How Post-Arrest DNA Swabs Threaten Innocent People's Privacy

Unless you’re living under a rock—or just don’t watch TV—you’re probably familiar with the mugshot and fingerprint steps of booking. Fewer are aware of the latest addition: the mouth swab.

On Friday, Herbert Stanback pleaded guilty to the hit-and-run that killed Ruth Buchanan 32 years ago. Investigators with the Charlotte-Mecklenburg Police Department identified Stanback by running DNA collected from a joint found in the hit-and-run vehicle through the Combined DNA Index System (CODIS). The FBI describes CODIS as a tool that enables “federal, state, and local forensic laboratories to exchange and compare DNA profiles electronically, thereby linking serial violent crimes to each other and to known offenders.”

The term “known offenders” might be a bit misleading. The DNA Fingerprint Act of 2005 requires all adults arrested—not convicted—of a federal crime to provide a DNA sample. Stanback’s genetic profile was available for comparison because he was previously incarcerated for larceny as a habitual felon in 2004, which placed his DNA in the National DNA Index System (NDIS), the national component of CODIS.

Requiring convicted felons to forfeit their identifying genetic information is hard to object to—convicted felons already lose certain privacy and liberties. But those merely suspected of a crime are presumed innocent until proven otherwise. Entering their DNA into a federal database for comparison with crime scene samples challenges this presumption of innocence. 

The Supreme Court disagrees. In 2013, the Court ruled in Maryland v. King that taking DNA upon arrest does not violate the Fourth Amendment’s protection against unreasonable searches and seizures. Since then, warrantless DNA collection and comparison has been widely practiced, much to the chagrin of civil liberties groups such as the American Civil Liberties Union.

According to data from the National Conference of State Legislatures, 20 states do not collect DNA upon any arrest. Of the remaining 30 states that do, most limit this collection to felony arrests, while eight also include specific misdemeanors. Even among felony arrests, the relevance of collecting DNA can vary widely: using DNA from a marijuana trafficking arrest to compare against samples from the crime scene of a serial murder is unjustifiable. 

In contrast to fingerprints and mugshots, “genetic information is typically regarded as particularly sensitive data since it’s impossible to change,” says Jennifer Huddleston, senior fellow in technology policy at the Cato Institute. Given the sensitivity and immutability of DNA, Huddleston notes that “it’s important to ask: Are there appropriate cybersecurity precautions in place to protect this information from hackers or other bad actors?”

The DNA Justice Project downplays these privacy concerns, stating that CODIS profiles only contain “20 base pairs or markers out of over 3 billion on the human genome,” which “provide no value for disease association, genetic predisposition or physical characteristics.” Moreover, CODIS only stores DNA profiles; it does not store “names or other personal identifiers of the offenders, arrestees, or detainees.” Therefore, the potential for medical and demographic discrimination—even if all the data were leaked—is minimal. 

Patrick Eddington, senior fellow in homeland security and civil liberties at the Cato Institute, disagrees with the DNA Justice Project’s assessment. Eddington says “governments should not be allowed to collect and permanently store sensitive and unique biological or biometric data on citizens not guilty of a crime. To allow it is to open the door not just to potential government misuse of the data, but to create a digital ‘honeypot’ for hackers to target and then engage in identity theft.”

Resolving cold cases is laudable; collecting, comparing, and retaining DNA from mere suspects is questionable at best and unconstitutional at worst.

The post How Post-Arrest DNA Swabs Threaten Innocent People’s Privacy appeared first on Reason.com.