Someone in Joseph James DeAngelo’s extended family went looking for their great-grandparents. What they turned up was him.

They had no idea, of course. A saliva sample went into a tube, off to a consumer testing company, and the raw data that came back got uploaded to GEDmatch, a free site where anyone could compare their DNA against everyone else’s. It was built for hobbyists chasing missing branches on a family tree, and in 2018 investigators quietly used it to run a genetic profile lifted from a Californian crime scene.

What the match actually said

No name came back. Nothing that tidy.

It returned more than a thousand distant genetic cousins, most of them third cousins or further out, which is roughly like being told your suspect is somewhere in a crowd of a few hundred strangers. Genetic genealogist Barbara Rae-Venter, brought in by Contra Costa County investigator Paul Holes, spent months building trees backwards from those matches to shared ancestors, then forwards again, striking out women, wrong ages and men living in the wrong part of the state.

Six names survived.

Investigators pulled Californian driver’s licence records for all six, and only one had blue eyes, a trait Rae-Venter had predicted from the crime scene sample. That man was DeAngelo.

Rae-Venter told CBS News she got there 63 days in, alone at her computer at three in the morning. What followed was ordinary police work. Detectives put DeAngelo under surveillance, fished a discarded straw from his rubbish and swabbed his car door handle at a shopping centre. His DNA matched. He was arrested in April 2018 and pleaded guilty in 2020 to 13 murders, drawing life without parole.

The sums that made everyone nervous

Six months after the arrest, a team led by Yaniv Erlich published a paper in Science that did the obvious follow-up maths. Working with 1.28 million consumer genomic profiles, they projected that about 60 per cent of searches for people of European descent would turn up a third cousin or closer, close enough to identify almost anyone once you add public records. At around three million profiles, they argued, nearly every American of European ancestry becomes findable.

That is one paper, and a projection rather than a headcount. Other geneticists argued the press release oversold what the modelling supported, and the profiles skewed towards European descent, since that demographic buys the kits most.

Even discounted, the finding lands somewhere uncomfortable. A person can decline to test, never touch a saliva kit, and still be traceable through a second cousin they have never met who signed up out of curiosity. Genetic privacy turns out to be a household decision made by whichever household member is keenest on genealogy.

The rules arrived late

For about a year, none of it was regulated. Then in May 2019, after criticism over a Utah assault case where the site bent its own rules for police, GEDmatch switched every profile to opted out by default, leaving it to users to opt in. The number of profiles available for police searches fell from around 1.2 million to zero overnight. Holes warned that active offenders would stay on the street because of it.

The pool has been rebuilding slowly since. Researchers writing in the Journal of Law and the Biosciences have noted the split between the two big databases: roughly 30 per cent of public GEDmatch profiles opted in, against more than 96 per cent at FamilyTreeDNA, which chose the opposite default.

Governments moved slower than the companies. The US Department of Justice issued an interim policy in late 2019, restricting eligible case types wherever federal funding was involved. Maryland went further in May 2021 with what legal scholars writing in Science called the first comprehensive law of its kind anywhere, requiring judicial authorisation before a search, on a model borrowed from wiretap statutes.

By then the technique had already been used in hundreds of cases, few of them making headlines.

Consent, in the loosest sense

Every account of this case reaches for the same word: breakthrough. Fair enough. The alternative was a man who murdered 13 people living out his days quietly in Citrus Heights, his name kept out of it entirely.

Still, the mechanism is worth examining closely. DeAngelo was caught because a distant relative wanted to know where their family came from, and that curiosity was converted, without anyone asking, into an investigative tool covering every branch of the tree. The relative consented to finding cousins. What they actually handed over was a searchable map of hundreds of people who had never heard of them.

Opt-in boxes and warrant requirements fix the paperwork. They do not change the underlying fact that in a genetic database, nobody gets to speak only for themselves.