23 And More Than Me

Police in California have caught a serial rapist. The Golden State Killer was been linked to 12 murders and 50 rapes in the last forty years. A good thing right? Not for privacy activists.

Police caught the man after uploading DNA from one of the crime scenes to a website called GEDMatch. Like a number of other sites, it allows you to upload your DNA and get information about your genetic history, including family members. But, GEDMatch is also an open-source platform which makes it clear that your genetic material will be shared with volunteers who work on compiling the family histories.  

Moreover, the site didn’t actually work with law enforcement. The police uploaded the DNA they had to the site and got a report about familial matches. They used that to narrow down a list of suspects, staked out the killer’s house, waiting until he threw out some garbage with his DNA and tested that. When that was a match, they arrested him.

This has privacy activists concerned. On VOX’s Today Explained, they interview a lawyer who emphasises how bad this is for our personal privacy.

I don’t see it.

You share your site with a DNA ancestry site which is very open about being open source. Police use that DNA to narrow down some suspects. They didn’t have the material turned over to them, they didn’t get any genetic information about you. They only found out if you were related to this DNA sample. From that, they found a suspect and then used their discarded DNA to make a match. How was anyone’s privacy violated?

On Today Explained, the lawyer uses an example of a bank robber who rents a car for the robbery. Police recover the car and find your DNA in it. This is because you rented the car before. You could be a suspect.

Except of course the car rental company would have a record of you returning the car. And also, if they found the car, they would go to the rental company and find out that you rented it anyway.

I have a lot more sympathy for people upset at how the BTK killer was caught. Police got a search warrant for his daughter and got her genetic material from a pap smear she had done. That screams of all sorts of privacy violations. She didn’t upload her DNA voluntarily. Further, police were already suspicious that it was him. Why not just wait around until he tossed a cup or something and get DNA from that?

But uploading your DNA voluntarily to an open-source site and having the police find a match to someone? I’m not bothered.