The Math Behind a Lack of Genetic Privacy

"This year, police in Eugene, Ore., said they had identified a serial killer who committed three murders from 1986 to 1988. The man, John Charles Bolsinger, had escaped attention for three decades because he had killed himself in 1988.

Investigators had stored DNA from the crimes and plugged it into a genealogy database, zeroing in on Bolsinger by first finding his distant cousins. It is the latest in a growing string of cold cases solved by law enforcement using techniques developed by genealogy hobbyists. Take a DNA sample, identify a second cousin here, a third cousin there, then use public records to reconstruct a killer's family tree.

If you're concerned about the privacy implications of this, you might think, "Well, I would never submit my DNA to one of those sites."

Sounds reasonable? In fact, it is far too late to completely protect your genetic privacy via personal abstention. A brief exploration into the mathematics of genetics explains why it has become possible to track down killers -- but also anyone -- through distant relatives.

"If somebody wanted to use the skills of forensic genealogists to try to track you down through a third cousin, they could," said Jennifer King, a privacy scholar at Stanford University.

To understand how exposed your genes potentially are, consider an obscure unit of measurement -- the centiMorgan, or cM. (It is named for Thomas Hunt Morgan, whose experiments on fruit flies led to the Nobel in 1933.) It gauges genetic distance, the length of identical segments of DNA that two people share due to descent from a common ancestor.

In general, people have about 6,800 cMs. A child inherits half their DNA -- one set of chromosomes -- from each biological parent. So child and parent will have around 3,400 cMs of DNA that match.

(Because of slightly different methodologies, the major testing companies report slightly different numbers.)

For every "degree of relatedness," the length of shared cMs halves. An uncle or grandparent, one degree removed from parents, shares half as much DNA on average. A first cousin or great-grandparent shares half again. And so on.

Even with all these halvings, very distant relatives out to fifth cousins share so much identical DNA that a common ancestor is the only possible source.

"I think most Americans don't realize this," said Libby Copeland, author of "The Lost Family: How DNA Testing Is Upending Who We Are." "It's a profound shift."

It is easy to find distant relatives because a typical individual has so many: according to various methods, around 200 third cousins, upward of 1,000 fourth cousins and anywhere from 5,000 to 15,000 fifth cousins.

This isn't just relevant for crime scenes. There is no such thing anymore as truly anonymous sperm or egg donors, unknown fathers, or closed adoptions. They are all examples of scenarios where secrets involving parentage are easily solved by the centiMorgans. No court ruling or confidentiality agreement can erase this science.

An adopted child who doesn't know his biological parent still shares 3,400 cMs with that person, and hundreds of centiMorgans with numerous cousins from that parent's family. The child, or that child's descendants, could upload their DNA to a database and by looking for matches with others who have uploaded theirs,discover some distant cousins. That would be enough to reconstruct his family tree and identify the parent, even though the parent never uploaded their DNA.

Katie Hasson, associate director of the Center for Genetics and Society, which advocates for protections against genetic information being abused, says that only collective action -- not individual precaution -- can address the privacy concerns.

"Right now, forensic genealogy is very labor intensive and new, and being used for very serious crimes and cold cases," said Ms. Hasson. "The likelihood it will be confined to that, without actual enforceable restrictions and regulations, is slim."

The scale of testing is enormous: around 21 million samples on AncestryDNA, 12 million at 23andMe, 5.6 million at MyHeritage and 1.7 million at FamilyTreeDNA, according to the International Society of Genetic Genealogy.

Legal protection is limited. The 2008 Genetic Information Nondiscrimination Act bars genetic information from being used for decisions about health insurance and employment. But it never anticipated the extent of today's testing, cutting-edge medical research or what happens, say, if a company with a giant genetic database collapsed. What happens if the data of millions of people (with cMs matching thousands of distant cousins each) is sold at bankruptcy auction?

In my own extended family, I corresponded with a distant cousin who discovered one great-great-grandfather in her family tree wasn't biologically related. By identifying distant cousins with whom she shared DNA, she found that she and these new cousins were all descended from a different man: a soldier who spent a month in the same county as her great-great-grandmother in 1862 during the Civil War, about nine months before a child was born. (She asked I not share names. Even 160 years later, some secrets are awkward.)

There is really only one thing that this Civil War soldier, the woman he briefly met in 1862, and Eugene, Ore.'s serial killer from the 1980s all have in common: They never submitted their DNA to a testing site. It didn't matter. Their centiMorgans are everywhere." [1]

1. U.S. News -- The Numbers: The Math Behind a Lack of Genetic Privacy
Zumbrun, Josh. 
Wall Street Journal, Eastern edition; New York, N.Y. [New York, N.Y]. 21 May 2022: A.2