THE BURNED OVER DISTRICT

Once upon a time you believed when you sent your DNA to 23 and Me for analysis you thought the results would stay private between you and the company. Guess again. The body of law covering 3rd party possession of your DNA is extremely thin.

Major testing companies such as Ancestry and 23andMe quickly denied being the source of genetic analysis that led Sacramento County deputies to arrest Joseph James DeAngelo as the notorious East Area Rapist, also known as the Golden State Killer. But those companies are rapidly building the world's largest DNA databases, which they may not be able to keep private if law enforcement uses court warrants and other means to access the data.

Erin Murphy, a New York University law professor and expert on genetic privacy, said it's only a matter of time before investigators collect DNA from a crime scene, and then obtain a court order for a company like Ancestry and 23andMe to provide the identity of any matches, either direct ones or those of relatives.

"Absolutely that could happen," said Murphy, author of "Inside the Cell," an examination of forensic investigations. "Right now, that would be legally cutting-edge, but it seems completely plausible."

Jennifer Lynch, a lawyer at the Electronic Frontier Foundation, said that despite DNA testing's promise in detecting health disorders, learning about ethnicity and helping police solve crimes, there are privacy perils that many people ignore when they spit in a tube and send it to a testing company.

"It raises so, so many issues," said Lynch, whose California-based group advocates for consumers of digital technology. "What will happen if one of these companies goes bankrupt in the future? Will the personal data they have collected be sold off just like any other asset?"

Ancestry and other companies have long revealed to consumers, in privacy statements, that their personal genetic information could be released in response to a court order.

"If we are compelled to disclose your personal Information to law enforcement, we will do our best to provide you with advance notice, unless we are prohibited under the law from doing so," the Ancestry privacy statement says. Helix and other DNA testing companies issue similar warnings.

But many consumers skim over those disclosures while navigating the flashy websites these companies use to tout their family history services.

There's also the potential for law enforcement to make a false match, turning innocent people into suspects.

In 2014, police in Idaho Falls, Idaho, were trying to solve a cold case from 1996, in which a young woman was murdered in her apartment. Police obtained DNA from the scene, but could not match it in criminal databases. So they went to a then-public database started by the Sorenson Molecular Genealogy Foundation, which held results for roughly 100,000 DNA tests and had recently been purchased by Ancestry.

That analysis and other matches led police to question a man named Michael Usry Jr., a New Orleans filmmaker. But after police took a sample of his DNA, they found — many weeks later — it did not match the sample found at the crime scene.

Murphy cites the false match as a cautionary tale. On the one hand, she said, DNA absolved Usry of murder. But before that, it put him under a cloud of suspicion for weeks. "Imagine what that would be like," she said. "Imagine what that would mean if an employer, or a girlfriend, found out."

While the companies are legal and ethical at this time, the laws regarding future actions are few and far between. With the current trend toward increasing police powers as demonstrated by the spread of Right To Shoot Blacks among others,don't expect any increase in your protection.