Investigative leads and DNA booking stations

A July Bredemarket post on Facebook has garnered some attention in September.

I wanted to answer some questions about rapid DNA use in a booking station, how (and when) DNA is used in booking (arrests), what an “investigative lead” is, and whether acquiring DNA at booking is Constitutional.

(TL;DR on the last question is “yes,” per Maryland v. King.)

Are rapid DNA booking stations a Big Brother plot?

The post in question was a Facebook post to the Bredemarket Identity Firm Services Facebook group. I posted this way back in July, when Thermo Fisher Scientific became the second rapid DNA vendor (of two rapid DNA vendors; ANDE is the other) whose system was approved by the U.S. Federal Bureau of Investigation (FBI) for use as a law enforcement booking station.

When I shared this on Facebook, I received some concerned comments:

“Big brother total control”

“Is this Constitutional??? Will the results of this test hold up in courtrooms???”

I’ll address the second question later: not just in regard to rapid DNA, but to DNA in general. At this point, however, I will go ahead and say that the use of rapid DNA in booking was authorized legislatively by the Rapid DNA Act of 2017. This was followed by over three years of procedural stuff until rapid DNA booking station use was authorized this year.

To accurately state what “rapid DNA booking station use” actually means, let me refer to the FBI’s language, starting with the purpose:

The FBI Laboratory Division has been working with the FBI Criminal Justice Information Services (CJIS) Division and the CJIS Advisory Policy Board (CJIS APB) Rapid DNA Task Force to plan the effective integration of Rapid DNA into the booking station process.

By way of definition, a “booking station” is a computer that processes individuals who are “booked,” or arrested. The FBI’s plan was that (when authorized by federal, state, or local law) when an arrested individual’s fingerprints were captured, the individual’s DNA would be captured at the same time. (Again, only when authorized.)

The use of the term “reference sample buccal (cheek) swab” is intentional. The FBI’s current development and validation efforts have been focused on the DNA samples obtained from known individuals (e.g., persons under arrest). Because known reference samples are taken directly from the individual, they contain sufficient amounts of DNA, and there are no mixed DNA profiles that would require a scientist to interpret them. For purposes of uploading or searching CODIS, Rapid DNA systems are not authorized for use on crime scene samples.

“CODIS,” by the way, is the Combined DNA Index System, a combination of federal, state, and local systems.

“Rapid DNA” is an accelerated, automated DNA method that can process DNA samples in less than two hours, as opposed to the more traditional DNA processes that can take a lot longer.

The FBI is NOT ready to use rapid DNA to solve crimes, although some local police agencies have chosen to do so. And until February of this year, the FBI was not ready to use rapid DNA in the booking process either.

So what has been authorized?

The Bureau recognizes that National DNA Index System (NDIS) approval of the Rapid DNA Booking Systems and training of law enforcement personnel using the approved systems are integral to ensuring that Rapid DNA is used in a manner that maintains the quality and integrity of CODIS and NDIS.

Rapid DNA Booking System(s) approved for use at NDIS by a law enforcement booking station are listed below.

ANDE 6C Series G (effective February 1, 2021)

RapidHIT™ ID DNA Booking System v1.0 (effective July 1, 2021) 

If you read the FBI rapid DNA page, you can find links to a number of forensic, security, and other standards that have to be followed when using rapid DNA in a booking environment.

But those aren’t the only restrictions on rapid DNA use.

Can ANY law enforcement agency use rapid DNA in booking?

Um, no.

According to the National Conference of State Legislatures (2013; see PDF), not all states authorize the taking of DNA after an arrest. As of 2013, 20 states did NOT allow the taking of DNA from individuals who had been arrested but not convicted. And of the 30 remaining states, some (such as Connecticut) only allowed taking of DNA for “serious felonies,” some (such as California) for all felonies, and various mixtures in between. Oklahoma, for example, only allowed taking of DNA for “aliens unlawfully present under federal immigration law.”

Now, of course, a rogue police officer could take your DNA when not legally authorized to do so. Then again, a rogue restaurant employee could put laxatives in your food; that doesn’t mean we outlaw laxatives.

An “investigative lead”

So let’s say that you’re arrested for a crime, and your state allows the taking of DNA for your crime at arrest, and your local law enforcement agency has a rapid DNA instrument.

Now let’s assume that your DNA is searched against a DNA database of unsolved crimes, and your DNA matches a sample from another crime. What happens next?

If there is a match, police will likely want to take a closer look.

Wait a minute. There’s a DNA match! Doesn’t that mean that the police can swoop in and arrest the individual, and the individual is immediately convicted?

Um, no. Stop trusting your TV.

It takes more than DNA to convict a person of a crime.

While DNA can provide an investigative lead, DNA in and of itself is not sufficient to convict an individual. The DNA evidence usually has to be supported by additional evidence.

Especially since there may be other explanations of how the DNA got there.

In 2011, Adam Scott’s DNA matched with a sperm sample taken from a rape victim in Manchester—a city Scott, who lived more than 200 miles away, had never visited. Non-DNA evidence subsequently cleared Scott. The mixup was due to a careless mistake in the lab, in which a plate used to analyze Scott’s DNA from a minor incident was accidentally reused in the rape case.

Then there’s the uncomfortable and inconvenient truth that any of us could have DNA present at a crime scene—even if we were never there. Moreover, DNA recovered at a crime scene could have been deposited there at a time other than when the crime took place. Someone could have visited beforehand or stumbled upon the scene afterward. Alternatively, their DNA could have arrived via a process called secondary transfer, where their DNA was transferred to someone else, who carried it to the scene.

But there is a DNA case that was (originally) puzzling. Actually, a whole bunch of DNA cases.

There is an interesting case, known as the Phantom of Heilbonn, that dates from 1993 in Austria, France and Germany. From that year the DNA of an unknown female was detected at crime scenes in those countries, including at six murder scenes, one of the victims being a female police officer from Heilbronn, Germany. Between 1993 and March 2009 the woman’s DNA was detected at 40 crime scenes which ranged from murder to burglaries and robberies. The DNA was found on items ranging from a biscuit to a heroin syringe to a stolen car.

Then it got really weird.

In March 2009 investigators discovered the same DNA on the burned body of a male asylum-seeker in France. Now this presented something of an anomaly: the corpse was male but the DNA was of a female.

You guessed it; it was the swabs themselves that were contaminated.

So a DNA match is just the start of an investigative process, but it could provide the investigative lead that eventually leads to the conviction of an individual.

Perhaps you’ve noticed that I use the phrase “investigative lead” a lot when talking about DNA and about facial recognition. Trust me, it’s important.

But is the taking of DNA at booking Constitutional?

Obviously this is a huge question, because technical ability to do something does not automatically mean that you are Constitutionally authorized to do so. There is, after all, Fourth Amendment language protecting us against “unreasonable searches and seizures.”

Is the taking of DNA from arrestees who have not been convicted (assuming state law allows it) reasonable, or unreasonable?

Alonzo Jay King, Jr. had a vested interest in this question.

Alonzo Jay King Jr…was arrested in 2009 on assault charges. Before he was convicted of that crime, police took a DNA sample pursuant to Maryland’s new law allowing for such collections at the time of arrest in certain offenses….

I want to pause right here to make sure that the key point is highlighted. King, an arrestee who had not been convicted at the time of any crime, was compelled to provide evidence. At the time of arrest, collection of certain types of evidence (such as fingerprints) is “reasonable.” But collection of certain other types of evidence (such as a forced confession) is “unreasonable.”

So King’s DNA was taken and was searched against a Maryland database of DNA from unsolved crimes. You won’t believe what happened next! (Actually, you will.)

The DNA matched a sample from an unsolved 2003 rape case, and Mr. King was convicted of that crime.

Sentenced to life in prison, actually.

Wicomico County Assistant State’s Attorney Elizabeth L. Ireland said she requested the court impose a life sentence on King, not only because of his past criminal convictions, but also because it turned out that he was a friend of the victim’s family. She said this proved King was a continuing danger to the community.

Before you say, “well, if he was the rapist, he should be imprisoned, legal niceties notwithstanding,” think of the implications of that statement. The entire U.S. legal system is based upon the premise that it is better for a guilty person to mistakenly go free than for an innocent person to mistakenly be punished.

And if that doesn’t sink in…what if YOU were arrested and convicted unlawfully? What if a plate analyzing YOUR DNA wasn’t cleaned properly, and you were unjustly convicted of rape? Or what if a confession were coerced from YOU, and used to convict you?

So King’s question was certainly important, regardless of whether or not he actually committed the rape for which he was convicted.

King therefore appealed on Fourth Amendment grounds, the Maryland Court of Appeals overturned his conviction (PDF), and the State of Maryland brought the case to the U.S. Supreme Court in 2013 (Maryland v. King). In a close 5-4 decision (PDF) in which both conservatives and liberals were on both sides of the argument, the Court ruled that the taking of DNA from arrestees WAS Constitutional.

But that wasn’t the end of the argument, because a new case arose in the state of California. But the California Supreme Court ruled in 2018 that the practice was allowed in that state.

So the taking of DNA at booking is not only authorized (in some states, for some charges), it’s also Constitutional. (Although the Supreme Court’s opinion is still widely debated.)

So anyone who gets arrested for a felony in my home state of California should be ready for a buccal (cheek) swab.

Maryland will soon deal with privacy stakeholders (and they CAN’T care about the GYRO method)

Just last week, I mentioned that the state of Utah appointed the Department of Government Operations’ first privacy officer. Now Maryland is getting into the act, and it’s worth taking a semi-deep dive into what Maryland is doing, and how it affects (or doesn’t affect) public safety.

By François Jouffroy – Christophe MOUSTIER (1994), Attribution, https://commons.wikimedia.org/w/index.php?curid=727606

According to Government Technology, the state of Maryland has created two new state information technology positions, one of which is the State Chief Privacy Officer. Because government, I will refer to this as the SCPO throughout the remainder of this post. If you are referring to this new position in verbal conversation, you can refer to the “Maryland skip-oh.” Or the “crab skip-oh.”

From https://teeherivar.com/product/maryland-is-for-crabs/. Fair use. Buy it if you like it. Virginians understand the origins of the phrase.

Governor Hogan announced the creation of the SCPO position via an Executive Order, a PDF of which can be found here.

Let me call out a few provisions in this executive order.

  • A.2. defines “personally identifiable information,” consisting of a person’s name in conjunction with other information, including but not limited to “[b]iometric information including an individual’s physiological or biological characteristics, including an individual’s deoxyribonucleic acid.” (Yes, that’s DNA.) Oh, and driver’s license numbers also.
  • At the same time, A.2 excludes “information collected, processed, or shared for the purposes of…public safety.”
  • But on the other hand, A.5 lists specific “state units” covered by certain provisions of the law, including both The Department of Public Safety and Correctional Services and the Department of State Police.
  • The reason for the listing of the state units is because every one of them will need to appoint “an agency privacy official” (C.2) who works with the SCPO.

There are other provisions, including the need for agency justification for the collection of personally identifiable information (PII), and the need to provide individuals with access to their collected PII along with the ability to correct or amend it.

But for law enforcement agencies in Maryland, the “public safety” exemption pretty much limits the applicability of THIS executive order (although other laws to correct public safety data would still apply).

Therefore, if some Maryland sheriff’s department releases an automated fingerprint identification system Request for Proposal (RFP) next month, you probably WON’T see a privacy advocate on the evaluation committee.

But what about an RFP released in 2022? Or an RFP released in a different state?

Be sure to keep up with relevant privacy legislation BEFORE it affects you.

Three recent #DNA stories

By Zephyris – Own work, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=15027555

Over the last few days, I’ve run across three stories that deal with two aspects of DNA collection: familial DNA, and DNA mixtures.

Familial DNA

(This case was mentioned on Forensics and Law in Focus, a recommended read for all sorts of forensic techniques.)

Of all of the biometrics, DNA has a property that the others don’t: the similarity of DNA between family members. Someone finding my child’s fingerprints won’t necessarily be able to find me, and even someone who finds my child’s face won’t necessarily be able to find me.

But 84 year old Raymand Vannieuwenhoven is on trial for a 1976 murder because of DNA similarities in families.

Vannieuwenhoven is accused in the July 9, 1976, murders of a Green Bay couple who was camping at McClintock Park in the Town of Silver Cliff. David Schuldes, 25, and Ellen Matheys, 24, were shot and killed at the campground….

A DNA profile obtained through evidence was already on file with the State Crime Lab, according to previous testimony….

Baldwin explained how a breakthrough came in 2018 when Parabon Nanolabs of Virginia developed new technology to examine DNA evidence, which could provide certain genetic characteristics of possible suspects through DNA….

On Dec. 21, 2018, Parabon contacted Baldwin and informed him that a possible suspect was found through the DNA testing. He said they gave him a Green Bay-area family—the Vannieuwenhovens—that had four sons and four grandsons who possibly could be a match.

The detectives then had to test the relatives and compare their DNA to the crime scene DNA. But not ALL of the relatives: this was solely used as an investigative lead, and there was no point in testing the grandsons for a 1976 murder. Raymand was one of those whose DNA was collected (by having him lick an envelope to seal it), and the probabilities indicated a match.

Obviously this technique has controversy in some quarters, since the family members who originally provided the DNA had no idea that it would be used to arrest (or, in some cases, exonerate) another family member in this way. But the technique is being used.

By the way, Vannieuwenhoven was found guilty, and the 84 year old may be sentenced to life in prison.

DNA mixtures

The other story concerns what can be found when a DNA sample is collected. The DNA sample may contain a lot of things, from a lot of people.

With improvements in DNA testing methods, we don’t need much DNA to make a profile and see perhaps if I am a likely contributor to that sample or if you have contributed — even if you never touched the table directly. That level of DNA profiling is useful for many different types of crimes, but also brings up the issue of relevance. We aren’t explaining how DNA got to a location. 

As an example, a single item at a crime scene may include the DNA of the person who committed the crime, the crime victim, an innocent bystander who touched the area in question before the crime was committed, and (if the police officer was careless) the police officer investigating the crime.

Now you have to look at the DNA sample that was collected. With DNA mixtures, this gets tough.

If single-source DNA is like basic arithmetic and a two-person mixture is like algebra, then a complicated mixture is like calculus!

The quotes above are from John Butler of the National Institute of Standards and Technology, who has a concern about how all of the different laboratories interpret DNA mixtures. Ideally, all labs should work together to have a consistent, verifiable way to interpret these mixtures.

We wanted to see if there were established methodologies that worked better than others when tested, and where those limits were being drawn. What we found is that there is not enough publicly available data to enable an external and independent assessment of the degree of reliability of DNA mixture interpretation practices.

NIST, as it does in other areas, seeks to advance the science, and is urging stakeholders to work together to do so.

But wait; there’s more on DNA mixtures!

While NIST has been conducting the work above, the National Institute of Justice have been funding other work.

Michael Marciano, research assistant professor and director for research in the Forensic and National Security Sciences Institute (FNSSI) within the College of Arts and Sciences, and Jonathan Adelman, research assistant professor in FNSSI, have invented a novel hybrid machine learning approach (MLA) to mixture analysis (U.S. patent number 10,957,421). Their method combines the strengths of current computational and expert analysis approaches with those in data mining and artificial intelligence.

Marciano and Adelman received funding from the National Institute of Justice to further develop their idea in 2014. Although this intellectual property has not been fully developed for commercial use, they are pursuing funding to transition the technology. Once this is done, they are hopeful that the new method will be used throughout the law enforcement and criminal justice communities, specifically by forensic DNA scientists and the legal community.

Actually, once the intellectual property has been developed for commercial use, it will NOT be used THROUGHOUT the law enforcement and criminal justice communities. It will be used by PORTIONS of the law enforcement and criminal justice communities, while OTHERS within the community will use commercial products from competitors.

Commercialization of a product actually works AGAINST universal acceptance, except in very limited cases. Take commercialization of fingerprinting products. As Chapter 6 of The Fingerprint Sourcebook details, independent research was performed in four separate countries (France, Japan, the UK, and the US) which, after commercialization, led to three (now two) separate fingerprinting products: NEC’s product from Japanese research, and IDEMIA’s product from separate French (Morpho) and United States (Printrak) research. This initial research, combined with subsequent research that led to additional products, led to an interoperability issue, despite efforts from NIST to advance greater inoperability.

Will NIST have to do the same thing to reconcile competing DNA mixture analysis methods?

The Surfside building collapse may require a redefinition of “real-time” regarding rapid DNA

I’ve previously noted that the definition of “real-time” can vary depending upon the use case. In the automated fingerprint identification systems world of the late 1990s, a definition of “real-time” in minutes was appropriate, but for the computer aided dispatch world, “real-time” was (and is) measured in seconds.

“Hi, SCC folks, welcome to Printrak. You’re joining a company that sells REAL TIME AFIS that delivers results within one minute! Aren’t you impressed?”

“Hello, new corporate overlords. We provide computer aided dispatch systems that send police, fire, and medical personnel to crime scenes and emergency sites as soon as possible. If our CAD systems took AN ENTIRE MINUTE to dispatch personnel, PEOPLE WOULD DIE. We use really powerful computers to get personnel dispatched in a second. Enjoy your real time AFIS…amateurs.”

I also mentioned a two-hour “real-time” use case, which is (conservatively) the time it takes a rapid DNA instrument to do its work.

The rapid DNA vendors provide machines that can perform an automated DNA analysis in 90 minutes, a vast improvement over traditional DNA especially when existing backlogs are taken into account. And for the most part, 90 minutes is fine.

But the Surfside tragedy illustrates how 90 minutes may not be adequate.

There’s already been coverage of how rapid DNA can be, and is being, used to identify victims of the Surfside building collapse. NPR ran an article on this, and WFLA aired a news report.

To date I have not found a public source that lists how many rapid DNA machines are being used in the investigation, but let’s do a little math and see how many rapid DNA instruments could possibly be required.

Assume a conservative two hours is required to fully analyze each DNA sample and determine the possible identity of a deceased victim. Further assume that because of the importance of this case, the DNA instruments are being operated 24 hours a day, 7 days a week. No going home at 5:00 pm in this case, which is receiving international attention.

Now let’s look at the numbers. As of 2:00 pm Eastern Daylight Time today, 20 deaths are confirmed, and 128 people are still unaccounted for.

What happens if there is a sudden horrific discovery of 100 deceased? How long would it take to identify all of them?

If 3 rapid DNA instruments are available, and each is processing 12 DNA samples in a 24 hour day, then it would take about three days to run all the samples through the DNA instruments.

Three very long days for the families of the potential victims who are waiting for news.

So the authorities may need to move to plan B.

The Indian River County Sheriff’s Office has been notified it might be asked to respond with the agency’s rapid DNA test machines to the deadly condominium collapse in Surfside, Sheriff Eric Flowers said….

“They put our folks on standby last weekend to respond if theirs got overwhelmed,” Flowers said. “At this point, they’ve not called for that, but our folks are ready and our machines are ready that if they call us we will respond to assist in DNA identification.”

Yes, in this case you can throw more machines at a problem to solve it, provided that you have the proper personnel to support them. Luckily, the rapid DNA instruments themselves do not need a forensic background to operate them, since they are designed to operate in an automated fashion. However, if rapid DNA analysis has an inconclusive result, then additional traditional DNA analysis will have to be performed which will require forensic expertise. (That, however, is outside of the scope of this post.)

By Zephyris – Own work, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=15027555

So where do we stand after Surfside?

Previous rapid DNA identification efforts have just involved one person or less than a dozen people. But this case, in which potentially over 100 people may need to be identified, is truly pushing the limits of the technology.

(Come to think of it, it’s similar to how video analytic analysis was pushed to the limits by the Boston Marathon bombings. But I digress.)

And sadly, there have already been instances in which that many people, or more people, needed to be identified. Imagine, for example, the crash of a large airplane. Or worse still, the crash of two large airplanes into a skyscraper.

And now this 90 minute response time suddenly doesn’t seem so fast any more.

DNA reunions of families don’t just happen at the U.S.-Mexico border

Dr. Michael Bowers shared an article about DNA-ProKids.

From the article:

DNA-ProKids works with governments in Peru, Mexico, Guatemala, El Salvador, Paraguay, Thailand, Brazil, India and Malaysia….

The programme uses our unique genetic footprint to trace thousands of missing children around the world. Some have been stolen from their parents and trafficked for sex or as slave labour, others sold in illegal adoptions, and some lost in hospital mix-ups….

The article includes several stories, including one of a woman who was drugged and her baby taken from her.

Guatemala’s government, which uses the DNA-ProKids programme, contacted the police who were able to find the baby using DNA within 48 hours. The thief, who was wearing a mask because of the pandemic, could not be identified.

Read more here, or visit the DNA-ProKids website.

Quantifying the costs of wrongful incarcerations

As many of you already know, the Innocence Project is dedicated to freeing people who have been wrongfully incarcerated. At times, the people are freed after examining or re-examining biometric evidence, such as fingerprint evidence or DNA evidence.

The latter evidence was relevant in the case of Uriah Courtney, who was convicted and sentenced to life in prison for kidnapping and rape based upon eyewitness testimony. At the time of Courtney’s arrest, DNA testing did not return any meaningful results. Eight years later, however, DNA technology had advanced to the point where the perpetrator could be identified—and, as the California Innocence Project noted, the perpetrator wasn’t Uriah Courtney.

I’ve read Innocence Project stories before, and the one that sticks most in my mind was the case of Archie Williams, who was released (based upon fingerprint evidence) after being imprisoned for a quarter century. At the time that Williams’ wrongful conviction was vacated, Vanessa Potkin, director of post-conviction litigation at the Innocence Project, stated, “There is no way to quantify the loss and pain he has endured.”

But that doesn’t mean that people haven’t tried to (somewhat) quantify the loss.

In the Uriah Courtney case, while it’s impossible to quantify the loss to Courtney himself, it is possible to quantify the loss to the state of California. Using data from the California Legislative Analyst’s Office 2018-19 annual costs per California inmate, the California Innocence Project calculated a “cost of wrongful incarceration” of $649,624.

One can quibble with the methodology—after all, the 2018-19 costs presumably overestimate the costs of incarcerating someone who was released from custody on May 9, 2013—but at least it illustrates that a cost of wrongful incarceration CAN be calculated. Add to that the costs of prosecuting the wrong person (including jury duty daily fees), and the costs can be quantified.

To a certain extent.