This was in violation of the site’s own terms of service, which restricted law enforcement’s use to cases of homicide and sexual assault. When this decision became public, the backlash was so intense that GEDmatch made an abrupt policy change: All users were now by default excluded from law-enforcement searches unless they explicitly chose to opt in. So few users have opted in their profiles—currently 163,000 out of 1.3 million DNA uploads—GEDmatch has become only marginally useful in many criminal cases.

This single episode managed to inflame the fears of people on all sides of the law-enforcement debate. It showed the flimsiness of privacy protection by terms of service. It showed that police could push to expand the types of crimes investigated. It showed that access to DNA databases, for genealogists on criminal cases, could easily and abruptly be taken away.

But these fears had all been simmering for a long time, too, ever since the Golden State Killer case ripped open the possibility of solving crimes through genealogy.

Read: How a genealogy website led to the Golden State Killer

Genetic genealogists—who use consumer DNA tests to build family trees—had been a close-knit community. Many began as volunteers. The tools they use were created by volunteers. GEDmatch was originally created by volunteers. None of it was meant for criminal investigations. As the genealogist Shannon Christmas puts it, “It was built for finding ancestors. It was built for reuniting families, and now it is being used essentially to get families to put their members in jail.”

Genealogists have suddenly had to contend with the much higher stakes of their work, and genealogy databases have had to make up the rules as they go, scrambling to deal with backlash. “Everybody’s clamoring for guidance—law enforcement, the companies, genealogists,” says Blaine Bettinger, who writes the blog The Genetic Genealogist. The investigations have raced ahead—until very recently—without any guidelines.

Using genealogy to identify a suspect is not so different from, say, looking for the birth parents of an adoptee. The process begins with a DNA sample, uploaded to a database like GEDmatch. In most cases, the only matches will be distant cousins, but skilled genealogists are able to map out family trees by cross-referencing shared bits of DNA with public records, obituaries, and social-media profiles. In criminal cases, law enforcement may also contact family members for information or additional DNA to narrow down possible hits. “There’s a lot of follow-up that has to take place,” says CeCe Moore, the chief genetic genealogist for Parabon NanoLabs, whose team has made about 70 identifications for law enforcement since it formed after the arrest of the Golden State Killer suspect.

Early on, genealogists settled on a tentative status quo for consulting GEDmatch’s consumer DNA profiles in criminal cases: Law enforcement could use the site, but only for homicides and sexual assaults, as spelled out in its new terms of service.