back to top

Cops Forced A Company To Share A Customer’s Identity For The Golden State Killer Investigation

The case raises questions about whether DNA testing companies will hand over more customer information to law enforcement.

Posted on

Prior to getting their big break through a public database used by genealogy enthusiasts to find potential relatives, investigators hunting the Golden State Killer used a subpoena to force a DNA testing company to reveal the identity of one of its customers.

That news will add to a growing debate over the balance between law enforcement and genetic privacy sparked by the dramatic arrest last week of Joseph James DeAngelo, believed to have committed 12 murders and at least 51 rapes in California.

After evading capture for more than four decades, DeAngelo was identified from partial matches between crime scene DNA and profiles uploaded to a public genetic genealogy database called GEDmatch. Customers of DNA testing firms can upload their genetic profiles to GEDmatch and make a wider set of connections than would be possible just by matching with people tested by the same company.

When the arrest was announced, the three leading companies in the DNA genealogy business — 23andMe, Ancestry, and Family Tree DNA — each said they were not involved in the case.

But on Monday, Family Tree DNA told BuzzFeed News that its parent company, Gene by Gene, received a federal subpoena from the Eastern District of California in March 2017 asking for “limited information” about a single customer account.

The company said it didn’t know if the request was related to the search for the Golden State Killer. But Paul Holes, a retired investigator with the Contra Costa County District Attorney’s Office who led the team that snared DeAngelo, confirmed to BuzzFeed News that they sent the subpoena to find out the name of the person tied to a particular profile in Family Tree DNA’s database.

“All we were looking for was the identity and who paid for the test,” Holes told BuzzFeed News.

At that time, Holes and his colleagues were looking for genetic matches between the Golden State Killer and profiles in a public database called Ysearch, run by FamilyTreeDNA. This site holds information about DNA on the Y chromosome, which is inherited from father to son.

From DNA collected from crime scenes, Holes knew 67 genetic markers on the killer’s Y chromosome. Every three months or so, he would check in Ysearch for matches. The subpoena was made when a profile containing just 12 genetic markers — including one that’s unusual among men of Western European ancestry — matched with the killer’s sample.

The subpoena required Family Tree DNA to hand over both the name associated with the profile and the payment information, Holes said, because some people use false names when submitting samples for DNA testing. In this case, the payment had been made by a woman who was researching her own family tree and had tested her father’s DNA as part of that quest.

Her elderly father was in a nursing home in Clackamas County, Oregon. Investigators obtained a warrant to take his DNA, but Holes said the man willingly gave a sample that quickly cleared him when it was tested for the entire 67 markers. “Maybe back in medieval times they shared a common male ancestor,” Holes said.

According to the Associated Press, which reported the false lead last week, the man’s daughter did not know about the incident until after her father had been contacted. Only now has it emerged that Family Tree DNA was legally compelled to reveal the family’s identity.

After clearing the man, Holes told BuzzFeed News that he gave the extended profile to his daughter to help her genealogical research.

Companies that offer DNA testing have sought to reassure their customers that they will not easily give up information to law enforcement. According to its transparency report, as of Dec. 15, 2017, 23andMe had received five requests from government agencies in the US for information on six customers and had complied with none.

But the companies also concede that they may be forced to obey valid subpoenas, court orders, or search warrants for customer information. And Family Tree DNA is not the first company to have complied with such an order.

In 2014, Ancestry received a search warrant ordering the company to reveal the identity behind a DNA profile in the Sorenson Molecular Genealogy Foundation Database, a public database that it had recently acquired.

The profile, for genetic markers on the Y chromosome, belonged to the father of a New Orleans filmmaker called Michael Usry. Police in Idaho Falls had partially matched the DNA to a semen sample from the 1996 murder of Angie Dodge, an 18-year-old who was stabbed in her apartment. Usry became the prime suspect but was cleared by subsequent DNA testing.

“After this case, we made the database private to help protect the privacy of our customers,” an Ancestry spokesperson told BuzzFeed News by email. “This is also the only formal legal request for DNA-related information we have received.”

Holes said his team only issued the one subpoena — to Gene by Gene. In the end, the key to cracking the Golden State Killer case lay in public databases and records.

In January of this year, Holes obtained a backup DNA sample from a 37-year-old murder in Ventura County in Southern California that had been preserved in a freezer. With this larger quantity of DNA, the investigators were able to run it on a “microarray” that simultaneously tests for hundreds of thousands of genetic markers spread across the whole human genome.

The same technology is used by the ancestry testing companies to match their customers to potential relatives, so Holes created a fake identity and uploaded the profile to GEDmatch. The most promising match shared a quantity of DNA suggesting that it was a second cousin of the killer.

Then came the painstaking process of using public records and local newspapers to extend family trees out from the matching profiles to find living people with close relatives connected to the locations where the murders and rapes happened.

“Obituaries are one of the best things out there,” Holes said. “Census records are awesome.”

The best match turned out to be another false lead. Although the family tree Holes and his colleagues constructed led to a potential suspect, he was cleared when a sibling voluntarily gave a DNA sample.

It took a five-person team four months to work from potential third or fourth cousins of the killer to finally identify DeAngelo as the leading suspect — succeeding where four decades of conventional police work had failed.

Once DeAngelo was the prime suspect, officers with the Sacramento County Sheriff's Department picked up objects he discarded that carried his DNA. It was a precise match to the crime scene samples.

“It shows the power of this technology,” Holes said.


Peter Aldhous is a Science Reporter for BuzzFeed News and is based in San Francisco. His secure PGP fingerprint is 225F B2AF 4B8E 6E3D B1EA 7F9A B96E BF7D 9CB2 9B16

Contact Peter Aldhous at peter.aldhous@buzzfeed.com.

Got a confidential tip? Submit it here.