One of the most notorious serial killers in US history has been sentenced to life in prison. Former police officer Joseph James DeAngelo, known as the Golden State Killer, committed at least 13 murders and more than 50 rapes in the state of California between 1973 and 1986.

In June, DeAngelo pled guilty to 13 murders, and after a four-day sentencing hearing, in which the Sacramento courthouse heard numerous testimonies from survivors, DeAngelo was sentenced to life in prision without parole on Friday, avoiding the death penalty.

But behind the identification and sentencing of the Golden State Killer was a pioneering yet somewhat controversial DNA tracing method known as genetic genealogy.

How genetic genealogy was used in the Golden State Killer case

In 2018, DeAngelo was identified as the Golden State Killer thanks to GEDmatch, a DNA database that allows users to upload DNA data files which can be used to identify possible relatives for “comparison and research services”.

As well as hobbyists constructing their family trees or adoptees searching for their birth parents, the database has been used by law enforcement in investigating several cold cases, as well as the identification of unidentified bodies, gaining public attention in 2018 for its role in previously unsolved Golden State Killer case.

First, investigators working on the Golden State Killer case uploaded a DNA sample from a crime scene to GEDMatch. They were then able to link this to identify distant relatives, which helped them create a family tree for the killer and, once corroborated with eye-witness statements and other evidence, led to the eventual identification of DeAngelo as a suspect.

From this, investigators were able to obtain a sample of the suspect’s DNA from a piece of rubbish, which was found to be a match to the DNA found at crime scenes, leading to his arrest.

A controversial method

Although the use of DNA databases undeniably has its merits, leading in some cases to the prosecution of those guilty of heinous crimes, it also raises questions about ethics and privacy.

As of February 2019, roughly 26 million people have taken an at-home ancestry test, according to Technology Review. This means that a sizeable proportion of the population has uploaded a DNA sample to a commercial DNA database such as 23andMe or

According to Science Mag, roughly 60% of white Americans have a relative’s DNA on the GEDMatch database, meaning that many people who have never uploaded DNA data can be linked to DNA samples from a third cousin or closer.

In the past, law enforcement has been able to upload fake profiles including a DNA sample from a suspect, without first disclosing that it is part of a criminal investigation.

This is arguably a valuable resource for law enforcement, but issues arise when the privacy of those who have uploaded a DNA sample, and even those that have not, comes into question. GEDMatch is thought to have helped US law enforcement in over 70 violent crime cases according to Buzzfeed, but privacy advocates have expressed concerns over users being unwittingly drawn into criminal investigations, with law enforcement permitted to access their DNA data without their consent.

Last year, Buzzfeed reported that genetic testing company Family Tree DNA had granted the FBI permission to search its database in violent crime cases, the first time a private database has been used in this way (GEDMatch is a public database).

This has concerned experts who believe it could set a precedent for the use of  genealogy databases in investigations, risking users’ anonymity.

Privacy concerns

In the past, 23andMe has said that it “has never turned over any customer data to law enforcement or any other government agency” and “chooses to use all practical legal and administrative resources to resist requests from law enforcement”, with having a similar stance. However, in its guide for law enforcement, the company says that “in certain circumstances, however, 23andMe may be required by law to comply with a valid court order, subpoena, or search warrant for genetic or personal information”.

Since the Golden State Killer investigation in 2018, some of the regulations surrounding this have changed. In May 2019, GEDMatch, which was acquired by forensic genomics company Verogen that year, changed its privacy rules, requiring users to “opt in” to their data being accessed by law enforcement, limiting the number of profiles available to law enforcement in investigations. The US Department of Justice has also released guidelines that forensic genaeology should only be used in the investigation of violent crimes or in the identification of human remains.

However, in November 2019, law enforcement in Florida was granted a warrant to search GEDMatch’s database, including users who had not opted in.

Commenting on the Florida warrant in 2019, Brian Higgins, security specialist, said it is unlikely that a similar thing could happen in the UK.

“It might be reassuring for those using similar services in the UK to know that it would be highly unlikely that similar access would be granted here. Law Enforcement must make a very strong case for the granting of warrants by the UK judiciary,” said Higgins.

“In cases such as these they must be able to justify necessity, proportionality and also satisfy the Court that they have sufficient processes in place to manage and mitigate any collateral intrusion their investigations may cause. This means that, rather than gaining access to an entire database and being allowed to data-mine its contents at will, it is more likely that UK officers would have to identify the specific information they required and rely upon the host to provide it.”

However, when it comes to the US, many have called for greater legal clarity on the issue of forensic genealogy. This issue will likely become more pressing if the role of forensic genealogy in criminal investigations becomes more prominent and DNA analysis techniques become more sophisticated.

Although in the case of the Golden State Killer investigation it is clear that this technique has its benefits for law enforcement, any advancements must be closely monitored if privacy is to be upheld.

Read more: Automatic facial recognition by South Wales Police ruled unlawful in Court of Appeal.