The process is simple, why wouldn’t more companies use it?

https://www.theregister.co.uk/2018/04/27/facebook_sec_privacy_lapses/

Facebook confesses: Buckle up, there's plenty more privacy lapses where that came from

Facebook has confirmed what many of us have known for years: Cambridge Analytica was far from the only organization engaging in the wholesale hoarding of netizens' personal data via the social network.

The Silicon Valley giant told America's financial watchdog, the SEC, on Thursday that it will probably reveal additional data-harvesting operations as it continues probing how outside developers accessed its website and what information they siphoned off in bulk.

… Now after years of letting companies chug from its firehose, Facebook is shocked – shocked – to discover that shady outfits were amassing folks' info via these APIs.

Soon, mandatory for all citizens (and visitors)?

https://www.newsday.com/opinion/commentary/ancestry-websites-privacy-1.18284999

How private is your DNA on ancestry websites? East Area Rapist case raises questions

… A partial DNA match with an unidentified relative of Joseph James DeAngelo on a genealogy website led to DeAngelo’s arrest as the suspect in the notorious East Area Rapist case, the Sacramento County District Attorney’s Office said Thursday.

Investigators recently found a “familial DNA match” to a sample collected years ago at a crime scene linked to the East Area Rapist. The family link then led the Sheriff’s Department to DeAngelo’s home on a quiet middle-class street in Citrus Heights, where they obtained a direct DNA sample from him after following him and picking up an unidentified object he discarded, according to Sheriff Scott Jones.

When that sample came back as a hit for a series of crimes, DeAngelo was arrested.

Sacramento County District Attorney Anne Marie Schubert declined to detail how her office obtained the relative’s DNA profile or accessed a genealogy database, raising questions about the privacy of personal genetic information on websites.

“I haven’t come across this before,” said John Roman, a senior fellow at research organization NORC at the University of Chicago. Roman is a forensics expert and studied the use of DNA in criminal investigation in 2005-09 in Orange County and L.A.

“If that’s how the match was obtained, then I would think there would be court battles to come.”

Colleen Fitzpatrick and Margaret Press, who run a nonprofit organization called the DNA Doe Project, said one of DeAngelo’s relatives may have shared DNA results with one of several public DNA matching websites, where people upload genetic data in search of biological parents or other long-lost relatives after obtaining results from a commercial site.

The Sheriff’s Department then could have gone to one of those sites, loaded DNA information from East Area Rapist crime scenes and found partial matches.

… California became the first state to authorize such familial line testing in 2008, but it has strict limits. Searches can be requested only when law enforcement has a suspect, and the DNA is only tested against databases containing samples from people arrested or convicted of felonies.

The FBI maintains that system, but each state manages its own DNA database. In California, it’s maintained by the California Bureau of Investigation.

(Related)

http://denver.cbslocal.com/2018/04/27/police-used-free-genealogy-database-to-track-golden-state-killer-suspect/

Police Used Free Genealogy Database To Track Golden State Killer Suspect

… Paul Holes, a recently retired investigator with California’s Contra Costa County District Attorney’s Office, said he took crime-scene DNA — believed to be that of the culprit — and entered the profile into the online Florida-based GEDmatch database.

… Holes said that when he entered the crime-scene DNA profile, more than 100 users matched as a distant relative, possibly as close as a third cousin. To use GEDmatch, users agree to make their information public and attach at least an email address to their profile.

(Related)

http://www.dailymail.co.uk/news/article-5663551/Use-DNA-serial-killer-probe-sparks-privacy-concerns.html

Cops hunting the Golden State Killer got the WRONG MAN by using a free genealogy site and ordered innocent sickly 73-year-old to give DNA to clear himself - then his daughter helped nail 'real killer'

Investigators hunting the Golden State Killer used DNA information from a genealogy website to identify a sickly 73-year-old as their prime suspect, and then a judge ordered him to undergo a test to prove he was not the serial murderer and rapist.

Cops used a genetic profile based on DNA from crime scenes and compared it to 189,000 others uploaded by family tree enthusiasts on free site YSearch.org to track down the care home resident, who also shared a rare genetic marker with the killer.

… Eventually, police used the same technique on a different genealogy website to track down who they believe to be the real Golden State Killer: 73-year-old former police officer Joseph DeAngelo, who has now been charged with eight counts of murder.

… Although many will celebrate the use of Internet DNA databases to identify DeAngelo, the fact that police wrongly identified an early suspect will worry campaigners who fear the approach jeopardizes privacy rights.

Steve Mercer, chief attorney for the forensic division of the Maryland Office of the Public Defender, said privacy laws are not strong enough to keep police from accessing ancestry sites, which have fewer protections than databases which hold the DNA of convicts.

… While people may not realize police can use public genealogy websites to solve crimes, it is probably legal, said Erin Murphy, a DNA expert and professor at New York University School of Law.

'It seems crazy to say a police officer investigating a very serious crime can't do something your cousin can do,' Murphy said. 'If an ordinary person can do this, why can't a cop? On the other hand, if an ordinary person had done this, we might think they shouldn't.'