This Genealogy Database Helped Solve Dozens Of Crimes. But Its New Privacy Rules Will Restrict Access By Cops.

GEDmatch’s revamped genetic privacy policy could set off legal battles that go all the way to the US Supreme Court.

It just got harder for police to find the perpetrators of violent crimes by sleuthing in people’s family trees.

Days after BuzzFeed News revealed that the website GEDmatch had bent its published rules to allow police in Utah to search for relatives of the perpetrator of a violent assault, the website changed its terms of service so that users now have to explicitly opt in for their DNA profiles to be included in law enforcement searches.

GEDmatch has been the main database used by police for genealogy, involved in more than 50 of the cases solved so far. Until a significant number of the 1.2 million or more people whose DNA data has been uploaded to GEDmatch give permission for cops to search against their profiles, it means that the site has suddenly become all but useless for solving crimes. And that may set off legal tussles that go all the way to the US Supreme Court.

“You will start to see search warrants being written on GEDmatch,” Paul Holes, a retired investigator with the Contra Costa County district attorney's office, who led the team that cracked the Golden State Killer case, told BuzzFeed News.

If cops must obtain a warrant, Holes added, they may also seek court orders to get access to the much larger DNA databases operated by the genealogy industry’s big players, Ancestry and 23andMe — which have said that they oppose their customers’ data being used in this way.

“Of course there are going to be legal battles,” Holes said. “It would not surprise me, years down the road, if this could be a US Supreme Court issue.”

GEDmatch’s move follows a backlash from some genealogy enthusiasts against a decision to let its database be used in the case of a 17-year-old arrested for a violent assault on an elderly woman in Centerville, Utah. “In some of our Facebook groups, the reaction was really strong,” Debbie Kennett, a genealogist and honorary research associate at University College London, told BuzzFeed News.

GEDmatch is used by people researching their family trees to find relatives who share some of their DNA. Until the latest change on Saturday, the website’s published terms of service restricted cops’ searches for perpetrators’ relatives to investigations of homicides or sexual assaults. But that rule was relaxed on a one-off basis in the Utah case, Curtis Rogers, a retired businessman in Florida and one of the founders of GEDmatch, told BuzzFeed News earlier this week.

The new terms of service extend the crimes for which law enforcement searches are allowed to “murder, nonnegligent manslaughter, aggravated rape, robbery, or aggravated assault.” But importantly, they also add a new privacy setting for users to say whether they wish to have their profiles made available for searches by police. And by default, all profiles have been set to “opt out” unless users decide to opt in.

“Your story and others brought attention to the definition of 'violent crime' which was clearly inconsistent with what is generally used elsewhere,” John Olson, an engineer in Texas who runs GEDmatch with Rogers, told BuzzFeed News by email. “The other changes were mostly based on lessons learned since our last TOS revision a year ago.”

Genealogists who opposed GEDmatch’s decision to relax its previous rules in the Utah case are pleased with the latest policy change. Judy Russell, who blogs as the Legal Genealogist, described it in a new post as “a good, right, ethical decision” that “leaves the entire field on firmer ethical ground.”

“As people opt in, this will become the database I’ve been advocating for,” Leah Larkin, a genealogist in California who has argued that law enforcement searches should obey the principles of informed consent, told BuzzFeed News.

But some experts say GEDmatch’s policy flip-flops reveal problems with allowing the operators of privately run websites to balance individual privacy and the goals of criminal investigators.

“They are reacting on the fly, making up the rules as they go along,” Kennett said. “Personally, I’d have preferred all of this has been worked out before the police started using these databases.”

The chance of finding relatives in a DNA database depends on its size. And the effective size of GEDmatch for police searches has suddenly dropped from around 1.2 million to zero. “The fear is that there are going to be active offenders who could have been taken off the street, but will now not be,” Holes said.

It’s unclear how many GEDmatch users will decide to opt in — or how quickly they will do so. A survey published last year indicated that more than 90% of Americans support the use of genealogy databases by law enforcement to solve violent crimes. Still, some GEDmatch users will be deceased. And the owners of many DNA profiles may not be regular users of the site, or may simply not bother to change from the default privacy settings.

Police do have another database they can use to solve crimes through genealogy. In January, BuzzFeed News revealed that FamilyTreeDNA had allowed the FBI to upload crime scene profiles to its database, which contains a similar number of DNA profiles to GEDmatch.

FamilyTreeDNA has since revised its terms of service, which now say that police must ask for permission to use the database and restricts this to cases of “homicide, sexual assault, or abduction.” It also now allows customers to decide whether to allow their profiles to be included in police searches, but in its case the default setting is to opt in.

Police could also subvert GEDmatch’s new policy by pretending to be normal customers. “Does law enforcement actually need to declare themselves in uploading data? Or can they just act like a typical customer,” population geneticist Graham Coop of the University of California, Davis, who has studied the chance of finding relatives in genealogy databases, wrote to BuzzFeed News by email.

Parabon NanoLabs, the leading company offering genealogy services to law enforcement, has previously said that it will not use genealogy databases without the operators’ permission to do so. Parabon did not immediately respond to a request for comment on GEDmatch’s policy shift. But Steven Armentrout, the company’s CEO, earlier this week told BuzzFeed News that “our policy is to remain within the terms of service.”

The FBI team that helped with the Golden State Killer case and several subsequent investigations has reportedly not been so scrupulous. In March, Forensic Magazine revealed that the FBI team had submitted DNA profiles to FamilyTreeDNA’s database before the company had given its permission.

“We had found the FBI in our database, and heard them with our own ears saying, ‘Look, we’re not going away — you can hide and you can pretend we’re not around … but we’re going to keep coming in,’” Bennett Greenspan, the company’s CEO, told Forensic Magazine. “‘If you make it impossible for us to put our samples in the database, it’s okay — we’ll just subpoena you.’”


This post was updated to clarify a comment by John Olson.

Skip to footer