Law enforcement agencies around the country have for the past few years eagerly latched onto consumer-facing DNA sites as a rich repository of information to help them close cases. Many of those sites have been allowing users to adopt privacy settings and restricting what data they allow police to access, but a first-of-its-kind search warrant may blow those users' data banks wide open.
Police in Orlando, Florida, obtained a warrant this summer to search DNA site GEDmatch and review data on all of its users—about a million people, The New York Times reports. Privacy advocates are now concerned that police will continue to get broad warrants for DNA sites, including larger peers such as 23andme or Ancestry that have much larger pools of user data.
GEDmatch hit the spotlight in 2018, when DNA data from its site led to the eventual arrest of a man suspected to be the "Golden State Killer," responsible for dozens of rapes and murders in California between 1976 and 1986.
"Although we were not approached by law enforcement or anyone else about this case or about the DNA, it has always been GEDmatch's policy to inform users that the database could be used for other uses, as set forth in the Site Policy," site co-founder Curtis Rogers told Ars at the time. "It is important that GEDmatch participants understand the possible uses of their DNA, including information of relatives that have committed crimes or were victims of crimes," he added, saying that anyone not comfortable with that should delete their data from the site.
In the wake of that attention-grabbing case, GEDmatch changed its policies in May 2018 to make it less easy for police to access their data. Users now have to opt in to having their data made available to police; information they upload is set to private by default. Rogers told the NYT that as of October, less than 15% of current users, 185,000 out of 1.3 million, have opted in to sharing their data with police.
That limitation has frustrated law enforcement, though, and the Orlando detective in July asked a Florida judge to approve a warrant that would let him search the entire GEDmatch database regardless of users' privacy settings, and the judge agreed. The site reportedly complied to the search demand within 24 hours.