Arrest of suspected killer through genealogy opens 'Pandora's box'

SAN FRANCISCO -- For more than 40 years, the Golden State Killer eluded authorities. As police scrambled to solve the cold case, Joseph James DeAngelo -- now suspected to be the serial burglar, rapist and murderer who terrorized the state in the 1970s and '80s -- lived a quiet life in a Sacramento suburb.

Meanwhile, genetic samples taken from crime scenes sat in an evidence closet. There were no matches. They appeared useless -- until an investigator plugged the DNA into a little-known genealogical website.

The capture last week of DeAngelo, 72, was a stunning breakthrough for law enforcement. Sacramento County officials charged him with two counts of murder, and other counties soon followed. But investigators' use of an open-source online genealogical service bearing similarities to 23andMe and Ancestry -- companies that have sparked controversy for selling sensitive user information to third parties -- has far-reaching privacy implications.

``A lot of people weren't aware that others could get into these sites,'' said Arthur Caplan, director of the Division of Medical Ethics at New York University's School of Medicine. ``It's a reminder that these companies not only have third parties and legal authorities coming in, but sometimes they resell their data. They are not just in business to tell you if you're Lithuanian or Portuguese. They get a lot of their money from reselling information.''

It was a smaller genealogical website in Florida called GEDmatch that led investigators to the man now accused of being the Golden State Killer and East Area Rapist, linked to 12 murders and around four dozen rapes. The free site lets people find and connect with family members. Its advantage is that it lets users compare DNA samples with those who also uploaded genetic information on platforms like 23andMe, expanding the data pool.

But because of how little-known GEDmatch is outside the world of genealogy buffs, officials likely turned to it on a whim, said Andrew Lee, an employee at Family History Fanatics, a popular genealogy education website. Investigators would have had to create a fake account and upload the sample they had of the killer using a pseudonym, then hope a relative -- a cousin, a grandfather, a sibling -- had also uploaded information to the site.

Such a connection was indeed made in the case of the Golden State Killer, officials said, producing a pool of people that was then painstakingly narrowed to a handful of possible suspects. DeAngelo made the cut, prompting Sacramento County sheriff's deputies to stake out his home in Citrus Heights and wait for him to discard something with his DNA on it. After finding a first sample too weak, they went back and tested a second sample, which investigators said was a definitive match.

While the case opens up broad new avenues for future police investigations, it reveals major privacy concerns in the young genetic testing industry, Lee said. A person who uses a website could be exposing their close and distant relatives -- past, present and future -- to potential police investigation.

``There is going to be a portion of the population that is really sensitive to their private information being used in some way they didn't intend, or didn't want,'' Lee said. ``But, on the other hand, I think there is a portion of the population that says, 'Hey, we have this great tool here, let's use it.'''

Curtis Rogers, a partner with GEDmatch, said in a statement that the website had not been alerted before detectives used the company to search for the Golden State Killer. Nor did company officials cooperate with police, he said.

Representatives of 23andMe and Ancestry said they would not hand over personal data to police unless ``compelled to by valid legal process.'' But people who sign up to use companies are told in fine print when they register that user data can be used in ways they never intended when they send in their initial DNA sample.

``While the database was created for genealogical research, it is important that GEDmatch participants understand the possible uses of their DNA, including information of relatives that have committed crimes or were victims of crimes,'' Curtis said.

The possible uses for that data can be far-reaching as genetic kits balloon in popularity and more information is collected and stored.

Companies like 23andMe -- which sells $199 kits that decode users' health and ancestral data -- has become one of the largest private DNA repositories in the world. Between Black Friday and Cyber Monday last year, the company sold 1.5 million testing kits. Access to some of that data has already been sold to corporations like drug companies, 23andMe officials admitted in 2015.

In 2017, the company's privacy policies were brought under a national spotlight when Sen. Chuck Schumer, D-N.Y., asked the Federal Trade Commission to thoroughly look at them.

``There are no prohibitions, and many companies say that they can still sell your information to other companies,'' Schumer said at a news conference last fall. ``Now, this is sensitive information, and what those companies can do with all that data, our sensitive and deepest information, your genetics, is not clear and in some cases not fair and not right.''

Fallout from the DeAngelo case has already hit the genealogy community. Kitty Cooper, a volunteer with GEDmatch, said people have left comments on her genealogy blog asking whether they should delete their accounts, or mark them as just for research. ``Sure,'' Cooper says she's told them. But she also asks: If their DNA could help solve a heinous crime, wouldn't they want to help?

``People in the community have mixed feelings,'' Cooper said. ``We're excited this guy was caught, but we just think if the results are going to be used ... we just want to know up front,'' she said.

Police were able to nab DeAngelo the way they did because of the sheer number of people who have used at-home DNA kits and sent them to genealogy websites, said Jennifer Lynch, an attorney at the Electronic Frontier Foundation, a civil liberties nonprofit.

``So we're at this point where law enforcement could reopen these cases, when they wouldn't otherwise be able to,'' she said.

The company 23andMe, which was founded in 2006, says on its website that it has more than 5 million customers. GEDmatch, founded four years later, has collected about 950,000 DNA ``kits.''

Lynch said it's concerning that law enforcement can use such websites in the same way that regular users can. Knowing police can access the data could dampen people's eagerness to share personal information on these sites, and for good reason, she said.

``For every example we have of a serial killer being caught, we also have people who were wrongfully caught,'' Lynch said, noting a 2014 case in which an Idaho man was wrongfully linked to a 20-year-old murder through a site now owned by Ancestry. ``How frequently does law enforcement use this tactic? And what kind of legal process are they getting before they get this database?''

Publicizing genetic data could also affect future health insurance -- something many users don't consider. Uploading genetic information onto sites like GEDmatch are not covered by the Health Insurance Portability and Accountability Act, or HIPAA, said Pam Dixon, executive director of the World Privacy Forum.

When people upload information about genetic disorders they have, like Huntington's disease or Alzheimer's, that could publicly expose their relatives, making them subject to higher insurance rates, Dixon said. The information could also play a role in custody cases, or in situations involving whether someone is a rightful heir to property or an inheritance, she said.

``It's a Pandora's box,'' Dixon said. ``Once you open it, the consequences come.''

One unintended consequence is finding out a long-lost cousin is a serial killer. People don't consider that, said Lorna Wallace, a volunteer at the California Genealogical Society in Oakland.

Wallace, who is retired and volunteers part-time, became interested in family trees when her first child was born in 1983. It was a nesting thing, she said. She knew very little about her father's family and wanted to know more. So Wallace took his cheek swab and sent it to an online site called Family Tree Maker.

The information should stay private, she said. No one else should be poking around her family tree.

``That stuff bothers me,'' Wallace said. ``I don't like people looking my information up. That's why I don't throw myself into the online stuff the way a lot of people do.''

For those who worry about what other people might discover about them, she has advice.

``Well,'' she said, ``I guess if you have something to hide, you shouldn't put it online.''