A family friend has leukemia. He’s 11. Without chemotherapy, he would have died. Thanks to modern biomedical research, though, he’s through the worst of the treatment, back in school, and doing well. He’s even participating in a drug study to improve the odds for patients who come after him.
There is no reason to think the experimental treatment will harm him; the doctors wouldn’t try it if they thought it might. Even so, there would be outrage if he had been enrolled in the research study without the knowledge and consent of his parents. Even though there is a greater good at stake. Even though it could improve treatments. Even though it could save lives.
That’s because informed consent is key.
Why should police investigations be any different? They shouldn’t, and yet, somehow, they are. Perhaps it’s because biomedical researchers ask for permission while the cops just barge on in. And for reasons beyond my ken, some of the very people we’ve entrusted to guard our most personal genetic data are happy to comply.
- In late 2017 or early 2018, the FBI uploaded the Golden State Killer’s DNA profile to GEDmatch without telling the site’s owners. The members of that database hadn’t given consent for their personal data to be searched by government agents; they’d never been asked. Rather than protecting their members from this intrusion, GEDmatch quickly changed their Terms of Service to allow murder and rape investigations and neglected to hide the DNA profiles of those who had not accepted the new Terms of Service.
- In January 2019, we learned that the FBI had been granted access to the autosomal database at FamilyTreeDNA, again without the knowledge or consent of FTDNA’s customers. That company, too, changed their Terms of Service (twice!) to prioritize law enforcement’s needs: their default setting is to expose their customers to criminal investigations, whether the person agrees or even knows what’s happening.
And now we have the first evidence that GEDmatch broke their own Terms of Service-a contract between themselves and their users-simply because the cops asked nicely. Deseret News reported yesterday on an assault (not murder or rape) case that was solved using GEDmatch, with GEDmatch’s permission.
Here’s their damage control:
The thing is, GEDmatch doesn’t have the right to give permission on behalf of their users. They don’t have the right to unilaterally ignore their own Terms of Service because one guy thinks it’s a good idea at the time. They have an obligation to put their users first, and they have utterly and completely betrayed that trust.
Parabon is at fault here, too. Their lead genealogist is keenly aware of the debates surrounding informed consent, and Parabon knew that GEDmatch could not ethically give permission on behalf of a million people who were completely unaware of what was happening. Yet, they went ahead anyway.
What’s next? Will GEDmatch and FTDNA open their databases for other violent crimes? Crimes that are classified as violent even if no one gets hurt? Why stop there? It’s in the interests of society to stop petty crime, too, is it not?
Coming Full Circle
Let’s go back to medical research. According to the Centers for Disease Control and Prevention, 647,457 people died of heart disease and 599,108 of cancer in 2017. And that’s just the top two causes of death that could be cured with new treatments. By contrast, the FBI reports that 17,284 people were murdered or died from non-negligent homicide that year, while 135,755 were raped.
Couldn’t we make a “compelling argument” that GEDmatch and FamilyTreeDNA should open their databases to Big Pharma—consent be damned—for the greater good? After all, curing heart disease alone would save nearly 40 times more lives per year than preventing all murders.
Of course not!
We wouldn’t, and shouldn’t, argue that our data be handed over for biomedical research without our consent, no matter how much good could come of it. Any database that did that would be pilloried. Heck, some of the companies have been pilloried even when they don’t betray our trust that way.
Why, then, does GEDmatch, and FTDNA before them, think it’s okay to give law enforcement access to our data? Not just law enforcement, but private, for-profit companies hired by law enforcement. It’s not okay. It’s wrong. And GEDmatch has shown us that their contract with their users is meaningless. They should change their Terms of Service to read “Anything goes. You’re on your own.”
Additional Reading
Aldous, Peter. “The Arrest Of A Teen On An Assault Charge Has Sparked New Privacy Fears About DNA Sleuthing.” Buzzfeed, 14 May 2019.
Reavy, Pat. “Plastic milk container, genealogy helped Utah police crack church assault case.” Deseret News, 13 May 2019.
Russell, Judy G. “Withdrawing a recommendation.” The Legal Genealogist, 15 May 2019.
This is deeply disturbing. Could there be a Lysistrata by genealogists?
Agree.
There has to be a line. And it has to be sustained.
For a start, GEDMatch is now going to be deluged in applications for worthy cases.
Taking their efforts away from their core task.
If Law Enforcement would like a database containing willing donors of DNA, then they should set one up.
Leah, you have been against this from the start. I have been happy with a sustained line.
Where it used to be. But this is way beyond.
I don’t think the Constitution would allow law enforcement to set up a database like this. The courts have limited them to CODIS markers because they don’t convey trait information, whereas our microarrays contain scads of personal genetic data like appearance, disease susceptibility, etc. They’re doing an end run around the courts by using GEDmatch and FTDNA instead.
I understand and agree with your point. But the question really is “What can we do about it?” I have already changed the status of the kits I manage to “Research” – hoping that this action will remove them from this very problem. Am I angry enough to actually remove these kits from Genesis? Probably not – as that, I feel, would be a bit like cutting off my own nose because the site performs an important part of my genetic genealogy research.
I certainly won’t be recommending them to the DNA group I convene for our local Family History Society without first providing our members with a full understanding that the Terms have been and may in the future be changed and that the site is becoming less and less trustworthy.
I am disappointed with Genesis and FTDNA and really hope that the DNA community’s outrage encourages them to act in the best interests of their customers.
I made all of my kits at GEDmatch “research” last year, removed my kits from matching at FTDNA after their ToS debacle, and finally and deleted all of my autosomal results entirely from FTDNA when they created the opt-out LE database. I’ll probably end up deleting my kits from GEDmatch, too, but I’m giving them time to make amends.
Leah, as you make a living using these DNA tools, I value your opinions, and am curious if you plan to stay in GEDmatch after their May 17/18 change in the TOS going to OPT-OUT of LE matching by default. Will you stay in GEDmatch, and if so, just as research kits? (it’s none of my business about opting in or out of LE!).
I also have a question regarding your statement on deleting all your autosomal results from FTDNA – can you do that and yet leave any yDNA and mtDNA results in? The latter two aren’t being used by LE (at least not yet), correct? So far neither of those tests have proven to be particularly useful in my genealogy research, but I hate to delete them, given how expensive they were. I’d like to follow your lead on the autosomal results, though.
I set all of my GEDmatch kits to “research” when the Golden State Killer story broke. Now that GEDmatch has adopted a true, opt-in, informed consent model, I have made my own merged kit public *and* opted it in to law enforcement use. (The issue was always about consent.) I will have conversations with my relatives and let them decide what they want to do with their own kits.
At FTDNA, I privatized all of my kits after GSK and ultimately deleted the autosomal results when they implemented the automatic opt-in policy. I kept the mtDNA and yDNA results, although they’re all opted out of matching, and the physical swab samples, for now. I also withdrew from their affiliate program. This wasn’t the first privacy breach I’ve experienced at FTDNA, and I no longer trust them. I’m sorry to have to say that.
Receiving treatment as part of a research study is not at all the same as having genetic data used by law enforcement. An experimental treatment could have deleterious effects, even if the researchers sincerely believe it will not. I suspect the leukemia patient’s parents had to sign an agreement acknowledging that possibility. Medical data are used in research all the time without the consent of the person to whom the data supposedly belong. Usually it is anonymized, but studies have shown that there is sometimes the possibility of reversing the anonymization. We aren’t even notified when our medical data are used in such studies, much less asked for consent.
23andMe does biomedical research with the data of some of their customers, with no physical risk those testers. Even so, they only use the data with the explicit, informed consent of each person individually. It’s an ethical imperative.
Well said. Thank you for speaking out on this.
Just wanted to give kudos to you and Judy Russell for “influencing” Gedmatch to finally do the right thing. The stance taken by some so-called leaders in this field has been appalling and wholly disingenuous. We civil liberty-loving zealots who actually expect the hard-fought-for Bill of Rights to mean something and be adhered to, salute you.
Thank you!
Thank you for the support! I don’t understand why “informed consent” is such a divisive issue, but it has been. I hope that FTDNA follows suit rapidly with an explicit opt-in (rather than their current system of automatically exposing their customers to law enforcement) and that the community can move to heal this rift.
We have submitted our DNA samples in good faith, trusting that our data will not be compromised. The FBI doesn’t have the right to confiscate information without that person’s informed consent.
Informed consent is essential.