CODIS

Twenty numbers that can move between every participating laboratory in the United States — if the profile was generated at the right sites and the evidence meets the rules for the tier it sits in.

What the system actually is

CODIS — the Combined DNA Index System — is not a single database. It is a three-tier architecture: a local level (LDIS), a state level (SDIS), and a national level (NDIS), with profiles flowing upward only when they meet the criteria for each successive tier. The FBI Laboratory manages NDIS and supplies the software that every participating laboratory uses, but the data at the national level is governed by the DNA Identification Act of 1994 and its subsequent amendments, not by the Bureau's discretion alone.

At the core of the system is a defined set of loci — positions in the genome where short tandem repeats, or STRs, vary enough between individuals to distinguish them. A profile is simply a list of allele values at those sites; what a profile is determines what the database can do. In January 2017, NDIS expanded from 13 core STR loci to 20, aligning American practice more closely with European and international standards and sharply reducing the chance of a coincidental match between unrelated people.

The index structure and its rules

CODIS holds several distinct indexes, and the rules about which may be searched against which are precise. The Convicted Offender Index contains profiles from people convicted of qualifying offences — the specific offences vary by state statute, and all 50 states, the District of Columbia, the federal government and the US Army participate. The Arrestee Index, enabled by the DNA Fingerprint Act of 2005, holds profiles from people arrested for certain offences in jurisdictions that collect at arrest rather than conviction. The Forensic Index holds profiles developed from crime-scene evidence. A separate Staff Elimination Database carries profiles of laboratory personnel, so that a contributor's own DNA can be recognised and excluded — the same principle that governs contamination controls in any accredited laboratory.

A forensic profile can be searched against offender and arrestee profiles; an offender profile cannot be searched against another offender profile for investigative purposes. That asymmetry is deliberate: the system is designed to link evidence to a known individual or to link crime scenes to each other, not to build relationships between people on the database.

CROSS-REF

The National Institute of Standards and Technology ↗ publishes the reference data behind the core loci — allele frequencies, population studies, the technical scaffolding that lets a likelihood ratio mean the same thing in one laboratory as in another. SWGDAM, the Scientific Working Group for DNA Analysis Methods, issues the interpretation guidelines that laboratories must follow to contribute profiles, specifying thresholds, mixture protocols and quality standards. Without that standardisation, a profile generated in Houston could not be meaningfully compared with one generated in Seattle.

What a hit means, and what it does not

A CODIS match — called a "candidate match" or "hit" — is not an identification. It is an investigative lead that must be confirmed by re-examination of the original evidence samples before any action is taken. FBI policy ↗ requires that a candidate match be verified by the laboratory that generated the offender profile before that laboratory discloses identifying information to the agency that submitted the forensic sample. The database returns a profile number; a human being's name is released only after confirmation.

That verification step matters because the database's power is proportional to its scale, and scale introduces risk. Adventitious matches — two profiles that coincide by chance at enough loci to trigger a candidate hit — are vanishingly rare at 20 loci, but not impossible when tens of millions of profiles are searched. The expansion from 13 to 20 loci was partly motivated by exactly this concern.

As of the most recent published figures, NDIS holds well over twenty million offender and arrestee profiles and has produced well over six hundred thousand hits — each representing a connection between evidence and an individual, or between two crime scenes, that investigators would not otherwise have had.

CODIS — the Combined DNA Index System — is not a single database.