Most White Americans’ DNA Can Be Identified Through Genealogy Databases

The genetic genealogy industry is booming. In recent years, more than 15 million people have offered up their DNA — a cheek swab, some saliva in a test-tube — to services such as 23andMe and Ancestry.com in pursuit of answers about their heritage. In exchange for a genetic fingerprint, individuals may find a birth parent, long-lost cousins, perhaps even a link to Oprah or Alexander the Great.

But as these registries of genetic identity grow, it’s becoming harder for individuals to retain any anonymity. Already, 60 percent of Americans of Northern European descent — the primary group using these sites — can be identified through such databases whether or not they’ve joined one themselves, according to a study published today in the journal Science.

Within two or three years, 90 percent of Americans of European descent will be identifiable from their DNA, researchers found. The science-fiction future, in which everyone is known whether or not they want to be, is nigh.

{snip}

The science involves a search for third cousins. To identify a person through a DNA sample, an investigator uploads a previously analyzed genetic sequence to a database. The goal is to find someone who shares enough DNA to place them in the third cousin or closer range. Most of us have at least 800 people out there, somewhere in the world, who fall into this category. So long as one of these people is in a database, a skilled sleuth may be able to use other publicly available information to start building a family tree and figure out the person’s actual identity.

That technique has been used in recent months to identify more than 15 suspects in murder and sexual assault cases. The breakthroughs began in April with an arrest in the case of the Golden State Killer, who terrorized California with rapes and murders in the ’70s and ’80s. Other successes soon followed. A truck driver in Washington State was charged with the murder of a Canadian couple in 1987; a DJ in Pennsylvania was charged with the murder of a teacher in 1992.

Watching these developments, Dr. Erlich wondered about the odds of identifying any given person through cousins’ DNA in one of these databases.

His analysis is based not on the big genealogy databases such as 23andMe and Ancestry, but on two of the smallest: GEDmatch, which has around one million profiles, and MyHeritage, which had around 1.5 million at the time of the study. {snip}

But the smaller sites, set up to help genealogists maximize the odds of finding relatives, are more flexible. GEDmatch allows law-enforcement officials to search for genetic matches in its database in murder and sexual assault cases. MyHeritage does not, but it permits uploads from external labs. With both, it’s hard to be sure what’s being uploaded: grandma’s saliva, crime scene blood, a sample from a medical study or something else entirely.

To determine the odds of correctly identifying an individual from a given DNA sample, Dr. Erlich and his colleagues — from Columbia University, the Hebrew University of Jerusalem and the New York Genome Center — analyzed 30 DNA kits chosen at random from the GEDmatch database.

Their results were eye-opening. The team found that a DNA sample from an American of Northern European heritage could be tracked successfully to a third-cousin distance of its owner in 60 percent of cases. A comparable analysis on the MyHeritage site had similar results. The analysis focused on Americans of North European background because 75 percent of the users on GEDmatch and other genealogy sites belong to that demographic. To identify an individual of any ancestral background, all that is needed is a database containing two percent of the target population, according to Dr. Erlich.

{snip}

CeCe Moore, a genetic genealogist with Parabon, a forensic consulting firm, also expressed worry in an email that the Science paper may obscure the difficulty involved in puzzling out someone’s identity; it takes a highly skilled expert to build a family tree from the initial genetic clues.

{snip}

In an alarming result, the Science study found that a supposedly “anonymized” genetic profile taken from a medical data set could be uploaded to GEDmatch and positively identified. This shows that an individual’s private health data might not be so private after all.

Dr. Erlich has urged genealogy companies to consider attaching some sort of cryptographic signature to the genetic profiles they analyze. This would help ensure that whoever uploads a genetic profile is who they say they are, and making it harder for anyone to abuse this data, should they, for example, want to figure out who attended a protest.

{snip}