Informed Consent: What It Is, What It Isn’t, and Why It’s Necessary

The genetic genealogy community is in turmoil. People are angry, accusations are flying, and friendships are sundering. All over something as seemingly straightforward as whether we have the right to decide whether our DNA data can be used by law enforcement.

The Backstory

Last year, the world learned that genetic genealogy had been used to identify a serial rapist and murderer who had terrorized the state of California in the 1970s and 1980s. The so-called “Golden State Killer” had been dormant for decades and was finally captured thanks to the inspired work of Barbara Rae-Venter. She knew from her years helping adoptees that he could be identified using DNA left at a crime scene. She was right: Joseph James DeAngelo was arrested in April 2018, thanks to her collaboration with the FBI.

While the world rejoiced that a vicious killer was finally off the streets, the surreptitious use of GEDmatch-a privately-owned third-party database created by and for genealogy enthusiasts-raised ethical and legal concerns. After all, the people whose data helped identify the suspect had not consented to that use, and the FBI had not obtained a court order to access the database. They hadn’t even asked GEDmatch’s owners for permission.

Since then, more than 50 criminal cases and 10 Doe cases (unidentified bodies) have been solved using these methods. The benefit to society and the solace to the victims’ families cannot be understated.

The privacy concerns, however, must still be addressed. After all, residents of the US are protected by the Fourth Amendment to the Constitution, which states:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

Privacy advocates argue that law enforcement violates the Fourth Amendment by searching a privately-owned database containing personal and biomedical genetic information without a warrant or individual consent of the DNA testers. Notably, those advocates, including myself, don’t want to stop such searches; we want them to be conducted with either judicial oversight or explicit permission. And since approval by a judge seems unlikely given that a warrant would not be able to describe the “persons or things to be seized” beforehand, explicit permission is key.

Uncharted Territory

The genetic genealogy world would have been better off had these questions been resolved before law enforcement entered our databases. Instead, we’re all playing catch-up on scientific and ethical issues that would be challenging to discuss under the best of circumstances and are all but impossible now that so many are emotionally or even financially invested in one side or another. No aspersions cast here. This is cutting edge stuff, and the guardrails are being built as the cars careen past, so to speak.

The fact remains that most people uploaded to GEDmatch with no idea at all of what was possible in terms of privacy. Not just regarding law enforcement, but also family secrets, biomedical information, and who knows what else.

The entire community should take a breather and objectively assess where we want to be in 5 years, else I’m afraid that will be watching this play out on the floor of the US Supreme Court. It may be too late to avoid judicial and legislative oversight, but implementing an informed consent model now for law enforcement searches seems reasonable.

Informed Consent

The term “informed consent” is borrowed from the medical community, which is ethically bound to ensure that patients and research subjects understand the risks and benefits of treatments (i.e., are informed) and that they or their powers-of-attorney agree before treatment is rendered (i.e., give consent).

23andMe offers an excellent example of informed consent in the context of genetic genealogy testing. Their business model centers on crowd-sourcing genetic and trait information to advance medical knowledge and drug discovery. To that end, their customers can opt in to research studies that use their DNA. Their Research Consent Document clearly outlines the risks and rewards:

How will I benefit from this research?

• By taking surveys you may learn about 23andMe’s research findings, including how your answers compare with those of others and new discoveries made by 23andMe’s research program.
• Sometime in the future you or your family may benefit indirectly from research discoveries made by 23andMe or its research partners.

What are the risks of taking part in this research?

• There is a very small chance that someone with access to the research data or results could expose personal information about you. 23andMe has policies and practices in place to minimize the chance of such an event.

Importantly, at no time does 23andMe make the decision for you, even though it’s in their interests for you to opt in. And nowhere in the Research Consent Document does 23andMe try to influence your decision one way or the other.

That’s a far cry from what’s been happening with regard to law enforcement. For example, Family Tree DNA unilaterally opted in the majority of their customers (and all of the Americans) to law enforcement matching. That is not consent, much less informed consent.

And although GEDmatch recently implemented a system that requires an explicit opt-in (as opposed to opting people in without their knowledge), nowhere do they outline the risks. (Judy Russell also observes that opting out does not make the kit truly invisible to law enforcement.) What’s more, the owners are openly advocating one choice over another.

That’s consent, but not informed consent, and GEDmatch is clearly favoring one choice over another. Should anything go awry with a criminal investigation in their database, GEDmatch may have exposed itself to liability with that statement.

The Risks and Benefits

We, as a community, need to think about the benefits and the risks of using the same databases as law enforcement. Because no one else is, to my knowledge, addressing these points explicitly, I put forth this preliminary list. I hope that others will chime in with both pros and cons that can be incorporated (with credit) in updates. And I hope that both GEDmatch and Family Tree DNA will consider posting this list, or one of their own devising, on their own websites to ensure that their customers are fully informed about the choice they’re being asked to make.

How will I benefit from opting in to law enforcement matching?

• By participating in law enforcement matching, your DNA data and family tree may help identify and capture a violent criminal, thus preventing further violent crime.*
• By making your data available to initiatives like the DNA Doe Project, your data may help to give closure to the family of an unidentified deceased person (a John or Jane Doe).
• A robust database may act as a deterrent to future criminals.*
• In some cases, the researchers working with law enforcement may be willing to share their genealogy research with you once the investigation is complete.

What are the risks of taking part in law enforcement matching?

• You may learn that you are related to a violent criminal.
• Government agents, or their contractors, may discover family secrets about you or your relatives.
• Your data may be used to arrest someone who will be sentenced to death.*
• Your data and family tree may misidentify an innocent person as a criminal, putting them through unexpected stress and legal expenses.
• You may be named in a search warrant or arrest warrant that becomes public, putting you at risk of public harassment or retaliation.  (See the screenshot below for an example.)
• The Terms of Service at GEDmatch and/or Family Tree DNA may change or be waived to expand investigations beyond violent crimes.
• And finally, while the vast majority of forensic genealogists are ethical and upstanding citizens, some may turn out to be otherwise. After all, the Golden State Killer was a cop.

Updates to This Post

• 23 May 2019: The description of GEDmatch’s attempt to influence the opt-in choice was rephrased to be more neutral, as advised by Ann Turner.
• 24 May 2019: The pros-and-cons list marked with an asterisk (*) were suggested by Maurice Gleeson or edited based on his contributions. His blog can be found here.
• 27 May 2019: Added this screenshot of a search warrant application in the arrest of Jerry Burns from Cedar Rapids, Iowa.
  
• 12 December 2019 – links to Maurice Gleeson’s blog and to the DNA Doe Project were updated or added