Verogen, a California-based forensic genomics company, is investigating how the Gedmatch's DNA databank has been accessed by law enforcement for their investigation.
In 2019, Verogen bought Gedmatch where users upload their DNA profile to trace their family lineage. However, the DNA analysis website was briefly down on Sunday, July 19, while the company probed on a certain security breach.
Davis School of Law from the University of California Elizabeth Joh told TechCrunch that while admitting the issue is a good start, many questions would remain if the solution is "simply correcting the error."
Joh cited whether Gedmatch knows if law enforcement agencies that accessed its data were used to "improperly" tag its users. "Will they disclose any further details of the breach?" she asked.
The professors also noted that having a genetic genealogy privacy breach is not simply Gedmatch's problem as it highlights the lack of regulatory protections over the most sensitive information.
How Gedmatch rose to popularity?
Gedmatch became popular after the police used its users' DNA profile that led to the arrest of the Golden State Killer in 2018.
The website confirmed that law enforcement sifted through its DNA database in resolving the case. However, it faced scrutiny as users called for breach of privacy as they were not advised that their data was used for policy analysis.
Thus, Gedmatch immediately released a privacy warning and provide an opt-in option for their DNA to be included in police searches. However, users claimed that those options are no longer available, so their DNA profiles become available to law enforcement searches.
There's been a major privacy breach at GEDmatch. It appears that all kits, regardless of user preferences, have been opted in to law enforcement matching. I've messaged Verogen on Facebook to alert them to the problem. The site now seems to be down completely. #geneticgenealogy pic.twitter.com/RZhEXEVa7s — Debbie Kennett (@DebbieKennett) July 19, 2020
Verogen Chief Executive Brett Williams said on July 19 that the company is "aware of the issue regarding Gedmatch," particularly about user consents that were improperly set. Williams said they have already fixed the issue, but decided to "taken the site down while we are investigating" the cause of the blunder.
He also declined to confirm whether the issue is due to an error or a security breach but vowed to issue a formal statement once they already discovered the root of the issue.
Police seek DNA database access
In 2010, GEDmatch was launched as an open-source database where users who were tested from private DNA testing companies like AncestryDNA and 23andme could upload the results to find family members. However, according to a Slate report in December, GEDmatch has been used in solving crimes.
This was after Verogen acquired the website on December 9, which raised an alarm among the public over a possible breach of privacy.
However, Williams did not confirm whether GEDmatch or Verogen recently received any request from the law enforcement to access its users' database or whether they have responded to the request.
The police authorities are pushing to access genetic databases as they try to resolve crimes using DNA left at crime scenes, particularly those cold cases that have been unresolved for years.
While Gedmatch does not publish how law enforcement accesses its data, other websites including 23andMe and Ancestry.com have already revealed their respective transparency reports. Utah-based Ancestry.com revealed in February that it declined to adhere to a police warrant issued in Pennsylvania. The warrant implies the continued use by authorities on DNA profiling and analysis sites.
