Universal DNA databases: a way to improve privacy?

Abstract

Many people have a visceral, negative reaction to the idea of a universal DNA database. Their main concern? That a universal DNA database would grossly invade their privacy. A universal DNA database's benefits in efficiently and effectively solving crimes, exonerating the innocent, and decreasing racial disparities in law enforcement, however, make such a database immensely appealing from a public safety and criminal justice perspective. As of April 2017, the federal DNA database has assisted in more than 358,069 investigations.2 DNA evidence has exonerated 350 innocents who combined had served 4787 years in prison, sometimes on death row.3 DNA also enabled law enforcement to identify 149 of the true perpetrators of those crimes, who ‘went on to be convicted of 147 additional violent crimes, including 77 sexual assaults, 35 murders, and 35 other violent crimes while the innocent sat behind bars for their earlier offenses’.4 A universal DNA database could have prevented those 350 false convictions and 147 later violent crimes. Yet discussions about universal databases are often halted by invasion of privacy concerns. Are those concerns rational? By analysing a universal DNA database's design, the probability that imagined abuses would occur, and the invasive investigative techniques the database could end, this article demonstrates that a universal DNA database might actually improve privacy. Part I briefly introduces current forensic DNA databases. Part II examines how a universal DNA database could be designed to limit its privacy-invasion potential. Part III responds to common privacy-based objections. Finally, Part IV argues that a universal DNA database may even increase privacy by decreasing more invasive investigative techniques, exonerating the innocent, and deterring crime. While constitutional arguments may exist on this topic, space does not allow their consideration here. I. Current DNA Databases DNA databases are already maintained by every state and the federal government. All states require DNA samples to be taken from individuals convicted certain crimes.5 Twenty-nine states and the federal government even collect DNA from individuals arrested, but not yet convicted, for certain offenses.6 All states have some process for expunging DNA profiles if a charge is dropped or the individual is acquitted, though most states require individuals to initiate the process.7 Only 36 per cent of state DNA profiles are incorporated into the national Combined DNA Index System (CODIS) database.8 After obtaining DNA from an offender or arrestee, law enforcement sends the DNA to an accredited, quality-controlled forensic laboratory.9 The laboratory then examines the 13 ‘CODIS loci’, also known as ‘CODIS markers’, of the DNA. Combined, the CODIS loci comprise only one millionth of a person's DNA10 and are ‘no more informative than an ordinary fingerprint’.11 These ‘noncoding, nonregulatory’12 snippets of DNA are not ‘even moderately correlated with disease status, physical traits, or behavioral predispositions’.13 Analysing these portions of an individual's ‘junk’ DNA thus ‘produces a set of numbers that are useful for identification purposes and nothing else’.14 These numbers become the offender or arrestee's DNA profile.15 CODIS does not store any personally identifying information with a DNA profile, not even the name of the person who provided the DNA sample or that sample itself.16 If a DNA sample taken from a crime scene matches a CODIS profile, a public forensic laboratory must contact the other laboratories involved in creating the DNA profile to obtain the suspect's name.17 In addition to limiting the information stored in DNA databases, current databases also strictly limit access and use of that information. All CODIS computers are ‘located in [a] physically secure space’ and laboratory communications occur over a private network ‘accessible to only criminal justice agencies approved by the FBI’.18 Generally, access to the databases is strictly limited to criminal justice agencies ‘for law enforcement purposes’,19 that is, criminal identification only.20 Criminal defendants may also be given access to samples and analyses connected to their cases.21 Unauthorized tampering, acquisition, disclosure, or use of DNA profiles is subject to fines and prosecution.22