New York Times reports police in Florida have successfully obtained full access to GEDmatch via court warrant

+15 votes
920 views

Back in May, GEDmatch limited access by police, requiring users to opt-in to matching with Law Enforcement DNA kits.

From what I have read elsewhere, that action limited the number of kits opted-in for law enforcement purposes to between 100k and 200k. Naturally, that has limited effectiveness of the database for law enforcement. There has been a marked drop off in LE successes using genetic genealogy in recent months.

Today the New York Times posted a story, ‘Game-Changer’ Warrant Let Detective Search Genetic Database indicating that police have sought and successfully obtained court-ordered access to GEDmatch. It is not clear from the reporting if the access includes the raw genotype data, or just kit matching.

Some key paragraphs from the article:

Last week, however, a Florida detective announced at a police convention that he had obtained a warrant to penetrate GEDmatch and search its full database of nearly one million users. Legal experts said that this appeared to be the first time a judge had approved such a warrant, and that the development could have profound implications for genetic privacy.

“That’s a huge game-changer,” said Erin Murphy, a law professor at New York University. “The company made a decision to keep law enforcement out, and that’s been overridden by a court. It’s a signal that no genetic information can be safe.”

DNA policy experts said the development was likely to encourage other agencies to request similar search warrants from 23andMe, which has 10 million users, and Ancestry.com, which has 15 million. If that comes to pass, the Florida judge’s decision will affect not only the users of these sites but huge swaths of the population, including those who have never taken a DNA test. That’s because this emerging forensic technique makes it possible to identify a DNA profile even through distant family relationships.

The warrant is currently being shared as a template with other police officers, and there is an expressed interest in trying the same with Ancestry DNA and 23andMe to obtain their data.

There are also many unknowns about the warrant itself the scope of access permitted.

It is also unclear why GEDmatch did not disclose to its users that it was subject of this warrant. 


Nov 07. Adding some additional responses on the subject. I haven't been able to find additional reporting on the details of the warrant, etc...

23andMe issued a statement on their blog, "Our stance on protecting customers’ data" (Nov 7, 2019):

Perhaps just as disturbing is GEDmatch’s apparent lack of scrutiny and challenge of the validity of the warrant issued. According to reporting by the New York Times, the company opened up its database to law enforcement within 24 hours of the judge’s decision. Given this timing, it does not appear that GEDmatch exhausted all legal avenues to challenge the warrant. In contrast, if we had received a warrant, we would use every legal remedy possible. And to be clear, because our database is and always has been private, we don’t believe that this decision impacts 23andMe. 

Science News (affiliated with one of the top scientific journals, Science) posted an article on the topic: "A judge said police can search the DNA of 1 million Americans without their consent. What’s next?" (Nov. 7, 2019 , 2:40 PM) The article interviews "Natalie Ram, a law professor at the University of Maryland’s Carey School of Law in Baltimore, about the implications."

There's an article on NakedSecurity, "Warrant let police search online DNA database", which restates the majority of the content in the original NYT, so it's a good proxy if you've hit a paywall.  

in The Tree House by anonymous G2G6 Pilot (139k points)
edited by anonymous
Two excellent points above:

(1)  A judge had to go over the particulars and determine that there was "probable cause" to search the database.  That is how the system is supposed to work.  An impartial third party has been invoked to make the decision.  Any of our persons or property could be searched _with probable cause_ at any time.  (And we can be searched/boarded near the US border at any time _without_ probable cause.)

(2)  Getting a DNA match in the database allows LE to develop a suspect list.  The match to the database is not evidence in court, because there is no chain of custody to make an accusation about an individual.  It's up to LE to get a fresh DNA sample from a suspect, maintain a chain of custody, show it matches the forensic specimen, and then get it admitted as evidence in court.  Safeguards exist all along the way.
safe guards if there is no corruption that is
Regardless of the facts, the perception could have a chilling effect on the number of dna uploads.

If it gets unpleasant enough, what's to keep GEDmatch from just closing up shop and erasing all their data?
It's my impression that there has been a chilling effect for a while already, ever since the news of the Golden State Killer case.

One can hope that the GEDmatch owners care enough about what they're doing not to trash it, and if not, at least would find it more in their interest to sell the site than destroy it.

Edit:  In case there's any confusion, I am replying to the comment immediately preceding.
What did people expect? That GEDmatch would ignore a warrant?

I think you're correct, Julie. All indications are that DTC autosomal test sales growth began slowing as of May 2018. Coincidence or not, the Golden State Killer story noting the involvement of GEDmatch and "forensic genealogy" broke 25 April 2018. Leah Larkin regularly monitors testing sales activity, and she reported the slow-down last summer. To illustrate the changes in sales growth, she used a curve-fitting algorithm to consider actual vs. projected numbers. Here's an example from AncestryDNA (click the image for a full-size version):


Regardless of the outcome of this new search warrant served in Florida, it's hitting all major (and minor) news outlets from The New York Times to NPR to the Technology Review. And it's hitting at precisely the start of "pre-Black Friday" holiday sales season. This can't bode well for the busiest DTC DNA testing sales season.

I saw and heard some of those news stories yesterday.  What bothers me most is that they cited five-year-old examples as if they were current news, as if testing hadn't improved and as if law enforcement could never grow more sophisticated at using DNA information appropriately.

Yep. As an example, Kitty Cooper was none too happy about yesterday's piece on PBS: https://blog.kittycooper.com/2019/11/shameful-dna-reporting-by-pbs/.

Seriously? Neither of your points addresses the issue of appropriating private property unjustly and without due process. Any measure of the data's accuracy, scope, or helpfulness is not enough to pierce the corporate responsibility that they protect 3rd-party DNA property. The LE should be limited to a single DNA profile per warrant application, and specific probable cause should be shown in each case.
It seems like at this point legislation will be necessary to protect people’s privacy. Ugh such a scary prospect though...one never knows exactly what you’ll end up with codified into law.

6 Answers

+17 votes
 
Best answer

Well-known genetic genealogist Debbie Kennett posted this commentary just a few hours ago: https://cruwys.blogspot.com/2019/11/search-warrant-granted-for-access-to.html. Leah Larkin wrote about it yesterday: https://thednageek.com/there-is-no-opt-out/.

One note that Debbie makes is this: "GEDmatch could potentially have resisted the warrant but they are unlikely to have the resources to fight a lengthy legal battle." With legal issues I've dealt only in legislative matters, not criminal cases. But I believe that in the US an issued search warrant carries with it the weight of immediate execution. In other words, your 4th amendment rights have been weighed, and you have no recourse of refusal or resistance. There are some exclusionary restrictions applied to search warrants, but there is no deferral of execution: law enforcement officers will inform you of the situation, hand you your copy of warrant, and proceed. Refusal almost certainly means arrest, and the search would continue anyway. There is legal recourse to try to invalidate the warrant, or specific search-and-seizure done improperly under the aegis of the warrant, rendering evidence/information obtained inadmissible, but that would be after-the-fact.

I believe there is still a great deal of detail yet to come, and I'm certainly not faulting GEDmatch for this. But a warrant has to specify its particular scope; for instance, it has to state what may be searched, and where the search may be conducted. Until--or if--we learn of the particulars in this warrant, we won't know how extensive the access was...or whether Judge Strowbridge overstepped and case law eventually works in the other direction.

That said, I believe, at least in the US, that we may still be operating on a model perhaps valid in the 1970s, but we're now expecting--and empowering--a single magistrate to make 4th amendment decisions about subjects with extremely complex infrastructures. I don't want to unnecessarily hinder law enforcement in any way, but the question may need to be raised whether any single judge is reasonably capable of approving issuance of a search warrant that might have far-reaching ramifications in the technological complexities we now have as we near the second decade of the 21st century. This case may be a perfect example.

How many sitting judges--or requesting detectives--have enough knowledge about molecular biology and the data-storage modalities involved to, in a completely informed and reasonable manner, structure a search warrant that then includes access to 1.2 million sets of individual genomic information? I don't have a personal issue at all with the honeypot-and-genealogy method Cece Moore and others have used in the past (I'm a GEDmatch law enforcement opt-in), but if this Florida warrant actually gave direct access to and manipulation of the stored genomic data--and unless a court invalidates the warrant--it could be a precedent that means it is far easier to gain access to the allele-level data of millions of individual genomes than it is to get access to the list of contacts on someone's iPhone.

This one bears close watching.

by Edison Williams G2G6 Pilot (439k points)
selected by Andreas West
I'm a private person and my DNA information is mine. I am not a criminal in any way and will share it as I see fit. So, I guess I'll do my family tree the "non dna verified way".

So, the police won't need actual Dna to convict you of anything. Its not like they walk into court with a vile of blood saying , "see the red blood is the same color red as that blood." They will only need a print out of your Dna Sequence on a piece of paper in the courtroom and your convicted. (Copy, Print, Convict)

Never mind Illegal search and seizure or the 5th Amendment - against self incrimination. Which is exactly what it is.

Also Treason.
Can countries other than the USA make similar requests from their law enforcement agencies to GedMatch and other genetic genealogy brands?

If so ... all nations or just some?

Since some western nations pool data between their law enforcement agencies ... does that in any way impact genetic data policies around the world or part of it?

Thanks for the best-answer star, Andreas. BTW, 4 days to my 11-month Dante sample-delivery anniversary, and still no shred of results...or even indication that sequencing has begun. As of that anniversarry Mr. Riposati will be hearing from me, and I'll give him four weeks to make something happen, or to every resource I shall go, including the FTC. 

Bree, I'm afraid I have no earthly idea about legalities in other countries. If I'm not mistaken, though, late last year or early this this there was a treaty required between the UK and the US for the UK to gain access to some IT intellectual property (in this case, I believe it was WhatsApp) from one particular user's account. Yesterday on Twitter, population geneticist Graham Coop wondered if MyHeritage could soon be embroiled in something like this, and my uninformed comment was that even though the DNA testing is done by FTDNA's lab in Houston, MyHeritage and its intellectual property are in Israel, and that a search warrant similar to this one in Florida likely has no bearing.

And because of a variety of comments upstream, I just want to clarify that my red flag went up over this case because we simply--still--don't understand the specifics of the affidavit that secured the search warrant from Florida's 9th District Court.

The way "forensic genealogy" has been used in the past, publicly beginning with the Golden State Killer case, is what I tongue-in-cheek called the "honeypot-and-genealogy" method. No one--not law enforcement and not investigators like Cece Moore--have (had?) access to actual genomic records...to our raw data. Using often quite-dated crime scene DNA samples, they would construct a "pseudo-kit" of markers (rsIDs) and allele values, and then upload that kit to GEDmatch. That's where the genealogy part comes in: a highly experienced genetic genealogist like Cece would evaluate the matching results and search out corresponding family trees. What they did was narrow the playing field on the cold case from and Unsub (unknown subject) to maybe a handful of people. That was/is the immense benefit. Arrests weren't made off this work alone; the detectives then did their thing to find the guy out of the narrowed-down prospects and the case was built, including freshly-sampled DNA evidence.

Preliminary indications--and there have been updates to the story in the past 24 hours, but still nothing definitive about the particulars--are that this Florida warrant might not have been merely a grant to upload a "pseudo-kit," but that it might have been much more akin to a carte blanche to give the detective direct access to the actual GEDmatch database. Potentially meaning not just finding results that match a specific kit that was uploaded, but the ability to view the raw data at the allele level.

That's a whole 'nuther ballgame from "honeypot-and-genealogy" when it comes to privacy issues and the potential for erroneous use of genomic data. I'm probably explaining myself no better this round, but that's the crux of my concern.

Is it carte blanche access? Is it "honeypot-and-genealogy" but the ability to override individual preferences and match against 1.2 million genomes, not just the ~190,000 that have expressly opted-in for law enforcement use? Either raises privacy concerns and sets potential legal precedent, but the former could be a factor of magnitude more significant in terms of far-reaching ramifications than the latter. (Given the published story, I've kept thinking the original affidavit to secure the warrant might have leaked somewhere, but I haven't turned it up yet.)

I have no doubt things will continue to develop, and new information come to light, over the upcoming days and weeks.

I contacted Curtis Rogers. He said they "would interpret the warrant or subpoena to finding matches on the public database."

Many, many thanks for the insider knowledge, Ann. If the scope of the warrant precludes the extreme "Possible Precedent A," we're not on quite so much a precipice. But even if not from Curtis, I suspect we might still see some legal challenges to the warrant, in Florida or even federally. The ACLU could always throw its hat into the ring, and the fact that the warrant exposes some EU citizens to privacy issues they did not agree to could bring international rights considerations into play.
+14 votes

Yawn . . . .

Until and/or unless someone has been falsely arrested and convicted due to evidence collected from genealogical DNA sites like GEDMatch I will continue to leave my data on those sites, AND keep them as public as I am allowed by those sites. I have tested my autosomal, mtDNA and Y DNA out to the limits available from FTDNA. I do not expect to lose sleep expecting knocks or battering rams on my door.

by John Beardsley G2G6 Mach 4 (44.3k points)
+5 votes
I manage several other family DNA files on Gedmatch and have chosen not to open those up to the LEOS. But MY DNA is open to the LEO access.

Since currently the only LEOs doing these searches are Americans and I (and my family) are not American, most of my ancestry is NZ, and British, I dont feel that I will be implicated in any crime on USA soil.
by Robynne Lozier G2G Astronaut (1.3m points)

Well, you have exposed your relatives' DNA data to both police and others.

Contrary to your assertion, police in NZ are considering doing the same. And in Canada. And the truth is that no one has public information on whether police in Australia are doing so at this time or previously.

Application of genetic genealogy to police searches is not just being used to catch serial killers and rapists; it's been used by police even to arrest a kid who broke into a car to steal $1.40 in change. The scope will continue to expand. 

Also, raw data can be extracted using GEDmatch in order to determine whether you and your relatives are susceptible to disease or for other purposes. As such, the site has been called "a national security risk".

I think it's misleading to suggest that police would consider it worthwhile to use DNA analysis to go after a petty criminal who stole $1.40.  

The original article (at https://sites.psu.edu/dhlaw/2011/02/21/how-successful-are-kinship-searches-aka-familial-searches/comment-page-1/) states:

In February 2008, several cars were burglarized in a Denver apartment complex. In one car, blood stains were left on the front seat...this case was only designed to test the new familial search software, it would probably have received more publicity had it led to the arrest of a rapist or murderer and not a car burglar who apparently stole only $1.40 in change.

And by the way, if he broke a car window, or slit a convertible top, or whatever else he did to get into the car, he caused a loss much greater than his gain of $1.40, as is so often the case with that type of crime, but in my own experience, police do not make a great deal of effort to pursue small-time burglars.

The method described in the paper linked by JN Murphy requires uploading artificial kits. GEDmatch would currently reject kits of that type.

https://www.washington.edu/news/2019/10/29/genetic-genealogy-site-vulnerable-compromised-data-impersonations/

Ann: GEDmatch has no means to determine or detect whether a kit is artificial or real because it isn't a "type" of kit. Such a kit can look exactly like a data upload from a users raw 23andMe or Ancestry DNA data. There are means to avoid this issue, however GEDmatch has expressed zero interest in such methods.

Julie: You have no magic insight into what the police will consider "worthwhile" and what they will not. Their resources  and powers of compulsion are unlimited compared to yours. The fact is that they have used it for such minor things in the past and usage creep has continued. When we were told that FTDNA would just allow use for rape and murder... suddenly we found out that they used it for a "violent assault" which was outside of those parameters.

Moreover, in the past, the police have found it worthwhile to extend huge amounts of effort even in more liberal countries, such as Canada, to prosecute people for possession of marijuana - something which is now legal. Even with legalization looming, and legislation in the process of being passed, they were still charging people for possession of small amounts. Not particularly worthwhile, eh? 

JN, what I said was "in my experience," not that I had magic insight.  I have been the victim of both home and car burglaries and other theft and vandalism over my lifetime, including some fairly recent, and I know how the police reacted.
JN, I'm collaborating with GEDmatch to create test files. I'm acting as an outsider, so I'm ignorant of the specific filters they have in place. An artificial kit emulating the method in the Ney paper failed to tokenize.

Ann: This is a case where the hackers are academics and explained in very clear terms what they did, how they did it, and why they did it. Do such academics make up the majority of hackers or those who may seek to illicitly gain access to large amounts of private genomic sequence data? No. 

Because these academics took the most straight forward version of a more general method, and because they published it, clearly laying out the exact steps taken, it was easily blocked. But only the exact same approach which they have taken.

Nonetheless, there are multiple ways around it. Which I'm not going to explain here. Outside of Wikitree, I've spoken with my fellow scientists, and we came up with a number of options that cannot be protected against.

This is probably (still no statement) part of why the site introduced CAPTCHAs recently. That will slow people down, at least those with zero financial resources. A modicum of money will get around that. 

The problem is ultimately the structure of GEDmatch and their choices — yes, their choices. They have chosen a particular data model which is highly risk prone. They have chosen their jurisdiction which leaves the site vulnerable to US warrants. (Curtis Rogers could easily sell the site to someone resident in a place outside the reach of the US judicial system.) They could fix it, but they won't. 

+8 votes
There is a new post by Judy G. Russell, The Legal Genealogist, this morning that discusses how little we know about this case.

https://www.legalgenealogist.com/2019/11/10/about-that-warrant/
by Living Kelts G2G6 Pilot (549k points)

Thanks, Julie. And I'm in great agreement with Judy's answers of, "We don't know."

Yesterday, I wrote the response below to one of the genetic genealogy mailing lists following several posts that seemed to use the terms "court order," "subpoena," and "search warrant" interchangeably. And that got me to wondering if the media reporting the matter might not have confused some terminology, as well. Suffice to say that's my word of the day: confused. Because we...well, we don't know!  wink


[Some] posts here and elsewhere, make me now wonder if I understand what transpired in Florida and if the media have been reporting it--and the legal terminology--correctly. What was reported, first by the New York Times, was that Judge Strowbridge in Florida's 9th District Court considered an affidavit submitted by a detective, and the judge then issued a search warrant based upon that affidavit.

A search warrant is a very specific instrument. A court order is not necessarily a search warrant, and a search warrant can never be confused with a subpoena. Mind you, I'm speaking only of U.S. law, and I have no experience specific to Florida law. But the term "court order" is far too broad, and a subpoena is a summons to compel testimony and/or produce evidence. A subpoena does not authorize search and seizure by law enforcement under the 4th amendment; it does not carry the here-and-now mandate that a search warrant does.

A subpoena to produce evidence can be argued prior to the presentation of the evidence. We see that all the time in the odd machinations that go on in Washington D.C. But a search warrant is specific and immediately actionable.

By issuing a search warrant the judge is authorizing law enforcement to search a defined location for specific materials or objects, and to seize those items if they are found. To obtain a search warrant, law enforcement must show probable cause that a crime was committed and that items connected to the crime are likely to be found in the location specified by the warrant. There are exceptions to the requirement for a warrant (emergency searches, imminent evidence destruction, etc.), but otherwise, without express consent granting the search, a warrant is required for immediate search.

The "probable cause" terminology comes straight from the 4th amendment: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." 

"Probable cause" has no iron-clad definition and, as evidence goes, has a relatively low bar and is dynamic in its evaluation. Ballentine's Law Dictionary defines it as "a reasonable amount of suspicion, supported by circumstances sufficiently strong to justify a prudent and cautious person's belief that certain facts are probably true."

We've seen 23andMe, for example, respond to this story saying that they would have contested the court's action. But there is no contestation of a search warrant prior to compliance. There will be multiple law enforcement officers presenting you with your copy of the warrant, and there's no "let me call my lawyer and get back to you tomorrow."

So what actually took place in Florida, and has the media been wrong? Was this an issued subpoena that the media incorrectly escalated to "search warrant" to make the story better click-bait?

(The next reply to the list, BTW, was, "Can we get away from law and politics and get back to genetic genealogy? The fact was reported, noted and is now being chewed at for the nth time." I refrained from pointing out that the matter seemed pretty germane to genetic genealogy, and that, at the time, the whole deal was less than 72 hours old and that we really hadn't been beating it to death; there had in fact been only eight posts about it before mine. But c'est la vie.)

+6 votes

First of all let's all agree that fear is the mind killer...  when you are afraid something might happen it shuts down your brain's ability to deal with it calmly and rationally.  Fear does not help in a situation like this and many of these posts are centering on fear of what might happen.

I for one have long since learned that the best way to survive anything is to face the fear and deal with it.  

So here is what each of the terms mean and often how it is used internationally is very different than how the legal system works in the USA.  More often it is harder to get access to things in the USA than other countries when the authorities are involved.  

https://en.wikipedia.org/wiki/Subpoena

https://www.uscourts.gov/rules-policies/judiciary-policies/subpoena-regulations

There are different kinds of subpoenas  https://definitions.uslegal.com/s/subpoena/

https://www.weil.com/~/media/files/pdfs/subpoenas-using-subpoenas-to-obtain-evidence.pdf

https://en.wikipedia.org/wiki/Search_warrant

https://www.nolo.com/legal-encyclopedia/search-warrant-basics-29742.html

https://www.genome.gov/about-genomics/policy-issues/Privacy

The courts restrict how the information gathered can be used.  It has to follow strict chain of custody requirements.  Before jumping into the fear mode, get the facts.  Unfortunately today news media seems more concerned with making headlines that get a lot of buzz and are not so careful with accuracy as they once were. 

by Laura Bozzay G2G6 Pilot (830k points)
I guess I am too simple minded to be fearful of this. My entire family's DNA is listed and open on GedMatch. If there are any criminals in my family, I will let them be fearful. Moreover, if I am questioned about a criminal that I may have information on (which I truly doubt that I would have), sorry about your luck, you shouldn't have done the crime, it you didn't want to do the time.

Living Free without Fear!
+3 votes

As an update to the situation a freelance researcher, Shreyas Gandlur, obtained the Orlando PD Search Warrant for GEDmatch via the state's freedom of information laws. It is partially redacted.  

The warrant has been discussed in a few places:

Worth taking some time to read and digest.
by anonymous G2G6 Pilot (139k points)

Related questions

+22 votes
7 answers
+10 votes
1 answer
+6 votes
2 answers
+5 votes
3 answers
+10 votes
0 answers
+24 votes
1 answer
+21 votes
1 answer

WikiTree  ~  About  ~  Help Help  ~  Search Person Search  ~  Surname:

disclaimer - terms - copyright

...