US court let police search GEDmatch's entire DNA database despite protections

[Elderberry]

engadget by Mariella Moon 11/6/2019

DNA policy experts believe it could encourage law enforcement agencies to request warrants for larger DNA databases.



Michael Fields, a detective from the Orlando Police Department, has revealed at a police convention that he secured a warrant to search the full GEDmatch database with over a million users. Legal experts told The New York Times that this appears to be the first time a judge has approved this kind of warrant. New York University law professor Erin Murphy even told the publication that the warrant is a "huge game-changer," seeing as GEDmatch restricted cops' access to its database last year. "It's a signal that no genetic information can be safe," the professor said.

GEDmatch came under the spotlight in 2018 after it was revealed that California police used its database to identify the Golden State Killer, who killed a dozen people in the '70s and '80s and was accused of over 50 rapes, through his relatives. It also came to light that cops have been using it to solve other cases, including decades-old cold ones. As a response to the backlash it got, GEDmatch changed its policy so that law enforcement can only use it to look for suspects in "murder, nonnegligent manslaughter, aggravated rape, robbery or aggravated assault" cases.

More importantly, its new policy only allows authorities to search for GEDmatch users who make their information available to the police. Users literally have to opt in -- their profiles are set to opt out by default. Company co-founder Curtis Rogers said only 185,000 users chose to opt in, but Fields' warrant allowed him to access all 1.3 million users' information. The detective said the service complied with the warrant within 24 hours, and while he hasn't made an arrest yet, he has already found some leads.

More: https://www.engadget.com/2019/11/06/gedmatch-search-warrant/

[Elderberry]

Cruwys news

https://cruwys.blogspot.com/2019/11/search-warrant-granted-for-access-to.html

It is difficult to comment on this case without having the full facts available. As this is an active investigation it is not possible to get a copy of the search warrant to find out why the police thought it necessary to over-ride the consents and we don't know the grounds on which the judge granted the warrant. GEDmatch could potentially have resisted the warrant but they are unlikely to have the resources to fight a lengthy legal battle. They are also likely to be sworn to confidentiality so they would not be able to discuss the case and would not have been in a position to warn their users. But if GEDmatch were sworn to confidentiality I wonder why Detective Fields was boasting about his actions at a police conference.

However, the use of a search warrant in this case does provide cause for concern as it potentially sets a precedent. What is to stop the police issuing search warrants to search for matches at the other testing companies? Would these companies be able to defy the warrant and refuse access? It is also troubling from an international perspective. An American judge has made a unilateral decision which affects the privacy and rights of all of GEDmatch's many international users who do not have any legal or governmental representation in the US. Granting access to the opted out profiles of international customers is not only a disproportionate measure, as their family trees are much less likely to be used to solve the crime, but it is also a gross over-reach by the judge who has passed a judgement which affects individuals who live in countries which are outside her jurisdiction.

If you think you might have been affected I suggest that you write to the Orlando Police Department to find out if your name is included in the match lists they are using. If you are an EU citizen you should be protected by the General Data Protection Regulation (GDPR) and you will have the right to have your information removed. If the police refuse to do so you should complain to your data protection regulator in the EU. If you are in the UK you should write to the Information Commissioner's Office. If you are in Ireland you should write to the Data Protection Commission. The ICO have a handy template on their website which you can use if you wish to submit a complaint. I have now written to the Orlando Police Department and I await their response with interest.

If you feel strongly about this judgement you might also like to write to Judge Patricia Strowbridge. She can be contacted via her judicial assistant. I have sent her an e-mail because I think it's important that she understands the international implications of her decision though I am not expecting a response.

Update 7th  November 2019
I have received the following response from Judge Strowbridge's office:

"Judge Strowbridge’s office is in receipt of the email you sent yesterday, November 6, 2019. Unfortunately, the Florida Code of Judicial Conduct strictly prohibits judges from commenting on any pending cases. As such, Judge Strowbridge is unable to respond to your email."

More at link.

[Cyber Liberty]

Isn't GEDmatch one of those "free" databases?

[Elderberry]

Isn't GEDmatch one of those "free" databases?

https://www.gedmatch.com/login1.php

GEDmatch provides applications for comparing your DNA test results with other people.

There are also applications for estimating your ancestry.

Some applications are free.

More advanced applications require membership in the GEDmatch Tier1 program at $10 per month.

[Cyber Liberty]

https://www.gedmatch.com/login1.php

I guess not....