Maryland Moves to Regulate Forensic Genealogy

Update: The bill was passed into law in May 2021

A bill is currently moving through the State of Maryland’s legislature that would regulate how genetic genealogy can be used in criminal investigations.  The bill, which aims to reconcile public safety with constitutional privacy protections, passed the Maryland House unanimously and is being considered by the state’s Senate.  It would be the first law in the US to regulate the use of “forensic genetic genealogical DNA analysis and search”, or FGGS (also called “investigative genetic genealogy”, IGG).

The bill is partially modeled on the Department of Justice interim guidelines released in September 2019.

Here’s my layperson summary, with some thoughts.  (Disclaimer: I am not a lawyer and have no legal training.)

The bill, “Forensic Genetic Genealogical DNA Analysis, Searching, Regulation, and Oversight” has five sections.

 

Section 1 Defines Terms

This section is pretty straightforward.  It defines terms that are used elsewhere in the bill.  It distinguishes between the STR tests that make up the law-enforcement CODIS database and the SNP tests used for genealogy and for FGG.  This is important because SNP tests contain huge amounts of personal biomedical information, whereas the STR markers in the CODIS database were chosen specifically to protect genetic privacy.

FGGS is defined to include the laboratory analysis of a biological sample, the search for matches in a genealogical database, and the genealogical work done to identify the suspect.

 

Section 2 Governs the Use of FGSS to Solve Crimes

Under this bill, FGGS can only be performed with a judge’s approval.  This provision aligns FGGS better with the Fourth Amendment right of Americans “to be secure in their persons … against unreasonable searches”.  After all, law enforcement is just trying to identify perpetrators, but they’re using technology that’s designed to reveal biomedical information.  Judicial oversight is key.  The bill goes further to explicitly forbid the use of the data to determine genetic predispositions for disease, medical conditions, or psychological traits.

The bill limits FGGS to actual or attempted murder, rape, felony sexual offense, or crimes posing a “substantial and ongoing threat to public safety or national security.”  The latter seems to  involve a lot of leeway, making judicial oversight all the more important.  Under this clause, some FGG investigations—a burglary in Texas, an assault in Utah—would not be permissible in Maryland.

Furthermore, before FGGS can be undertaken, investigators must have exhausted reasonable leads, including using the CODIS database on less-invasive STR markers.  The DNA sample itself must also be reasonably believed to be from the perpetrator (or an unidentified murder victim).

Should law enforcement need to collect DNA from a third party—someone other than the perpetrator—they must get informed consent in writing from that person.  Under some circumstances, a judge can approve covert DNA collection (without consent), but only if getting consent would jeopardize the investigation.

The databases used for FGGS must give explicit notice that law enforcement may be investigating cases there, and the service users must acknowledge and consent to that use.  This provision could prove to be a major hurdle, because neither of the two main databases used for FGGS currently get acknowledgment and positive consent.

FamilyTreeDNA, which has been working covertly with law enforcement since at least 2017, opts their customers in to FGGS by default. Most of their customers probably have no idea they’re being matched to criminal cases and have not given consent. This is the default setting there:

Similarly, when a new user uploads their DNA data to GEDmatch, the “opt-in” status is pre-selected, and it doesn’t explain what the user is opting into. This is not acknowledgment and consent.

Genealogists who upload to sites that prohibit forensic investigations, as is widely rumored, would jeopardize their cases and their licenses.

How this bill will affect Doe cases (unidentified bodies) is an open question.  The most recent Terms of Service at GEDmatch do not consider Does to be law-enforcement cases, so someone who has opted-out may still be exposed to murder investigations.  The Maryland bill specifically covers unidentified human remains, so presumably GEDmatch could not be used for these cases under the existing Terms of Service.

The bill also requires that all laboratories and genealogists performing FGGS work for Maryland be licensed by 2023 and 2025, respectively. This will help ensure that the public knows who is doing this work and that they are qualified.  Right now, the vast majority of forensic genetic genealogists are working anonymously.

There are a number of provisions to protect the long-term privacy of the suspect and any third-parties whose DNA is used in the investigation.  Once the case is over, the contractors must turn over all of their findings (including genealogy research), remove the DNA kits from the databases, and destroy their records on the case as well as the DNA samples.  Third-party DNA profiles must also be destroyed.  There are penalties for not complying and for disclosing genetic genealogy information inappropriately.

One odd provision is that a prosecutor may petition to suppress STR data.  How does this serve justice?

Section 3 Governs the Use of FGSS to Show Innocence

Someone who has been charged with or convicted of a violent crime can request an FGGS investigation to aid in their defense.  Once the request is approved, the procedures and restrictions are generally as described above.

 

Section 4 Covers Licensing and Training

Section 4 establishes licensing requirements for laboratories and genealogists conducting FGGS.  Because no such licensing programs exist in the US to date, the bill allows until 1 October 2022 to establish the laboratory licensing program and until 1 October 2024 to establish the genetic genealogy licensing program. Once the programs are established, contractors have one year to apply.  Until then, anyone is allowed to do this work.

Individuals seeking informed consent from third parties must be trained by a genetic counselor.

The licensing and training provisions are the right thing to do, and the extended timeline will ensure that labs and genealogists are not unreasonably impacted.

 

Section 5 Requires Public Reporting

Finally, the bill establishes public reporting requirements on the use of FGGS in the state.  The public will have access to an annual report specifying:

• how many FGGS requests were made and by whom;
• how many FGGS requests were approved;
• the number of suspects identified;
• the number of covert DNA collections;
• an evaluation of leads pursued before FGGS was used;
• the costs involved;
• the race and age of the suspects identified;
• the race and age of the third parties tested;
• the number of FGGS requests made by defense teams;
• and the outcome of each search, including arrests and convictions.

Each year, the report will be reviewed by a panel of experts, who will make policy recommendations.  These experts will include “judges, prosecutors, defense attorneys, public defenders, law enforcement officials, crime laboratory directors, bioethicists, racial justice experts, criminal justice researchers, civil and privacy rights organizations, and organizations representing families impacted by the criminal justice system.”  Having a diverse mix of stakeholders on the panel will go a long way to making sure FGGS is used appropriately and without bias.

 

Summary

Overall, this bill does an excellent job of balancing society’s need for justice with reasonable restrictions that better align FGGS with the Constitution.  It should serve as a role model for the rest of the nation.

 

Update

The bill was signed into law in May 2021.  See this article in The New York Times for more information.