Genetic genealogy

When a distant relative posts their DNA to a public database, they make their whole family findable — including people who have never consented to any search.

From crime scene to family tree

A standard forensic database like CODIS works by exact or near-exact match: you look for the person whose profile is already on the register. Investigative genetic genealogy turns that logic inside out. A crime-scene profile is uploaded not to a law-enforcement index but to a consumer genealogy platform — typically one that accepts user-submitted files, such as GEDmatch — where it is compared against hundreds of thousands of voluntarily contributed profiles. The hits it returns are not suspects. They are third and fourth cousins, people who share enough short stretches of DNA with the unknown contributor to suggest a common ancestor several generations back.

What follows is genealogical detective work rather than laboratory science: investigators build family trees outward from those cousins, use public records — census data, obituaries, vital statistics — to map descendants, and then narrow a list of candidates by age, sex and geography until a small number of individuals emerge who could plausibly have been at the scene. A conventional forensic sample then confirms or excludes each one.

The technique's public profile was established by the 2018 identification of Joseph James DeAngelo as the Golden State Killer, a case worked by genetic genealogist Barbara Rae-Venter in collaboration with law enforcement. The result demonstrated that someone who had never submitted a profile to any database, and who had evaded investigation for decades, could nonetheless be identified through the profiles of relatives who had. That is the method's forensic power and its civil-liberties problem stated in the same sentence.

CROSS-REF

Consent, reach and regulation

The consent issue is structural, not incidental. A person who uploads to a genealogy platform agrees to that platform's terms; their relatives have agreed to nothing. Because DNA is heritable, a single contributed profile reaches backwards and sideways through a pedigree in ways the contributor cannot control and the relatives cannot anticipate. Estimates published in research literature suggest that a database containing a few million profiles can, in principle, return a match for a large proportion of the population of a given ancestry group — the coverage is not from direct contributors but from the combinatorial reach of their relatives.

Responses have been uneven. GEDmatch, after the DeAngelo case, changed its default setting so that profiles are opted out of law-enforcement searches unless a user explicitly opts in. Several US states have enacted statutes that restrict or require a judicial process for investigative genetic genealogy searches; others have none. The FBI Laboratory ↗ issued interim guidance in 2019, and the Department of Justice published a formal policy the same year, requiring that the technique be used only for violent crimes and unidentified remains and that conventional investigative means be exhausted first. No comparable statutory framework yet applies at federal level.

In Europe, ENFSI member laboratories and national supervisory bodies have been cautious; the data-protection architecture of the General Data Protection Regulation makes uploading crime-scene profiles to commercial platforms legally complex in most jurisdictions, and few European forces have used the technique operationally. The European Court of Human Rights' existing jurisprudence on DNA retention and privacy — developed in the S. and Marper line of cases — provides a framework that sits uneasily with the scope of genealogy searching.

The underlying science is robust: the detection of shared segments of DNA between distant relatives is well-validated. What remains contested is the governance. Who decides which databases may be searched, under what judicial oversight, for which offences, and with what notification to people who surface as candidates and are then excluded — these are policy questions that the method's speed and power have consistently outrun.