13 ms·

Police are getting DNA data from people who think they opted out

228 points by ilamont 3y ago

lowbloodsugar 3y ago
Using a back door. I expect charges and jail time, as is done with other CFAA violators like Aaron Schwartz. /s
rolph 3y ago
>> The loophole, which a source demonstrated for The Intercept, allows genealogists working with police to manipulate search fields within a DNA comparison tool to trick the system into showing opted-out profiles. In records of communications reviewed by The Intercept, Moore and two other forensic genetic genealogists discussed the loophole and how to trigger it. In a separate communication, one of the genealogists described hiding the fact that her organization had made an identification using an opted-out profile. <<
- dylan604 3y ago
  The fact you have to trick the system to do something should give pause then and there that maybe what you are doing is not the expected behavior. By deliberately doing something like this acknowledges the user is aware of the behavior and is okay with doing it anyways. This should be used in determining level of "guilt" or curiosity getting the cat.
  - WarOnPrivacy 3y ago
    > The fact you have to trick the system to do something should give pause This sort of Exceeding Access isn't being used to violate copyright or expose Gov wrongdoing. There is zero politician outrage over it, purchased or otherwise.
  - 14 3y ago
    If this was a “hacker” who got caught doing this you know damn well that key point would be used to say “unauthorized access”
    - dylan604 3y ago
      hopefully, they're not using wget with the work around or they'd really be screwed
- kelnos 3y ago
  I'm surprised that evidence gathered through this method can't be thrown out in court. The customer that provided the DNA did not give consent to sharing the data, and the company holding the data did not give consent to share it with law enforcement (would be entertaining if the act of exploiting a security hole in the search form could be a CFAA violation on top of that). Of course, this doesn't stop parallel construction; once they find their likely suspects through the illegally-obtained genetic search, they can likely often construct a case without even mentioning the genetic tracing.
  - rolph 3y ago
    >> they can likely often construct a case without even mentioning the genetic tracing<< I think that would be cause to throw the whole thing out, if it was eluted during discovery.
    - ralferoo 3y ago
      Actually, I've never really understood the reason behind this. Surely, it doesn't really matter WHY you suspected somebody in the first place. If there's enough other evidence to show irrefutably that they committed the crime, there shouldn't be a huge difference between the first tip coming from some random guy phoning the cops and saying "there's a dodgy looking guy here" or getting a random match from a DNA database? I can see the intent behind probable cause for e.g. traffic stops, because that is designed to stop prejudiced-based harassment. But if there is an extremely close DNA-match found randomly, that search hasn't caused any harm to anyone, and should be a perfectly good reason to investigate someone a little more thoroughly. Maybe it should be disclosed in the case, e.g. "we became suspicious because of the DNA matching, and further investigation showed the victim's blood all over his house, clothes, and the murder weapon that he'd put back in his tool rack" should be a slam dunk conviction not grounds for letting someone go on a technicality because e.g. there wasn't a nosy neighbour who'd reported them for being too noisy or whatever.
  - superkuh 3y ago
    Using the interface in unintended (by the creators) ways is a prosecutable crime under the CFAA. People can be and have been imprisoned for it. https://en.wikipedia.org/wiki/Weev#Trial https://en.wikipedia.org/wiki/Weev#Trial is a notable example.
- EvanAnderson 3y ago
  If incrementing a counter in a URL got somebody sent to jail this absolutely should render evidence acquired this way inadmissible at the very least.
Anon_Forever 3y ago
In our lifetime, there will be a government system that will record DNA data for every baby born. It'll happen, just a matter of time.
- andrewxdiamond 3y ago
  What is the impact of this? I have the same aversion to government power built into my bones but I can’t think of a concrete way the government would be able to abuse this capability to assert power over me.
  - RandallBrown 3y ago
    It will be harder to get away with crimes if everyone's DNA is on file. Of course if you recently visited the place where a crime took place you might also be falsely accused. I suppose they could also use it to track your movements if there was some way to massively collect DNA samples from the environment.
    - rolph 3y ago
      There is some way to massively collect DNA samples from the environment. https://www.newscientist.com/article/2375624-air-pollution-monitors-have-been-accidentally-harvesting-wildlife-dna/ https://www.newscientist.com/article/2375624-air-pollution-m... https://www.bbc.com/future/article/20230606-how-air-pollution-sensors-can-find-wildlife https://www.bbc.com/future/article/20230606-how-air-pollutio... https://www.sciencedirect.com/science/article/pii/S0960982221016900 https://www.sciencedirect.com/science/article/pii/S096098222... these can be deployed at great density in an array providing granularity made to order.
      - jart 3y ago
        Wow this sounds like a slam dunk for my next YC application.
    - pessimizer 3y ago
      Or they could bust a place where religious services were held in secret, or an apartment where gay people gather to socialize, or an underground abortion clinic, suck up the DNA and get warrants for everybody. That isn't being falsely accused, it's worse.
tcoff91 3y ago
This definitely seems like a CFAA violation.
chrisjj 3y ago
https://archive.ph/LUC20 https://archive.ph/LUC20
zlg_codes 3y ago
More and more, the governments of the world try to erode the status of the lone, average human, for they think their efforts will protect countries and governments. Fear has been the primary motivator in the world of government ever since 9/11. America is so scared of itself it has turned inward, against itself. She's willing to forget about the 4th Amendment, the 13th Amendment, and even her own founding document, as long as they get a little more data they can abuse on their own citizens. At what point do we accuse the government of treason? None of this invasion of privacy was part of the deal, and Americans stand to gain nothing from these false assertions of privacy and opting out. Our government is betraying us and the dominant ideology is to lay down and take it. This country will never improve until we can fight back against surveillance. They couldn't keep us safe during 9/11, and none of their desperate "security" efforts have protected us. Again I ask, when do we accuse the government of betraying us and the social contract?
- zapdrive 3y ago
  Don't forget the attacks on the first and the second amendment.
  - koolba 3y ago
    Without the 1st and 2nd, it’s pretty hard to stop attacks on the 4th or 6th.
    - rgrieselhuber 3y ago
      One of the issues that has emerged is a strange fixation (which the Anti-Federalists warned of) on the Bill of Rights as the source of these rights. But the Bill of Rights is merely a non-exhaustive index, not a grantor, of our natural rights. These rights do not depend on a document, they exist regardless.
      - edrxty 3y ago
        It's frustrating because unless it's written in stone Americans won't even pretend to agree on it, we're a very chaotic culture that craves the predictability of rules and laws (unless they impact me specifically). There's no concept in American society of a universal ethical standard at even the most fundamental level, probably stemming from how much inequality exists.
hn_shithole 3y ago
[flagged]
deleted 3y ago
[deleted]
theptip 3y ago
Seems to be a CPRA violation for CA citizens? https://www.bytebacklaw.com/2022/02/how-do-the-cpra-cpa-vcdpa-treat-biometric-information/ https://www.bytebacklaw.com/2022/02/how-do-the-cpra-cpa-vcdp... Though not sure if law enforcement exemptions apply, AFAICT you need a subpoena to get a company to disclose sensitive personal information like DNA.
paulpauper 3y ago
police/feds will look for anything to get an edge to make cases easier for them
- Zigurd 3y ago
  That is, in fact, an optimistic position. Police are so ineffective at solving crimes that "easier" and "getting an edge" overstate the possibility of a publicly minded motivation to cheat. Instances like the Massachusetts crime lab scandal should destroy all confidence in evidence handling: https://slate.com/news-and-politics/2021/05/massachusetts-crime-lab-houston-forensic-science.html https://slate.com/news-and-politics/2021/05/massachusetts-cr... All evidence handling and analysis should be performed by an independent agency, maybe answerable to courts, not cops.
  - rolph 3y ago
    i would go a step further, and insist that test results of evidentiary DNA be provided for defense discovery, before probative DNA [sample from accused] is even touched by an examiner from forensic services lab. as is the only thing stopping probative DNA from ending up in the evidence lane is a promise not to abuse the opportunity, that also says nothing about "by mistake" occurances
LispSporks22 3y ago
Jesus what a shit show. What’s the point if the sites can change their ToS and flip opt-out to opt-in at whatever whimsy they do choose. Needs to be some kind of uniform privacy enforced.
WarOnPrivacy 3y ago
I'm a genealogist. I discourage everyone I can from uploading their DNA. For DNA to be secure, there doesn't just need to be firm walls, they can't ever be breached for a moment - not now or a generation from now. Holders of DNA can't be bought out or come under the control of leadership that doesn't fully grasp and exercise privacy safeguards. They can't allow laws to be bought or leveraged that will compromise their ability to safeguard it. LEO's use of DNA is a surveillance method and powerful interests will always feel compelled to use it to hunt people they perceive are enemies. Whatever info we may get by uploading it can't possibly be worth the risk to our descendants and relations.
- andersrs 3y ago
  There is always that one asshole in your family that thinks they're clever by uploading their DNA to one of the ancestry services. By doing that they've leaked a fair bit of information about their relatives who never consented.
  - 14 3y ago
    I have a dumb brother who I won’t talk to decides to be a shitty career criminal. They took his dna so I’m in the same boat as family uploading it. Not that I am worried about it being used for a crime but I worry in future people will be discriminated on by dna. Life insurance could be more expensive if they know you have a slight chance of x disease for examples.
    - memefrog 3y ago
      If you have a higher chance of getting a disease, why wouldn't life insurance be more expensive? Life insurance will also be cheaper if you don't have that chance. The point of insurance is to spread random risk around. Nobody complains that young women have cheaper car insurance than young men, or that young people have more expensive car insurance than older people, but cheaper health insurance. Young men are more likely to have car accidents, but less likely to have cancer. The point of insurance is not wealth redistribution or the spreading of systemic risk, but the spreading of random risk. (I mean this in the sense of 'systemic error' vs 'random error' that you will remember from high school physics.)
freitzkriesler2 3y ago
Cats already out of the bag. Cousins already uploaded this stuff to 23andme. Really annoying.
justinclift 3y ago
Super ironic: "If you’re doing something you wouldn’t want blasted on the front page of the New York Times, Moore said, you should probably rethink what you’re doing." Then proceeds to deliberately search the DNA of people who explicitly opted out of sharing genetic information with police.
kstenerud 3y ago
And if this doesn't make the hair stand up on the back of your neck: --- In fact, Moore told the audience, she believes that forensic genetic genealogy can help to eradicate crime. “We can stop criminals in their tracks,” she said. “I really believe we can stop serial killers from existing, stop serial rapists from existing.” “We are an army. We can do this! So repeat after me,” Moore said, before leading the audience in a chant. “No more serial killers!” --- There is nothing more dangerous than a true believer.
vGPU 3y ago
> In a statement posted to the Facebook group, Pam Lauritzen, the project’s communications director, said the loophole was an artifact of changes GEDmatch implemented in 2019, when it made opting out the default for all profiles. “While we knew that the intent of the change was to make opted-out users unavailable, some volunteers with the DNA Doe Project continued to use the reports that allowed access to profiles that were opted out,” she wrote. That use was neither “encouraged nor discouraged,” she continued. Still, she claimed the access was somehow “in compliance” with GEDmatch’s terms of service — which at the time promised that DNA uploaded for law enforcement purposes would only be matched with customers who’d opted in — and that the loophole was closed “years ago.” Huh? > In July 2020, GEDmatch was hacked, which resulted in all 1.45 million profiles then contained in the database to be briefly opted in to law enforcement matching; at the time, BuzzFeed News reported, just 280,000 profiles had opted in. How rather convenient. Realistically, I think there’s likely a bit of parallel construction going on too, likely making up flimsy excuses to hide the fact that some crimes were solved with the use of surveillance programs that have not been revealed to the general public. I’d be extremely surprised if the CIA doesn’t have a secret copy of all major commercial DNA databases. If they were using Mitre to try to build a database of [actual, physical] fingerprints by scraping social media images, there’s no way they’d leave such low hanging fruit… hanging.
ThinkBeat 3y ago
If the federal government was to establish a pilot program designed to covertly collect the DNA of every person living in, say, Denver. In a way where the DNA was matched to a person with a high degree of confidence. and the feds were willing to spend some serious resource on it. Wow long do people think it would take? Would it be possible? Big conferences must be an awesome opportunity. When people go to sign in and show id to pick up their badges and then wear the badges but that goes for a lot of companies too that have people wear various forms of cards / badges. Physical access to homes, work, gyms, public transit, hospitals, nursing homes, and cars would make it fairly straight forward for the majority of citizens. I dont think you could scale that to a city and do it quickly. Send out snail mail with some motivation for people to send back a physical reply? Send out snail mail ads and collect from the garbage / recycling? Keyboards would be awesome but harder to get to without physical access. Public transit is good. Airports. A crime spree could be arranged that gave law enforcement a good reason to stop and id people driving or walking around would be effective. Vaccines would be great but hard to establish in a specific regional area. A Qtip (or whatever)swipe of the screen of a cellphone? Free in person give aways that required a signature? If you just follow a person for a while walking in the city is there an easy covert way to get a sample? (Yanking out a hair is going to raise questions. ) Some form of "specialized" mini "vacum cleaner" to "suck" in cells from a bit of a distance. Probably hard to be accurate. Could probably do mass harvesting of DNA at gyms with a certain expectations of inaccuracy that would be improved with multiple runs or DNA from sets of people in different mixes.

228 points by ilamont 3y ago

Using a back door. I expect charges and jail time, as is done with other CFAA violators like Aaron Schwartz. /s

>> The loophole, which a source demonstrated for The Intercept, allows genealogists working with police to manipulate search fields within a DNA comparison tool to trick the system into showing opted-out profiles. In records of communications reviewed by The Intercept, Moore and two other forensic genetic genealogists discussed the loophole and how to trigger it. In a separate communication, one of the genealogists described hiding the fact that her organization had made an identification using an opted-out profile. <<

dylan604 3y ago
The fact you have to trick the system to do something should give pause then and there that maybe what you are doing is not the expected behavior. By deliberately doing something like this acknowledges the user is aware of the behavior and is okay with doing it anyways. This should be used in determining level of "guilt" or curiosity getting the cat.
- WarOnPrivacy 3y ago
  > The fact you have to trick the system to do something should give pause This sort of Exceeding Access isn't being used to violate copyright or expose Gov wrongdoing. There is zero politician outrage over it, purchased or otherwise.
- 14 3y ago
  If this was a “hacker” who got caught doing this you know damn well that key point would be used to say “unauthorized access”
  - dylan604 3y ago
    hopefully, they're not using wget with the work around or they'd really be screwed
kelnos 3y ago
I'm surprised that evidence gathered through this method can't be thrown out in court. The customer that provided the DNA did not give consent to sharing the data, and the company holding the data did not give consent to share it with law enforcement (would be entertaining if the act of exploiting a security hole in the search form could be a CFAA violation on top of that). Of course, this doesn't stop parallel construction; once they find their likely suspects through the illegally-obtained genetic search, they can likely often construct a case without even mentioning the genetic tracing.
- rolph 3y ago
  >> they can likely often construct a case without even mentioning the genetic tracing<< I think that would be cause to throw the whole thing out, if it was eluted during discovery.
  - ralferoo 3y ago
    Actually, I've never really understood the reason behind this. Surely, it doesn't really matter WHY you suspected somebody in the first place. If there's enough other evidence to show irrefutably that they committed the crime, there shouldn't be a huge difference between the first tip coming from some random guy phoning the cops and saying "there's a dodgy looking guy here" or getting a random match from a DNA database? I can see the intent behind probable cause for e.g. traffic stops, because that is designed to stop prejudiced-based harassment. But if there is an extremely close DNA-match found randomly, that search hasn't caused any harm to anyone, and should be a perfectly good reason to investigate someone a little more thoroughly. Maybe it should be disclosed in the case, e.g. "we became suspicious because of the DNA matching, and further investigation showed the victim's blood all over his house, clothes, and the murder weapon that he'd put back in his tool rack" should be a slam dunk conviction not grounds for letting someone go on a technicality because e.g. there wasn't a nosy neighbour who'd reported them for being too noisy or whatever.
- superkuh 3y ago
  Using the interface in unintended (by the creators) ways is a prosecutable crime under the CFAA. People can be and have been imprisoned for it. https://en.wikipedia.org/wiki/Weev#Trial https://en.wikipedia.org/wiki/Weev#Trial is a notable example.
EvanAnderson 3y ago
If incrementing a counter in a URL got somebody sent to jail this absolutely should render evidence acquired this way inadmissible at the very least.

Anon_Forever 3y ago

In our lifetime, there will be a government system that will record DNA data for every baby born. It'll happen, just a matter of time.

andrewxdiamond 3y ago
What is the impact of this? I have the same aversion to government power built into my bones but I can’t think of a concrete way the government would be able to abuse this capability to assert power over me.
- RandallBrown 3y ago
  It will be harder to get away with crimes if everyone's DNA is on file. Of course if you recently visited the place where a crime took place you might also be falsely accused. I suppose they could also use it to track your movements if there was some way to massively collect DNA samples from the environment.
  - rolph 3y ago
    There is some way to massively collect DNA samples from the environment. https://www.newscientist.com/article/2375624-air-pollution-monitors-have-been-accidentally-harvesting-wildlife-dna/ https://www.newscientist.com/article/2375624-air-pollution-m... https://www.bbc.com/future/article/20230606-how-air-pollution-sensors-can-find-wildlife https://www.bbc.com/future/article/20230606-how-air-pollutio... https://www.sciencedirect.com/science/article/pii/S0960982221016900 https://www.sciencedirect.com/science/article/pii/S096098222... these can be deployed at great density in an array providing granularity made to order.
    - jart 3y ago
      Wow this sounds like a slam dunk for my next YC application.
  - pessimizer 3y ago
    Or they could bust a place where religious services were held in secret, or an apartment where gay people gather to socialize, or an underground abortion clinic, suck up the DNA and get warrants for everybody. That isn't being falsely accused, it's worse.

tcoff91 3y ago

This definitely seems like a CFAA violation.

chrisjj 3y ago

https://archive.ph/LUC20 https://archive.ph/LUC20

zlg_codes 3y ago

More and more, the governments of the world try to erode the status of the lone, average human, for they think their efforts will protect countries and governments. Fear has been the primary motivator in the world of government ever since 9/11. America is so scared of itself it has turned inward, against itself. She's willing to forget about the 4th Amendment, the 13th Amendment, and even her own founding document, as long as they get a little more data they can abuse on their own citizens. At what point do we accuse the government of treason? None of this invasion of privacy was part of the deal, and Americans stand to gain nothing from these false assertions of privacy and opting out. Our government is betraying us and the dominant ideology is to lay down and take it. This country will never improve until we can fight back against surveillance. They couldn't keep us safe during 9/11, and none of their desperate "security" efforts have protected us. Again I ask, when do we accuse the government of betraying us and the social contract?

zapdrive 3y ago
Don't forget the attacks on the first and the second amendment.
- koolba 3y ago
  Without the 1st and 2nd, it’s pretty hard to stop attacks on the 4th or 6th.
  - rgrieselhuber 3y ago
    One of the issues that has emerged is a strange fixation (which the Anti-Federalists warned of) on the Bill of Rights as the source of these rights. But the Bill of Rights is merely a non-exhaustive index, not a grantor, of our natural rights. These rights do not depend on a document, they exist regardless.
    - edrxty 3y ago
      It's frustrating because unless it's written in stone Americans won't even pretend to agree on it, we're a very chaotic culture that craves the predictability of rules and laws (unless they impact me specifically). There's no concept in American society of a universal ethical standard at even the most fundamental level, probably stemming from how much inequality exists.

hn_shithole 3y ago

[flagged]

deleted 3y ago

[deleted]

theptip 3y ago

Seems to be a CPRA violation for CA citizens? https://www.bytebacklaw.com/2022/02/how-do-the-cpra-cpa-vcdpa-treat-biometric-information/ https://www.bytebacklaw.com/2022/02/how-do-the-cpra-cpa-vcdp... Though not sure if law enforcement exemptions apply, AFAICT you need a subpoena to get a company to disclose sensitive personal information like DNA.

paulpauper 3y ago

police/feds will look for anything to get an edge to make cases easier for them

Zigurd 3y ago
That is, in fact, an optimistic position. Police are so ineffective at solving crimes that "easier" and "getting an edge" overstate the possibility of a publicly minded motivation to cheat. Instances like the Massachusetts crime lab scandal should destroy all confidence in evidence handling: https://slate.com/news-and-politics/2021/05/massachusetts-crime-lab-houston-forensic-science.html https://slate.com/news-and-politics/2021/05/massachusetts-cr... All evidence handling and analysis should be performed by an independent agency, maybe answerable to courts, not cops.
- rolph 3y ago
  i would go a step further, and insist that test results of evidentiary DNA be provided for defense discovery, before probative DNA [sample from accused] is even touched by an examiner from forensic services lab. as is the only thing stopping probative DNA from ending up in the evidence lane is a promise not to abuse the opportunity, that also says nothing about "by mistake" occurances

LispSporks22 3y ago

Jesus what a shit show. What’s the point if the sites can change their ToS and flip opt-out to opt-in at whatever whimsy they do choose. Needs to be some kind of uniform privacy enforced.

WarOnPrivacy 3y ago

I'm a genealogist. I discourage everyone I can from uploading their DNA. For DNA to be secure, there doesn't just need to be firm walls, they can't ever be breached for a moment - not now or a generation from now. Holders of DNA can't be bought out or come under the control of leadership that doesn't fully grasp and exercise privacy safeguards. They can't allow laws to be bought or leveraged that will compromise their ability to safeguard it. LEO's use of DNA is a surveillance method and powerful interests will always feel compelled to use it to hunt people they perceive are enemies. Whatever info we may get by uploading it can't possibly be worth the risk to our descendants and relations.

andersrs 3y ago
There is always that one asshole in your family that thinks they're clever by uploading their DNA to one of the ancestry services. By doing that they've leaked a fair bit of information about their relatives who never consented.
- 14 3y ago
  I have a dumb brother who I won’t talk to decides to be a shitty career criminal. They took his dna so I’m in the same boat as family uploading it. Not that I am worried about it being used for a crime but I worry in future people will be discriminated on by dna. Life insurance could be more expensive if they know you have a slight chance of x disease for examples.
  - memefrog 3y ago
    If you have a higher chance of getting a disease, why wouldn't life insurance be more expensive? Life insurance will also be cheaper if you don't have that chance. The point of insurance is to spread random risk around. Nobody complains that young women have cheaper car insurance than young men, or that young people have more expensive car insurance than older people, but cheaper health insurance. Young men are more likely to have car accidents, but less likely to have cancer. The point of insurance is not wealth redistribution or the spreading of systemic risk, but the spreading of random risk. (I mean this in the sense of 'systemic error' vs 'random error' that you will remember from high school physics.)

freitzkriesler2 3y ago

Cats already out of the bag. Cousins already uploaded this stuff to 23andme. Really annoying.

justinclift 3y ago

Super ironic: "If you’re doing something you wouldn’t want blasted on the front page of the New York Times, Moore said, you should probably rethink what you’re doing." Then proceeds to deliberately search the DNA of people who explicitly opted out of sharing genetic information with police.

kstenerud 3y ago

And if this doesn't make the hair stand up on the back of your neck: --- In fact, Moore told the audience, she believes that forensic genetic genealogy can help to eradicate crime. “We can stop criminals in their tracks,” she said. “I really believe we can stop serial killers from existing, stop serial rapists from existing.” “We are an army. We can do this! So repeat after me,” Moore said, before leading the audience in a chant. “No more serial killers!” --- There is nothing more dangerous than a true believer.

vGPU 3y ago

> In a statement posted to the Facebook group, Pam Lauritzen, the project’s communications director, said the loophole was an artifact of changes GEDmatch implemented in 2019, when it made opting out the default for all profiles. “While we knew that the intent of the change was to make opted-out users unavailable, some volunteers with the DNA Doe Project continued to use the reports that allowed access to profiles that were opted out,” she wrote. That use was neither “encouraged nor discouraged,” she continued. Still, she claimed the access was somehow “in compliance” with GEDmatch’s terms of service — which at the time promised that DNA uploaded for law enforcement purposes would only be matched with customers who’d opted in — and that the loophole was closed “years ago.” Huh? > In July 2020, GEDmatch was hacked, which resulted in all 1.45 million profiles then contained in the database to be briefly opted in to law enforcement matching; at the time, BuzzFeed News reported, just 280,000 profiles had opted in. How rather convenient. Realistically, I think there’s likely a bit of parallel construction going on too, likely making up flimsy excuses to hide the fact that some crimes were solved with the use of surveillance programs that have not been revealed to the general public. I’d be extremely surprised if the CIA doesn’t have a secret copy of all major commercial DNA databases. If they were using Mitre to try to build a database of [actual, physical] fingerprints by scraping social media images, there’s no way they’d leave such low hanging fruit… hanging.

ThinkBeat 3y ago

If the federal government was to establish a pilot program designed to covertly collect the DNA of every person living in, say, Denver. In a way where the DNA was matched to a person with a high degree of confidence. and the feds were willing to spend some serious resource on it. Wow long do people think it would take? Would it be possible? Big conferences must be an awesome opportunity. When people go to sign in and show id to pick up their badges and then wear the badges but that goes for a lot of companies too that have people wear various forms of cards / badges. Physical access to homes, work, gyms, public transit, hospitals, nursing homes, and cars would make it fairly straight forward for the majority of citizens. I dont think you could scale that to a city and do it quickly. Send out snail mail with some motivation for people to send back a physical reply? Send out snail mail ads and collect from the garbage / recycling? Keyboards would be awesome but harder to get to without physical access. Public transit is good. Airports. A crime spree could be arranged that gave law enforcement a good reason to stop and id people driving or walking around would be effective. Vaccines would be great but hard to establish in a specific regional area. A Qtip (or whatever)swipe of the screen of a cellphone? Free in person give aways that required a signature? If you just follow a person for a while walking in the city is there an easy covert way to get a sample? (Yanking out a hair is going to raise questions. ) Some form of "specialized" mini "vacum cleaner" to "suck" in cells from a bit of a distance. Probably hard to be accurate. Could probably do mass harvesting of DNA at gyms with a certain expectations of inaccuracy that would be improved with multiple runs or DNA from sets of people in different mixes.