The president of FamilyTreeDNA, one of the country’s largest at-home genetic testing companies, has apologised to its users for failing to disclose that it was sharing DNA data with federal investigators working to solve violent crimes.
In the booming business of consumer DNA testing and genealogy, FamilyTreeDNA had marketed itself as a leader of consumer privacy and a fierce protector of user data, refusing, unlike some of its competitors, to sell information to third parties.
But unbeknownst to its users, the Houston-based firm quietly and voluntarily agreed in 2018 to open its database of more than 1 million records to the FBI and examine DNA samples in its laboratory to identify suspects and victims of unsolved rapes and murders.
FamilyTreeDNA confirmed the deal Thursday, in a report by BuzzFeed News, setting off a backlash among its loyal users who felt betrayed and igniting another debate over privacy and ethical issues with investigators using genealogical sites to solve crimes.
In an email to its users Sunday, the company’s president, Bennett Greenspan, defended the agreement with the FBI but apologised for not revealing it sooner.
“I am genuinely sorry for not having handled our communications with you as we should have,” Greenspan wrote, according to a copy of the email obtained by The New York Times. “We’ve received an incredible amount of support from those of you who believe this is an opportunity for honest, law-abiding citizens to help catch bad guys and bring closure to devastated families.”
The news underscored the lack of universal regulations governing direct-to-consumer genetic testing in the United States and how companies can use their data without consumers’ knowledge.
“It’s a good example of, are you willing to stay abreast of every terms of service change with FamilyTreeDNA, or are you doing it once because it was a holiday present?” Erin E. Murphy, a professor at New York University School of Law who wrote the book “Inside the Cell: The Dark Side of Forensic DNA,” said in an interview.
“Even if you were reading all of your spam email about all the privacy changes, did you get one that says you have agreed to be the FBI’s testing lab? No, they did not issue that,” Murphy said.
Alan Butler, senior counsel at the Electronic Privacy Information Center, described the situation as “'bait and switch’ behaviour that consumer protection laws are meant to prohibit.”
“The company needs to either roll back the change or else delete all stored DNA data it has collected from individuals under the previous agreement,” Butler said.
Consumer DNA tests have skyrocketed in popularity in recent years, with major sites like Ancestry.com and 23andMe offering personalized ancestry reports and tools to find possible relatives. They have also become useful tools for law enforcement agencies, helping detectives solve high-profile cases such as the Golden State Killer last year.
While investigators have used open-source sites such as GEDmatch, which is free, to find DNA matches and possible relatives, the arrangement with FamilyTreeDNA includes the first known commercial site to provide some services without a subpoena or warrant.
According to FamilyTreeDNA, the FBI will have access to its website like any other user: After uploading a person’s DNA file, investigators can search for potential relatives with overlapping DNA. Detectives will have access to the same repository of genealogical records as all users, the company said.
In addition, the company’s genetic testing laboratory, Gene by Gene, has agreed to create data profiles from DNA samples provided by the FBI, which can then be plugged into other family history sites. The company said on its website that the FBI would need a subpoena to gain access to information not already available on its website.
The company has not disclosed how many cases it has worked on, but Greenspan said in the email to users that it was “a handful of DNA samples for cold cases from the FBI” A company spokeswoman did not respond to a list of questions sent Monday.
Greenspan defended the deal by saying his company was forcing law enforcement agencies to be transparent, unlike other DNA testing companies.
“Law enforcement has the ability to test DNA samples from crime scenes and upload the results into databases, like any other customer can, and it appears they have been doing it at other companies for the past year,” he said. “The distinction is that, according to our Terms of Service and Privacy Policy, we expect the FBI and law enforcement agencies to let us know when they submit something to our database.”
The FBI declined to comment.
After BuzzFeed reported on the arrangement, genealogists revolted. Some discussed creating a petition to encourage FamilyTreeDNA to reverse its decision, while others threatened to delete their profiles.
“Not being upfront about what it wanted to do and quietly changing its terms with no notice to current customers is a big ‘no no,'” Rachel King, founder of Toll Genealogy, a resource for genealogists, said in an email. “At the end of the day, this is valuable work. Anything that helps put a name to unidentified body, potentially enabling their loved ones to finally know what happened to them, is a good thing.”
More than 15 million people have submitted their DNA to companies like FamilyTreeDNA in recent years. While they represent a small fraction of all people, the pool of profiles is large enough to allow 60 per cent of white Americans — the primary users of DNA sites in the United States — to be identified through the databases, according to researchers.
As the number of tests expands in the coming years, researchers believe that 90 percent of Americans of European descent will be identifiable, even if they did not submit their own DNA, according to researchers.
“It’s about their third cousin that they don’t know exists or their child that they haven’t had yet,” Murphy said. “We shouldn’t be having this conversation about just the users on the site. It’s more than their privacy that is at stake.”
