The world’s leading for-profit geneaology company, Ancestry.com, was founded in Provo, Utah in 1983. Thirteen years later, an 18-year-old woman named Angie Dodge was sexually assaulted and murdered in Idaho Falls, Idaho. Nearly two decades after her death, a twisting set of circumstances and rapidly-evolving technology have linked those two events in ways that have daunting implications for all of us.

In 1998, two years after Dodge’s murder, a man named Chris Tapp was charged with the crime and gave a confession to police. He was convicted of the crime and sentenced to 30 years in prison. Recently, however, serious questions have been raised about the strength of the evidence against Tapp and the methods used to obtain his confession. An 85-page report prepared by retired FBI supervisory special agent Steve Moore strongly criticizedthe handling of the case by the Idaho Falls Police Department.

Not long after the Moore report was released, the Idaho Falls Police Department decided to take advantage of advances in genetic analysis to see if they could generate any fresh leads. Investigators had collected semen from the crime scene but were unable to find a DNA match in state or federal DNA databases using traditional testing techniques. The IFPD decided to try a relatively new type of DNA analysis called “familial searching.” According to the Federal Bureau of Investigation, familial searching is a process that is only used in relatively rare circumstances in a limited number of states.

Unlike a routine database search which may spontaneously yield partial match profiles, familial searching is a deliberate search of a DNA database conducted for the intended purpose of potentially identifying close biological relatives to the unknown forensic profile obtained from crime scene evidence. Familial searching is based on the concept that first-order relatives, such as siblings or parent/child relationships, will have more genetic data in common than unrelated individuals. Practically speaking, familial searching would only be performed if the comparison of the forensic DNA profile with the known offender/arrestee DNA profiles has not identified any matches to any of the offenders/arrestees.

In order to conduct the familial search, the IFPD sent the semen evidence to a lab to extract two genetic markers — Y-STR and mtDNA — that are used to establish patrilineal and matrilineal relationships (this technique is most commonly used, not surprisingly, in paternity cases). With this information, the IFPD thought it might be able to identify, if not the actual killer, then someone who might be related to the killer.

What made this line of inquiry even possible is the fact that there are a large and rapidly-growing number of DNA databases around the world. One of the leading companies in this field, the Sorenson Molecular Genealogy Foundation (SMGF), operates a publicly-accessible database of de-identified genetic information. IFPD officers entered their newly-extracted genetic markers into the database and learned that there were 41 people who might be related to the ejaculator, including one individual who matched the sample on 34 out of 35 alleles. Typically, two individuals with that many matching alleles share a close family relationship.

Not surprisingly, the IFPD was very interested in learning the identity of the “near relative.” The department went to court to force Ancestry.com, the owner of SMGF, to turn over the hidden identity. I reached out to Ancestry.com for an explanation of its policies regarding the privacy of DNA information under its control and received the following statement:

The genetic information provided by our DNA customers is personal and we have strict standards in place to protect their identities and the integrity of their data. These standards are our first priority. On occasion when required by law to do so, and in this instance we were, we have cooperated with law enforcement and the courts to provide only the specific information requested but we don’t comment on the specifics of cases.

The name provided to the IFPD was Michael Usry Sr., a 63-year-old man living near Jackson, Mississippi who didn’t fit the profile the police had developed for Dodge’s killer. However, using the genetic information in the SMFG database, they learned that Usry had a 36-year-old son named Michael Usry Jr., a filmmaker living in New Orleans. His age and close connection to Usry Sr. made the filmmaker a much more promising suspect for the IFPD, and they began aggressively investigating his potential connections to Idaho Falls. A Facebook search revealed that Usry Jr. had a few friends living in the general vicinity of Idaho Falls. Even more damning were the results of Google searches that showed Usry’s films often feature murders or other deaths. (In fact, one award-winning film he directed was called “Murderabilia,” about people who collect mementoes of homicides and other high-profile crimes.)

The IFPD compiled the results of its online searches into a warrant application seeking a sample of Usry’s DNA to see if it matched the semen evidence. The order was granted, and Usry spent an anxious month awaiting the test results. On January 13, he received a letter stating that his DNA was not a match of the evidence collected at the crime scene.

“All of the circumstantial evidence was right,” Sgt. James Hoffman, of the Idaho Falls Police Department, told the New Orleans Advocate. “He seemed like a really good candidate. But we’ve had that happen before.”

While Usry’s grim introduction to DNA testing may be over (although it has inspired him to do a documentary about Chris Tapp), the debate about DNA privacy is just beginning to heat up. Despite grave potential for misuse and abuse of private genetic information, there is no comprehensive statutory or regulatory protection for our DNA. As the Electronic Frontier Foundation points out, we all have an individual responsibility to think twice about how and when we share our DNA:

This case highlights the extreme threats posed to privacy and civil liberties by familial DNA searches and by private, unregulated DNA databases. People should be able to learn about their ancestors and relatives and about possible risks for genetic diseases without fear that their data will be shared with the cops without their consent. However, Usry’s case shows that we can’t count on private companies’ internal policies to keep our private data safe, and we should think twice before sharing our genetic information with a third party.

The benefits of DNA testing will only accelerate, however, and there will be tremendous pressure on consumers to take advantage of advances. Moreover, citizens often don’t have a choice about whether their DNA will be entered into a database, thanks to a disturbing 2013 Supreme Court decision. It is long past time for Congress and the states to take clear and effective steps to protect genetic privacy.