Kaizen Grey

John Doe's Family Tree

The Jane Doe Files, Part 3 of 6

For more than 40 years, investigators had the Golden State Killer’s DNA and no idea whose it was. He had raped and murdered his way across California from 1975 to 1986, and he had never been arrested for anything that put him in a criminal DNA database. In 2018, a team took DNA from an old rape kit, uploaded it to a public genealogy website, and went looking for his cousins instead of him. About four and a half months later they had a name: Joseph DeAngelo, a former police officer (ISHI interview with investigator Paul Holes).

In 2020 he pleaded guilty to 13 murders and 13 rape-related charges, and admitted dozens more sexual assaults that were too old to prosecute. Prosecutors counted 87 victims (NBC News).

The technique is called investigative genetic genealogy. It fills the one gap the national DNA database can’t: a rapist whose DNA is in the kit but who has never been swabbed. It doesn’t need him in any database. It needs his family. And that’s where it runs into a problem that has nothing to do with science.

How it works

  1. A lab builds a genealogy-style profile from the crime-scene DNA. Often that’s semen from a rape kit. This is a different kind of profile from the one in the police database, so it can be compared with consumer DNA tests.
  2. Police search it against genealogy sites that allow it. That means sites like GEDmatch and FamilyTreeDNA, using portals set aside for law enforcement. They don’t see anyone’s DNA. On GEDmatch, they see a match’s name or alias, email address, and how much DNA they share with the unknown suspect (GEDmatch).
  3. Genealogists build family trees out from those distant cousins, using public records, until the trees converge on one man who fits.
  4. Police confirm it the old-fashioned way. They get his DNA directly, from a discarded cup or a warrant, and match it to the evidence. Under Justice Department policy, nobody can be arrested on a genealogy lead alone, and the technique is reserved for homicides and sex crimes where the regular DNA database has already come up empty (DOJ interim policy).

Officially, only police can run these searches; GEDmatch lets users upload only their own DNA or DNA they’re authorized to share (GEDmatch terms). In practice, the site can’t check whose DNA it’s getting, and private labs already turn DNA from clothing into files it can read (The Genetic Genealogist). A victim could try it herself. But her sample would be mixed with her own DNA, and with no chain of custody it would be worth little in court.

What makes it so powerful is how little it needs. A 2018 study in Science estimated that if just 2% of a population is in the database, more than 99% of that population would have at least one third cousin or closer in it, enough to start a family tree (Erlich et al.). You don’t have to be in the database to be findable. You just need a cousin who is.

It works. By the end of 2023, genealogy had helped solve 651 criminal cases, and most of the DNA used came from semen left in sexual offenses (FIGG case tracker). In Sacramento it identified the “NorCal Rapist,” convicted in 2020 of attacking nine women between 1991 and 2006. “Nine victims waited for more than 20 years,” the prosecutor said, and it was “only with the use of Investigative Genetic Genealogy” that the case was solved (KVIA/AP).

The box nobody checks

Ask Americans in the abstract, and they’re overwhelmingly for it. In a 2018 national survey, 80% supported police using genetic genealogy to identify violent criminals, and 78% for crimes against children (Guerrini et al., PLOS Biology). A follow-up survey in 2023 found support for violent-crime cases at least as strong (FIGG at 5).

Then look at what happened when people had to act on it.

In May 2019, after a controversy over a non-homicide case in Utah, GEDmatch changed its rules. Instead of everyone being searchable by police unless they objected, users had to opt in. Overnight, the number of profiles police could search fell from more than a million to about 20,000; two weeks later it was around 50,000, a 95% drop (KSL; PBS NewsHour). Opt-ins climbed slowly after that. By 2023 one genealogist estimated about 700,000 of GEDmatch’s 1.8 million profiles were open to police, still well under half (The Intercept).

The two biggest testing companies don’t let police in at all. 23andMe says it uses “all practical legal and administrative resources to resist requests” and reports producing no data in response to any of the 13 law-enforcement requests it has received since 2015 (23andMe). Ancestry says it insists on a court order or search warrant, and reports zero valid DNA requests in 2025 (Ancestry). When 23andMe went bankrupt in 2025, about 1.9 million customers, roughly 15%, asked the company to delete their data rather than see it change hands (Yahoo/AP).

The law is moving toward more limits, not fewer. Maryland requires a judge’s approval for these searches, Montana requires a warrant, and Utah restricts them to violent felonies and missing persons (Maryland; Utah SB 156).

So in surveys, four in five people say yes. On GEDmatch, the one major site that put the question directly to its users, most still haven’t checked the box.

Protecting the uncle

Why the gap? Some of the reasons are serious, and they deserve a fair hearing.

But the same focus groups surfaced something else. Participants worried about “genetic snitching,” and said relatives “shouldn’t be made part of an investigation.”

That one deserves a harder look, because of who it protects. Opting in doesn’t put innocent relatives on trial. Police can only search with DNA from an unsolved violent crime, and under federal policy no one can be arrested on a genealogy match alone. The relative with the most to lose is the one whose DNA is already sitting in a rape kit.

Every family has an uncle people don’t leave the kids alone with. Maybe there was a story once, and his version was that she was drunk and it was just sex. When someone declines to check the box because they don’t want to be the reason a family member goes to prison, the person they’re protecting is him. That instinct, to keep it in the family and not make trouble for a man over what he did to a woman, is about as pure an example of rape culture as exists. Not because anyone endorses rape, but because a man’s comfort quietly outranks a woman’s justice, and it never has to be said out loud.

What it can’t do

Genealogy is the most powerful “who was there?” tool ever built. That’s also its limit.

It only helps when nobody knows who he is: a stranger in a parking garage, a man she never saw clearly, an attack she can’t remember because she was drugged. Most rapes aren’t like that. As Part 4 shows, most victims know the man who raped them. When she can already name him, police don’t need his cousins; they can get his DNA directly. And a match proves the same thing it always does: that sex happened. Whether she consented is still a fight about her word against his.

So genealogy won’t fix most rape cases. What it can do is catch the men who are hardest to catch, the strangers who rape again and again until a database finally names them. The NorCal Rapist attacked nine women over 15 years. The Golden State Killer had 87 victims.

What checking the box means

If you’ve taken a consumer DNA test, here is the decision in plain terms.

Whether to do it is your call, and the privacy worries are real. But it’s worth being honest about what the choice is. For most people, opting in risks very little. Not opting in protects someone. It’s worth asking who.

Next in the series, Part 4: Jane Doe Knows His Name.

Research and drafting assistance for this piece, including source verification, was provided by Claude (Anthropic). All claims are cited to primary or secondary sources linked inline throughout; the analysis and opinions are my own.