Golden State Killer suspect's capture sparks DNA site privacy fears

To crack the decadeslong cold case of the elusive Golden State Killer, investigators in California used police work straight out of the 21st century — the convergence of DNA testing and an online genealogy database — to track down their suspect.

But the arrest of Joseph James DeAngelo raises potential legal and privacy concerns for the millions of people who submit their DNA to learn about their heritage or family health history — not to be dragged into a police investigation.DNA databases are relatively new, but nobody thinks they'll ever be used in this manner," said Joel Winston, a consumer protection lawyer and a former deputy attorney general for the state of New Jersey.

"But these companies have privacy policies that are actual binding legal contracts," he added. "The problem is nobody reads them."

The debate came as a wheelchair-bound DeAngelo made his first appearance Friday before a judge in the Sacramento County Jail, where the charges were formally read out against him and he was given a May 14 return court date. Dressed in an orange prison uniform and squinting at the judge, he was in and out of the room in less than five minutes.

The idea of people relinquishing control of their DNA — and ultimately giving up their privacy to genetic testing companies and third parties without fully realizing it — worries some observers.

DeAngelo, 72, was arrested after investigators matched crime scene DNA with genetic material stored by a distant relative on an online site. From there, they narrowed it down to DeAngelo using DNA obtained from material he'd discarded outside his home in Citrus Heights, a Sacramento suburb, Sacramento County District Attorney Anne Marie Schubert said Thursday.

DeAngelo has been charged with at least eight killings, but is a suspect in 12 murders, 45 rapes and 120 burglaries throughout California in the 1970s and '80s.

The site used to find him is called GEDmatch.com, a free open-source website that allows people to upload their genetic information retrieved from genetic testing companies, mainly to find other relatives or for research.

GEDmatch said in a statement that law enforcement never approached it about the case in California.

"It has always been GEDmatch's policy to inform users that the database could be used for other uses, as set forth in the site policy," the website said, adding that participants' information could help in the "identification of relatives that have committed crimes or were victims of crimes."

Paul Holes, a recently retired cold-case detective with the Contra Costa County Sheriff's Office, described the process of narrowing down suspects using DNA."When you find somebody that has DNA that they might share with our offender ... then you find somebody else. And if you see that they share a little more DNA, you've stepped a bit closer to who the offender is," Holes told NBC News. "And so you end up marching down that path until, ultimately, you get within a reasonably small suspect pool."The pool in this case included DeAngelo, who was the right age and lived in the area where many of the crimes took place, officials said. Investigators kept tabs on him for six days, collecting actual DNA on items he had thrown out, before arresting him Tuesday night at his home.

And DNA potentially may have played an earlier role in the case: by stopping the crime spree. Genetic testing was just coming into use as a criminal investigative tool in 1986 when the Golden State Killer apparently ended his decadelong wave of attacks.

DeAngelo, who was a police officer for two departments in the 1970s, most likely would have known about the new method, experts said.

After Sacramento County prosecutors confirmed Thursday that they found DeAngelo through genealogical websites, Ancestry.com and 23andMe issued statements denying that they had played any role.

Still, privacy laws aren't strong enough to stop other police departments from prying, said Steve Mercer, the chief attorney for the forensic division of the Maryland Office of the Public Defender.

"People who submit DNA for ancestors' testing are unwittingly becoming genetic informants on their innocent family," said Mercer, adding that they "have fewer privacy protections than convicted offenders whose DNA is contained in regulated data banks."

Sheldon Krimsky, a Tufts University professor who studies ethics in science and medicine, said almost half of the firms that provide ancestry information will sell customers' genetic information to some other company. Those might include pharmaceutical or drug developers that want it for research.

Earlier this year, Krimsky said in an interview with Tufts Now, a news site affiliated with Tufts University, that only 10 percent of the ancestry companies will destroy a person's original sample.

"The vast majority hold onto your sample or sell it. So it's not just the data, but your actual saliva, that's being shopped around," he added

With so much at stake, Sen. Chuck Schumer, D-N.Y., last November called for more scrutiny into DNA testing kits — saying unknowing customers may be putting their genetic information at risk of being sold.

In response, companies such as Ancestry, which has had more than five million users register for its product, said they do not sell data to third parties or researchers without a customer's consent.

While the Golden State Killer case raises a host of ethical questions, including whether the relatives of DeAngelo were told how their DNA was being used, Winston, the consumer protection lawyer, said the DNA testing kit industry, which had a boom in sales in 2017, is showing no signs of slowing.

It's up to consumers, he said, to be informed.

"Privacy is the thing that everybody cares about," Winston added, "but it's not stopping anyone from using these services."