A third-party DNA database that began as a passion project and later became embroiled in an ongoing debate over genetic privacy has now gone commercial. This week, the San Diego-based forensics company Verogen announced its acquisition of the controversial genealogy website GEDmatch. But it’s anyone’s guess as to how the shift in ownership will affect its over one million users—or its recent repurposing as a controversial crime-solving tool.
Verogen, founded in 2017, is a spinoff from the genome-sequencing company Illumina. While Illumina’s products have largely been used in the research and biotech world, Verogen has advertised its next-generation sequencing technologies to law enforcement agencies.
By contrast, GEDmatch was started by a pair of amateur genealogists Curtis Rogers and John Olson in 2010. It was intended as a way for other people curious about their family history to freely and publicly pool together their resources. It eventually offered a premier membership only to cover server costs and was run by volunteers. Users submit the DNA testing results they’ve gotten from any other closed off services like 23andMe and Ancestry, which are then cross-referenced against others’ results.
For years, the website’s userbase steadily grew in relative obscurity. But in 2018, that changed dramatically when it came to light that Sacramento police used GEDmatch to identify the suspected Golden State Killer, Joseph James DeAngelo.
They submitted crime scene DNA from the alleged killer to the website, which allowed them to find the suspect’s possible distant relatives, then they worked backward and constructed a likely family tree that led to Deangelo. He was subsequently apprehended in April 2018 and is still awaiting trial.
Though GEDmatch’s owners initially expressed dismay at how their data had been used, they soon changed their minds and encouraged law enforcement agencies as well as other forensic companies to sift through their website. That quickly led to a flurry of similar investigations, with the Virginia-based Parabon Nanolabs, in particular, claiming they had identified dozens of alleged perpetrators behind violent crimes, most often in cases that had long gone cold.
Earlier this year, William Earl Talbott II became the first person convicted of murder with the help of what’s become known as forensic genealogy.
While the number of GEDmatch users spiked following the capture of Deangelo and at least one survey has suggested that most people are generally fine with consumer DNA databases being used by police to solve violent crimes, some experts have urged caution about the trend and its unintended consequences.
There are no federal guidelines on when law enforcement agencies should be allowed to use genealogy databases, for instance, although companies like 23andMe have pledged not to openly share their data with the police or any public venue.
And last December, a study found that only a tiny percentage of people in a population would need to submit their DNA in a database like GEDMatch before it’d be possible to track down the identity of virtually anyone; others have shown how easy it would be for someone with bad intentions to hack and manipulate DNA databases.
Amidst these criticisms, GEDmatch’s owners eventually implemented a new opt-in policy this past May meant to let users decide if they wanted their data to be searchable by police in these cases. Regardless, in November, police in Florida obtained a warrant to search through all of GEDmatch, a decision that it chose not to contest.
In light of these developments, it’s worth wondering if GEDmatch’s founders simply felt too exhausted to continue running it.
“Like others, I’m not very surprised that GEDmatch has been acquired. The site operators have faced unexpected and difficult questions about use and access over the last 18 months or so,” Natalie Ram, a legal expert from the University of Maryland who has written about the challenges of genetic privacy, told Gizmodo via email.
On the one hand, it’s possible that Verogen’s greater resources will make it better able to fend off future attempts by police to circumvent GEDMatch’s opt-in policy.
Verogen spokesperson Kim Mohr told Gizmodo via email that the company would not disclose any of the terms, including financial, behind the acquisition. Co-founder Curtis Rogers will maintain a role with the website, though, according to Verogen. And Mohr added that the company will remain “steadfast in its commitment to privacy,” and that it would “pursue legal avenues should there be any future attempt to access information of users who have not opted in.”
On the other hand, Ram noted that Verogen has long focused on working with law enforcement agencies.
“That mission may now supplant ordinary genealogy as the primary focus of the GEDmatch site and lead to expansion of law enforcement cooperation,” she said. “In addition, Verogen is a for-profit company, while GEDmatch was previously operated without a significant profit motive. That change in profit-seeking may make GEDmatch’s new owners more likely to cooperate further with law enforcement and other interested entities that can pay.”
Verogen claims that users will continue to have free access to the basic tools long offered by GEDmatch, though “in the future, enhanced applications will become available.” Other companies such as Parabon Nanolabs will continue their existing arrangement with GEDmatch as well. Currently, some 200,000 GEDmatch users are believed to have allowed their DNA to be searchable by police.
“There are no changes planned in terms of consumers accessing the GEDmatch database,” Mohr said. “Everyone who could access GEDmatch in the past will still be able to access the site.”
That said, users logging back onto GEDMatch starting Monday were confronted with a notice about the change. Those who wished to continue using the site were asked to sign off on new terms of service, while those who refused were told they could scrub all of their data from the website’s servers.
“The revisions in the terms of service occasioned by this acquisition should once again remind users—of any similar service—that their privacy and other rights may be only as strong as the goodwill and financial motive of the site operator allow, and that the site operator usually may change those terms at any time,” Ram said.