DNA, Genealogy, and Law Enforcement: All the Facts

Blaine T. Bettinger, Ph.D., J.D. [email protected] / www.DNA-Central.com

NOTE: Law enforcement use of genetic genealogy is a rapidly changing area, and thus everything in this syllabus is subject to change at any point. The content is meant to be accurate as of December 2019.

TERMINOLOGY: There are currently two terms used for law enforcement use of genetic genealogy: (1) Investigative Genetic Genealogy (IGG); and (2) Forensic [Genetic] Genealogy (FG or FGG). The preferred term among the people doing this the longest, and among genealogists familiar with the long-standing and very different field of forensic genealogy (genealogical research performed by a forensic genealogist to assist in legal matters, typically heir identification), is Investigative Genetic Genealogy (IGG). “Forensic Genetic Genealogy” or even worse “Forensic Genealogy” are misleading terms for law enforcement use of genealogy.

What is Law Enforcement use of Genetic Genealogy?

For purposes of this discussion, law enforcement use of genetic genealogy comprises two approaches: (1) using DNA obtained from a crime scene to query one or more genetic genealogy databases to identify genetic relatives, leading to identification of the human source of the crime scene DNA sample through genealogical research; and (2) using DNA obtained from unidentified remains to query one or more genetic genealogy databases to identify genetic relatives, ultimately leading to identification of the remains through genealogical research.

What Methodology Does Law Enforcement Use?

The identification methodology utilized by law enforcement to identify the source of a DNA sample is the same methodology utilized for many years by adoptees to identify biological family. The trees of close genetic matches identified from querying the genetic genealogy database(s) are reviewed and built out (potentially both backward to identify ancestors and forward to identify living people) in order to lead to an individual (i.e., that is a nexus of multiple trees, that is a known missing person or possible suspect, etc.). However, law enforcement typically has access to additional databases that can significantly facilitate the genealogical research of living and recently deceased individuals that is often much more difficult for genealogists (which helps minimize the impact of law enforcement on families identified as being closely related to the DNA source).

How Does Law Enforcement Access a Genetic Genealogy Database?

There are two main ways for law enforcement to query a genetic genealogy database. One, the genetic genealogy company or database may specifically allow law enforcement to submit or upload a SNP profile to query some or all of the database. Currently, only Family Tree DNA and GEDmatch have procedures in place to allow law enforcement to access some or all of their respective databases. This is the easiest and fastest method of access, and the only method recommended by the Department of Justice (discussed below). Two, law enforcement may submit a warrant or subpoena to compel the genetic genealogy company or database to allow a query of a law enforcement SNP profile against some or all of the database. To what extent a warrant or subpoena can be used, particularly the scope and boundaries for such a warrant or subpoena, is currently unknown/untested.

Technically there is a third way for law enforcement to query a genetic genealogy database, namely unauthorized uploading of a SNP profile to a genetic genealogy database that allows uploads (such as MyHeritage or Family Tree DNA), or dosing a saliva sample with DNA for normal processing by the genetic genealogy company (such as 23andMe and Ancestry). Although there is no verified documentation, anecdotally it is widely believed that at least the upload approach has been utilized.

The Big Four Genetic Genealogy Companies and Law Enforcement

There are some very big differences in how the big four genetic genealogy companies (23andMe, AncestryDNA, Family Tree DNA, and MyHeritage) approach law enforcement use of their database. Each company is discussed individually below.

i. 23andMe (www.23andMe.com)

Quick Summary: 23andMe does not allow law enforcement to either upload SNP profiles to the 23andMe database or provide a sample for SNP analysis. 23andMe will of course respond to legally valid requests such as a search warrant or written court order, but will resist such requests to the extent it can do so.

Detailed Information: In a customer care article entitled “How 23andMe Responds To Law Enforcement Requests For Customer Information” (https://customercare.23andme.com/hc/en-us/articles/212271048- How-23andMe-responds-to-law-enforcement-requests-for-customer-information), 23andMe acknowledges that it can legally be forced to provide law enforcement access to the database:

“We work very hard to protect your information from unauthorized access from law enforcement. However, under certain circumstances, your information may be subject to disclosure pursuant to a judicial or other government subpoena, warrant or order, or in coordination with regulatory authorities. If such a situation arises, we have to comply with valid governmental requests and we will notify the affected individual(s) unless the legal request prevents us from doing so.”

However, 23andMe also indicates that it will fight such requests. The “23andMe Guide for Law Enforcement” (https://www.23andme.com/law-enforcement-guide/) states that:

“23andMe chooses to use all practical legal and administrative resources to resist requests from law enforcement, and we do not share customer data with any public databases, or with entities that may increase the risk of law enforcement access.”

Additionally, in a November 2019 New York Times article, 23andMe spokesman Christine Pai said in an emailed statement:

“We never share customer data with law enforcement unless we receive a legally valid request such as a search warrant or written court order. Upon receipt of an inquiry from law enforcement, we use all practical legal measures to challenge such requests in order to protect our customers’ privacy.”

“Your DNA Profile is Private? A Florida Judge Just Said Otherwise” (https://www.nytimes.com/2019/11/05/business/dna-database-search-warrant.html).

23andMe also maintains a Transparency Report (https://www.23andme.com/transparency-report/) which provides details on all law enforcement requests for user information that they receive. As of the date of this syllabus, 23andMe had received a total of seven (7) requests from the U.S. government for data that affected ten (10) user accounts. 23andMe did not provide data in response to any of those requests.

ii. AncestryDNA (www.ancestry.com)

Quick Summary: AncestryDNA does not allow law enforcement to either upload SNP profiles to the AncestryDNA database or provide a sample for SNP analysis. AncestryDNA will of course respond to legally valid requests such as a search warrant or written court order, but will resist such requests to the extent it can do so.

Detailed Information: AncestryDNA provides an “Ancestry Guide for Law Enforcement” (https://www.ancestry.com/cs/legal/lawenforcement) that describes the company’s approach to law enforcement use of the database. The company acknowledges that it can legally be forced to provide law enforcement access to the database:

“Contents of communications and any data relating to the DNA of an Ancestry user will be released only pursuant to a valid search warrant from a government agency with proper jurisdiction.”

However, AncestryDNA indicates that it will resist such requests. The “Ancestry Guide for Law Enforcement” states that:

“Ancestry does not voluntarily cooperate with law enforcement. To provide our Users with the greatest protection under the law, we require all government agencies seeking access to Ancestry customers’ data to follow valid legal process and do not allow law enforcement to use Ancestry’s services to investigate crimes or to identify human remains.” (emphasis in original).

“Respect for the privacy and security of our users’ account data drives our approach to complying with legal requests for information. When we receive a request our team reviews it to make sure it satisfies legal requirements and our policies. If we believe a request is overly broad, we will try to narrow it to the extent legally permitted.”

AncestryDNA also provides a yearly “Transparency Report” (https://www.ancestry.com/cs/transparency). The 2019 report is not yet available. However, according to the 2018 report, the company received ten (10) valid law enforcement requests for user information in 2018, and provided information in response to 7 of those 10 requests. All of those requests involved credit card misuse, fraud, and identity theft, and thus AncestryDNA has never (as of the 2018 report) received a valid request for information related to genetic information of any Ancestry member, and has never disclosed such information to law enforcement (again as of the 2018 report).

iii. Family Tree DNA (www.familytreedna.com)

Quick Summary: On a reviewed case-by-case basis, Family Tree DNA grants law enforcement and third parties working with law enforcement permission to upload a SNP profile for querying against the opt-in portion of the FTDNA database. Permission is only granted after the required documentation is submitted, reviewed, and approved. Family Tree DNA offers sample processing to law enforcement, and offers research services to law enforcement via its new Investigative Genetic Genealogy Unit.

Detailed Information: Family Tree DNA maintains a “FamilyTreeDNA Law Enforcement Guide” (https://www.familytreedna.com/legal/law-enforcement-guide) which describes the process by which law enforcement may request access to the Family Tree DNA database. Per the Guide, every law enforcement use of the Family Tree DNA database must be specifically requested by law enforcement and approved by FTDNA:

“As stated in Section 6.B.xii of our Terms of Service, you agree to not use the Services for any forensic examinations, criminal investigations, and/or similar purposes (“Law Enforcement Purposes”) without written permission from FamilyTreeDNA.

“Law enforcement, and any third-party representative working with law enforcement, is required to register all forensic samples and genetic files prior to uploading to the FamilyTreeDNA database. Permission to use the Service is only granted after the required documentation is submitted, reviewed, and approved.”

Law enforcement use of the FTDNA database is only approved for “[c]ases where law enforcement is attempting to identify the remains of a deceased individual or a perpetrator of a sexual assault, homicide, or child abduction.”

Opt-In/Opt-Out at FTDNA: Law enforcement can only see matches that are opted-in to law enforcement matching. If a person is opted-out of matching, law enforcement cannot see that person as a match (however, that person may still be subject to a legal request such as a warrant or subpoena). The very detailed “Law Enforcement Matching – Frequently Asked Questions” (https://learn.familytreedna.com/ftdna/law- enforcement-faq/) has answers to more than 10 different questions. The FAQ addresses the opt-in/opt-out aspect of matching:

If you are opted in to Law Enforcement Matching, you will only show up in the matches list of a law enforcement user account if ALL of the following requirements are met: • You are a DNA relative of the DNA file uploaded to the law enforcement user account • Both you and the law enforcement user account have the same matching levels selected If a law enforcement user account meets the above requirements, the information accessible to them will be identical to the information you’ve made accessible to your other matches…If you opt out of Law Enforcement Matching, law enforcement registered accounts that are genetic relatives will not be able to see you as a match, but you will continue to see them as one.

On March 12, 2019, Family Tree DNA announced (https://mailchi.mp/familytreedna/updates-to-our-terms- of-service-and-privacy-policy) that they would allow law enforcement access to the database (pursuant to proper procedures), and gave everyone the option to opt-out of law enforcement matching. Everyone except identifiable EU residents were automatically opted-in to law enforcement matching. Going forward from March 12, 2019, opting in or out has been part of the registration process for new DNA testing. Accordingly, non-EU test-takers that tested with FTDNA prior to March 12, 2019, and have not made a decision about whether to opt-out or stay opted-in, are being used for law enforcement matching without their informed consent.

Family Tree DNA offers genealogy research services to law enforcement. On September 27, 2019, FTDNA announced (“Dr. Barbara Rae-Venter And Gene By Gene Join Forces To Shape The Future Of Investigative Genetic Genealogy” (https://www.prnewswire.com/news-releases/dr-barbara-rae-venter-and-gene-by- gene-join-forces-to-shape-the-future-of-investigative-genetic-genealogy-300926689.html)) that genealogist Dr. Barbara Rae-Venter is the Director of Gene By Gene's Investigative Genetic Genealogy Unit.

Although Family Tree DNA formerly maintained a transparency report similar to 23andMe and Ancestry (formerly at https://learn.familytreedna.com/ftdna/transparency-report/), the page has been removed.

iv. MyHeritage (www.myheritage.com)

Quick Summary: MyHeritage does not allow law enforcement to either upload SNP profiles to the MyHeritage database or provide a sample for SNP analysis. MyHeritage will of course respond to legally valid requests such as a search warrant or written court order, but will resist such requests.

Detailed Information: The MyHeritage Terms and Conditions (https://www.myheritage.com/terms-and- conditions) state that:

“…using the DNA Services for law enforcement purposes, forensic examinations, criminal investigations, "cold case" investigations, identification of unknown deceased people, location of relatives of deceased people using cadaver DNA, and/or all similar purposes, is strictly prohibited, unless a court order is obtained. It is our policy to resist law enforcement inquiries to protect the privacy of our customers.”

Similarly, the Privacy Policy (https://www.myheritage.com/privacy-policy) states that “We will not provide information to law enforcement unless required by a valid court order or subpoena for genetic information.”

Verogen/GEDmatch and Law Enforcement

As of 2018 and 2019, GEDmatch was the fourth or fifth largest autosomal DNA genealogy database (behind 23andMe, AncestryDNA, and MyHeritage, and possibly behind FTDNA), with more than 1 million DNA profiles. Accordingly, because it uses uploaded DNA for matching, it is a very powerful database for law enforcement queries. On May 24, 2018, shortly after a suspect was identified in the Golden State Killer case using GEDmatch, GEDmatch modified their Terms to Service to more explicitly allow law enforcement use of the database for investigations involving violent crimes (homicide and sexual assault).

In May 2019, it was reported that GEDmatch had granted permission for law enforcement to use the GEDmatch database to investigate an assault case (which didn’t fit within the homicide and sexual assault categories permitted by the Terms of Service). Shortly after this, GEDmatch implemented an opt-in system for law enforcement matching. EVERY kit was automatically opted-OUT of law enforcement matching, meaning that the law enforcement database immediately went to 0 kits and had to be rebuilt. Under the opt- out program, kits that opt-out of law enforcement matching do not show up as a match to the law enforcement sample. However, opt-out kits are NOT invisible to law enforcement; opt-out kits can appear as a match to an opt-in kit. For example, Kyle is opted-out but his first cousin Shawn is opted-in. If the law enforcement sample matches Shawn, and law enforcement then uses Shawn’s kit to search for matches to Shawn’s kit, they CAN see Kyle as a match to Shawn’s kit.

On December 9, 2019, it was announced (“GEDmatch Partners with Genomics Firm”(https://verogen.com/gedmatch-partners-with-genomics-firm/)) that GEDmatch had been purchased by Verogen, a California “forensic genomics company that tailors next-generation sequencing solutions for forensic laboratories.” Notably, this is a full purchase of GEDmatch rather than a partnership between the two entities. As of late December 2019, the size of the opt-in law enforcement database at GEDmatch is approximately 200,000 to 300,000 DNA profiles.

Misconceptions re: Law Enforcement use of Genetic Genealogy

There are MANY misconceptions about law enforcement use of genetic genealogy, some of which I hope to cover in this presentation.

For example, one common misconception is that the results of genetic genealogy analysis are utilized to try/convict the identified suspect. This is not the case, and although the methodology will certainly be tested in court, the results of the analysis are only to identify leads. In other words, while genetic genealogy may

identify a suspect, the suspect is only charged, arrested, and tried based on other evidence. In most or all cases to date, that other evidence has included a CODIS match, which we will discuss.

Another common misconception is that use of genetic genealogy increases the number of people impacted by a law enforcement investigation. However, anecdotal evidence suggests that it typically significantly lowers the number of people that are investigated, including the number of people that might be surreptitiously DNA tested for comparison to the law enforcement sample.

Guidelines for Law Enforcement use of Genetic Genealogy

There are no universally accepted guidelines for the use of genetic genealogy in a law enforcement investigation. Some state and local law enforcement agencies have protocols that are used to guide that agency’s use of genetic genealogy for investigations, but they can vary from location to location. The only guidelines that have been promulgated (as of December 2019) are the United States Department of Justice’s Interim Policy on Forensic Genetic Genealogical DNA Analysis and Searching, released on September 24, 2019 (see “Department of Justice Announces Interim Policy on Emerging Method to Generate Leads for Unsolved Violent Crimes” (https://www.justice.gov/opa/pr/department-justice-announces-interim-policy- emerging-method-generate-leads-unsolved-violent), and the policy at (https://www.justice.gov/olp/page/file/1204386/download). This is only an interim policy and may change in response to feedback from various stakeholders.

Companies Offering Genetic Genealogy

Below is a non-comprehensive list of companies or projects offering genetic genealogy research services to law enforcement (with lead genealogist(s) in parentheses):

• AdvanceDNA (Cheryl Hester and Amanda Reno) - advancedna.org

• Bode Technology (Melinde Lutz Byrne) - www.bodetech.com/pages/bode-forensic-genealogy- service

• DNA Doe Project (Margaret Press and Colleen Fitzpatrick) - dnadoeproject.org

• DNA Labs International (Kirsten Charlson and Allison Nunes) - dnalabsinternational.com/genealogy

• DNASolves – dnasolves.com

• Gene by Gene (Barbara Rae-Venter) - genebygene.com/forensics

• Innovative Forensic DNA (Jennifer Moore and Christa Stalcup) - www.innovativeforensic.com

• Kin Finder Group (Myles B Caggins and Angela Trammel) - kinfindergroup.com

• Othram (Anthony Lukas Redgrave and Lee Bingham Redgrave) - www.othram.com

• Parabon Nanolabs (CeCe Moore) - snapshot.parabon-nanolabs.com/genealogy

• Saber Investigations ( Kevin Lord) - www.saberinvestigations.com