State leaders in Maryland quietly stopped implementing key parts of a landmark privacy law meant to protect ancestry data online, a Newsy investigation has discovered.
The law, enacted last year, was seen as a model for other states looking to set standards for when law enforcement can tap into DNA uploaded by Americans researching their heritage.
"States that don't have a law like ours, it's kind of the Wild West," said Natalie Ram, law professor at the University of Maryland.
The state's law set some of the first limits in the nation on forensic genetic genealogy, a technique used occasionally to help crack the toughest murder and rape cases.
Authorities take DNA from a crime scene, and if they can't find a match to known offenders in law enforcement databases, they compare the sample to profiles of millions of Americans whose DNA is online from ancestry research.
"Like where I would go to try to find my long-lost relatives, we would use exactly those same publicly available tools to try to find out, whose DNA is this?" said Ray Wickenheiser, director of the New York State Police Crime Lab System.
Forensic genetic genealogy has become a more popular practice after 2018, when it was used to help catch Joseph DeAngelo, the notorious "Golden State Killer."
But unlike a police search of a home or car, there were virtually no standards for when and how law enforcement could dip into genetic genealogy data online.
Maryland's law set some of the nation's first guardrails on the investigative tool.
"It is comprehensive," Ram said. "It regulates the initiation of forensic genetic genealogy, how it is conducted."
Newsy's investigation found, almost a year after the law became active in October 2021, key pieces of it have yet to roll out.
The Maryland Department of Health has yet to publish best practices and minimum qualifications for people using forensic genetic genealogy.
In a required annual report, a branch of the governor's office failed to disclose how often law enforcement accesses ancestry data, as well as the number of complaints.
The health department also suspended a task force working on the new regulations, without providing an explanation even to members of that task force, including Wickenheiser.
The Maryland Department of Health would not answer Newsy's detailed questions about the lack of progress.
But emails obtained through state open records requests show by March, a decision had been made to stop implementing major parts of the law.
Dr. Tricia Nay, director of the health department's Office of Health Care Quality, wrote in a March 16 email, "Unfortunately, OHCQ did not receive any staff or funding for this bill, so we are unable to implement it at this time."
A health department spokesman confirmed there are no funds to support the law this fiscal year, which runs through June 2023.
That came as news to Ram, who worked with legislators to get the pioneering law on the books.
"That concerns me," Ram said. "I'd like to see this law implemented, and I hope that resources are available to do so."
The law has faced other challenges, including concern and opposition from a key health department leader.
In an email dated June 13, 2021, Paul Celli, public˙health administrator for clinical and forensic laboratories, wrote: "I am just not sure how to go about getting started on all of this. The bill tasked OHCQ with all this with zero consultation on it ... I don't even agree with most of what's in it ..."
Emails show that by this summer, communication appeared to break down between the Maryland Department of Health and Maryland State Police, another agency also required to help roll out the law.
"I still don't know what MDH's plan is in regard to the regulations. They have gone silent and I've tried every avenue available to me to get some resolution without success," reads a July 13 email from Dan Katz, lab director for Maryland State Police.
Katz declined a request to be interviewed for this story.
Maryland Department of Health spokesman Chase Cook sent a statement responding to Newsy's findings: "The Maryland Department of Health has actively been working internally and with our partner state agencies on implementation of this law, which we understand has not been implemented anywhere else in the United States. We will provide further updates as they become available."
For now, ancestry websites are setting their own privacy rules.
User terms of service for ancestry.com and 23andme.com say they won't voluntarily share data with law enforcement.
There are looser restrictions on GEDmatch.com, a free online ancestry database used to find the Golden State Killer.
The site has 1.8 million profiles.
Users must opt out if they don't want to share data with police.
"For me, it's critical that Maryland continue this," Wickenheiser said. "The sooner we can have these discussions and have these laws put in place, the better it is. We want to prevent and solve crime, and we also want to make sure that we respect people's rights."
A major test of how things are going in Maryland is just weeks away: The law requires the health department to establish licensing requirements for labs using forensic genetic genealogy by Oct. 1.
