As critics warn of genetic 'surveillance', RCMP explores use of DNA matching in criminal probes

For years, he was only known as Septic Tank Sam — a macabre nickname the RCMP pinned on a disfigured body pulled from a septic tank in rural Alberta in the late 1970s.

But this past summer saw a breakthrough: Septic Tank Sam got his name back.

Through a Texas-based DNA lab that uses genetic genealogy, the RCMP in Alberta was able to identify the deceased as Gordie Sanderson, who had been reported missing decades earlier.

Using DNA extracted from his bones, Othram Inc. was able to build a genetic profile by uploading his information to public genetic databases.

While Sanderson's homicide remains an open file, it now has a name, a history and new sense of urgency.

"He deserved to have his name restored," said Othram CEO David Mittelman.

"Techniques like this give us the opportunity to help basically piece families back together and let them heal, whether it's to return a loved one that was missing, or to seek justice for a loved one that was harmed."

While law enforcement's use of genetic genealogy has been credited with advancing and solving cold cases, it's also raising ethical questions about how police are taking advantage of the at-home DNA testing trend.

"There have been some pretty big wins with this technology, but the downsides are pretty big as well," said Brenda McPhail, director of the Canadian Civil Liberties Association's privacy, surveillance and technology program.

"Our genetic information is quite literally the most personal, intimate information that there is about us, which means that it's deserving of the highest level of protection that we can provide it."

Investigative genetic genealogy — famous for its role in catching the Golden State Killer — involves scouring private genealogical companies' databases for matches to identify a familial relationship or a likely suspect.

It piggybacks off the rise of private sector genealogical companies, used by people to explore their family heritage or determine their odds of contracting hereditary diseases.

RCMP assessing 'viability and legalities' of technique

The RCMP says it's reviewing the legitimacy of using genetic genealogy in investigations — even as it continues to use the technique in the meantime.

Apart from employing the services of Othram Inc., the RCMP also signed a $98,000 contract with U.S..-based Parabon NanoLabs in early 2018 — something first reported by the Globe and Mail.

RCMP spokesperson Sgt. Caroline Duval said the force is working with the Office of the Privacy Commissioner, the Department of Justice, the RCMP National Forensic Laboratory Services and the National DNA Databank Advisory Committee on "assessing the viability and legalities of using this technique in criminal investigations."

"The guidance provided, along with a privacy impact assessment, will assist the RCMP in the development of the appropriate policies and procedures moving forward," she told CBC News in an email.

"Once formalized, RCMP policy will determine certain approval criteria and responsibilities on police to ensure organizational accountability."

Some observers are calling for legal guardrails to control how law enforcement uses DNA databanks.

Unwarranted 'surveillance'

"If we don't wake up, we're going to sleepwalk towards a society where police have extraordinary capacities for using invasive surveillance without having had the necessary public conversations about when that's appropriate," said McPhail.

"When they're uploading their personal DNA swab to this database to find out their heritage ... what they are doing is subjecting both themselves, their relatives and everything up to their unborn children or the unborn children of their children to potential police surveillance."

Information and Privacy Commissioner of Ontario Patricia Kosseim said non-consenting family members could find themselves subjected to unwarranted police surveillance.

"Once you come up in a partial match, there are many law-abiding relatives that may come under intensive scrutiny of investigators who are looking to narrow down their suspects," she said.

"So police might use these leads to surveil their homes, they might trail their comings and goings, they might question their neighbours."

That could also lead to some unwanted disclosures, Kosseim said.

"Some people implicated may not know they were adopted, they may not know they have siblings," she said. "And these are really difficult situations, and police services need guidance on how to handle those situations."

The RCMP wouldn't say how many times it's used the technique beyond the few cases that are known to the public.

"Local investigative units may use commercial laboratory and database services to support the genetic genealogy process, provided that they comply with the associated terms of service and privacy polices of the labs currently in place," said Duval.

In a briefing note prepared for federal Privacy Commissioner Daniel Therrien ahead of a meeting with RCMP Commissioner Brenda Lucki earlier this year, Therrien's office said RCMP investigators should only use the technique in serious cases.

"Currently, given the lack of internal policy, the RCMP does not know the extent to which the technique is used," said the briefing note, obtained through an access to information request.

Striking a balance 

Last week, Therrien's office said it's working with the RCMP as it drafts a Privacy Impact Assessment on genetic genealogy. The assessment is meant to identify potential privacy risks and propose ways to manage them.

The office's spokesperson Vito Pilieci said it would support oversight and monitoring of the collection, use, retention and destruction of DNA profiles.

Kosseim, a former member of the National DNA Databank Advisory Committee, said the law as it stands hasn't kept pace with evolving technology.

"We're talking about a whole other realm of databases that have really grown in sort of a parallel universe to the state sanctioned national database," she said.

"I think there would have to be a real rethink of the current rules and how they would need to be adapted and changed in order to get a handle on these new sources of genealogical information."

Her British Columbia counterpart, Michael McEvoy, said it's about striking a balance.

"As a society, what we seek is to have law enforcement that keeps us safe and secure, while at the same time we want to ensure that our liberties and freedoms are are preserved. We can do both of those things," he said.

"I expect that rules that are put in place around this would distinguish between very serious crimes — murder, rape, for example, very violent crimes — versus shoplifting."

Daryl Pullman, a professor of bioethics and director of the Centre for Bioethics at Memorial University in Newfoundland and Labrador, said it's no surprise police want to use what's becoming the "fingerprint of the new generation of forensic investigations."

But he questioned whether the police themselves should be the ones drafting a policy.

"Maybe we shouldn't leave it in their hands to decide whether or not they're going to have a policy about how they're going to handle private citizens' information," he said.

"Maybe we need to have governments that are actually wading into this and sort of say, 'These are the parameters that we're going to put around these things, this is the bar that you're going to have to reach.'"

McEvoy said privacy advocates around the world have called for certification programs to evaluate the work of the companies collecting and storing genetic data.

"This is not a matter, by the way, where police just push a button to get DNA, push a button and out comes an answer," he said. "This involves a combination of the DNA and very skilled people who understand the genealogy world."

It's not clear how the relatively new criminal investigative technique would stand up in court. Duval said a Canadian case involving genealogical DNA going through the court system could affect how the RCMP uses this technique going forward.

Read the fine print

Private companies have varying terms of service for law enforcement. Responding to pushback from the public, GEDmatch changed its terms of service and removed users' profiles from law enforcement searches (it restores the profiles for users who opt in).

FamilyTreeDNA says police can access its profiles to identify the remains of a deceased individual or to identify a perpetrator of homicide, sexual assault or abduction — but only with the permission of the clients who own the profiles.

"I don't think it's good enough that companies put in place rules ... They vary," McEvoy said. 

"It's based on a system in some cases where you, as the person giving up your data, either consent or don't consent to it being turned over to the police. In many cases, of course, it's in the fine print. Many people don't quite appreciate or realize what they're giving up."

Othram's Mittelman said his company's sole purpose is to work with law enforcement and he believes people should allow police to use their genetic data to solve crimes.

"Nobody wants to wake up and find out their data is being used in a way that they did not expect," he said.

"I'd rather get the support of the public because we've got hundreds of thousands of cases to go ... It would be a tragedy to cut them off, or to delay or somehow obstruct our ability to do good, just because we didn't follow a process."