The three men who showed up at Michael Usry’s door last December were unfailingly polite. They told him they were cops investigating a hit-and-run that had occurred a few blocks away, near New Orleans City Park, and they invited Usry to accompany them to a police station so he could answer some questions. Certain that he hadn’t committed any crime, the 36-year-old filmmaker agreed to make the trip.

The situation got weird in the car. As they drove, the cops prodded Usry for details of a 1998 trip he’d taken to Rexburg, Idaho, where two of his sisters later attended college—a detail they’d gleaned by studying his Facebook page. “They were like, ‘We know high school kids do some crazy things—were you drinking? Did you meet anybody?’” Usry recalls. The grilling continued downtown until one of the three men—an FBI agent—told Usry he wanted to swab the inside of Usry’s cheek but wouldn’t explain his reason for doing so, though he emphasized that their warrant meant Usry could not refuse.

The bewildered Usry soon learned that he was a suspect in the 1996 murder of an Idaho Falls teenager named Angie Dodge. Though a man had been convicted of that crime after giving an iffy confession, his DNA didn’t match what was found at the crime scene. Detectives had focused on Usry after running a familial DNA search, a technique that allows investigators to identify suspects who don’t have DNA in a law enforcement database but whose close relatives have had their genetic profiles cataloged. In Usry’s case the crime scene DNA bore numerous similarities to that of Usry’s father, who years earlier had donated a DNA sample to a genealogy project through his Mormon church in Mississippi. That project’s database was later purchased by Ancestry, which made it publicly searchable—a decision that didn’t take into account the possibility that cops might someday use it to hunt for genetic leads.

Usry, whose story was first reported in The New Orleans Advocate, was finally cleared after a nerve-racking 33-day wait—the DNA extracted from his cheek cells didn’t match that of Dodge’s killer, whom detectives still seek. But the fact that he fell under suspicion in the first place is the latest sign that it’s time to set ground rules for familial DNA searching, before misuse of the imperfect technology starts ruining lives.

Mitch Morrissey, Denver’s district attorney and one of the nation’s leading advocates for familial DNA searching, stresses that the technology is “an innovative approach to investigating challenging cases, particularly cold cases where the victims are women or children and traditional investigative tactics fail to yield a solid suspect.” Familial DNA searches have indeed helped nab people who might otherwise have evaded justice. In the most celebrated example, Los Angeles police arrested a man believed to be the Grim Sleeper serial killer after discovering that the crime scene DNA shared a significant number of genetic markers with that of a convicted felon—who turned out to be the man’s son.

Familial DNA searching is a scattershot approach that yields false leads.

But the well-publicized success stories obscure the fact that familial DNA searches can generate more noise than signal. “Anyone who knows the science understands that there’s a high rate of false positives,” says Erin Murphy, a New York University law professor and the author of Inside the Cell: The Dark Side of Forensic DNA. The searches, after all, look for DNA profiles that are similar to the perpetrator’s but by no means identical, a scattershot approach that yields many fruitless leads, and for limited benefit. In the United Kingdom, a 2014 study found that just 17 percent of familial DNA searches “resulted in the identification of a relative of the true offender.”

The technology’s limitations have the potential to cause real harm: What if Michael Usry was not a filmmaker, for example, but rather a high school teacher whose alleged involvement in a girl’s murder was leaked to the media? Yet despite all that can go wrong, few states have developed guidelines. California, Colorado, Virginia, and Texas have detailed policies regarding how and when familial DNA searches can take place; Maryland and the District of Columbia explicitly forbid the technique. Elsewhere in the nation, cops are largely free to search as they see fit, which is why Idaho Falls police decided it was OK to sift through an Ancestry database of genetic data from thousands of people with no criminal records.

Familial DNA searching is only going to get more prevalent as the cost of rapid DNA analysis plummets and the size of genetic databases swells. States must start putting rules in place to protect citizens, beginning by prohibiting police from running searches through nongovernmental databases, as happened in Usry’s case. This is not only because of privacy concerns—the people who contribute their DNA to such endeavors, whether medical or genealogical, rarely expect to have their genetic code scrutinized by cops—but also because those databases haven’t been vetted for use by law enforcement. Police in Idaho Falls, for example, were able to obtain a warrant for Usry’s cheek cells because his father’s DNA “matched 34 of 35 alleles” of that of Angie Dodge’s killer. But how common are those particular alleles in the general population? Does this even mean that there is a familial link? This isn’t entirely clear. (Ancestry, which gave Idaho Falls police the name of Usry’s father in response to a court order, has since shut down the database in question because, the company said, the “site [had] been used for purposes other than that [for] which it was intended.”)

States should also follow California’s lead by creating a layer of oversight that prevents cops from pursuing shaky matches. Before a police department in California can proceed with a familial DNA search, it must ask permission from a committee run by the state’s Department of Justice, which determines whether the crime in question was serious enough to merit the procedure. (Only homicides and sexual assaults have been considered.) Once approved, a search must yield a match that conforms to rigorous reliability criteria, including a test that verifies that the criminal and the person in the database share an identical Y chromosome. (Y chromosomes are passed intact from father to son.) According to a 2012 report, only about 10 percent of California’s searches return a match that warrants any investigative follow-up.

Even under the best of circumstances, widespread familial DNA searching will result in some innocents being compelled to offer DNA samples. When those people are exculpated, they deserve to reclaim their genetic privacy. “There should be an automatic expungement of both the sample and profile, without any affirmative action from the individual,” says Sonia Suter, a George Washington University Law School professor who has written about familial DNA searching. That requirement may seem like common sense, but it needs to be in writing. Genetic material is potentially valuable evidence, and law enforcement agencies are loath to relinquish it once they’ve acquired it; they cannot be trusted to destroy such evidence out of the kindness of their hearts.

Above all, states must be transparent about both the efficacy and the collateral damage of familial DNA searching: They should publish annual statistics regarding how many searches are conducted, what percentage of those result in convictions, and how many suspects are cleared after enduring a stressful period of suspicion. Only then can we get a sense of whether we’re catching enough Grim Sleepers to merit causing problems for a whole lot of Michael Usrys.

Brendan I. Koerner (@brendankoerner) is a contributing editor and author of The Skies Belong to Us.