Relative's DNA from genealogy websites cracked East Area Rapist case

This is a very interesting issue with sending your DNA to sites like 23andme. This means that a police officer can get a warrant to submit a DNA sample to the site, and get back anyone who matches. (Or in this case, their relatives.)<p>The reason I think it&#x27;s particularly interesting is that it <i>passes</i> one of the basic tests I have for whether something should be searchable by law enforcement: Do they have a target in mind and a warrant to search for that target? For PRISM and the other things that Snowden warned us about, the answer was no: the government was doing dragnet surveillance of all sorts of data warehouses to find people who fit a profile, without knowing who they&#x27;re looking for ahead of time. With this, they have to have a DNA sample found at a crime scene, and they&#x27;re using that combined with a warrant to do a targeted search for people with matching DNA. It just happens to be a website that people send their DNA to, rather than a police database.<p>So I&#x27;m actually inclined to say I think this is ok? But I&#x27;m not 100% sure how I feel yet.<p>EDIT: ok it looks like this was done not necessarily with a warrant, but with the officer just submitting the DNA as if they&#x27;re a customer of the site. But actually my point still stands if they changed their technique to instead use a warrant and ask the site directly, not hiding that they were police officers... it&#x27;s just that in this case they didn&#x27;t even need to because it&#x27;s so easy to just send others&#x27; DNA samples to these sites? It really seems like the lack of a warrant was a technicality here and could have easily gone the other way and still got to the same result.

I was very confused about this. The genealogy website did not probide any information to law enforcement. Instead, law enforcement uploaded DNA from the crime scene to the genealogy website.<p><a href="https:&#x2F;&#x2F;www.nytimes.com&#x2F;2018&#x2F;04&#x2F;26&#x2F;us&#x2F;golden-state-killer.html" rel="nofollow">https:&#x2F;&#x2F;www.nytimes.com&#x2F;2018&#x2F;04&#x2F;26&#x2F;us&#x2F;golden-state-killer.ht...</a>

Interestingly it wasn’t even his DNA in the database, but a relative’s. It just goes to show that there is nowhere to hide. Even if you stay completely offline, it only takes one relative to log the bulk of your DNA onto the Internet. Metadata strikes again.

One guy I know sent in his dna to ancestry. He was immediately matched with a woman as highly likely to be his sister. He was shocked and they connected. Turns out they are siblings and both adopted at birth. So there’s some upsides to these sites<p>Nevertheless hopefully ancestry etc would have sensible policies to protect peoples’ privacy unleSs a court order is involved.

The reporting on exactly how DNA was used to identify the Golden State Killer is still pretty limited.<p>It sounds like they submitted DNA from GSK crime scenes to a number of genealogical sites and got back one or more familial matches. From that match or matches, they were able to backtrack to a specific suspect.<p>Once the suspect was identified, they were able to surreptitiously obtain the suspect&#x27;s DNA, then they directly tested that DNA against GSK DNA samples, and were able to confirm the match.<p>It hasn&#x27;t been stated directly, but it seems like there is plenty of still-usable DNA from GSK crime scene evidence, even though it will now be 30+ years old.

&#x27;As he was being arrested, he told officers he had a roast in the oven. They said they would take care of it.&#x27;<p>Humans are an odd bunch.

This comment section reads like half the people didn&#x27;t bother to read the article or even Google the case and somehow think the police are framing an innocent man.

I&#x27;m surprised they are being so public about this (they could have downplayed it, even if they didn&#x27;t go full parallel construction.)<p>This will potentially cause people to be less willing to use sites like this, and this could have long-term negative public health impact. Plus, it hurts the commercial businesses.<p>(My DNA is on record with DOD for personnel recovery purposes, as are most military&#x2F;contractor personnel of the past 15 years or so, but I&#x27;m not sure how the actual database works. I suspect in reality it means China, Russia, Israel, and any other competent infosec adversary also has a full copy of this database.)

This kind of screening is extremely fucked up because <i>average people are terrible statistical reasoners</i>. A 99.999% accurate DNA test will find mostly innocent people if applied to a database of tens of millions of people. And even without corroborating evidence, juries will convict on the DNA because average people aren’t wired for this kind of statistical reasoning.

An excerpt from Michelle McNamara&#x27;s letter to the golden state killer.<p>The race was yours to win. You were the observer in power, never observed. An initial setback came on September 10, 1984, in a lab at the University of Leicester, when the geneticist Alec Jeffreys developed the first DNA profile. Another came in 1989, when Tim Berners-Lee wrote a proposal for the World Wide Web. People who weren’t even aware of you or your crimes began devising algorithms that could help find you. In 1998, Larry Page and Sergey Brin incorporated their company, Google. Boxes holding your police reports were hauled out, scanned, digitized, and shared. The world hummed with connectivity and speed. Smartphones. Optical-text-recognition technology. Customizable interactive maps. Familial DNA.<p>I’ve seen photos of the waffle-stomper boot impressions you left in the dirt beneath a teen-age girl’s bedroom on July 17, 1976, in Carmichael, a crude relic from a time when voyeurs had no choice but to physically plant themselves in front of windows. You excelled at the stealth sidle. But your heyday prowess has no value anymore. Your skill set has been phased out. The tables have been turned. Virtual windows are opening all around you. You, the master watcher, are an aging, lumbering target in their crosshairs.<p>A ski mask won’t help you now.<p><a href="https:&#x2F;&#x2F;www.newyorker.com&#x2F;books&#x2F;page-turner&#x2F;letter-to-the-golden-state-killer" rel="nofollow">https:&#x2F;&#x2F;www.newyorker.com&#x2F;books&#x2F;page-turner&#x2F;letter-to-the-go...</a>

I did 23 and Me but under a fake name. It correctly identified me as a 1st cousin with my cousin, whom I had no idea had already taken the test as well. It was very very spooky, and I can see how useful this would be for law enforcement. At some point in the future, you can drastically limit the number of people to search for based on DNA to a single family tree, if enough people submit their own DNA. It&#x27;s scary.<p>It&#x27;s exactly like your contact list. Facebook doesn&#x27;t need you to give them your phone number. They just need 1 out of your 500 contacts to upload their entire contacts list so that they get your phone number. The law of numbers is completely against you and your privacy is already violated completely because one of your friends did it to you.

To what extent the bone marrow donor databases are subject to the same risk of police <i>fishing expeditions</i>? Do they hold full DNA profile, or just the fragments relevant to immunocompatibility?

I&#x27;ve been saying this for years. DNA sites are a goldmine for unresolved cold cases ( rape, murder, missing persons ) where DNA is available.<p>In the past, if there was a rape in a city, the cops couldn&#x27;t force everyone in the city to give their DNA to find the rapist. Now, everyone in the city is paying to give their DNA to DNA sites. All cops had to do is submit the DNA of cold cases to these sites and see if they get a match of any kind ( cousins, siblings, parents or the suspect themselves ).

If law enforcement can make use of a private sector DNA database like this, is there a good argument against a mandatory national database?

This is pretty huge. I&#x27;m wondering if it is from something like YSearch [1] where you can just put in any-old Haplotype and see results or if it is from one of the larger, well known firms like 23AndMe or Ancestry.com.<p>[1] <a href="http:&#x2F;&#x2F;www.ysearch.org&#x2F;search_search.asp?uid=&amp;freeentry=true" rel="nofollow">http:&#x2F;&#x2F;www.ysearch.org&#x2F;search_search.asp?uid=&amp;freeentry=true</a>

Does anyone have any more information on this? How do the police get access to DNA from genealogical databases? Do they need a warrant for a specific persons DNA? Do the police check for matches or does the company?

DNA is not infallible, and DNA transfer is so common that DNA &quot;evidence&quot; is not really evidence of anything at all.<p>Here&#x27;s an interesting recent story on this very topic:<p><a href="https:&#x2F;&#x2F;www.pbs.org&#x2F;wgbh&#x2F;frontline&#x2F;article&#x2F;framed-for-murder-by-his-own-dna&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.pbs.org&#x2F;wgbh&#x2F;frontline&#x2F;article&#x2F;framed-for-murder...</a>

I&#x27;m really glad they caught the guy.<p>I am concerned about the way it happened.<p>They didn&#x27;t match evidence to a person directly. They matched evidence to a DNA database to find the person. That sounds like the same thing, but it&#x27;s not.<p>There was no warrant. The DNA database company did not know they were participating in a law enforcement case. There could be other people (unlikely but possible) that matched but weren&#x27;t on file anywhere. People will start viewing such evidence as &quot;Science!&quot; instead of evidence like all the rest.<p>Finally, if this okay, we have an economics question. It cost the cops 40 or 50 bucks to catch a serial killer. Well-spent money in my book. But what if they could catch people for 10 bucks? Or a dollar? What if they could automatically collect samples and run them without any manual effort?<p>If this happens -- and I see no reason that it won&#x27;t -- it won&#x27;t be just serial killers. It&#x27;ll be parking violations, trespassers, urban graffiti artists -- anybody that can leave DNA. And who&#x27;s got the money to fight something like this over a traffic ticket if they get it wrong? People will just pay up or go to prison.<p>It&#x27;s continuing the destruction of our human-powered, adversarial, community-approved justice system, replacing it with automation and faux certainty. Catching evil killers is awesome, but the rest of it doesn&#x27;t seem like such a good future for my kids or grand-kids.

Great to see justice in this case. On the flip side, privacy treasure trove&#x27;s like this may become a tool for targeting non-criminals, for example classified cases targeting anonymous political activists or similar. It&#x27;s no longer their own opsec activists need to worry about. It&#x27;s all so very Gattaca.

How many other police departments do you think just read this and are frantically sending in cold case DNA samples?

Is it legal to search a medical database to get details of people with a certain genetic disorder?

Let us the police collect this data and ask everyone who is honest person to add their DNA to it. I have no problem adding my DNA to such resource but when this data is obtained without my knowledge or permission it is the same as stealing.

I guess they produced export which is similar or exact format to the exports of one of the popular sites and imported it. For example 23andme currently has DNA day promotion which lets you import ancestry exports. Seems a bit shady to me.

I wonder if this sort of method will be challenged and end up in the Supreme Court.

I do hope the prosecutor is being careful about representing the strength of DNA evidence as this person was found through a fishing expedition via a DNA database.<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Prosecutor%27s_fallacy" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Prosecutor%27s_fallacy</a><p><i>However, if the DNA evidence is the sole evidence against the accused and the accused was picked out of a large database of DNA profiles, the odds of the match being made at random may be increased, and less damaging to the defendant. The odds in this scenario do not relate to the odds of being guilty, they relate to the odds of being picked at random.</i>

Highly recommend this DEFCON talk:<p><a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=HKQDSgBHPfY" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=HKQDSgBHPfY</a>

I wonder if they&#x27;re doing the same thing for the Zodiac killer and other high profile cases.

He spent 12 years of his life as rapist and murderer. I wonder why he stopped? Mid-life crysis?

I don&#x27;t see this anywhere: This is most likely not statistically significant. A DNA match might be 99.99% accurate, but when you try to match based on a database of a million people, you&#x27;re going to get a few false positives. I really hope the police have some more evidence to go on, because otherwise it sounds like they just arrested an innocent person.

I see a future where all foreign visitors needs to submit DNA instead of finger prints.

So 23andme shares our DNA with government? Screw that...

What if Evidence is planted by Corrupt officials?

Don&#x27;t forget &quot;innocent until proven guilty&quot;.<p>I want to know what DNA they got from the Golden State Killer, and how they know that it was his. The guy that they arrested was a police officer during the period where the killing was going on, in an era before DNA tests existed. Did they take DNA from a sample that was accidentally contaminated by a police officer at the scene, and conclude that the DNA belonged to said police officer?

damn ... so the guy is going to jail based just on the data obtained from the website?<p>What if the &quot;match&quot; is not correct?<p>This should scare a lot of people away from these family tree websites. One day you might have FBI knocking on your door for being a close match to some killer somewhere.

Hang on, am I&#x27;m missing something - guy is a suspect, they have yet to find proof he is the Killer and he has been arrested based on a second attempt of trying to match the DNA after the first was inconclusive. Why does the article read like they found the killer?