“It’s very controversial,” says Margaret Press, a genetic genealogist who co-runs the nonprofit DNA Doe Project.“It’s going be debated for a very long time in law and forensics and genealogy and everywhere you can imagine.”

The Sacramento County district attorney’s office declined to comment, except to confirm the Bee’s reporting. Genetic genealogists, however, outlined to The Atlantic how the search was likely done. “The process is really your standard genealogy research project. It’s no different from finding an adoptee,” says Press.

First, how it was not done. Direct-to-consumer DNA testing companies like 23andMe and AncestryDNA did not directly hand customer information over to police. Nor could law enforcement have sent DNA from the crime scene to these two companies, which require a large tube of saliva. Both 23andMe and Ancestry have denied being involved in the case.

But customers can themselves choose to export the raw data file from these and other DNA-testing services to a third-party site, such as GEDmatch. These third-party sites are less user friendly than the websites of 23andMe or AncestryDNA, but they offer a more powerful suite of tools. For example, GEDmatch allows users to find profiles that match only one particular segment of DNA. It also lets users who have tested with different services match with each other without shelling out for another one. GEDmatch offers premium tools but is largely free to use.

GEDmatch.com

It’s unclear how exactly law enforcement generated a profile of the Golden State Killer from DNA left at crime scenes. But the DNA Doe Project’s Press and her partner, Colleen Fitzpatrick, were recently able to identify Marcia King, murdered in 1981, after whole genome sequencing on a highly degraded DNA sample nevertheless matched to a first cousin once removed on GEDmatch.

GEDmatch is an example of the openness in the genealogy community, says CeCe Moore, a genetic genealogist. “We have amazing citizen scientists who have built tools the companies have not been able or willing to provide,” she says. “And we encouraged or demanded we have access to our raw data.” But this openness makes it easier for law enforcement to access data, too. Unlike 23andMe or Ancestry, GEDmatch does not have lawyers to protect the data of its users. The website issued a statement saying law enforcement did not directly approach the site about the research and urged concerned users to delete their registration.

“The police officer’s ability to throw some information into a public database like this is wholly unregulated,” says Erin Murphy, a law professor at New York University Law School. In 2014, a genealogical database search led police working a cold case to man in New Orleans, who turned out to be innocent. California also allows law enforcement to look for relatives in criminal-justice DNA databases—but those searches are regulated and restricted to certain serious crimes.