As the number of migrants at the southern border has surged in the past several months, the Trump administration has turned to increasingly draconian measures as a form of deterrence. While the separation of children from their parents and housing of migrants in overcrowded and ill-equipped holding facilities have rightfully made front-page headlines, the administration’s latest effort—to conduct Rapid DNA testing on migrant families at the border—has flown under the radar. However, this new tactic presents serious privacy concerns about the collection of biometric information on one of the most vulnerable populations in the U.S. today—and raises questions of where this practice could lead.

Background

In May 2019, CNN reported that Immigration and Customs Enforcement (ICE) was launching a pilot program to conduct Rapid DNA testing on families at the U.S.-Mexico border. The purpose of the pilot program was to identify and prosecute individuals who were not related through a biological parent-child relationship. The pilot program was confirmed as a joint operation between ICE and Customs and Border Protection (CBP) at two locations at the border. The government contracted with ANDE, a Massachusetts-based Rapid DNA testing company, to conduct the Rapid DNA testing for the pilot program.

Later that month, ICE released a Request for Proposal seeking a contractor to expand the Rapid DNA testing program for ten months at seven locations at the U.S.-Mexico border. In mid-June, Bode Cellmark Forensics, Inc. was awarded the Rapid DNA testing expansion contract for $5.2 million.

On June 25, 2019, the U.S. Department of Homeland Security (DHS) and ICE released a Privacy Impact Assessment (PIA) on Rapid DNA Operational Use [.pdf], stating that:

The issue of “family unit fraud” has been increasing since the spring of 2018 and that such fraud “can lead to, or stem from, other crimes, including immigration violations, identity and benefit fraud, alien smuggling, human trafficking, foreign government corruption, and child exploitation.”

Rapid DNA testing to establish a biological parent-child relationship can be conducted in approximately 90 minutes without human review, unless there is an inconclusive result.

Families subjected to the testing are provided with a privacy notice and consent form. The Rapid DNA test is voluntary, but “failure to submit to Rapid DNA testing may be taken into account as one factor in ICE’s assessment of the validity of the claimed parent-child relationship.”

Rapid DNA testing will only be used to establish the biological parent-child relationship. After the testing results are returned, the vendor is required to destroy DNA samples and purge electronic data from the system.

ICE’s initial planned use of Rapid DNA testing will involve migrant families at the border that agents suspect of family unit fraud; however, it may roll out the use of Rapid DNA more broadly in the future, including to lawful permanent residents and to situations beyond the border.

Problems with Rapid DNA Testing

In 2017, the Swedish National Forensic Centre published a report [.pdf] detailing serious problems with a Rapid DNA testing system, the RapidHit System by IntegenX, including:

[N]umerous issues with the system related to the hardware, firmware, software as well as the cartridges. The most severe issues are the retrieval of an incorrect DNA profile, PCR product or sample leakage and the low success rate. In total 36% of the runs had problems or errors effecting two or more samples resulting in a 77% success rate for samples consisting of . . . amounts where complete DNA profiles are expected.

Although not the same system, the Swedish report’s characterization of the many problems with their Rapid DNA testing technology just two years ago raises questions about the accuracy of the Rapid DNA testing used by ICE. The PIA states that a biological parent-child match must be verified by a 99.5% accuracy. But we don’t even know the baseline rate of success that these Rapid DNA testing companies have established: the government has provided no statistical information or peer-reviewed studies as to the testing’s accuracy.

Nor is there any indication in the PIA of an appeals process if a test misidentifies a parent and child as biologically unrelated, implicating a lack of due process. When the stakes are so high—indefinite separation of a child from their parent—the government must have, at a minimum, a process to challenge designations of biological non-relation.

Continued Erosion of Privacy Rights

Rapid DNA testing of migrant families also raises serious concerns about the Fourth Amendment, which protects against searches and seizures—in this case, DNA—without a warrant. The government claims that it retains authority to conduct Rapid DNA testing from 8 U.S.C. § 1357(b), which allows ICE to “take and consider evidence concerning the privilege of any person to enter, reenter, pass through, or reside in the United States.” However, this statute generally has applied to “evidence” such as inspecting entry documents, not conducting invasive DNA testing.

In fact, recent actions taken by Congress indicate that ICE doesn’t have the statutory authority to conduct Rapid DNA testing. In 2016, Congress failed to pass H.R. 5203, which proposed language that would require DNA tests to verify family relationships for visa petitions. Similar language appeared in two rejected immigration bills put before Congress in 2018, H.R. 4760 and H.R. 6136. Just this week, Rep. Lance Gooden introduced a bill [.pdf] that would amend federal law to require DNA testing for adults entering the country with accompanying children to determine a familial relationship. Congress’ repeated actions to amend federal law to give ICE statutory authority to conduct DNA testing indicates that ICE currently doesn’t possess such authority.

The government relies on the fact that these tests are “voluntary” and that migrants are provided with consent forms and privacy notices prior to being tested. However, the consent forms note that if families decide to opt out of the Rapid DNA testing, that could factor into a decision of whether or not to separate parent from child in immigration detention. Consent is meaningless when families are threatened with indefinite separation if they don’t provide it.

Despite the PIA’s claims that DNA profiles are not stored and that tests are immediately destroyed after the results return, there still exist serious concerns about the amount of personal information collected through Rapid DNA testing. Just last month, the Washington Post reported a massive data breach when face and license plate images held by a CBP subcontractor, Perceptics, were hacked. CBP claimed that Perceptics kept the data in its own database and was trying to match faces to license plates at the time of the breach, both practices contrary to CBP policy. The threats of government (or subcontractor) misconduct and breaches further jeopardize the vast amount of personal information at stake as a result of Rapid DNA testing.

What’s a Family?

Perhaps the most fundamental question that Rapid DNA testing at the border raises is one that technology cannot solve: what constitutes a family?

One of the reasons the government is employing Rapid DNA testing is to show a lack of biological parent-child relationship, which it then uses to justify separating the adult and child in different detention facilities. While the court-ordered Flores settlement governs how long ICE can hold minors in government custody (which immigrant rights attorneys allege the federal government is currently violating), no such settlement governs the detention of adults. The Trump administration believes that the threat of indefinite detention will act as a deterrence to migration across the southern border.

But the federal government’s narrow interpretation of a family as a biological parent-child relationship has no basis in immigration law. In fact, a person may apply for asylum and claim as a derivative a child born in or out of wedlock, a stepchild, or an adopted child. And the government generally encourages a broad definition of a parent-child relationship. For example, under common law, there is a legal presumption of paternity if the child is born in wedlock or if there is otherwise no dispute. This presumption exists even though the rate of people in the U.S. biologically unconnected to at least one of their parents—due to adoption, infidelity, or other circumstances—is fairly significant. With the introduction of Rapid DNA testing on migrant families at the border, the government is challenging familial relationships, including the presumption of paternity, thereby imposing a different standard on immigrants than citizens.

Window to a Dystopian Future

The Trump administration is creating its very own dystopia at the border, not only by separating families and caging migrants, but also by conducting Rapid DNA testing on one of the most vulnerable groups in the country. ICE is working quietly and quickly to expand the program, having gone from a pilot to a privacy notice for an ostensibly agency-wide program in less than two months. And the PIA foreshadows what could be ahead: Rapid DNA testing of lawful permanent residents and in contexts outside of the border. EFF encourages the public to contact their congressional representatives and voice their concerns about ICE’s Rapid DNA testing program. We cannot allow the federal government to exploit migration as an excuse to erode fundamental privacy rights through DNA testing.