Selling Your Saliva: Privacy Dangers of DNA Testing

Is Your DNA (and your privacy) For Sale Online?

You might not think your relative’s genealogy hobby could bring you an hours-long interrogation by the FBI and a search warrant for your DNA. But that’s what happened to one film maker, and with the growing popularity of online DNA testing services, the odds of it happening to almost anyone are growing by the day.

It’s no secret that federal, state, and local governments share DNA profiles gathered at crime scenes. The DNA of convicted offenders also goes into the CODIS (Combined DNA Index System). The federal government and several dozen States have enacted laws permitting the collection of DNA from people who have merely been arrested or charged with crimes; yes, even the “innocent until proven guilty" persons must give up their DNA.

In New York state, for example, any person convicted of a misdemeanor or felony is required by law to provide a DNA sample, which will be kept in the New York State DNA Databank. Some local law enforcement agencies have set up “sobriety checkpoints” where every vehicle is stopped and its occupants are pressured to “voluntarily” provide DNA samples by intimidating, uniformed officers. In Windsor, Ontario, police went door to door “requesting” the DNA of everyone in a neighborhood in search of the murderer of a pregnant woman.

But law enforcement can’t collect everyone’s DNA; at least, not as fast as it would like. So now, police are turning to private-sector databases of DNA profiles collected for medical, genealogical, and other purposes that have nothing to do with crime.

Ancestry.com, perhaps the largest genealogical research resource available to the public, owns a DNA database purchased from an LDS Church genealogy project years ago. Incredibly, Ancestry.com made this sensitive data public and searchable! For law enforcement, it was the genetic equivalent of dumb criminals’ self-incriminating public Facebook posts. All they had to do was search Ancestry.com’s free database for a match with crime scene DNA, then get a warrant for the Ancestry.com user’s identity.

What is Familial Searching?

“Familial searching” goes a long step further. It’s based on the premise that one’s relatives have DNA similar to yours. So if a direct search doesn’t turn up a match strong enough to serve as probable cause for a warrant, police may look for partial matches that indicate a relative of the unknown DNA sample. Such a familial match may serve to obtain a warrant for the potential relative’s identity. Then the police go looking for that person’s relatives.

That is exactly what happened to Michael Usry. Years ago, his father donated DNA to that LDS genealogy project, never dreaming it would end up in a commercial, public database searched by the Idaho Falls police. The senior Usry’s DNA profile was an “excellent match” to DNA found at a 1996 murder scene, though still dissimilar enough to rule him out as a suspect. But that was enough for a warrant to obtain Dad’s identity, and the police started going through his family.

What they found is that Michael Usry had “ties” to the Idaho Falls crime scene; two of his sisters attended university 25 miles from it. He’d been on a ski trip near Idaho Falls when he was 19. Oh, and he had Facebook friends in Idaho, too. Also, Michael Usry’s films often feature violence, indicating a “depravity of mind” according to police. This thin soup, and the fuzzy science of familial DNA searching, convinced a judge to issue a search warrant for Michael’s DNA, which was executed by FBI agents in Usry’s current home town of New Orleans. Usry sweated for 33 days before the DNA test results cleared him. (I wonder why they went to all that trouble, since police can secretly collect suspect DNA from a discarded bottle or even trash.)

DNA testing is becoming more popular and less expensive. It’s a very useful tool for identifying potential medical problems before they actually arise. But if DNA databases become fishing holes for law enforcement, people may well shy away from getting tested.

Familial searches of DNA yield a high percentage of false positives, generating numerous fruitless leads in a criminal investigation. In the UK, which has employed familial DNA searches for over 10 years, a 2014 study found that just 17 percent of familial DNA searches “resulted in the identification of a relative of the true offender.” The damage done to the reputation of someone who merely falls under suspicion of a crime may outweigh the utility of unreliable familial DNA searching. Had Michael Usry been a schoolteacher, rumors that he was being investigated for a girl’s murder might have ended his career unjustly.

Other DNA Privacy Concerns

MyHeritage, one well-known genealogy and DNA testing business announced a security breach in June 2018 that revealed 92 million customers' passwords and email addresses. This incident highlighted the vulnerability of user information maintained by DNA testing companies. Despite the company's claims that no genetic or DNA data was compromised, this event acted as a warning, demonstrating how vulnerable genetic information is to hacker attacks and illegal access.

Additionally, DNA testing has the potential to reveal family secrets that some people would rather not be known, which raises privacy concerns. There have been incidents where the results of DNA tests have unintentionally revealed family secrets, including paternity fraud. One woman found out that the man she had assumed to be her biological father was not, after taking an Ancestry DNA test for fun. As at-home DNA testing yield surprising results such as this, stories like these have grown more frequent. Some people face damaged relationships, and in certain situations, even legal fights as a result of these revelations, while others find closure.

On the flipside, police in California were able to find and arrest the "Golden State Killer" Joseph DeAngelo, 40 years after his string of murders, rapes and burglaries. They used publicly available DNA information from GEDmatch, to identify a distant relative of the suspect. GEDmatch stores DNA information voluntarily uploaded by people who use DNA testing kits provided 23andMe or Ancestry, to search for family members.

Is DNA Protected By Law?

There is no federal law regulating familial DNA searching. Maryland and Washington D.C. explicitly prohibit it, while the practice is regulated by laws in California, Colorado, Montana, Virginia, and Texas. Police have free rein in other States. The Idaho Falls police searched Usry Sr.’s family tree for five generations, even though the FBI says familial searching is useful only for identifying suspects among parents or siblings.

When it comes to insurance, there are some protections in place. The Genetic Information Nondiscrimination Act (GINA) is a federal law that prohibits health insurance providers from using genetic information to discriminate regarding health insurance coverage. Specifically, they can't use any genetic test results to deny coverage or charge higher premiums. But there are some loopholes in the GINA law. It does not apply to companies with fewer than 15 employees, nor to disability insurance, long-term care insurance, or life insurance.

Can Anyone Do a DNA Search?

Ancestry.com suspended public access to its DNA database in the wake of the Usry case. However, that does not prevent law enforcement from seeking a search warrant to look through that database for a specific DNA profile, if they can cite probable cause to believe that a useful match is in Ancestry.com’s database. As long as the data exists, it is vulnerable to court orders. Ancestry.com tells users in its terms of service that it will provide their data to law enforcement in response to search warrants or court orders. However, the company is silent on how many warrants, orders, or informal requests it has received, and how many have been fulfilled. They do state that the company "will not share your genetic data with employers, insurance providers or third party marketers without first getting your consent."

23AndMe.com, another DNA testing firm that tests for genetic indicators of medical problems, issues a quarterly transparency report. It shows that since 2015, the company has received only eleven requests from law enforcement agencies for its data, and that no request has been granted in whole or in part, without the explicit consent of any individual identified in a request.

However, that doesn't mean that DNA testing companies aren't *selling* the data they collect.

Both Ancestry and 23andMe do sell (or have sold) your data to drugmakers and other interested parties. In 2018, pharmaceutical giant GlaxoSmithKline paid $300 million for a four-year deal to use 23andMe's genetic data to help them develop new drugs. That deal was renewed in January 2022. 23andMe also has (or has had) data sharing partnerships with P&G Beauty, Alnylam Pharmaceuticals, Biogen, Pfizer, Genentech, and several universities and nonprofit research groups.

Ancestry partnered with Google's Calico subsidiary from 2015 to 2018, to study aging and longevity. Currently, Ancestry only partners with universities and research institutions. Among those are the University of Utah and the American Society of Human Genetics.

The genetic data is anonymized, of course, before sharing. But despite the best efforts to remove personally identifying information from DNA samples, researchers at the Whitehead Institute for Biomedical Research have proved that anonymizing this data is not foolproof. They were able to determine the identities of 50 people who anonymously donated DNA donated for scientific studies. That was back in 2013, so just imagine how much more efficiently this could be done with AI and quantum computers.

Add to that, mistakes and data breaches happen regularly. One must wonder how all those companies, universities and research groups handle the data they receive in all these partnerships. Does the data "leak" out to other parties? We'll never know for sure. On the bright side, Ancestry, 23andMe, and other DNA kit vendors offer choices about sharing your data with third parties. If you missed that when signing up, look for the relevant profile settings, and ask if you can delete your data entirely if desired.

Have you had your DNA tested? Your thoughts on this topic are welcome. Post your comment or question below...