Gedmatch, the DNA analysis site the police used to catch the so-called Golden State Killer, was briefly taken offline on Sunday, while its parent company investigated how its DNA profile data users were apparently available for law enforcement searches.
The site, which allows users to upload their DNA profile data to trace their family tree and ancestors, became famous overnight in 2018 after law enforcement used the site to match DNA. a serial murder suspect with over a million site DNA profiles in the site's database without telling the company.
Gedmatch has issued a privacy warning to its users and has implemented new controls to allow users to choose their DNA to be included in police searches.
But users reported on Sunday that these parameters had changed without their permission and that their DNA profiles had been made available to search authorities.
There has been a major privacy breach at GEDmatch . It seems that all kits, regardless of user preferences, have been activated for law enforcement pairing. I sent a message to Verogen on Facebook to alert them of the problem. The site now appears to be completely down. #geneticgenealogy pic.twitter.com/RZhEXEVa7s
- Debbie Kennett (@DebbieKennett) July 19, 2020
Users have called it a "privacy breach". But once reached, the business owner refused to say whether the problem was due to an error or a security breach, citing an ongoing investigation.
"We are aware of the problem with Gedmatch, where user permissions have not been set correctly," said Brett Williams, managing director of Verogen, which acquired Gedmatch in 2019. "We have fixed this problem; however, as a precaution, we have deleted the site while we are investigating the actual cause of the error. Once we understand the cause, we will issue a more formal statement, "he said.
DNA profiling and analysis companies are becoming increasingly popular with users who are trying to understand their cultural and ethnic origins by discovering new and ancestral family members. But law enforcement is pushing more and more to access DNA databases to try to solve crimes from DNA left at crime scenes.
Williams would not say, when asked, if Verogen or Gedmatch have received law enforcement requests for user data in the past day, or if either company has responded .
Gedmatch does not publish the frequency with which law enforcement seeks to access corporate data. Its competitors, like 23andMe and Ancestry.com, have already released these so-called transparency reports. Earlier this year, Ancestry.com revealed that it had rejected an out-of-state police warrant, saying the police continue to use DNA profiling and analysis sites for information.
"Recognizing a problem is a start, but if" solving "simply means correcting the error, there are still many questions," said Elizabeth Joh, professor of law at the University of California, Davis School of Law , at TipsClear.
"For example, does Gedmatch know if law enforcement has accessed these mislabeled users? Will they disclose other details of the violation? And of course, this is not just Gedmatch's problem: a breach of privacy in a genetic genealogy database highlights unfortunately unfortunately inadequate regulatory protections for the most sensitive information, in a new arena for civil liberties "She said. "It's a mess."
