DNA forensics was once reserved for official police labs, but thanks to the internet and a new wave of start-ups, those official barriers are wearing away.

Commercial DNA testing services and crowdsourced genetic databases are helping people find long-lost relatives.

But a recent American case shows how these platforms can be used in criminal investigations, sometimes without a warrant or prior consent.

For critics, this raises concerns about the growing shadow market for highly personal information — as well as the implications for people who can be tracked down using these platforms without ever signing up.

You're already in the database

In April, police used a genealogy website to help identify and arrest a suspect in the "the Golden State Killer" case: an unsolved series of brutal murders and rapes in northern California.

Police took a decades-old genetic sample from a crime scene, and used it to search for relatives on GEDmatch, which lets users load their genetic information to map family connections.

They could apparently do this without a warrant, as GEDmatch is available for anyone to search.

The police did not locate the suspect Joseph James DeAngelo specifically — or even a close relative.

Joseph James DeAngelo allegedly often took souvenirs, notably coins and jewellery, from his victims. ( AP: Sacramento County Sheriff's Office )

Instead, they found several third and fourth cousins. For context, the average person in a two-child family has somewhere around 190 third cousins.

Because of this vast genetic network, many people may already be traceable through such databases without ever giving up their own information.

GEDmatch has about a million users, according to its co-creator Curtis Rogers.

Depending on location and ancestry, many people are likely to have a third cousin in GEDmatch already.

Michael 'Doc' Edge, a population geneticist at the University of California, Davis, worked out some back-of-the-envelope estimates of its reach.

Roughly speaking, he suggested that in the United States, more than 90 per cent of people of European descent could already expect to have a third cousin in GEDmatch.

"The upshot is that if you're somebody that has substantial recent ancestry in the United States, it's quite likely that you have a detectible genetic cousin in GEDmatch," Dr Edge said.

Vastly more powerful than traditional DNA profiling

GEDmatch is also used by Australians, raising questions about whether this forensic technique could be used here.

"Our number one users are in the United States, then Canada, then England, and then Australia. So, we get a lot of users out of Australia," Mr Rogers said.

Locally, the first national forensic database was established in 2001.

Now known as the National Criminal Investigation DNA database (NCIDD), it contains over 800,000 DNA profiles that differ from GEDmatch in several important ways.

The Australian police's genetic profiles are narrower in scope. Much like a fingerprint, they are generally used to establish a direct link between a person and an unknown sample (like a blood sample).

They are also able to reveal the relationship of a close relative like a parent or sibling.

With the rise of companies like ancestry.com, there's been a surge in interest to uncover the information in people's genes. ( Unsplash: Roman Kraft )

The information contained in a commercial ancestry genetic test — which is the type of data in the GEDmatch database — is different.

In comparison to a DNA profile in a traditional police database, it records 35,000 times more sites of your DNA.

As a result, it is a much more powerful tool for identifying relatives, even very distant ones.

Another key difference between law enforcement databases and GEDmatch is who is included in them.

In New South Wales, for example, NCIDD is restricted to those that have been convicted of a crime. Generally, DNA profiles are discharged if a person is not convicted.

In South Australia, the requirements are much lower and can extend to those charged with a crime. There is no provision for that information to be removed from the system, even if they are later acquitted.

In contrast, anyone can contribute to GEDmatch.

A new cottage industry of police genealogy?

Beyond cold cases like the Golden State Killer, there are concerns genetic testing is also being used in less severe criminal cases.

Politicians have grappled with this question in Colorado, where a technique known as "familial searching" allows DNA searches for close family members within the state's forensic database in instances of "significant public safety concerns".

Despite this restriction, police used the technique of familial searching on blood from a broken window left at a car break-in and the theft of $1.40 in change.

Loading

This growing industry raises important questions about how genetic information should be used — and whether users of commercial genetic testing fully understand the power of the data they are giving up.

As Dr Edge points out, it is complicated.

"For these very severe cases, I think you have a lot of public support for law enforcement doing anything they can to find these people," he said.

"I feel a lot less cheery about it if it becomes a more routine procedure. And if genetic surveillance is being used for more routine crimes, drug crimes, things like that … that worries me more."

GEDmatch founder Mr Rogers wants genealogy websites to remain open and unregulated, although he has updated the terms and conditions to make users more aware of the risk.

"I hope they don't clamp down on this. Let the people decide. Don't let government decide," he said.

But who really gets to make these decisions?

One person's decision to upload their genetic ancestry data can have serious implications for many others, including people they have never met.

Dr Caitlin Curtis is a research fellow at The University of Queensland, with broad expertise in genetics. She is also one of the Top 5 scientists for 2018.