Cryptographic Thinking

Advocates for a national DNA identity database won a major victory with the Supreme Court’s recent decision to permit the routine collection and storage of DNA data. Justice Anthony M. Kennedy wrote for the majority,

When officers make an arrest supported by probable cause to hold for a serious offense and they bring the suspect to the station to be detained in custody, taking and analyzing a cheek swab of the arrestee’s DNA is, like fingerprinting and photographing, a legitimate police booking procedure that is reasonable under the Fourth Amendment.”

Finger prints are a person’s unique identifier. When your finger prints are entered into a database, they will only serve to identify you. DNA has very different properties from fingerprints since DNA is a “biological social network.” You can tell with fairly high precision when an unknown sample is related to someone in the database.

For example, if your cousin’s DNA is in the DNA database, then leaving an eyelash somewhere will lead to you very quickly. Given the number of people who move through the criminal justice system, it is unlikely that your family will not be in the database, so it amounts to a national registry. The dissenting opinions in the Supreme Court case see this property of DNA (among other issues) as an affront to the fourth amendment.

One solution not being discussed in the media is an algorithm that would maintain DNA database’s usefulness for matching criminals to their DNA already in the database, but would destroy the ability for the database to find familial ties. Basically, you can construct a function (a cryptographic hash), that allows you to match crime scene DNA to records in the database without actually storing a record of DNA.

It would be useful for our fourth amendment rights if legislators knew of basic privacy-preserving technologies. It is often possible to investigate crimes without needing to compromise the privacy of the entire populace if only we think about solutions instead of tradeoffs.