12 ms·

This is a very interesting issue with sending your DNA to sites like 23andme. This means that a police officer can get a warrant to submit a DNA sample to the

This is a very interesting issue with sending your DNA to sites like 23andme. This means that a police officer can get a warrant to submit a DNA sample to the site, and get back anyone who matches. (Or in this case, their relatives.) The reason I think it's particularly interesting is that it passes one of the basic tests I have for whether something should be searchable by law enforcement: Do they have a target in mind and a warrant to search for that target? For PRISM and the other things that Snowden warned us about, the answer was no: the government was doing dragnet surveillance of all sorts of data warehouses to find people who fit a profile, without knowing who they're looking for ahead of time. With this, they have to have a DNA sample found at a crime scene, and they're using that combined with a warrant to do a targeted search for people with matching DNA. It just happens to be a website that people send their DNA to, rather than a police database. So I'm actually inclined to say I think this is ok? But I'm not 100% sure how I feel yet. EDIT: ok it looks like this was done not necessarily with a warrant, but with the officer just submitting the DNA as if they're a customer of the site. But actually my point still stands if they changed their technique to instead use a warrant and ask the site directly, not hiding that they were police officers... it's just that in this case they didn't even need to because it's so easy to just send others' DNA samples to these sites? It really seems like the lack of a warrant was a technicality here and could have easily gone the other way and still got to the same result.

Harelin 9y ago
If the officer submitted the DNA as if they were a customer of the site, I wonder how they complied with the company's sample collection process. You usually have to submit a generous amount of saliva or cheek swabs.
- tzs 9y ago
  Could they make a fake saliva sample that has the same consistency as real saliva and whatever other characteristics that the analysis equipment depends on, but contains no DNA (or take a real saliva sample from someone and strip out the DNA), and then but the DNA they want to test into this fake saliva and submit that?
  - deleted 9y ago
    [deleted]
- doublec 9y ago
  There are sites that don't require a sample, but instead you upload the raw data from a site where you did submit a sample. Gedmatch is one such site. One could construct a file in a compatible format containing DNA data obtained from your own laboratory, upload to gedmatch, and analyse matches. This is how "ancient DNA" samples are uploaded to gedmatch to see how you match against thousand year old human DNA samples.
deleted 9y ago
[deleted]
anigbrowl 9y ago
It's a really tricky question. I'm not at all enthused about the police having rights to collect and store all arrestees' DNA indefinitely for example. On the other hand, it's both commercially risky and wholly impractical to refuse access to the service to law enforcement. You can't have a networked society and expect the police not to use OSINT techniques.
- wlesieutre 9y ago
  Even if they arrest you for nonsense reasons and release you without filing any charges?
  - thefifthsetpin 9y ago
    "not" enthused.
    - wlesieutre 9y ago
      Whoops, missed that word. Changes the meaning a bit.
  - anigbrowl 9y ago
    If you're arrested or charged for a felony in California you're obliged to provide a sample, since 2009. I don't know about other jurisdictions. CA apparently has the largest database in the world.
scarmig 9y ago
Hmmm. As a consumer, am I allowed to submit someone else's DNA to 23andMe without their consent?
- dzink 9y ago
  Sounds like they submitted to another, smaller, site.
  - scarmig 9y ago
    Yeah. I'm more wondering about the general case, though. If I were an insurance company, what's to stop me from hiring investigators to go through customers' garbage to find their DNA, analyze it, and then take "appropriate" action?
    - dzink 9y ago
      Genealogy sites have no way of confirming the DNA submitted belongs to the person submitting it. Trash left on the street is considered abandoned property, so fair game for identity thieves and insurers alike. However, unless you know the person lives alone and has had no other guests between trash pickups, you can't be sure the garbage DNA is theirs. More likely an insurer might try to get a sample during a house visit or, stalking out the target at a cafe, or a hairdresser appointment, you name it. Life insurance companies can come to your house and get your EKG already, a swab would be easy.
      - mrunkel 9y ago
        >Trash left on the street is considered abandoned property. I wouldn't be so sure of that interpretation. In most places that I've lived, you could be arrested for taking things out of the trash, whether in front of your house, or even if dumped on the side of the road.
        dekhn 9y ago
        Nope, law is pretty clear on this one: people can take things from trash.
dzink 9y ago
Is this too different from looking up a person's name in Google or Facebook search boxes? In all three scenarios Police are taking advantage of publicly available information written/published by you or about you by others. Police can inspect openly viewable property without a warrant as well. They did not find the killer's DNA in a web site, but blood relatives provided enough triangulation to hone in on a person and get their "abandoned DNA" (maybe cup, cigarette, bloody nose napkin in the trash).
- txsh 9y ago
  The difference is your name isn't plastered on every object you come in contact with. Your name isn't transferred to other people who come in contact with the same objects as you. Your name doesn't end up in other locations that have nothing to do with you. The idea I could get arrested because my cousin coughed on a doorknob is terrifying. Everyone has that black sheep in their family. Why should I get harassed by the police every time they or someone they know commits a crime?
  - dzink 9y ago
    Your name is transferred to other relatives (your spouse, children, parents), and it does end up in press, documents, reports, yellow-page type sites, and other locations you haven't touched. Depending on your level of celebrity, it can also get plastered in news and projects you do not come in contact with. In this case though, they narrowed down a suspect, but did not bother him until they had two pieces of abandoned DNA that directly matched the killer. This is not the first time a black sheep has been found, by the DNA of relatives wealthy enough to afford a $100 test (now probably cheaper). The moment they mentioned he has a daughter and granddaughter when they announced the capture yesterday, I knew they probably triangulated him by a relative's DNA. The article today proved it.
    - txsh 9y ago
      That's not what I'm talking about. Your DNA can end up under the fingernails of a murder victim with no connection to you. Your name cannot. There was a Wired article about this the other day: https://www.wired.com/story/dna-transfer-framed-murder/ https://www.wired.com/story/dna-transfer-framed-murder/
masonic 9y ago
Does 23andMe's Privacy Policy address this at all?
- hw89y24y89 9y ago
  Oh I dunno, maybe read it: https://www.23andme.com/about/privacy/ https://www.23andme.com/about/privacy/
- return1 9y ago
  could they even? They d have to send a letter to all the relatives of each of their customers that their partial genetic information is stored in their computers.
chiefalchemist 9y ago
> "It really seems like the lack of a warrant was a technicality here and could have easily gone the other way and still got to the same result." It still might. He's yet to be tried. He's yet to be convicted. It's going to be interesting / crazy to see how the ACLU reacts to this. Also, in a way, this situation reminds me of the recent FB snafu. That is, access to your friends was granted by you (or me), not them. The point being, personal privacy isn't so personal anymore.
kevin_thibedeau 9y ago
Given the fallibility of DNA testing they may as well be using a divining rod to declare someone a witch. This will be abused to falsely accuse innocent people. Lives will be ruined and the authorities will act like their hands are clean. 23andMe is not a forensics lab. Their techs have no incentive to avoid mistakes with cross contamination. This is just plain dumb.
- thiagocsf 9y ago
  If DNA tests are so unreliable, how come they are still accepted in court?
  - kevin_thibedeau 9y ago
    Because the public is ignorant of the problems with it and the judiciary likes tools that can win easy convictions. Breathalyzers don't actually measure blood alcohol and there is no credible way they can estimate it to three significant digits but courts allow them too. Polygraphs are pure bullshit but the examiner's word that someone is "lying" is taken as sacrosanct evidence in court.
    - eanzenberg 9y ago
      Conspiracy theorist.
      - yetanother1980 9y ago
        Not sure about DNA testing. The other two examples are true. Across the Atlantic polygraphs are regarded as a comedy technology and breathalyser tests are sufficient grounds only for arrest and an actual blood test.
        pfranz 9y ago
        I'm pretty sure most all jurisdictions allow you to request a blood test in lieu of a breathalyser. I assumed it was common knowledge polygraphs were junk, but at least Wikipedia says they're in common use in the U.S. but are considered controversial. I knew polygraphs were banned as a prerequisite for jobs in many areas and that many government jobs had them as part of the interview, but figured it was more of a stress test or hazing. I do think the bar for expert testimony and scientific evidence could use a lot of improvement in the U.S.
dfsegoat 9y ago
I found it intriguing that the EU GDPR explicitly recognizes genetic data as something that it covers under PII - and thus you a have "right to request deletion" of your genomic data, I assume? "GDPR, in contrast, explicitly recognizes the sensitive nature of genetic data collected in a variety of settings. In Article 9, an adjusted definition of special categories of personal data has been provided that includes genetic data and biometric data, among others." [1] [1] - https://www.nature.com/articles/s41431-017-0045-7 https://www.nature.com/articles/s41431-017-0045-7
- milofeynman 9y ago
  The problem isn't deleting your DNA. The problem is you cannot delete your relative's DNA. Which is how I've read that they found him. Found a relative match from a 3rd-party, made sure he would have been in the area the years of the rapes, tailed him for a verification DNA sample, made arrest.
  - donogh 9y ago
    If this were to come before the CJEU[1], it would not be clear-cut at all. There was a landmark case where home CCTV was ruled inadmissible in a robbery by virtue of the fact that it included footage of a public road, and the thieves did not consent to the use of their personal data[2], i.e., the recording of their images in public using a home CCTV system. And the definition of personal data extends to any data that can be linked to you. For example, if a server records a log entry with your name and IP, and the server also records log entries with just the IP, all of the log entries are considered personal data, even for dynamic IPs in some instances[3]. There are some exceptions around criminal justice and the protection of persons and property, however, I still wouldn't be surprised if this DNA evidence were ruled inadmissible in the EU. [1] Court of Justice of the European Union [2] http://curia.europa.eu/juris/document/document.jsf?docid=160561&doclang=EN http://curia.europa.eu/juris/document/document.jsf?docid=160... [3] https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases https://www.whitecase.com/publications/alert/court-confirms-...
    - 9y ago
svat 9y ago
I'm not sure it passes the “do they have a target in mind” test. If they had a particular suspect in mind and asked whether that suspect's DNA matched or not, that's one thing. If they indiscriminately look for arbitrary people with matching DNA, then it seems to fit the definition of a common statistical mistake that even has a Wikipedia article: https://en.wikipedia.org/wiki/Prosecutor%27s_fallacy https://en.wikipedia.org/wiki/Prosecutor%27s_fallacy (Although again, if the match turns out to be a prior suspect rather than a random person, that's another story—see the “defense attorney's fallacy” lower on the page.)
- tysonzni 9y ago
  Interesting point - I highly doubt the suspect was a "prior suspect". But in this case I believe investigators were able to find additional evidence after they matched the DNA. So in Bayesian terms, multiple updates (DNA match + location match + suspect appearance match + other physical evidence) were made to their prior. Additionally, I think investigators tend to act more carefully in a high profile case than in a typical case, so I expect that they possess some additional conclusive evidence.
  - tantalor 9y ago
    It doesn't matter if multiple updated positively confirm the suspect as the perpetrator when the first link in the chain (ill-gotten DNA match) is excluded by the court. This guy will walk.
    - fixermark 9y ago
      Will he? I believe this novel use of a private DNA database is so novel that there may not be any governing case law on whether it's a violation of privacy. The scanned individuals opted in for relative matching. The fact those people were relatives of John Doe is publicly-documented knowledge in birth records and not susceptible to a privacy challenge.
      - tantalor 9y ago
superkuh 9y ago
You should feel upset and scared. Sites like 23andMe are just a small subset of genes and variations of them. The number of false positives due to this limit is significant. In whole database fishing searches by non-experts (ie, police) it will result in false positives every single time. And also contributing is the increased sensitivity of the DNA amplification methods and lax procedures at most labs. See http://www.sciencemag.org/news/2016/03/forensics-gone-wrong-when-dna-snares-innocent http://www.sciencemag.org/news/2016/03/forensics-gone-wrong-... >In 2013, geneticist Michael Coble of the National Institute of Standards and Technology in Gaithersburg, Maryland, set up a hypothetical scenario in which a mix of DNA from several people had been found on a ski mask left at a crime scene after a series of robberies. Coble asked 108 labs across the country to determine whether a separate DNA sample, which he posited had come from a suspect in the robberies, was also part of the mix. Seventy-three of the labs got it wrong, saying the suspect's DNA was part of the mix when, in fact, it was not.
- sedatk 9y ago
  It only allows finding the suspect. A full DNA test is required to be conclusive. I think it is the case here.
  - st26 9y ago
    The Wikipedia notes the police acquired a sample of the suspect's DNA and confirmed a match to the crime samples
    - deleted 9y ago
      [deleted]
    - astura 9y ago
      Yes, and they even acquired a second sample after the first came back positive just to confirm.
      - fixermark 9y ago
        If anything, I'd expect people to have more concern about the fact that the police in California are allowed to steal your stuff and grab DNA off of it than the risks from them being allowed to submit your DNA to a privately-owned database full of voluntary DNA submissions.
trhway 9y ago
what is the difference here between a face photo and DNA? I don't really see any. Both are kind of information fingerprint of a person. If police have a photo of a suspect is it ok for them to use image search of FB/Google/etc.?
- st26 9y ago
  Or, literally, fingerprints.
- lostlogin 9y ago
  To me it’s that the evidence didn’t come from the suspect. It’s like being able to recognise me from a photo of a relative on FB - I don’t like the idea of that. I don’t know why, but I don’t.
  - astura 9y ago
    What's the difference between this case and the fact the unabomber was caught because his brother and sister-in-law recognized his writings? What's the difference between this case and if the cops post a photo of a suspect and someone says "looks kinda like my co-worker, maybe a close relative" and that co-worker says "oh, that's my brother, we look alike, people mistake us for each other all the time." And then the DNA matches the brother.
    - lostlogin 9y ago
      That the relatives gave evidence unknowingly and that the DNA service was used quite differently to what it was designed for. A terrible person was caught in a clever, but sleazy way.
      - astura 9y ago
        The police used GEDMatch which is openly available and it says explicitly it's used for "researcher" and warns users that their genetic information is available to the public and they can't control what the public does with it. People "unknowingly" give evidence to the police all the time. That's like complaining the police used information that someone blogged about to solve a crime.
jakobegger 9y ago
I don’t think it’s a big deal. Lets assume that instead of DNA evidence, they had a photo of a white van at the scene of the crime. In that case it would be obvious that the police would search databases for people who own that model of car. If police would need to have a specific suspect in mind before they start investigations, how would they ever be able to investigate anything?
- yani 9y ago
  Car registrations are required. You are allowed a choice of owning a vehicle knowing what it requires. Sample of your DNA and fingerprints is not a requirement when we are born. Thus I find the comparison not adequate.
  - dx034 9y ago
    You're not required to use the page. It's no real difference if your uncle has a white van or a matching DNA in a database. With GDPR, you should be able to force 23andme to delete your DNA information after you received the results. That's if you're European at least.
    - bbatha 9y ago
      But it wasn’t the suspect’s DNA it was his relative’s. Deleting your own information would not be a sufficient privacy measure in this case. It’s increasingly statistically likely that someone you’re a relative of will be in a DNA database, it’s simply not tractable to ask all of them to remove their DNA. And what about when some of these people die, can I take down my late grandma’s DNA.
      - brfox 9y ago
        If I am European and I ask Facebook to remove my data, will they also remove pictures of me which are owned by my family? I doubt it, and that's also the problem with providing consent on these DNA databases - they don't require the consent of all of your relatives.
      - 9y ago
lopmotr 9y ago
Wow, this whole comment thread is given up acceptance of ambulance-at-the-bottom-of-the-cliff thinking. The real solution would be to make the police accountable so you can trust them, then let them search however they like.
- lostlogin 9y ago
  I’d like the first bit without the second bit.
guelo 9y ago
Which is the fundamental problem with data businesses. When you give your data to a 3rd party it is not possible within our legal system to restrict who has access to it.
deleted 9y ago
[deleted]
rmc 9y ago
It's interesting that the first use of DNA in a criminal trial, in 1986 in England actually exonerated the prime suspect. http://news.bbc.co.uk/2/hi/programmes/newsnight/8245312.stm http://news.bbc.co.uk/2/hi/programmes/newsnight/8245312.stm
mtgx 9y ago
> seems like the lack of a warrant was a technicality here Seriously? That's all it takes for you to accept the police doesn't need a warrant? That the warrant is "just a technicality"? If that were true, we wouldn't need judges to approve warrants. Police has and will abuse their powers without the judge being a filter for their actions. That should never change.
- ninkendo 9y ago
  I think that's a non-charitable way of reading what I said. Although I was certainly unclear. What I mean is, the interesting issue to me is whether it's OK for law enforcement to send a DNA sample and compel ancestry/genomic sites to respond with any matches, even if they do have a warrant. So I misspoke saying it's a technicality, what I really mean is that the issue is interesting to me even if a warrant were provided.
stevenwoo 9y ago
Law enforcement used an freemium DNA site: GEDMatch. https://www.theatlantic.com/science/archive/2018/04/golden-state-killer-east-area-rapist-dna-genealogy/559070/ https://www.theatlantic.com/science/archive/2018/04/golden-s...

Harelin 9y ago

If the officer submitted the DNA as if they were a customer of the site, I wonder how they complied with the company's sample collection process. You usually have to submit a generous amount of saliva or cheek swabs.

tzs 9y ago
Could they make a fake saliva sample that has the same consistency as real saliva and whatever other characteristics that the analysis equipment depends on, but contains no DNA (or take a real saliva sample from someone and strip out the DNA), and then but the DNA they want to test into this fake saliva and submit that?
- deleted 9y ago
  [deleted]
doublec 9y ago
There are sites that don't require a sample, but instead you upload the raw data from a site where you did submit a sample. Gedmatch is one such site. One could construct a file in a compatible format containing DNA data obtained from your own laboratory, upload to gedmatch, and analyse matches. This is how "ancient DNA" samples are uploaded to gedmatch to see how you match against thousand year old human DNA samples.

deleted 9y ago

[deleted]

anigbrowl 9y ago

It's a really tricky question. I'm not at all enthused about the police having rights to collect and store all arrestees' DNA indefinitely for example. On the other hand, it's both commercially risky and wholly impractical to refuse access to the service to law enforcement. You can't have a networked society and expect the police not to use OSINT techniques.

wlesieutre 9y ago
Even if they arrest you for nonsense reasons and release you without filing any charges?
- thefifthsetpin 9y ago
  "not" enthused.
  - wlesieutre 9y ago
    Whoops, missed that word. Changes the meaning a bit.
- anigbrowl 9y ago
  If you're arrested or charged for a felony in California you're obliged to provide a sample, since 2009. I don't know about other jurisdictions. CA apparently has the largest database in the world.

scarmig 9y ago

Hmmm. As a consumer, am I allowed to submit someone else's DNA to 23andMe without their consent?

dzink 9y ago
Sounds like they submitted to another, smaller, site.
- scarmig 9y ago
  Yeah. I'm more wondering about the general case, though. If I were an insurance company, what's to stop me from hiring investigators to go through customers' garbage to find their DNA, analyze it, and then take "appropriate" action?
  - dzink 9y ago
    Genealogy sites have no way of confirming the DNA submitted belongs to the person submitting it. Trash left on the street is considered abandoned property, so fair game for identity thieves and insurers alike. However, unless you know the person lives alone and has had no other guests between trash pickups, you can't be sure the garbage DNA is theirs. More likely an insurer might try to get a sample during a house visit or, stalking out the target at a cafe, or a hairdresser appointment, you name it. Life insurance companies can come to your house and get your EKG already, a swab would be easy.
    - mrunkel 9y ago
      >Trash left on the street is considered abandoned property. I wouldn't be so sure of that interpretation. In most places that I've lived, you could be arrested for taking things out of the trash, whether in front of your house, or even if dumped on the side of the road.
      - dekhn 9y ago
        Nope, law is pretty clear on this one: people can take things from trash.

dzink 9y ago

Is this too different from looking up a person's name in Google or Facebook search boxes? In all three scenarios Police are taking advantage of publicly available information written/published by you or about you by others. Police can inspect openly viewable property without a warrant as well. They did not find the killer's DNA in a web site, but blood relatives provided enough triangulation to hone in on a person and get their "abandoned DNA" (maybe cup, cigarette, bloody nose napkin in the trash).

txsh 9y ago
The difference is your name isn't plastered on every object you come in contact with. Your name isn't transferred to other people who come in contact with the same objects as you. Your name doesn't end up in other locations that have nothing to do with you. The idea I could get arrested because my cousin coughed on a doorknob is terrifying. Everyone has that black sheep in their family. Why should I get harassed by the police every time they or someone they know commits a crime?
- dzink 9y ago
  Your name is transferred to other relatives (your spouse, children, parents), and it does end up in press, documents, reports, yellow-page type sites, and other locations you haven't touched. Depending on your level of celebrity, it can also get plastered in news and projects you do not come in contact with. In this case though, they narrowed down a suspect, but did not bother him until they had two pieces of abandoned DNA that directly matched the killer. This is not the first time a black sheep has been found, by the DNA of relatives wealthy enough to afford a $100 test (now probably cheaper). The moment they mentioned he has a daughter and granddaughter when they announced the capture yesterday, I knew they probably triangulated him by a relative's DNA. The article today proved it.
  - txsh 9y ago
    That's not what I'm talking about. Your DNA can end up under the fingernails of a murder victim with no connection to you. Your name cannot. There was a Wired article about this the other day: https://www.wired.com/story/dna-transfer-framed-murder/ https://www.wired.com/story/dna-transfer-framed-murder/

masonic 9y ago

Does 23andMe's Privacy Policy address this at all?

hw89y24y89 9y ago
Oh I dunno, maybe read it: https://www.23andme.com/about/privacy/ https://www.23andme.com/about/privacy/
return1 9y ago
could they even? They d have to send a letter to all the relatives of each of their customers that their partial genetic information is stored in their computers.

chiefalchemist 9y ago

> "It really seems like the lack of a warrant was a technicality here and could have easily gone the other way and still got to the same result." It still might. He's yet to be tried. He's yet to be convicted. It's going to be interesting / crazy to see how the ACLU reacts to this. Also, in a way, this situation reminds me of the recent FB snafu. That is, access to your friends was granted by you (or me), not them. The point being, personal privacy isn't so personal anymore.

kevin_thibedeau 9y ago

Given the fallibility of DNA testing they may as well be using a divining rod to declare someone a witch. This will be abused to falsely accuse innocent people. Lives will be ruined and the authorities will act like their hands are clean. 23andMe is not a forensics lab. Their techs have no incentive to avoid mistakes with cross contamination. This is just plain dumb.

thiagocsf 9y ago
If DNA tests are so unreliable, how come they are still accepted in court?
- kevin_thibedeau 9y ago
  Because the public is ignorant of the problems with it and the judiciary likes tools that can win easy convictions. Breathalyzers don't actually measure blood alcohol and there is no credible way they can estimate it to three significant digits but courts allow them too. Polygraphs are pure bullshit but the examiner's word that someone is "lying" is taken as sacrosanct evidence in court.
  - eanzenberg 9y ago
    Conspiracy theorist.
    - yetanother1980 9y ago
      Not sure about DNA testing. The other two examples are true. Across the Atlantic polygraphs are regarded as a comedy technology and breathalyser tests are sufficient grounds only for arrest and an actual blood test.
      - pfranz 9y ago
        I'm pretty sure most all jurisdictions allow you to request a blood test in lieu of a breathalyser. I assumed it was common knowledge polygraphs were junk, but at least Wikipedia says they're in common use in the U.S. but are considered controversial. I knew polygraphs were banned as a prerequisite for jobs in many areas and that many government jobs had them as part of the interview, but figured it was more of a stress test or hazing. I do think the bar for expert testimony and scientific evidence could use a lot of improvement in the U.S.

dfsegoat 9y ago

I found it intriguing that the EU GDPR explicitly recognizes genetic data as something that it covers under PII - and thus you a have "right to request deletion" of your genomic data, I assume? "GDPR, in contrast, explicitly recognizes the sensitive nature of genetic data collected in a variety of settings. In Article 9, an adjusted definition of special categories of personal data has been provided that includes genetic data and biometric data, among others." [1] [1] - https://www.nature.com/articles/s41431-017-0045-7 https://www.nature.com/articles/s41431-017-0045-7

milofeynman 9y ago
The problem isn't deleting your DNA. The problem is you cannot delete your relative's DNA. Which is how I've read that they found him. Found a relative match from a 3rd-party, made sure he would have been in the area the years of the rapes, tailed him for a verification DNA sample, made arrest.
- donogh 9y ago
  If this were to come before the CJEU[1], it would not be clear-cut at all. There was a landmark case where home CCTV was ruled inadmissible in a robbery by virtue of the fact that it included footage of a public road, and the thieves did not consent to the use of their personal data[2], i.e., the recording of their images in public using a home CCTV system. And the definition of personal data extends to any data that can be linked to you. For example, if a server records a log entry with your name and IP, and the server also records log entries with just the IP, all of the log entries are considered personal data, even for dynamic IPs in some instances[3]. There are some exceptions around criminal justice and the protection of persons and property, however, I still wouldn't be surprised if this DNA evidence were ruled inadmissible in the EU. [1] Court of Justice of the European Union [2] http://curia.europa.eu/juris/document/document.jsf?docid=160561&doclang=EN http://curia.europa.eu/juris/document/document.jsf?docid=160... [3] https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases https://www.whitecase.com/publications/alert/court-confirms-...
  - 9y ago

svat 9y ago

I'm not sure it passes the “do they have a target in mind” test. If they had a particular suspect in mind and asked whether that suspect's DNA matched or not, that's one thing. If they indiscriminately look for arbitrary people with matching DNA, then it seems to fit the definition of a common statistical mistake that even has a Wikipedia article: https://en.wikipedia.org/wiki/Prosecutor%27s_fallacy https://en.wikipedia.org/wiki/Prosecutor%27s_fallacy (Although again, if the match turns out to be a prior suspect rather than a random person, that's another story—see the “defense attorney's fallacy” lower on the page.)

tysonzni 9y ago
Interesting point - I highly doubt the suspect was a "prior suspect". But in this case I believe investigators were able to find additional evidence after they matched the DNA. So in Bayesian terms, multiple updates (DNA match + location match + suspect appearance match + other physical evidence) were made to their prior. Additionally, I think investigators tend to act more carefully in a high profile case than in a typical case, so I expect that they possess some additional conclusive evidence.
- tantalor 9y ago
  It doesn't matter if multiple updated positively confirm the suspect as the perpetrator when the first link in the chain (ill-gotten DNA match) is excluded by the court. This guy will walk.
  - fixermark 9y ago
    Will he? I believe this novel use of a private DNA database is so novel that there may not be any governing case law on whether it's a violation of privacy. The scanned individuals opted in for relative matching. The fact those people were relatives of John Doe is publicly-documented knowledge in birth records and not susceptible to a privacy challenge.
    - tantalor 9y ago

superkuh 9y ago

You should feel upset and scared. Sites like 23andMe are just a small subset of genes and variations of them. The number of false positives due to this limit is significant. In whole database fishing searches by non-experts (ie, police) it will result in false positives every single time. And also contributing is the increased sensitivity of the DNA amplification methods and lax procedures at most labs. See http://www.sciencemag.org/news/2016/03/forensics-gone-wrong-when-dna-snares-innocent http://www.sciencemag.org/news/2016/03/forensics-gone-wrong-... >In 2013, geneticist Michael Coble of the National Institute of Standards and Technology in Gaithersburg, Maryland, set up a hypothetical scenario in which a mix of DNA from several people had been found on a ski mask left at a crime scene after a series of robberies. Coble asked 108 labs across the country to determine whether a separate DNA sample, which he posited had come from a suspect in the robberies, was also part of the mix. Seventy-three of the labs got it wrong, saying the suspect's DNA was part of the mix when, in fact, it was not.

sedatk 9y ago
It only allows finding the suspect. A full DNA test is required to be conclusive. I think it is the case here.
- st26 9y ago
  The Wikipedia notes the police acquired a sample of the suspect's DNA and confirmed a match to the crime samples
  - deleted 9y ago
    [deleted]
  - astura 9y ago
    Yes, and they even acquired a second sample after the first came back positive just to confirm.
    - fixermark 9y ago
      If anything, I'd expect people to have more concern about the fact that the police in California are allowed to steal your stuff and grab DNA off of it than the risks from them being allowed to submit your DNA to a privately-owned database full of voluntary DNA submissions.

trhway 9y ago

what is the difference here between a face photo and DNA? I don't really see any. Both are kind of information fingerprint of a person. If police have a photo of a suspect is it ok for them to use image search of FB/Google/etc.?

st26 9y ago
Or, literally, fingerprints.
lostlogin 9y ago
To me it’s that the evidence didn’t come from the suspect. It’s like being able to recognise me from a photo of a relative on FB - I don’t like the idea of that. I don’t know why, but I don’t.
- astura 9y ago
  What's the difference between this case and the fact the unabomber was caught because his brother and sister-in-law recognized his writings? What's the difference between this case and if the cops post a photo of a suspect and someone says "looks kinda like my co-worker, maybe a close relative" and that co-worker says "oh, that's my brother, we look alike, people mistake us for each other all the time." And then the DNA matches the brother.
  - lostlogin 9y ago
    That the relatives gave evidence unknowingly and that the DNA service was used quite differently to what it was designed for. A terrible person was caught in a clever, but sleazy way.
    - astura 9y ago
      The police used GEDMatch which is openly available and it says explicitly it's used for "researcher" and warns users that their genetic information is available to the public and they can't control what the public does with it. People "unknowingly" give evidence to the police all the time. That's like complaining the police used information that someone blogged about to solve a crime.

jakobegger 9y ago

I don’t think it’s a big deal. Lets assume that instead of DNA evidence, they had a photo of a white van at the scene of the crime. In that case it would be obvious that the police would search databases for people who own that model of car. If police would need to have a specific suspect in mind before they start investigations, how would they ever be able to investigate anything?

yani 9y ago
Car registrations are required. You are allowed a choice of owning a vehicle knowing what it requires. Sample of your DNA and fingerprints is not a requirement when we are born. Thus I find the comparison not adequate.
- dx034 9y ago
  You're not required to use the page. It's no real difference if your uncle has a white van or a matching DNA in a database. With GDPR, you should be able to force 23andme to delete your DNA information after you received the results. That's if you're European at least.
  - bbatha 9y ago
    But it wasn’t the suspect’s DNA it was his relative’s. Deleting your own information would not be a sufficient privacy measure in this case. It’s increasingly statistically likely that someone you’re a relative of will be in a DNA database, it’s simply not tractable to ask all of them to remove their DNA. And what about when some of these people die, can I take down my late grandma’s DNA.
    - brfox 9y ago
      If I am European and I ask Facebook to remove my data, will they also remove pictures of me which are owned by my family? I doubt it, and that's also the problem with providing consent on these DNA databases - they don't require the consent of all of your relatives.
    - 9y ago

lopmotr 9y ago

Wow, this whole comment thread is given up acceptance of ambulance-at-the-bottom-of-the-cliff thinking. The real solution would be to make the police accountable so you can trust them, then let them search however they like.

lostlogin 9y ago
I’d like the first bit without the second bit.

guelo 9y ago

Which is the fundamental problem with data businesses. When you give your data to a 3rd party it is not possible within our legal system to restrict who has access to it.

deleted 9y ago

[deleted]

rmc 9y ago

It's interesting that the first use of DNA in a criminal trial, in 1986 in England actually exonerated the prime suspect. http://news.bbc.co.uk/2/hi/programmes/newsnight/8245312.stm http://news.bbc.co.uk/2/hi/programmes/newsnight/8245312.stm

mtgx 9y ago

> seems like the lack of a warrant was a technicality here Seriously? That's all it takes for you to accept the police doesn't need a warrant? That the warrant is "just a technicality"? If that were true, we wouldn't need judges to approve warrants. Police has and will abuse their powers without the judge being a filter for their actions. That should never change.

ninkendo 9y ago
I think that's a non-charitable way of reading what I said. Although I was certainly unclear. What I mean is, the interesting issue to me is whether it's OK for law enforcement to send a DNA sample and compel ancestry/genomic sites to respond with any matches, even if they do have a warrant. So I misspoke saying it's a technicality, what I really mean is that the issue is interesting to me even if a warrant were provided.

stevenwoo 9y ago

Law enforcement used an freemium DNA site: GEDMatch. https://www.theatlantic.com/science/archive/2018/04/golden-state-killer-east-area-rapist-dna-genealogy/559070/ https://www.theatlantic.com/science/archive/2018/04/golden-s...