SoylentNews

takyon writes:

Police submitted a DNA sample under a fake name to GEDmatch, an online DNA-matching/genealogy service, in order to capture a man they suspect to be the "Golden State Killer". Science Magazine interviewed Yaniv Erlich, who warned back in 2014 that GEDmatch could be used for law enforcement purposes:

A chat with the geneticist who predicted how the police may have tracked down the Golden State Killer

Yaniv Erlich, a geneticist at Columbia University in New York City, was far from surprised at the news last week that police may have found a serial murderer and rapist, California's long-sought Golden State Killer, by tapping a public DNA database to match crime scene DNA: Erlich had cautioned in a June 2014 article [open, DOI: 10.1038/nrg3723] [DX] about genetic privacy, published in Nature Reviews Genetics, that GEDmatch, the website that was reportedly used, could allow for such "genealogical triangulation." On GEDmatch, people voluntarily supply their own DNA sequences that they obtain through consumer sequencing companies—like MyHeritage, where Erlich serves as chief science officer--and provide e-mail addresses, which allows presumed relatives to contact each other. In this case, the investigators fished the database with a DNA sequence obtained from a frozen, 37-year-old rape kit used in a murder case attributed to the Golden State Killer.

Police have not yet revealed precise details about how GEDmatch, or other such sites, were used, but Erlich, who was not involved with cracking this decades-old case, spoke with Science about how the suspect's DNA sequence likely led to his arrest and related privacy issues. This interview has been edited for brevity and clarity.

Q. How do you think police narrowed down the many matches they found on GEDmatch?

A: I would be surprised if it was more distant than a second cousin--probably a first cousin because with a second you have too many people. Then they had three choices: no cooperation, just figure out the family tree; contact the relative and make up a story like, "I'm an adoptee and saw you on GEDmatch"; or explain, "We're the police and you're not a suspect but you can help us because of your DNA." Probably the safest thing is to come up with a story and say, "Oh, thank god I found you, let's meet." When they meet, police come as a team and say we're investigating this type of thing, please walk us through your family tree. It's not very nice to say no. Then if you have 20 people on the tree, it's quite trivial to go for the one person you're looking for who is quite old, male, lives in California, and who, some of the victims said, had light colored eyes.

[...] Q. There's a lot of concern about privacy being compromised here, but people voluntarily put their data into GEDmatch.

A: It's not like people fully understand the consequences of putting their DNA into a public database. They think, "So many people use the website, so it's ok." Or: "Oh, it's a website for genealogy." What if it was called Police Genealogy? People wouldn't do it. We don't think about everything. We think about the most likely thing.

An earlier search led to the wrong man, because a Y chromosome database was searched, turning up a poor match. GEDmatch allows for autosomal matching (the paper also noted Mitosearch.org, which includes mitochondrial data).

Also at STAT News.

Original Submission