How private is your DNA on ancestry websites? East Area Rapist case raises questions

SACRAMENTO, Calif. — Millions of Americans are doing it – packing up samples of their saliva and mailing it off to an online genealogy company to analyze their DNA and help trace their family tree.

Without knowing it, they may be helping law enforcement crack difficult cases.

A partial DNA match with an unidentified relative of Joseph James DeAngelo on a genealogy website led to DeAngelo's arrest as the suspect in the notorious East Area Rapist case, the Sacramento County District Attorney's Office said Thursday.

Investigators recently found a "familial DNA match" to a sample collected years ago at a crime scene linked to the East Area Rapist. The family link then led the Sheriff's Department to DeAngelo's home on a quiet middle-class street in Citrus Heights, where they obtained a direct DNA sample from him after following him and picking up an unidentified object he discarded, according to Sheriff Scott Jones.

When that sample came back as a hit for a series of crimes, DeAngelo was arrested.

Sacramento County District Attorney Anne Marie Schubert declined to detail how her office obtained the relative's DNA profile or accessed a genealogy database, raising questions about the privacy of personal genetic information on websites.

"I haven't come across this before," said John Roman, a senior fellow at research organization NORC at the University of Chicago. Roman is a forensics expert and studied the use of DNA in criminal investigation in 2005-09 in Orange County and L.A.

"If that's how the match was obtained, then I would think there would be court battles to come."

[She stalked the Golden State Killer until she died. Some think her work led to the suspect's arrest.]

Colleen Fitzpatrick and Margaret Press, who run a nonprofit organization called the DNA Doe Project, said one of DeAngelo's relatives may have shared DNA results with one of several public DNA matching websites, where people upload genetic data in search of biological parents or other long-lost relatives after obtaining results from a commercial site.

The Sheriff's Department then could have gone to one of those sites, loaded DNA information from East Area Rapist crime scenes and found partial matches.

"It's like working a puzzle," Press said. "It's painstaking."

Typically, genetic database searches by law enforcement are limited to those arrested or convicted of crimes.

California became the first state to authorize such familial line testing in 2008, but it has strict limits. Searches can be requested only when law enforcement has a suspect, and the DNA is only tested against databases containing samples from people arrested or convicted of felonies.

The FBI maintains that system, but each state manages its own DNA database. In California, it's maintained by the California Bureau of Investigation.

The California Attorney General's Office on Thursday said it had run 192 familial searches since 2007 in 108 cases.

California voters expanded whom it collects DNA samples from in a 2004 ballot measure approved by 62 percent of voters. Proposition 69, called the DNA Fingerprint, Unsolved Crime and Innocence Protection Act, allowed law enforcement to collect DNA from any person arrested for a felony or arrested for a misdemeanor but having a felony record.

The person doesn't have to be charged or convicted for the sample to be taken. The law sparked legal challenges and consternation from privacy advocates who feared it went too far – especially since those ultimately not convicted of crimes are not automatically removed.

The California Supreme Court in April upheld the law.

Familial testing has successfully led to arrests in 10 cases in California, including the so-called "Grim Sleeper" in Los Angeles.

In May 2016, the Sleeper, Lonnie Franklin Jr., was convicted of 10 counts of first-degree murder for decades-old crimes in Southern California.

A familial DNA match led to the arrest of Sacramento's "Roaming Rapist," Derek Sanders. He attacked women and two teenage girls between 1998 to 2003.

Investigators eventually homed in on him after getting a partial DNA match with his brother – a convicted rapist with DNA in the system. Sacramento County sheriff's deputies followed him to a fast-food restaurant and collected his garbage to obtain a DNA sample from a straw he had used. That sample matched DNA from the crime scene.

Sanders was sentenced to 396 years to life in 2014.

The California Attorney General's Office said Thursday it had run available DNA in the East Area Rapist cases through familial searches of its databases, but never had a hit.

Mehul Anjaria, a DNA criminology consultant in Los Angeles, said using familial DNA has its limits. "Only the closest of relatives are helpful," he said. "Certainly parents and biological siblings, those are good. Beyond that, it gets trickier and trickier."

But it can also be fruitful. A 10 percent match indicates two people are cousins. A 50 percent match signifies they're either siblings or have a parent-child relationship, Fitzpatrick said.

Anjaria said the use of private genealogy customers' genetic materials could raise privacy and civil liberty problems. Someone mailing a saliva swab probably expects the genetic results will be kept private, he said.

The major genealogy companies say they don't freely share customers' DNA information with law enforcement, but they may comply with subpoenas and court orders to turn over the materials. Others promise to fight for customers' privacy. Those policies are spelled out on the companies' websites.

"It's our policy to resist any law enforcement inquiries with all legal and practical means at our disposal," said Andy Kill, spokesman for 23andMe.com. "We have had a handful of inquiries over the years, and have never given customer information to law enforcement officials."

Ancestry.com, 23andMe and MyHeritage said they had no involvement in the DeAngelo case. The DA's Office hasn't said which companies were connected to the investigation, other than to say there was more than one.