Last week, EFF, along with the ACLU and the ACLU of Iowa, filed an amicus brief in the Iowa Supreme Court challenging the surreptitious collection of DNA without a warrant. We argued this practice violates the Fourth Amendment and Article I, Section 8 of the Iowa state constitution. This is the first case to reach a state supreme court involving such a challenge after results of a genetic genealogy database search linked the defendant to a crime.
The case, State v. Burns, involves charges from a murder that occurred in 1979. The police had no leads in the case for years, even after modern technology allowed them to extract DNA from blood left at the crime scene and test it against DNA collected in government-run arrestee and offender DNA databases like CODIS.
In 2018, the police began working with a company called Parabon Nanolabs, which used the forensic DNA profile to predict the physical appearance of the alleged perpetrator and to generate an image that the Cedar Rapids Police Department released to the public. That image did not produce any new leads, so the police worked with Parabon to upload the DNA profile to a consumer genetic genealogy database called GEDMatch, which we’ve written about in the past. Through GEDMatch, the police linked the crime scene DNA to three brothers, including the defendant in this case, Jerry Burns. Police then surveilled Mr. Burns until they could collect something containing his DNA. The police found a straw he used and left behind at a restaurant, extracted a profile from DNA left on the straw, matched it to DNA found at the crime scene, and arrested Mr. Burns.
The State claims that the Fourth Amendment doesn’t apply in this context because Mr. Burns abandoned his privacy interest in his DNA when he left it behind on the straw. However, we argue the Fourth Amendment creates a high bar against collecting DNA from free people, even if it’s found on items the person has voluntarily discarded. In 1978, the Supreme Court ruled that the Fourth Amendment does not protect the contents of people’s trash left for pickup because they have “abandoned” an expectation of privacy in the trash. But unlike a gum wrapper or a cigarette butt or the straw in this case, our DNA contains so much private information that the data contained in a DNA sample can never be “abandoned.” Even if police don’t need a warrant to rummage through your trash (and many states disagree on this point), Police should need a warrant to rummage through your DNA.
A DNA sample—whether taken directly from a person or extracted from items that person leaves behind—contains a person’s entire genetic makeup. It can reveal intensely sensitive information about us, including our propensities for certain medical conditions, our ancestry, and our biological familial relationships. Some researchers have also claimed that human behaviors such as aggression and addiction can be explained, at least in part, by genetics. And private companies have claimed they can use our DNA for everything from identifying our eye, hair, and skin colors and the shapes of our faces; to determining whether we are lactose intolerant, prefer sweet or salty foods, and can sleep deeply; to discovering the likely migration patterns of our ancestors and the identities of family members we never even knew we had.
Despite the uniquely revealing nature of DNA, we cannot avoid leaving behind the whole of our genetic code wherever we go. Humans are constantly shedding genetic material; In less time than it takes to order a coffee, most humans lose nearly enough skin cells to cover an entire football field. The only way to avoid depositing our DNA on nearly every item we touch out in the world would be to never leave one’s home. For these reasons, as we argue in our brief, we can never abandon a privacy interest in our DNA.
The Burns case also raises thorny Fourth Amendment issues related to law enforcement use of consumer genetic genealogy databases. We’ve written about these issues before, and, unfortunately, the process of searching genetic genealogy databases in criminal investigations has become quite common. Estimates are that genetic genealogy sites were used in around 200 cases just in 2018 alone. This is because more than 26 million people have uploaded their genetic data to sites like GEDmatch to try to identify biological relatives, build a family tree, and learn about their health. These sites are available to anyone and are relatively easy to use. And many sites, including GEDMatch, lack any technical restrictions that would keep the police out. As a result, law enforcement officers have been capitalizing on all this freely available data in criminal investigations across the country. And in none of the cases we’ve reviewed, including Burns, have officers ever sought a warrant or any legal process at all before searching the private database.
Police access to this data creates immeasurable threats to our privacy. It also puts us at much greater risk of being accused of crimes we didn’t commit. For example, in 2015, a similar forensic genetic genealogy search led police to suspect an innocent man. Even without genetic genealogy searches, DNA matches may lead officers to suspect—and jail—the wrong person, as happened in a California case in 2012. That can happen because our DNA may be transferred from one location to another, possibly ending up at the scene of a crime, even if we were never there.
Even if you yourself never upload your genetic data to a genetic genealogy website, your privacy could be impacted by a distant family member’s choice to do so. Although GEDmatch’s 1.3 million users only encompass about 0.5% of the U.S. adult population, research shows that their data alone could be used to identify 60% of white Americans. And once GEDmatch’s users encompass just 2% of the U.S. population, 90% of white Americans will be identifiable. Other research has shown that adversaries may be able to compromise these databases to put many users at risk of having their genotypes revealed, either at key positions or at many sites genome-wide.
This is why this case and others like it are so important—and why we need strong rules against police access to genetic genealogy databases. Our DNA can reveal so much about us that our genetic privacy must be protected at all costs.
We hope the Iowa Supreme Court and other courts addressing this issue will recognize that the Fourth Amendment protects us from surreptitious collection and searches of our DNA.
