Back to the DNA Bank

Now that I’ve worked through my 2,800-word preamble in the form of this week’s history of Canada’s Protection of Communities and Exploited Persons Act, it’s time to focus on the subject I actually set out to cover: Canada’s National DNA Data Bank (NDDB).

As I explained back in 2017, when I first wrote about it, Jean Chretien’s Liberal government passed the establishing legislation in 1997 and the Data Bank came into existence in 2000. Six years ago, I noted that the NDDB consisted of:

…the Crime Scene Index (CSI) and the Convicted Offender Index (COI), both of which are maintained by the Royal Canadian Mounted Police (RCMP), an organization now under fire for its “dysfunctional culture” and lack of leadership, so that’s a comfort.

Little did I know the damage the RCMP would do to its already shaky reputation over the next six years.

When the NDDB launched, there were 37 designated offenses for which an offender could be required to supply a DNA sample. A 2002 Justice Department consultation paper explained that:

With a few exceptions [emphasis mine] the list of designated offences is limited to violent offences and sexual offences where there is a likelihood of bodily substances being left behind by the perpetrator of the offence. Primary designated offences are the most serious of these offences.

Primary designated offenses are mostly of a violent or sexual nature and the presiding judge in the case must make a DNA order; secondary offenses are less serious but a judge may make a DNA order if they feel it is “in the best interests of the administration of justice.”

The Data Bank’s 2020-21 Annual Report explains that:

…after significant legislative changes in 2008, more than 350 offences now qualify as designated offences. This means that more DNA profiles from convicted offenders are collected and entered into the Convicted Offenders Index for a variety of offences, from less serious to more violent and serious offences.

Also worth noting is that advances in DNA analysis meant that by 2008, “microscopic traces of DNA” could be used “in different types of investigations, not in investigations of violent or sexual offences alone, the original focus of DNA analysis.”

The Office of the Privacy Commissioner (OPC) sounded the alarm about this mission creep as early as 2009, when its acting general counsel, Lisa Madelon Campbell, warned a Parliamentary Standing Committee on Public Safety and National Security that:

Rather than primarily being a means of linking DNA of offenders who have committed serious violent and/or sexual offences with DNA found at the crime scene of similar offences, the data bank is being populated by the DNA of offenders who have committed a much wider range of offences that are not necessarily violent or sexual in nature. The Office of the Privacy Commissioner views this as a fundamental shift away from the original rationale of the data bank – it was intended to apply only to designated offences which consist of violent and sexual offences that might involve leaving DNA at a crime scene.

In my original article, I was working with stats from March 2016, at which point the CSI contained 117,163 DNA profiles obtained from crime scene investigations of “designated primary and secondary offences identified in section 487.04 of the Criminal Code” and the COI contained 326,989 profiles collected from offenders convicted of those same designated primary and secondary offenses.

As of March 2023, the CSI contained 210,001 DNA profiles (up 79%) while the COI contained 489,182 profiles (up 50%)—or as the RCMP likes to put it, the NDDB now contains “more than half a million” DNA profiles.

But that’s not the only growth the NDDB has experienced since 2017.


Lindsey’s Law

According to the RCMP’s account, the government of Canada amended the DNA Identification Act in 2014 to create five new indices but the actual story is more complicated.

Stephen Harper’s government committed $8 million dollars to creating the National Missing Persons Data Bank in 2014, but the bank itself didn’t actually enter into operation until 2018, with the passage of something called “Lindsey’s Law” by Justin Trudeau’s Liberal government.

The law was named for a 14-year-old girl, Lindsey Peterson, who went missing in Comox Valley, BC in 1993. That Lindsey was white and blonde strikes you rather forcibly given that in 2018, the National Inquiry into Missing and Murdered Indigenous Women and Girls had been underway for two years and the potential for the data bank to help solve such cases was certainly a topic of discussion—see this 2015 Globe and Mail story. But a spate of media stories from the time—see here and here and here—largely credited Peterson’s mother and her 18-year campaign for the creation of the Data Bank. She signed the first documents consenting to have her daughter’s DNA profile added to the Missing Persons Data Bank, although the case apparently remains unsolved.

Lindsey’s Law created three new  “humanitarian” indices:

  • Missing Persons Index – DNA profiles of missing persons developed from personal effects, such as a toothbrush or an article of clothing.
  • Human Remains Index – DNA profiles from found human remains.
  • Relatives of Missing Persons Index – DNA profiles voluntarily submitted by close relatives of the missing, and used to either help identify the missing person, or to compare to DNA profiles in the Human Remains Index.

And two new criminal indices:

  • The Victims Index – Voluntary DNA profiles from victims of crime, which could help police identify serial offenders and link crime scenes.
  • The Voluntary Donors Index – DNA profiles voluntarily submitted by any person, other than a victim, to advance a criminal, missing persons or unidentified human remains investigation.

Under the terms of the Act, DNA from relatives of missing persons may only be compared to DNA from missing persons or human remains—in other words, the cops can’t compare DNA samples from the relatives of missing persons to DNA from crime scenes on the off chance that the relative is also a guilty of a crime.

But DNA samples collected from voluntary donors during the course of a criminal or “humanitarian” investigations “will be compared to the Crime Scene Index (CSI), Convicted Offenders Index (COI), MPI, and HRI,” as will DNA profiles collected from victims.

There are rules in place regarding how long such samples may be kept, but what I would point out is that those rules can change.

All the DNA

In the early ’90s, the UK’s Metropolitan Police (that would be the force most recently in the headlines for was arresting protesters before the coronation) floated the idea of creating a DNA database of “the whole male population” of the country arguing that, although it would be expensive to establish and maintain, it “would provide considerable benefits for the police.”

The UK government didn’t green light the proposal but the Met made a pretty good stab at creating its database anyway because, until 2008, British law “allowed the permanent retention of DNA samples and records from anyone arrested for virtually any offence, regardless of whether they [we]re charged or convicted.”

The law was overturned by the European Court of Human Rights in 2008 and in 2013, the UK’s Protection of Freedoms Act took effect, as a result of which, British authorities removed 1.7 million DNA profiles  of children and innocent people from the database and destroyed 7,753,000 DNA samples.

That’s where I left this story in 2017—at what seemed like a happy ending. But looking into the status of the UK’s National DNA Database (NDNAD) as of 2020-2021 (the most recent annual report I could find), I discovered that police can still take a DNA sample from every individual that they arrest and that they can retain profiles for people (including youths) who have been charged but not convicted or arrested but not charged for “three years, if granted by the Biometrics Commissioner plus a 2 year extension if granted by a District Judge (or indefinite if the individual has a previous conviction for a recordable offence which is not excluded.)”

No surprise, then, that as of 31 March 2021, the UK’s National DNA Database (NDNAD) held 6,682,131 subject profile records which, given a population of about 68 million, means the database profiles about 10% of the population.

The same year the European Court of Human Rights overturned the UK law, the US Supreme Court ruled that “police may routinely take DNA cheek swabs from suspects who have been arrested but not yet convicted of a crime.”

Justice Antonin Scalia, of all people, joined Justices Ruth Bader Ginsburg, Sonia Sotomayor and Elena Kagan in opposing the ruling, writing a “sharp dissent” which he read aloud in the courtroom:

Make no mistake about it: because of today’s decision, your DNA can be taken and entered into a national database if you are ever arrested, rightly or wrongly, and for whatever reason.

DNA profiles from participating federal, state, and local forensic laboratories in the US are stored in the National DNA Index System (NDIS) and analyzed using the FBI’s Combined DNA Index System (CODIS).

Because it’s the US, states all have their own rules around DNA collection and exploring them all is beyond the scope of this article, I just wanted to make the point that law enforcement generally can’t get enough of that DNA.


All in the family

Which begins me to my next topic: familial searches.

This is when a DNA profile is run through a databank and returns no exact matches but does return partial matches—meaning, potential relatives of the source. It’s a way of expanding your database without actually expanding your database.

In a 2010 paper for the Michigan Law Review called “Relative Doubt: Familial Searches of DNA Databases,” Professor Erin Murphy of New York University School of Law considered the case for familial or “kinship” matching and found it wanting.

She begins her paper with a story that illustrates that point I made earlier about how the rules around the use of DNA profiles can change. It involves “Denver District Attorney Mitchell Morrissey” who, in 2005, “recovered DNA profiles in three separate unsolved rape cases, but his search for matching profiles in the national DNA database failed to return any hits.”

Typically, such a search looks for complete identity between a crime-scene sample and a known offender using thirteen genetic markers. However, the software that compares profiles can reveal not only exact matches, but also near-miss matches of fewer markers. In Morrissey’s case, each of the three searches also uncovered partial matches. Because genetic information is inherited, Morrissey conjectured that those profiles might belong to relatives of the sources, and thereby point to the perpetrators of the offenses.

The only problem was the matches originated in Oregon, Arizona and California and the FBI, which administers the national database, stores its information anonymously and its rules forbade states from disclosing to other states the identifying information of anyone other than the “putative perpetrator.”

A photo of a woman in a classroom.

Professor Erin Murphy, NYU School of Law (Source: YouTube )

Morrissey wrote the FBI to complain and a few days later, he received a call from FBI Director Robert Mueller (!) who, shortly after, “changed the national database regulations to permit the release by states of identifying information in the event of a partial match.” Oregon and Arizona complied but California initially resisted. Then, after “a campaign by the state’s sheriffs and district attorneys, “California Attorney General Jerry Brown agreed to release the name” and, better still, as far as law enforcement was concerned:

…in April of 2008, Brown announced that California would not only share such information, but would also set out the first policy in the nation that explicitly authorizes intentional searches for partial matches-also known as “familial” or “kinship” searches-in its DNA databank. Additional jurisdictions have since then formally announced their intention to begin conducting familial searches,’ and individual laboratories have simply conducted such searches even in the absence of formal legal authorization or express policies.

But Murphy ends the story with a piece of information she says is generally lost in the telling—Morrisey’s familial searches didn’t work:

None of the three matches turned out to point toward a relative, much less the source, of the actual crime-scene sample. Also often absent from the tale is any story of what happened in the aftermath of the searches. How many relatives were investigated? How did officials rule out wrongly identified persons, or attempt to confirm the identity of a perpetrator? Given that it failed in three separate cases, how tailored was the partial match search?


Not in Canada?

Murphy doesn’t have the answers to those questions but they give you a sense of her concerns about familial searches. She acknowledges they can produce results, she even cites the famous—and horrible—story of California’s Grim Sleeper, a serial killer whose son’s DNA sample pointed police toward the father, whose DNA was collected (by a police detective “disguised as a busboy”) from “a half-eaten slice of pizza, a fork, two napkins, two plastic cups and a piece of chocolate cake” left on his table at a pizzeria and “rushed them to the LAPD’s lab for testing.”

But she suggests we pay a price for victories like these in terms of “equality, accuracy, privacy, racial discrimination, and democratic accountability.”

In a different context, but to the same point, Information and Privacy Commissioner of Ontario Patricia Kosseim told the CBC in 2021:

“Once you come up in a partial match, there are many law-abiding relatives that may come under intensive scrutiny of investigators who are looking to narrow down their suspects,” she said.

“So police might use these leads to surveil their homes, they might trail their comings and goings, they might question their neighbours.”

That could also lead to some unwanted disclosures, Kosseim said.

“Some people implicated may not know they were adopted, they may not know they have siblings,” she said. “And these are really difficult situations, and police services need guidance on how to handle those situations.”

(To understand what such police tactics actually look like, see this 2022 New York Post story about a man who became a murder suspect based on his father’s DNA sample at

Murphy also suggests over-reliance on “family forensic DNA” has the potential to “harm, rather than aid, police investigations,” causing investigators to rely on “genetic leads” at the expense of more traditional lines of investigation. Another worry is that discovering the “source” of the DNA could “so dominate and shape the course of any subsequent investigation that it inevitably taints the results.” And as Murphy reminds the reader more than once, the “source” of the DNA is not necessarily the perpetrator of the crime.

At the time she was writing (2010), Canada was one of the few jurisdictions that forbade familial searches outright. Murphy cites a 2009 paper by Sonya Norris which considered features of the NDDB that could potentially “deter” the use of familial searching, first:

From a practical perspective, the size of the data bank, with less than 0.5% of Canadians profiled (compared to more than 5% in the United Kingdom), reduces the chance of a finding a family member.

By my calculations the NDDB now profiles about 2.0% of the Canadian population and it’s growing every year. But it’s worth noting what the Brits, with their much larger database, had to say about familial searches in the 2020-2021 DNA database report:

Due to the cost and staffing needed to carry out familial searches, they are used only for the most serious of crimes…A total of 7 familial searches were carried out in 2020/21.

Norris also suggests that:

From a political perspective, using the Canadian Convicted Offenders Index to investigate individuals with no criminal background would be a significant policy change, one that might be difficult to implement.

There’s much more to this than I can get into in this article but I believe it’s worth thinking about because the RCMP, according to the NDDB’s 2020-2021 Annual Report, certainly is:

The NDDB is assessing the potential use of familial DNA searching as a means to provide leads to criminal investigations. This type of searching would require a change in legislation before it could be implemented. The NDDB is also supporting efforts to examine expanding the collection of DNA samples to include all individuals convicted of a designated offence.

Shorter version: let us gather even more DNA and let us do more with it.


Commercial DNA

While awaiting legislative changes that would allow them freer rein in the nationally sanctioned DNA database, RCMP and other Canadian police forces have found another way to expand the amount of DNA available to them for searching. They are, as the CBC put it in 2021:

…scouring private genealogical companies’ databases for matches to identify a familial relationship or a likely suspect.

But don’t worry, the force says it’s “reviewing the legitimacy of using genetic genealogy in investigations” even as it uses the techniques.

The CBC story was about the RCMP identifying human remains they had nicknamed “Septic Tank Sam.” (And can I just say how jarring I find the juxtaposition of this deeply disrespectful nickname with the RCMP’s claims to concern for providing family members with “closure?”) The cops turned to a Texas-based company, Othram Inc, that used DNA extracted from the victim’s bones to build a genetic profile by “uploading his information to public genetic databases.” As a result, they were able to identify the victim (although his murder remains unsolved.)

In 2020, the Office of the Privacy Commissioner called out the RCMP for “flouting federal directives by exploring a new investigative technique without spelling out its effect on the privacy of Canadians” after the Globe and Mail revealed the force had signed a $98,000 contract in March 2018 with US-based Parabon NanoLabs, a:

…“genetic-genealogy” company that mines the DNA profiles of people in hopes of identifying suspects. The company…seeks to match police crime-scene DNA with analyses drawn from “direct-to-consumer” genetic-testing companies.

As the Globe explained, while there are “no laws governing police access to tools such as these,” the RCMP has to write “what are known as privacy impact assessments [PIAs] that lay out the pros and cons of any potentially invasive new programs.”

As of 2021, the OPC was working on the PIA with the RCMP.

The Globe continues:

Several Canadian police forces are now using these kinds of forensic services [You don’t even want to know about the Edmonton police and their DNA-generated mug shots], which have far-reaching privacy implications as they can detect crime suspects who have not consented to surrendering their DNA data to authorities.

These techniques rely on roundabout searches of genetic information – usually by matching DNA recovered from crime scenes with pre-existing portraits of entire families whose members have given up their genetic information to be analyzed on consumer sites.

According to Wired, there are currently two for-profit companies—GEDmatch and FamilyTreeDNA—that allow law enforcement agency searches.

With GEDmatch, users first take a test through 23andMe, AncestryDNA, or another genetics company and then upload the raw DNA file that’s generated by those services. FamilyTreeDNA is a testing service like 23andMe or Ancestry, but unlike them, it allows law enforcement to search its database of consumer data.

Wired says that since 2019, GEDMatch users must opt-in to allow their profiles to be searched by law enforcement; FamilyTreeDNA sets new accounts to automatically grant permission for law enforcement searches, although customers can later opt out.)

GEDmatch is now owned by a Dutch firm and FamilyTreeDNA recently merged with an Australian firm, leading the “two genealogists” who are the subject of the Wired article—CeCe Moore of Parabon NanoLabs and Margaret Press—to launch a “new nonprofit DNA database specifically designed to aid law enforcement” called the DNA Justice Foundation. They expect people to voluntarily upload their DNA to the database and risk implicating themselves or their family members in criminal investigations in return for the satisfaction of helping the police.

Which allows me to end with a question asked (and answered) by Canada’s Privacy Commissioner back in 1995:

…should it be the object of government privacy policies to make life easier for the police…? Democracies accept that police efficiency must yield to respect for fundamental human rights — in this case, the right to privacy. The availability of DNA technology should not be allowed to undermine this principle.