Before 2018, DNA at a Crime Scene Only Helped If You Had a Name. One Database Changed That.

For four decades, a sample existed. It had been collected, preserved, logged, relogged, tested, retested, and compared against every name law enforcement could justify feeding into the national database. It matched nothing. The man who left it had attacked at least fifty women, murdered at least thirteen people across California, and then, at some point in the 1980s, simply stopped — or at least stopped in a way anyone could trace. The sample remained. The man did not surface. That is where the case sat in 2017: a confirmed biological profile with no confirmed identity attached to it, which is forensic science's version of a locked room with the key missing.

The standard model of forensic DNA identification runs in one direction. You have a crime scene profile. You have a suspect. You test both and either they match or they don't. The database version of this — CODIS, the FBI's Combined DNA Index System — works the same way, but at scale: you upload the unknown profile and search it against a library of known offenders. If the unknown profile belongs to someone already in that library, the system finds them. If it doesn't, you get nothing. This architecture was built on a reasonable assumption: that DNA evidence is a confirmation tool, not a discovery tool. It answers the question "is this person the source?" It cannot, on its own, answer "who is this person?" That distinction seemed permanent. For most of forensic history, it was.

What changed in April 2018 was not the DNA. The sample from the Golden State Killer was the same sample it had always been. What changed was the direction of the search — and the database it ran through. Investigator Paul Holes, working with genetic genealogist Barbara Rae-Venta^[3] and a small team that had been quietly developing the methodology for years, uploaded the killer's DNA profile not to CODIS but to GEDmatch, a public genealogy platform where ordinary people upload their own consumer ancestry test results to find distant relatives. The profile returned partial matches. Not to the killer — to his distant cousins, people who shared enough DNA to suggest a common ancestor a few generations back. From those partial matches, the team built family trees forward in time, narrowing by age, sex, geography, and known details of the crimes. The trees eventually converged on a single name: Joseph James DeAngelo, a seventy-two-year-old former police officer living in Citrus Heights, California.

DeAngelo was arrested on April 24, 2018. DNA recovered from a discarded item — something he had touched in public — confirmed the match. He later pleaded guilty to thirteen murders and admitted to the rapes. The case closed. But what it left behind was not a closed question. It was a methodology — sometimes called investigative genetic genealogy, or IGG — that had just demonstrated, in public and under scrutiny, that the old assumption about what forensic DNA could do was wrong. The tool had not changed. The frame around it had.

The Architecture of the Old System

CODIS was established in 1990 and became a national system in 1998. It works by storing short tandem repeat profiles — specific locations on the genome where sequences of base pairs repeat a countable number of times. The original system used thirteen of these STR markers; a 2017 expansion added seven more^[1]. Two profiles match when the repeat counts at all tested locations are identical or within expected variation. The system is fast, statistically robust, and well-understood. It is also, by design, a closed loop. Profiles in CODIS belong to convicted offenders, arrestees in some states, and a smaller category of forensic unknowns. If your DNA has never touched the criminal justice system, it is not in CODIS. You are, from that system's perspective, invisible.

This limitation was documented and accepted. The FBI estimated that CODIS generates investigative leads in roughly 90 percent of searches where a known offender profile exists in the database. That number sounds high until you consider what it leaves out: first-time offenders, people from demographics historically underrepresented in criminal databases, and anyone careful enough to have avoided arrest before committing a serious crime. The Golden State Killer fit the third category. He was a former law enforcement officer with apparent operational knowledge of how not to get caught. Whatever his reasons for stopping in the mid-1980s, they worked. CODIS had nothing.

“The old system could confirm a suspect you already had. It could not find one you had never heard of.”

The Methodology Nobody Wanted to Try

The idea of using public genealogy databases for forensic identification had circulated in specialist circles for years before the DeAngelo case. The logic was straightforward: consumer DNA testing — services like 23andMe and AncestryDNA — analyzes hundreds of thousands of SNPs, single nucleotide polymorphisms, across a person's genome. These are positions where the genome commonly varies between individuals. They are not the same markers CODIS uses, and converting between the two formats requires additional processing, but the underlying information is compatible enough to allow relative-finding. If a suspect's DNA can be reformatted into the SNP profile type used by consumer tests, it can then be searched against databases of people who took those tests voluntarily and uploaded their results. Distant relatives — third cousins, fourth cousins — share enough genome to show up as partial matches.

The problem, for years, was institutional. Law enforcement agencies were not designed to work like genealogists, and genealogists were not embedded in cold case units. The methodology also raised immediate questions about consent and scope: the people in genealogy databases had uploaded their DNA to find relatives, not to have it searched by police. And critically, the technique required building family trees from scratch — laborious, skilled work that produced probabilistic leads rather than definitive hits. In an environment where prosecutors and investigators were accustomed to DNA as a yes-or-no instrument, this looked like an unreliable approximation. Barbara Rae-Venta later described years of pitching the approach to agencies that were skeptical or simply uninterested. The case wasn't going to close on a maybe.

What eventually made the DeAngelo investigation possible was the size of the GEDmatch database. By 2017, it held roughly one million profiles — enough that statistically, most people of European ancestry had at least one third cousin or closer already in it. The math, developed in part through academic work on genetic genealogy and population genetics, suggested a database of that size should return usable partial matches for a significant proportion of the population. The team ran the killer's profile. The partial matches appeared. The genealogy work took months of careful tree-building, cross-referencing historical records, and eliminating candidates who didn't fit the geography or timeline. But the method worked.

What the Method Actually Does — and What It Doesn't

“Investigative genetic genealogy doesn't find a suspect. It finds a cloud of relatives and then asks a genealogist to find the suspect inside it.”

The distinction matters because the technique is sometimes described as if it produces a direct identification from a database search. It doesn't. The database search produces a list of people who share segments of DNA with the unknown contributor — people who are almost certainly not the suspect themselves, but who share a recent enough common ancestor to be genetically traceable relatives. From there, the genealogist builds outward: who are this partial match's parents, grandparents, siblings, children? Where did the family live? Which branches stayed in the relevant geography? Which individuals would have been the right age to commit the crimes? The DNA work narrows the universe. The genealogy work narrows it further. The final confirmation still requires a traditional DNA match — ideally from something the suspect discarded voluntarily, in public, without expectation of privacy.

This architecture has a corollary that is less comfortable: innocent people appear in the process. Family members who are partial matches in the database are not suspects. They did not consent to being part of a criminal investigation. Their DNA, uploaded to find their grandmother's birthplace or a long-lost cousin, became a waypoint in a homicide inquiry. In the DeAngelo case, those relatives were eliminated methodically and their identities have not been made public. But the question of what happens to them — procedurally, legally, in terms of documented records — was not answered by the arrest. It was only clarified that the technique is powerful enough that the answer matters.

The Policy Scramble That Followed

GEDmatch's terms of service, at the time of the DeAngelo investigation, did not explicitly authorize law enforcement searches. The company updated its terms in 2019 to require users to opt in to law enforcement matching^[4] — meaning only profiles from users who actively checked a box would be searchable by investigators. Enrollment in the opt-in pool dropped sharply. Privacy advocates called it a meaningful protection. Some law enforcement officials called it an obstacle. The scientific reality is somewhere between those positions: the technique still works on a smaller database, but the probability of finding a usable partial match decreases as the pool shrinks. A 2019 study using population genetics modeling^[2] estimated that a database of roughly three million opt-in profiles would be needed to reliably identify suspects of European ancestry. GEDmatch's opt-in pool has not reached that threshold.

The FBI issued interim guidelines for investigative genetic genealogy in 2019 and formalized them into a policy framework over the following years. The guidelines restrict IGG use to violent crimes and unidentified remains cases, require exhaustion of conventional investigative leads first, and mandate supervisory approval. Several states have enacted their own legislation, some more restrictive and some more permissive than the federal guidelines. The result is a patchwork: what is permissible in one jurisdiction is prohibited in another, and the legal infrastructure is still catching up to a methodology that has been in active use for several years. As of 2024, IGG has been credited with identifying suspects or remains in hundreds of cases — the exact number depends on who is counting and what counts as a "use" — but the legal framework governing it remains unsettled.

The Assumption That Didn't Survive

“The file from 1979 didn't change. The database around it did — and that turned out to be enough.”

The history of forensic science is largely a history of expanding what physical evidence can say. Fingerprints moved from a curiosity to a courtroom standard. Blood typing narrowed suspect pools. DNA typing replaced blood typing and compressed those pools to near-certainty. Each transition involved a methodological argument — a period when the new technique was resisted, tested, challenged, and eventually absorbed into standard practice. Investigative genetic genealogy is somewhere in that process now: proven in high-profile cases, contested in policy, and still generating the kind of legal questions that take decades to settle.

What the DeAngelo case retired was not a law or a regulation. It was an assumption so embedded in forensic practice that it functioned more like a natural limit than a rule: that crime-scene DNA without a matching name in the system would stay nameless. That assumption held for forty years, through the development of every major forensic database, through the cataloging of millions of profiles, through thousands of cold cases that sat exactly where the Golden State Killer case sat in 2017. The assumption wasn't wrong, exactly. It was just contingent — dependent on databases being closed, on consumer genomics not existing at scale, on the gap between forensic markers and ancestry markers staying unbridged. Those conditions changed. The assumption didn't survive the change. What remains is a technique that can, in principle, connect any biological sample to a living family network — which means the question is no longer whether identity can be extracted from old evidence. The question is under what terms, and who gets to decide.

References

1. a 2017 expansion added seven more (le.fbi.gov)
   Documents the 2017 expansion of CODIS from thirteen to twenty STR markers used for DNA profile matching.
2. Identity inference of genomic data using long-range familial searches (science.org)
   Provides the population genetics modeling showing that a one-million-profile database should return usable partial matches for a significant proportion of the population.
3. Barbara Rae-Venter (en.wikipedia.org)
   Identifies Barbara Rae-Venter as the genetic genealogist who helped police identify Joseph James DeAngelo as the Golden State Killer.
4. Terms of Service - GEDmatch (gedmatch.com)
   Confirms GEDmatch's current terms allow users to opt in to law enforcement matching of their DNA profiles.