Cops are asking Ancestry.com and 23andMe for their customers’ DNA
Cops are asking Ancestry.com and 23andMe for their
customers’ DNA
by Kashmir Hill | October 16, 2015 7 a.m.
When companies like Ancestry.com and 23andMe first
invited people to send in their DNA for genealogy tracing and medical
diagnostic tests, privacy advocates warned about the creation of giant genetic
databases that might one day be used against participants by law enforcement.
DNA, after all, can be a key to solving crimes. It “has serious information
about you and your family,” genetic privacy advocate Jeremy Gruber told me back
in 2010 when such services were just getting popular.
Now, five years later, when 23andMe and Ancestry both
have over a million customers, those warnings are looking prescient. “Your
relative’s DNA could turn you into a suspect,” warns Wired, writing about a case
from earlier this year, in which New Orleans filmmaker Michael Usry became a
suspect in an unsolved murder case after cops did a familial genetic search
using semen collected in 1996. The cops searched an Ancestry.com database and
got a familial match to a saliva sample Usry’s father had given years earlier.
Usry was ultimately determined to be innocent and the Electronic Frontier
Foundation called it a “wild goose chase” that demonstrated “the very real
threats to privacy and civil liberties posed by law enforcement access to
private genetic databases.”
The FBI maintains a national genetic database with
samples from convicts and arrestees, but this was the most public example of
cops turning to private genetic databases to find a suspect. But it’s not the
only time it’s happened, and it means that people who submitted genetic samples
for reasons of health, curiosity, or to advance science could now end up in a
genetic line-up of criminal suspects.
Both Ancestry.com and 23andMe stipulate in their privacy
policies that they will turn information over to law enforcement if served with
a court order. 23andMe says it’s received a couple of requests from both state
law enforcement and the FBI, but that it has “successfully resisted them.”
23andMe’s first privacy officer Kate Black, who joined
the company in February, says 23andMe plans to launch a transparency report,
like those published by Google, Facebook and Twitter, within the next month or
so. The report, she says, will reveal how many government requests for
information the company has received, and presumably, how many it complies
with.
“In the event we are required by law to make a
disclosure, we will notify the affected customer through the contact
information provided to us, unless doing so would violate the law or a court
order,” said Black by email.
Ancestry.com would not say specifically how many requests
it’s gotten from law enforcement. It wanted to clarify that in the Usry case,
the particular database searched was a publicly available one that Ancestry has
since taken offline with a message about the site being “used for purposes
other than that which it was intended.” Police came to Ancestry.com with a
warrant to get the name that matched the DNA.
“On occasion when required by law to do so, and in this
instance we were, we have cooperated with law enforcement and the courts to
provide only the specific information requested but we don’t comment on the
specifics of cases,” said a spokesperson.
As NYU law professor Erin Murphy told the New Orleans
Advocate regarding the Usry case, gathering DNA information is “a series of
totally reasonable steps by law enforcement.” If you’re a cop trying to solve a
crime, and you have DNA at your disposal, you’re going to want to use it to
further your investigation. But the fact that your signing up for 23andMe or
Ancestry.com means that you and all of your current and future family members
could become genetic criminal suspects is not something most users probably
have in mind when trying to find out where their ancestors came from.
“It has this really Orwellian state feeling to it,”
Murphy said to the Advocate.
If the idea of investigators poking through your DNA
freaks you out, both Ancestry.com and 23andMe have options to delete your
information with the sites. 23andMe says it will delete information within 30
days upon request.
Comments
Post a Comment