? I say it's not.

~~~
carbocation
> _I see these DNA database searches as an amazing tool to find criminals and
> not in any way privacy infringing. And I wish it was more widespread,
> ideally everyone being required to submit their DNA._

I think I can at least understand the viewpoint of those who favor DNA
database searches. But, I don't understand how DNA database searches are not
obviously in tension with privacy. Can you explain why you think that DNA
database searches are "not in any way privacy infringing"?

~~~
eanzenberg
This is a bit of a strawman. Law enforcement already uses databases of DNA and
fingerprints of offenders and tries to match new cases to them. These are
highly effective measures since many criminals are repeat offenders. So of
course a DNA genetic database is privacy infringing to a degree. Its not
required for every citizen to register their DNA, and its an extremely useful
tool that helped put extremely violent offenders in jail.

~~~
carbocation
It’s not a strawman; it’s a request for clarification from the GP.

------
tareqak
One thing I realized now after thinking about the impact of DNA databases is
the long-term impact. We already live in a world where law enforcement and the
criminal justice system as a whole can be biased for or against different
kinds of people depending on race, gender, background, sexual orientation,
sexual identity, and wealth. If law enforcement is able to collect DNA samples
and store the DNA of those who are convicted, then they could do statistical
analysis on the genetic make-up of criminals by crime. Some people already
have concerns about insurance companies getting access to their DNA and
discriminating against them using increased prices or refusing to insure them
all together. Similar analysis could be used by law enforcement and
governments to monitor and apprehend people they suspect might have a higher
probability commit a crime. Again, law enforcement already pulls over certain
groups of people while they are out driving more often than others without
repercussions.

Improper use of both DNA databases and statistical analysis can realistically
be used to bring about the rise of something that I’ve only ever read about:
pre-crime. That we live in a time where big data gets bigger, mass
surveillance becomes evermore inescapable, politics more divisive, and
government more powerful yet less accountable just makes this one possible but
extremely powerful tool of oppression.

------
jijji
I would think that police would need a warrant from every person that hits on
the the database, not just the targets, but every person whose DNA is included
in such a database. If there are 50 million records of DNA included in the
database, they would need 50 million warrants and show cause, otherwise its a
violation of the fourth amendment.

~~~
ltbarcly3
You would be wrong about that. The police don't need a warrant to collect
evidence left out in plain site. If you upload your DNA profile for people to
match DNA profile's with, then the police are legally allowed to match DNA
against it.

Requiring a warrant for this would be like requiring the police to get a
warrant to look at the photos people upload to facebook.

~~~
tantalor
Whether it's in plain sight depends on whether subjects _consented_ to the
search.

~~~
ltbarcly3
What? Plain sight means they could see it without even performing a search at
all.

Unless you are just saying that they only claim something was in plain sight
as a lie when the person doesn't consent and they do the search anyway?

~~~
shawnz
It does not show the profile "in plain sight". It only shows it to users who
are potential relatives, and the TOS indicates that you may not submit others'
DNA as your own when applying.

------
dmix
> One study found that 60% of white Americans can now be tracked down using
> such searches.

Woah, this is a goldmine for law enforcement.

I'm curious what the false positive rate is currently. We've already seen the
police, or more accurately their prosecution teams, overstate the scientific
value of touch DNA [1][2]. This type of database, which some agencies are
already building themselves [3][4], is only going to keep growing. Even for
minor crimes.

Their ability to collect DNA properly as well as in a legitimate fashion
connected to a crime should come under heavier scrutiny (if it hasn't already)
and no private database should just be handed to them.

For example: can we trust the DNA companies to have an appropriate chain of
evidence?

We really need to avoid the beginning arrest scene in Brazil type of stuff...
if they are going to do it at all, they better do it properly. Legal
constraints are highly welcome.

1\. [https://www.propublica.org/article/thousands-of-criminal-
cas...](https://www.propublica.org/article/thousands-of-criminal-cases-in-new-
york-relied-on-disputed-dna-testing-techniques)

2\. [https://www.nytimes.com/2005/05/07/us/labs-errors-force-
revi...](https://www.nytimes.com/2005/05/07/us/labs-errors-force-review-
of-150-dna-cases.html)

3\.
[https://www.nytimes.com/2019/08/16/nyregion/newyorktoday/nyp...](https://www.nytimes.com/2019/08/16/nyregion/newyorktoday/nypd-
dna-database.html)

4\. [https://www.nytimes.com/2019/08/15/nyregion/nypd-dna-
databas...](https://www.nytimes.com/2019/08/15/nyregion/nypd-dna-
database.html)

------
irq-1
A different point: most murders are committed by people who are known by the
victim, while DNA can reveal connections from strangers.

[https://www.bjs.gov/index.cfm?ty=tp&tid=941](https://www.bjs.gov/index.cfm?ty=tp&tid=941)

> "Stranger" is a classification of the victim's relationship to the offender
> for crimes involving direct contact between the two. Incidents are
> classified as involving strangers if the victim identifies the offender as a
> stranger, did not see or recognize the offender, or knew the offender only
> by sight.

Interestingly, there was a brief period in the US 1990's where over 50% of
murders were committed by strangers.

------
kolanos
If anyone is interested in a list of perpetrators of crimes identified through
genealogy databases [0]. Most famously the Golden State Killer, who likely
would have remained unidentified [1].

[0]:
[https://en.wikipedia.org/wiki/List_of_suspected_perpetrators...](https://en.wikipedia.org/wiki/List_of_suspected_perpetrators_of_crimes_identified_with_GEDmatch)
[1]:
[https://en.wikipedia.org/wiki/Golden_State_Killer](https://en.wikipedia.org/wiki/Golden_State_Killer)

------
neilv
A consideration I didn't yet see mentioned in the comments: announcing rules
like this might allay concerns some people have about submitting their DNA to
databases, thereby increasing participation (and business).

The resulting increased participation is then subject to a number of major
pros and cons for the individual and society -- now, and in the future.

~~~
rhizome
I doubt law enforcement is going to just let this go, and I imagine
legislation is being designed right now to ease the warrant process for this
purpose, exclude law enforcement from some protections, or to carve-out
allowances within (scant) existing protections.

------
bureaucrat
If a DNA is found on a felony crime site, I think all searches should be
possible. If possible restrict it with a need for a warrant.

I’m trying to think but so far there seems no way to justify limiting
searches.

~~~
kragen
Felony crimes—such as lying to a federal government employee, like Martha
Stewart, or possession of marijuana?

~~~
oh_sigh
Why not? Are there laws relating to "these investigative techniques are
acceptable for these crimes, but not these"?

Doesn't it just come down to law enforcement discretion? As in, maybe they
might not use a dna database to find a buyer of .125oz of pot, but might use
it when investigating a crime syndicate dealing in thousands of pounds of pot?

~~~
kragen
> Doesn't it just come down to law enforcement discretion?

Maybe giving police that much discretionary power is a bad idea.

~~~
greedo
Police in the US (and the prosecuting attorneys) have incredible amounts of
discretionary power.

~~~
kragen
They do; my friend Aaron died from it.

------
gbrown
Fun fact: Family tree DNA search skews towards white people, balancing out
some of the disproportionately black federal criminal DNA databases.

------
detail-oriented
This should be a law, not a rule. How do we push this into law, so there are
consequences when the databases are abused?

------
olliej
Does it limit the DNA database companies from simply forwarding the data?
Otherwise you just get the dumb "police officer has lunch with exec 'it sure
would be nice if we had dna data for X'" and other approaches they've taken to
circumvent the law.

~~~
inetknght
> _Otherwise you just get the dumb "police officer has lunch with exec 'it
> sure would be nice if we had dna data for X'" and other approaches they've
> taken to circumvent the law._

How would you prevent that here when the argument could be applied to _any_
regulation?

------
riazrizvi
I get why our behavior should be protected with privacy, to prevent bad actors
from exploiting us. But DNA matching seems to be a reliable way to find
criminals without impacting anyone’s standard of living.

Can someone explain why it’s bad to solve crimes with this data?

~~~
anon9001
I don't know if anyone else will say it, but I think part of the reason is
because not every crime deserves a prosecution.

Most murders probably do, but if you have this database you might as well use
it for automatic paternity tests too.

Ever spit gum somewhere you shouldn't have? If I was a cop that stepped in
gum, with an instant DNA scanner in my pocket, I'd be tempted to scan it and
pay the offender a visit.

Laws change very slowly, and things are going to get weird very fast when
anyone can run a global DNA scan from their iPhone.

------
GWSchulz
The policy should also require the FBI — prior to utilizing private genealogy
sites — add the case details to Justice’s NamUs database and network. The FBI
pretends it doesn’t exist, because the bureau doesn’t get to control it. Poor
FBI.

------
pfdietz
What about mothers searching for unknown fathers? The civil law applications
of DNA database searches could be considerable.

This would also have a criminal element: every pregnant underage mother is a
potential statutory rape case.

------
bayesian_horse
I'm having a hard time finding privacy issues with such searches. When those
databases are used to search for suspects in legitimate crime cases using
legitimate DNA evidence, I fail to see where either the suspect or the culprit
have a reasonable right or expectation to privacy.

There is an argument around not giving a government such power to abuse. But
if a government is already inclined to use such databases illegally and to
circumvent due process, they won't really care about such legislation either.

------
jmpman
Can we get a constitutional amendment to codify this right?

------
fuzz4lyfe
I agree with these "new rules" but isn't it odd how unelected DOJ officials
get to effectively make new law out of whole cloth like this? I don't recall
seeing anything in the constitution about the law making powers of the DOJ.

~~~
phkahler
It's not a law, its guidelines. Basically meaningless.

------
peter303
I have read that 26 million Americans have taken these genetic tests, now
encompassing 8% of the population. Not all of these are generally searchable.
But approaching a critical mass for forensic genealogy.

------
dzhiurgis
So majority of HN don’t like idea when private company censoring information
from “right to be forgotten” claims, yet would love law enforcement solve less
crime by using public data?

------
madrox
Great. To me the more interesting question will be how this evidence is
handled at trial. DNA matching is a stochastic process. There is no line of
logic involved. Therefore, when using it in court it can only be used in the
context of probability of a match. Humans are notoriously bad at assessing
probability, and there are some great TED talks out there on how bad we really
are and how it’s already affected our non-genetically enhanced justice system.
My greatest hope is not that DNA searches are banned, but that we treat DNA
matches as circumstantial evidence that may help indicate a suspect but is
inadmissible as evidence of guilt.

~~~
peter303
Forensic genealogy being a very new tool has resulted in dozens of arrests,
but only one finishing a trial.

[https://www.wired.com/story/the-first-murder-case-to-use-
fam...](https://www.wired.com/story/the-first-murder-case-to-use-family-tree-
forensics-goes-to-trial/)

Like any new forensic method, it will undergo years of legal scrutiny.

------
treebeard901
Similar to other questionable methods of data collection, how likely is it
that a form of parallel construction is used even with these laws in place?

------
killjoywashere
So the only people searching these databases will be the security agencies of
every country that can break in?

------
ulises314
Not making a point, just stating that this method was how they got the golden
state killer.

------
droithomme
Thank goodness! This whole situation has been crazy.

------
Muuuchem
Ok, great. I get it, privacy. But there are murderers that could be caught,
that would likely reoffend...

~~~
_jal
So where is your line? I'm sure there are murderers who could be caught by
suspicion-less, warrantless home searches, too.

~~~
echelon
I'm a huge privacy advocate, but I don't think DNA should be private. DNA
database tech is a game changer and I absolutely support it being used to
solve crimes.

* DNA is immutable, comparable, heritable, and searchable in a tree. It's an ideal lookup key. Unlike fingerprints or face data you don't even need direct DNA evidence. A relative will do.

* It doesn't invade privacy to look this up in a database. No homes were entered into, no phone conversations were tapped. Private lives weren't snooped. No relatives were harmed.

* If you commit a violent crime, bad on you. If you leave DNA behind, you're stupid. The first deserves punishment; taken together doubly so.

* DNA evidence alone may not be enough to convict, but it can be the basis for an investigation.

* We already use video footage and artist sketches. Right now we rely on the "database" of collective human consciousness to find matches, which is unreliable and imperfect. When matches are found it's simply luck or chance -- cases shouldn't have to depend upon that when it's the same class of evidentiary data.

I'd be in favor of the government having all of our DNA on file so long as it
isn't used for discriminatory purposes (health insurance, job, organ
transplant denial, ...) or for advertising to us.

We're only scratching the surface of what's possible, though. Imagine when we
extract higher dimensional features, such as gender, race, hair color, and
ultimately facial structure from the DNA. Feed that into a photo database...

Your phenotype and genotype != your private life. Even if we aren't happy with
what we got, these are the most concrete representations of our own selves.
It's our code and (usually) unique addressing label, independent of any
database. We should view it as such.

You're shedding DNA right now through exfoliation, waste elimination, and
breathing. You can almost be guaranteed that corporate interests will start
tapping into these sources in the next few decades. The law enforcement use
case at least seems legitimate.

I just don't want them reading my email. :)

~~~
learc83
>If you commit a violent crime, bad on you. If you leave DNA behind, you're
stupid. The first deserves punishment; taken together doubly so.

You aren't more deserving of punishment for being stupid. What kind of insane
moral system do you follow?

>You're shedding DNA right now through exfoliation,

And I'd prefer that law enforcement not be able to track me everywhere I go
because the risk of getting caught up in an investigation is too high.

The criminal justice system has serious flaws and I'd rather not be wrongly
implicated just because I happened to shed DNA near where a crime happened.

~~~
echelon
> You aren't more deserving of punishment for being stupid.

I was being tongue in cheek. Punishments should fit crimes and those accused
should not be judged on the basis of intelligence, race, wealth, or any other
factor but the facts of their case. That said, it's easy to prosecute cases
with abundant evidence available. Such crimes tend not to be premeditated, and
easy convictions serve as social reenforcement to deter similar crimes.

> The criminal justice system has serious flaws and I'd rather not be wrongly
> implicated just because I happened to shed DNA near where a crime happened.

Fair point.

DNA should be used to place persons at crime scenes and not be used in absence
of additional evidence. Unless said DNA was found on the victim of a sex
crime, under fingernails, etc.

