In April, a citizen scientist named Barbara Rae-Venter used a little-known genealogy website called GEDMatch to help investigators find a man they’d been looking for for nearly 40 years: The Golden State Killer. In the months since, law enforcement agencies across the country have flocked to the technique, arresting a flurry of more than 20 people tied to some of the most notorious cold cases of the last five decades. Far from being a forensic anomaly, genetic genealogy is quickly on its way to becoming a routine police procedure. At least one company has begun offering a full-service genetic genealogy shop to law enforcement clients. And Rae-Venter’s skills are in such high demand that she’s started teaching her secrets to some of the biggest police forces in the US, including the Federal Bureau of Investigation.

Identifying individuals from their distant genetic relatives, a technique called long-range familial searching, is a potent alternative to the types of DNA searches commonly available to cops. Those are typically limited to forensic databases, which can only identify close kin—a sibling, parent, or child—and are highly regulated. No court order is required to mine GEDMatch’s open source trove of potential leads, which, unlike forensic databases, contains genetic bits of code that can be tied to health data and other personally identifiable information.

Want more? Read all of WIRED’s year-end coverage

Currently, there aren’t any laws that regulate how law enforcement employs long-range familial searching, which hobbyists and do-gooders have turned to for years to find the biological families of adoptees. But some legal experts argue its use in criminal cases raises grave privacy concerns. They expect to see a legal challenge at some point, though probably not in the next year. In the meantime, GEDMatch is becoming even more powerful, as it grows by nearly a thousand new uploads every day. And with hundreds more cases currently in the hands of full-time family-tree builders, one thing’s for sure: In 2019, genealogy is going to send a lot more people to jail.

It was the last Saturday of June and CeCe Moore had been working on her couch, hunched over her laptop for 16 hours straight. The month before, the genetic genealogist had been hired by a forensic DNA company in Virginia called Parabon, to lead its new division devoted to long-range familial searching. She was immersed in a case out of Fort Wayne, Indiana; In the spring of 1998, eight-year-old April Tinsley went missing from her home. Three days later, a jogger discovered her body in a ditch on DeKalb County Road 68, about 20 miles outside of town. She had been raped and strangled to death.

For years, Tinsley’s killer haunted that northeastern corner of Indiana, leaving messages scrawled on a barn bragging of his crime. In 2004, four threatening notes appeared on bicycles owned by young girls that had been left in their yards. The notes, which were claimed to be written by the same person that killed Tinsley, were placed inside baggies alongside used condoms. The semen matched DNA found in Tinsley’s underwear.

This summer, Indiana investigators extracted DNA from the original crime scene and sent it to Parabon. There, the company reverse-engineered the information into a DNA data profile similar to what you would get back from consumer genetics companies like 23andMe or Ancestry. Then they uploaded it to GEDMatch and waited for a match. They got 12. Twelve relatives, ranging from fifth to third cousins.