|
Computers, Privacy & the Constitution
|
|
|
Introduction
For over three decades, authorities floundered in their search for the Golden State Killer, a man responsible for at least 13 murders, 50 rapes, and 120 burglaries. Their breakthrough in 2018 was the result of a DNA match—by uploading crime scene DNA to an online genealogy database, investigators were able to link the evidence to the killer’s great-great-great-grandparents and make an arrest. In addition to taking dangerous offenders off the streets and giving victims and their families peace of mind, DNA testing has been used to exonerate more than 200 wrongfully convicted people.
These anecdotes and statistics serve as compelling evidence in support of using online genealogy databases to solve crime. However, law enforcement’s use of commercial DNA databases brings with it a slew of serious privacy and constitutional concerns. The issues raised by this new investigative technology make clear that it is in desperate need of regulation.
History of DNA Collection
In 1987, police in Leicestershire, England became the first law enforcement officials to make an arrest on the basis of DNA evidence. After failing to solve the murders of two girls using traditional investigative methods, law enforcement officers employed the help of a local professor to test the DNA of over 4,000 men in the area, eventually leading to the identification, arrest, and conviction of the murderer.
Though the DNA dragnet in Leicestershire was ultimately successful, it was also a time-consuming and labor-intensive process. The event proved the potential of DNA evidence to revolutionize criminal investigation, but without a centralized collection of DNA samples, DNA evidence would be limited in its use. Congress sought to create such a collection with the DNA identification Act of 1994, which authorized the FBI to create a national database of DNA collected from convicted offenders and crime scenes. Today, the FBI’s Combined DNA Index System (CODIS) contains more than six million DNA profiles.
As the FBI worked on compiling its own database, private companies began developing their own. In 2000, Family Tree DNA became the first company to offer genetic genealogy tests to the public. In the years since, the DNA testing industry has exploded; as of 2019, over 26 million people having submitted their DNA to commercial ancestry and health databases—a number expected to nearly quadruple by this year.
Law enforcement agencies quickly realized that they could expand their DNA comparisons beyond CODIS to include the commercial sector. In the same manner as the average consumer, investigators can send a crime scene DNA sample to commercial databases and receive a list of matches. They can then identify exact matches or narrow their suspect pool based on familial matches.
Privacy Concerns
The unique qualities of DNA and the genetic profiles generated by DNA databases present special privacy concerns. Though frequently compared by law enforcement to fingerprints, DNA profiles contain not only far more information than fingerprints, but also far more sensitive information. While both can serve to identify an individual, DNA profiles can reveal an individual’s medical conditions, physical and mental characteristics, heritage, and relatives.
Most importantly, DNA profiles expose this kind of sensitive data about the individual and their relatives. Thus, unlike with some other types of personal data, an individual who chooses to provide or is required to provide their DNA cannot do so without also providing the data of non-consenting relatives. GEDmatch, the database used by Golden State Killer investigators, has a user base of 0.5% of the U.S. adult population. Studies have suggested that once that number reaches 2%, more than 90% of people of European descent will be traceable using the database. This means that even if an individual and everyone in their immediate family refrains from using these services, they will still be detectable.
In the case of law enforcement officers uploading crime scene DNA evidence to online genealogy databases, the privacy rights of the suspect are inherently implicated. Without the suspect’s consent or knowledge, their entire genetic makeup is made available to a corporation and its customers. If the suspect is ultimately acquitted or never charged with a crime, removing their genetic material and genetic profile from these databases may present a challenge, especially if they never learn they were a suspect in the first place.
Constitutional Concerns
The Fourth Amendment protects citizens from unreasonable searches and seizures and mandates that warrants be supported by probable cause. Courts assess the application of Fourth Amendment protection using a two-part test, which asks (1) whether an individual has exhibited an actual (subjective) expectation of privacy and (2) whether the expectation is one that society is prepared to recognize as reasonable. In Maryland v. King, the Supreme Court held that a Fourth Amendment search occurs when the government collects a
DNA sample from an individual.
However, under the third-party doctrine, an individual forfeits their subjective expectation of privacy when they voluntarily share their data with a third party. Because consumers voluntarily submit their DNA to commercial databases, law enforcement can presumably access their data without a warrant based on probable cause. Law enforcement officials can therefore obtain data without a warrant that would otherwise be subject to Fourth Amendment protections.
In King, the Supreme Court determined that although DNA collection by the government constitutes a search, arrested and convicted individuals have diminished expectations of privacy, rendering collection of their DNA reasonable. Suspects whose DNA is submitted by law enforcement to commercial databases have not been charged with a crime and are therefore presumed innocent. Until they are arrested, these individuals do not have diminished expectations of privacy and under the Fourth Amendment, have a right to be “secure in their persons, houses, papers, and effects.”
Conclusion
Currently, Utah is the only state to propose legislation which would require police to obtain a court order or warrant before accessing private genetic data stored with third
parties. Given the privacy and constitutional interests at stake in law enforcement’s use of commercial DNA databases, individuals’ rights will be at risk so long as this area goes unregulated.
A very good first draft. The best route to improvement on the execution side is to add links to good-quality sources supporting the extensive factual propositions included here. If you found them in the course of preparation for writing the draft, they should be easy to add. Substantively, I think the best route to improvement is to concentrate less on the Fourth Amendment, which simply does not provide relevant protection for the privacy of genetic information held by third parties, given ts limitation to criminal prosecution situations and the absence of need for the direct introduction of genetic evidence once the persons of interest identified by genetic searching have been investigated and other evidence gathered by other means. More attention to the legislative possibilities would therefore be helpful. You are entitled to restrict access to your paper if you want to. But we all derive immense benefit from reading one another's work, and I hope you won't feel the need unless the subject matter is personal and its disclosure would be harmful or undesirable. To restrict access to your paper simply delete the "#" character on the next two lines:
|
|
