The rise of direct-to-consumer DNA tests comes with a host of thorny problems, including how to interpret the data and major questions about genetic privacy. Even if you decide not to spit in a tube, if your relative does, your genetic privacy might already be compromised.

To understand how, Verge Science and Vox took a closer look at the hunt for the Golden State Killer, who was connected with at least 51 rapes and 12 murders in the 1970s and 1980s. Even though the killer left his DNA at multiple crime scenes, investigators couldn’t find him until they turned to a massive genealogical website called GEDmatch. Users can upload their genetic profiles to GEDmatch — and websites like it — to learn about their family trees and look for long-lost relatives.

Investigators discovered that they could also use GEDmatch to look for a killer. They uploaded a fake genetic profile using crime scene DNA and found matches, not of the killer himself, but of his relative. From there, they could hunt through the family tree to find a suspect who had been in the right place at the right time. This is called a long-range familial DNA search, and it raises all sorts of questions about ethics, consent, and just how far law enforcement can go in their pursuit of a killer.

In a search for answers, Vox’s Danush Parvaneh took a DNA test of his own, and Verge Science looked at what the Golden State Killer investigation means for the future of genetic privacy.