New Privacy Fears Of Massive DNA Database Over Ancestry Testing

When the news broke that police had arrested the man suspected of being California's infamous Golden State Killer, believed responsible for 12 murders, 52 rapes and over 120 burglaries, the public's relief was tempered by a measure of anxiety over the manner in which he was caught. The crimes appear to have stopped in 1986, at a time when DNA testing was first becoming possible. 

The suspect, now known to be an ex-police officer, would have been aware of the power of DNA to link him to his crimes, but few could have predicted the irony that linked him to his crimes: public DNA databases.

As the cost of DNA testing fell and our knowledge of the genome grew, companies realized that they could market it to consumers who wanted to trace their family origins and check for potential serious genetic disorders waiting in their futures. 

The two largest companies in the field of consumer genetic testing, 23andMe and Ancestory.com, have collected the genetic information from upwards of 15 million paying customers and this figure is only expected to grow. 

Both companies have released official statements claiming that they do not share access to their databases without being compelled to do so by official court orders nor have they ever been asked to share customer data with police. 

So, if the Golden State Killer never submitted his DNA for testing and the largest testing companies in the country haven't opened their genetic databases to law enforcement, how was he caught and how does this pose a privacy threat to everyone?

The answer is simple: another DNA company called GEDmatch does share the genetic information its users submit in an attempt to find links between distant relatives. The police submitted evidence found at the crime scenes to the GEDmatch database and received a list of the 100 closest relatives. 

From there, they narrowed their list of suspects by age, gender, location, appearance and other factors until they had a possible address and could collect DNA from the suspect's trash that would link him to the now decades-old crimes. Thus, it was genetic material given freely by innocent relatives who had no idea they were related to a killer that was used to solve the crime.

Fingerprints can be used to link a suspect to a crime scene but they provide no useful link that can be made among family members. With DNA, anyone with access to a large enough database can now form connections and predict genetic traits shared by individuals. 

When consumers pay between $100 and $200 to discover the origins of their ancestors and their predisposition for genetic disorders, they are surrender their rights to the genetic material sent in that tube of saliva. 

Corporations such as 23andMe, Ancestory.com and others can then sell these unique genetic markers to research laboratories, insurance companies, private tracking databases and governments, all without any further consent or knowledge on the part of the individual. 

For those who shudder at the thought of publishing their social security number or were upset by the Cambridge Analytic breach of Facebook, the privacy risks presented by surrendering rights to your genetic code should be absolutely terrifying.

Furthermore, since the information can now be acquired without an individual's specific consent through third-party agreements, there would be no way to know if one were the victim of discrimination. And if an individual should discover that they are at risk of a genetic disorder, they may face charges of fraud if they do not disclose it to insurance companies, even if they do not currently suffer from the condition.

While both 23andMe and Ancestory.com make claims to protect the privacy of their customers, they also grant themselves the right freely to distribute and sell the DNA they now control, and the third parties who purchase such material are under no legal privacy obligations whatsoever. 

HIPPAA laws require the protection and confidential management of protected health information, but not genetic data and, whether it be from corporations, government agencies or hackers, there is no lack of bad actors eager to exploit a treasure trove of highly sensitive  personal information.

The case of the Golden State Killer is not the first case in which the DNA of relatives was used by investigators to zero in on a killer and there have been local campaigns in favor of testing innocent family members before, but it is the first time that a major national database has been used in such a way. 

Finger prints, facial scans and social security numbers all present their own risks to privacy but a corporate or national database of DNA is unique in both its predictive power (diseases, appearance, intelligence, behavior) and the capacity to link individuals across family lines.

The privacy concerns involved are truly staggering and whereas a public database may be used to catch a serial killer today, as the public becomes comfortable with the idea of DNA sharing, government and corporate interests will slowly normalize the idea of DNA databases.

Perhaps in fifteen years we will have a Cambridge Analytica-type scandal for selling DNA profiles or discovering, Edward Snowden style, that for decades the US government has been building a comprehensive database of genetic codes. Though we may applaud the capture of the Golden State Killer, his case heralds the coming of a new threat to our privacy the scope of which we cannot even imagine.