Fabricating DNA Evidence

This isn't good:

The scientists fabricated blood and saliva samples containing DNA from a person other than the donor of the blood and saliva. They also showed that if they had access to a DNA profile in a database, they could construct a sample of DNA to match that profile without obtaining any tissue from that person.

[...]

The planting of fabricated DNA evidence at a crime scene is only one implication of the findings. A potential invasion of personal privacy is another.

Using some of the same techniques, it may be possible to scavenge anyone's DNA from a discarded drinking cup or cigarette butt and turn it into a saliva sample that could be submitted to a genetic testing company that measures ancestry or the risk of getting various diseases.

The paper.

EDITED TO ADD (8/19): A better article.

Posted on August 19, 2009 at 6:57 AM • 53 Comments

Comments

CrispinAugust 19, 2009 7:34 AM

if this helps take the shine off DNA evidence's squeaky-clean-silver-bullet image, mightn't revelations like this be a _good_ thing?

ThomasAugust 19, 2009 7:41 AM

Crispin: It's a good thing once there are judicial precedents set about it. Until then, it's just a great new way to fabricate evidence.

Marc B.August 19, 2009 7:46 AM

It's the old problem of all kinds of biometrics. They can be compromised easily and then the whole system is burned.

If a password or a secret key is compromised it can be changed quite easily. But how do you change your fingerprints, iris scan image or DNA pattern?

JasonAugust 19, 2009 8:08 AM

Marc B, this is the opposite of biometric authentication. In the usual authentication problem, you want to prove who you are so you can get something you want.

Here, the authorities are trying to prove who you are so they can give you something you *don't* want. In that context, being unable to change your biometric "password" is a feature, not a bug ... and finding out biometric information is changeable is a problem.

As for "DNA evidence's squeaky-clean image", I recently served on a jury trial where the prosecution presented the Worst DNA Evidence Ever. (Among other things, the cops collected the evidence in a used paper shopping bag.) As the defense attorney pointed out, the DNA statistics included the defendant as a possible suspect, but odds were good that one of the twelve members of the jury would also be a DNA match. I was impressed at my fellow jurors' ability to tell sh*t from shinola.

Anyway, before we all panic, it's worth pointing out that it's been easy to obscure and, to some extent, forge DNA evidence for a long time. To cover your tracks, sweep up some dust from the floor of a public subway, and sprinkle it liberally on your clothes and around the crime scene. To frame your enemy, gather some of his hair and leave it at the scene.

The scary bit here is twofold. First, using DNA profile databases it's possible to frame someone for a crime without having ever seen them. Second and more importantly, some juries are receptive to the "I was framed!" defense, and the more technical tools we have for faking DNA evidence, the more reasonable doubt a jury can have.

Snarki, child of LokiAugust 19, 2009 8:08 AM

How long until us citizens have to make sure to obsessively clean up and destroy any trace of DNA that we might leave, just to avoid false DNA accusations.

Of course, people have been doing this for centuries, but for less rational reasons: those in fear of voodoo, as an example.

There's probably a dystopian cyberpunk novel in that DNA/Voodoo combination...

Marc B.August 19, 2009 8:24 AM

@ Jason: I believe it is the same problem. We see here that DNA as evidence can be compromised.

TroyAugust 19, 2009 8:25 AM

@Marc B.

Is that a market opening I hear?

You can change your blood DNA by undergoing a bone marrow transplant. My google-fu is rusty today, best link I can find is http://www.forensic-science-society.org.uk/...

I'm sure changing your fingerprints is a technical problem with a reasonably simple solution (relative to how much we actually want to solve it), although I expect changing your iris pattern without damaging your eye is more challenging.

Tomorrow's opportunities start today!

Kiaser ZohsayAugust 19, 2009 8:50 AM

This is essentially a hash-collision problem. The scientists were able to blend samples from a library of sequence fragments that would generate a profile that matches an existing profile stored in an FBI database. DNA evidence on the whole has not been compromised, only the method of creating a profile has, along with most of the existing stored profiles.

Dr. FellAugust 19, 2009 9:10 AM

But this should surprise nobody who is familiar with what science is! Science can only disprove a hypothesis. Only charlatans and poseurs (in this case, police) claim otherwise. Evidence collected at a crime scene, if unaltered, can only disprove guilt, not confirm it.

vwmAugust 19, 2009 9:24 AM

Having a full disclosure point of view in mind, I also think that this is actually good.

@Dr. Fell, when did maths stop being scientific (SCNR)?

Dr. FellAugust 19, 2009 9:38 AM

Science is a process of inquiry. Mathematics constitute a language -- a tool. The proofs of mathematics are results of logical constructs. They are distinct but complementary.

Jackson MaddenAugust 19, 2009 9:42 AM

I love to drop other peoples cigarettes, hairs, chewing gum and drinking cans at the scenes of burglaries. I once left somebody elses urine in their toilet.

RofloAugust 19, 2009 9:47 AM

I agree with saad-net and vwm. This is good.

Not too convenient for CSI though.

EadwacerAugust 19, 2009 9:54 AM

Fortunately, the technique described requires a large, well equipped lab, which only police departments are likely to....um...nevermind.

mcbAugust 19, 2009 10:06 AM

@ Snarki, child of Loki

"How long until us citizens have to make sure to obsessively clean up and destroy any trace of DNA that we might leave, just to avoid false DNA accusations."

And the squidblog movieplot DB says...bing!..."Gattaca" (1997)

KCAugust 19, 2009 10:22 AM

"This isn't a good thing." Congratulations, you win today's Understatement-Of-The-Day prize.

mcbAugust 19, 2009 10:25 AM

@ Jackson Madden

"I love to drop other peoples cigarettes, hairs, chewing gum and drinking cans at the scenes of burglaries."

Ooh, ooh! How about the terror cells pinching the contents of wastebaskets at public parks, homeless shelters, and bus stops to contaminate their safe houses and the burglaries used to acquire the components for their R/C IEDs? Genetic chaff...137 false leads...better get Abby another Caff-Pow and make this NCIS episode a two hour special.

pTbAugust 19, 2009 10:31 AM

I have never been a fan of convictions based soley on DNA evedince, hopefully this will make it so more than just DNA is needed for a conviction. But who am I kidding, the government wont make changes to reflect these findings for years.

derfAugust 19, 2009 10:32 AM

Your DNA is all over your garbage. Just go grab your neighbor's garbage, lift some DNA evidence, and plant it very carefully at your crime scene. Much easier then having to fabricate it from scratch.

FrankAugust 19, 2009 10:51 AM

Derf has it right - Its all in the rules of evidence, and likelihood that it isn't a frame-up, and we're already at the mercy of 'contrived' evidence. We just need to hope those in power seek not to do the unjust to meet their needs.

ShaneAugust 19, 2009 11:21 AM

Well, hopefully the detectives and prosecutors of any given case haven't completely given up the feeling of having to prove both motive and opportunity to the jury as well, in addition to whatever forensic evidence they have at hand.

I'm an avid follower of forensics, but it is a tool like any other, and any self-respecting forensic scientist will use it as such, and not as a 'squeaky-clean-silver-bullet' or whatnot.

A good example of this is bite marks on the skin. They were once thought to be distinct to a degree of near certainty in many instances, until they held a man for 10 years on death row for a crime he did not commit (later overturned by DNA evidence, and a matching bite mark from whom the DNA happened to match, as well as placement at the scene). However, despite the DNA clearing the initial suspect, it took a full on confession from the killer to his fellow inmate, who in turn ratted him out, before the case was even brought up in court again.

An example of fabricating DNA evidence takes a more rudimentary approach in the UK, years and years ago. A young man had been strangling (and raping IIRC) young women walking alone on a wooded path, and the entire town was asked to provide DNA samples to weed out the killer. However, the killer simply asked one of his mates from out of town to give the sample in his stead, claiming he had a warrant out for some lesser nonsense crime. Fooled the police for quite some time as I recall. The way the man was found, again, was looking at motive and opportunity, in addition to the killer's accomplice having a loud mouth at a local pub. There wasn't much in the way of motive save for some sick self-gratification, but the opportunity was there due to his job's proximity to the crime scenes, and the hours which he worked, as well as the suspicion regarding his avoidance of providing a DNA sample.

Additionally, most cases of murder are committed by the spouse or family member of the victim, and in many cases the suspect's DNA is all over the crime scene, but with a reasonable explanation. If DNA evidence was fabricated in these instances, it may move the case away from the suspect for awhile, but again, many times other pieces are easily put together to build a bigger picture of the crime (ie - blood stained clothing, victim's wounds matched to a particular object, shoe impression, eyewitnesses, faulty alibi's, blantant lies, et al), and the statistics themselves are hard to fool as well.

ShaneAugust 19, 2009 11:27 AM

That said, this does scare the crap out of me, for a number of reasons.

DNA is certainly a helpful tool, a very helpful tool, and now... well, seems in time, if these techniques are perfected, it may be moved down to the ranks of 'bite marks' and mitochondrial DNA samples, if that.

However, most of the time, it simply re-enforces what the detectives already suspect, since no one has a database containing DNA samples from the entire population. Although, in the article it did state that it was quite a simple task to fabricate DNA to match a stored sample, but without matching a suspect already stored in a database who *also has motive and opportunity (ie - isn't 200 miles away in prison, and had a reason to commit the crime), you've really kind of shot your 'frame-up' in the foot.

RayAugust 19, 2009 11:36 AM

My mind has changed. If I were on a jury, DNA evidence would not be convincing enough anymore. Wow.

SAI PeregrinusAugust 19, 2009 11:36 AM

The only really new thing is the ability to target someone already in the database.
Otherwise, just get some hair, extract DNA, use a PCR machine, and spray everything with a spray bottle of DNA.

Peter MaxwellAugust 19, 2009 12:14 PM

Who would have thought it: DNA evidence has gone the way of the fingerprint.

Does that mean we've gove unfair trials based on DNA evidence for about twenty years then.

BF SkinnerAugust 19, 2009 12:25 PM

GATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGA
TTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATT
ACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTAC
GATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGA
TTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATT
ACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTAC
GATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGA
TTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATT
ACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTAC
GATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGA
TTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACGATTACTACG

Clive RobinsonAugust 19, 2009 12:52 PM

Does anybody remember Dr David Berryman (DNA expert) from Murdoch University?

And his 2003 paper,

"Forensic DNA Profiling: Infallible or Fundamentally Flawed?"

Or the stir he created when interviewed by ABC,

http://www.abc.net.au/catalyst/stories/...

Bruce posted about the stir he created (way back then) about getting DNA tests to give incorrect results (you can read a little more about the science of it at http://www.forensicscience.uwa.edu.au/__data/... or http://www4.gu.edu.au:8080/adt-root/uploads/... )

As I pointed out then I had worked out a similar defect in the testing process some time prior to that (and even Emailed Bruce about it). Also that on trying to raise awareness of the issue I had been treated as though I was "slaying the Goose that laid the golden eggs" by those involved with the test verification process.

I could not find the original blog page in google but I did find some other pages where I posted about the same or similar method,

http://www.schneier.com/blog/archives/2005/06/...

http://www.schneier.com/blog/archives/2005/09/...

http://www.schneier.com/blog/archives/2006/11/...

What these researchers have done is move the process forward a few steps.

As the article linked to by Bernie (above at August 19, 2009 7:54 AM ) so aptly puts it at the end of this paragraph,

"Fortunately, in identifying the problem, the researchers have come up with a solution. DNA inside human cells picks up a chemical modification called methylation; DNA amplified in a test tube doesn't. It's possible to determine whether or not a given stretch of DNA has been methylated using standard lab techniques, although these are a bit laborious and time-consuming, and it's the sort of technique that hasn't made its way into forensic training yet. Still, testing for methylation in a DNA sample should provide an important quality control on the sample—at least until biologists figure out how to apply methylation in a controlled manner."

I guess it will be within the next couple of years so watch this space...

Ward S. DenkerAugust 19, 2009 1:00 PM

The difficulty of doing this kind of thing would be high enough to still ensure that most of the people who are convicted on DNA evidence probably are guilty of the crime they're charged with.

The real danger here is that governments have access to the kind of funding to run labs to do this. Our own government is a very dangerous adversary, even for an innocent citizen, to contend with.

One of the few places left where citizens engage with the justice system is on jury trials, and juries can be bought or manipulated. Face it, if someone in the government wants you gone they only need to commit one undetectable crime (fake DNA evidence) and the system will take care of the rest of the details of removing you as any kind of threat. They don't even need to necessarily get their hands dirty by committing a murder - they can just take advantage of an unsolved crime where no DNA evidence was left at the scene and get it into the evidence room under false pretenses (which is probably easier than stealing real evidence). Selecting an unsolved crime to fit the circumstances should not be too difficult since all they really need is to select one for which they know you have no verifiable alibi.

Getting a new trial is already nigh impossible for prisoners, and trying to convince anyone of one's innocence with an "I was framed by a government official" defense is certainly doomed to fail.

ShaneAugust 19, 2009 1:06 PM

@Ward

"The real danger here is that governments have access to the kind of funding to run labs to do this. Our own government is a very dangerous adversary, even for an innocent citizen, to contend with."

C'mon... What's to stop the investigators themselves from planting (or 'finding') all the DNA they want at any crime scene already?

Nothing really. Doesn't take a huge consipiracy and government spooks to frame someone for a crime. Basically all it takes is the will to do so.

The justice system also works in our favor, for the most part. Or that is the hope... and one we have to cling to lest we cry wolf and run for the hills. No system is infallible.

kozmundAugust 19, 2009 1:24 PM

The library approach for generating fake evidence based on the standard tested sites was the most interesting thing, to me. The DNA based frame-up has always been there as a possibility, but being able to do it using only the bits that would reside in a police database is fun.

The bit that they're pushing to catch their fakes falls into the "defending only against things you thought of" area. I'll just leave this here: http://www.freshpatents.com/...

Clive RobinsonAugust 19, 2009 1:57 PM

Unfortunately (as is becoming very common) the paper is behind a "Pay Wall".

However a little digging around shows that the "researchers" have a start-up company called Nucleix Ltd.

From one of there blurb pages,

"Nucleix, an emerging life science company specializing in forensic DNA analysis, has developed a "DNA authentication" assay for forensic casework samples with potential applications across multiple DNA analysis and validation fields. DNA fingerprinting has been established as one of the most important forensic tools in criminal investigations. Nucleix scientists have demonstrated the viability of creating artificial DNA and "biological identify theft."(1) Using basic equipment and know-how, DNA with any desired profile can be fabricated in the lab, and this artificial DNA can then be planted in crime scenes as fake evidence. Until recently, there has been no way to distinguish between genetic profiles obtained from falsified DNA samples, which can appear identical to real biological profiles based on current analytical protocols and technologies. Nucleix's proprietary assays can distinguish between "fake" (in-vitro synthesized) DNA, and "real" (in-vivo generated) DNA. The company is committed to developing state-of-the-art "DNA authentication" assays that can be integrated into the standard forensic procedure, in order to maintain the high credibility of DNA evidence in the courtroom and other uses."

In other words we have found a solution to a known problem that people where ignoring, now lets make some noise and sell you our patented solution (so we can get rich ;)

Oh and the bit,

"Until recently, there has been no way to distinguish between genetic profiles obtained from falsified DNA samples"

Is not quite right, there are some ways already known but... they are complicated and therefore expensive to carry out and thus not used in routine testing. Oh and the problem with this, some DNA tests are destructive of evidence so you cannot go back and check again...

But as has been noted most DNA evidence is supporting or circumstantial the criminal is already known (usually because of their big mouth, MO or they are connected with the crime fairly directly).

And that is the real issue of "means, motive and opportunity". If you are going to frame somebody with a crime,

Step 1, is to provide a recognised "motive" for them (which may not be as easy as you think).

Step 2, is to use a "means" that is directly linkable to them (again it may not be easy)

Step 3, remove any alibi for them, and preferably have them at or close to the crime at the correct time (possibly easier).

Obviously the better acquainted you are with the individual the better your chances of framing them but... it also potentially puts you closer to the crime for an investigator as well.

Possibly the best way is still the old way of framing people, which is to delay the discovery of the crime so that there is a great deal of uncertainty in the details, and then put "hard evidence" into the possession of the person you wish to frame in some way (like some of the crime evidence in a bag hidden on their property).

snuhAugust 19, 2009 3:21 PM

"GATTACGATTACGATTACGATTACGATTACG..."

Oh no! That's me! Wait a minute... that's a "T" in the 176th position, not a "G". Whew, off the hook.

aikimarkAugust 19, 2009 3:39 PM

I suggest we all send this to any judges and lawyers we know.

============
Who would have imagined that the LA County Sheriff's department crime lab had this technology 12 years ago?!? ;-)

============
Gattaca reference:
http://www.imdb.com/title/tt0119177/

============
@BF Skinner

'thanks' for making this thread difficult to read. :-/

Clive RobinsonAugust 19, 2009 10:01 PM

@ Shane,

"C'mon... What's to stop the investigators themselves from planting (or 'finding') all the DNA they want at any crime scene already?"

Nothing at all it used to be a popular pastime with certain Policemen in the UK....

So as you say,

"Nothing really. Doesn't take a huge consipiracy and government spooks to frame someone for a crime. Basically all it takes is the will to do so."

Or a lot of "Political Pressure" from above (for which we now have a large number of politically embarrassing releases of wrongly convicted persons as evidence and investigations are shown to be "flawed".

"The justice system also works in our favour, for the most part. Or that is the hope... and one we have to cling to lest we cry wolf and run for the hills. No system is infallible."

Sadly more than a thousand years of legal historical safe guards have been removed or are in the process of being removed from the actions of the previous UK Prime Minister the RH Tony Blair, and his old side kicks "Charlie" Falconer (now Lord Falconer of Thoroton) the RH Jack Straw MP, David Blunkett et al.

The rot got going in 2003 ( http://www.independent.co.uk/news/uk/politics/... ) and has progressed step by step.

In England and Wales we now have the Orwellian sounding "Ministry of justice" (Run by Jack Straw MP), that supposedly protects the legal
process.

Amongst other things we are losing or have lost,

1) the right to a tribunal of truth (jury),
2) the right to silence
3) the right to not be pre-judged by previous behaviour.
4) the right to only be tried once.
5) weakening of the right to representation

All in order to save money / court time.

Amongst other little schemes we have coercion where you are given a "fixed penalty" which is only fixed if you pay without question. Start defending your rights and you will pay and pay and pay (for instance the London Congestion Charge, due to the laziness of the organisation people have been hit with "fines in the post" for which they have not committed the offence, most people payed up but when one person went to court whoops the lazy behaviour and illegally sited cameras came out, likewise with Gatso Cameras, and at-least one occurrence of deliberate evidence tampering by an official organisation where they "photoshoped" in a parking restriction sign that was not actually there at the time).

Oh and the latest proposal is effectively to get rid of the last vestiges of "legal aid" through the back door. Legal aid is the process where your legal representative gets payed by the public purse to defend you in criminal cases where you might not be represented otherwise. The sums involved have been whittled down one way or another over the years to a very low "fixed rate" so low that few competent legal representatives will work for the sums involved. The latest wheeze is to replace the current low "fixed rate" with a "Dutch Auction" bidding system, where the lowest bid for the work gets it...

As has been noted in the past,

"Justice has to be seen to be done, not done in reality".

jdAugust 20, 2009 1:35 AM

Nothing new here: It's called chain of custody. It's in the testing company and PD's interest to keep in tact.

JohnAugust 20, 2009 3:38 AM

@Shane, @Clive

Clive forgot to say that, in the UK, we *do* have a database that will soon contain DNA samples from almost the entire population. It has been ruled illegal, but the police have decided to ignore the law and are continuing to build the database anyway.

When the police start acting illegally with the support of the politicians, things are really starting to go wrong.

NostromoAugust 20, 2009 4:08 AM

@Shane:
"Additionally, most cases of murder are committed by the spouse or family member of the victim"

BZZT! Wrong. Most murder *convictions* are of the spouse or a close family member. That's because generally when someone is murdered, the first thing the police do is build a case against the spouse. Consequently (1) when it clearly isn't the spouse, the murderer is often much harder to find, and nobody gets convicted; (2) there have been a lot of wrongly-convicted spouses - the standard of proof in some US courts is more like "he probably did it" than "proved beyond reasonable doubt".

Petr KadlecAugust 20, 2009 6:12 AM

Philip K. Dick also wrote about this… Mmmm… I believe it was “The Unreconstructed M” (or something else from “The Golden Man”)?

Clive RobinsonAugust 20, 2009 9:25 AM

@ John,

"Clive forgot to say that, in the UK, we *do* have a database that will soon contain DNA samples from almost the entire population. It has been ruled illegal, but the police have decided to ignore the law and are continuing to build the database anyway."

Unfortunately it is just one of many DBs that are paid for from the UK public purse that are illegal.

In the UK there is a charitable organisation "The Joseph Rowntree Reform Trust" ( http://www.jrrt.org.uk/ ) who are well known and respected for the work they sponsor. In their own words,

"We fund political campaigns in the UK to promote democratic reform, civil liberties and social justice."

One aspect of these "political campaigns" is paying for research reports into government abuse of justice etc. A case in point is their report,

"Database State - a comprehensive map of UK government databases" ( http://www.jrrt.org.uk/uploads/database-state.pdf )

It makes sobering reading of how the UK is sleep walking into a police state via the needless collection aggregation and cross referencing of information and speculation on individuals in the UK, much of it completely illegally and with little or no audit or security, often hidden behind a gossamer veil of "Secrecy" or "Confidentiality" (to protect the guilty).

Often so much so that otherwise sensitive and well protected data on for instance children for their protection is laid bare to individuals with access to one or more databases. There are hundreds of thousands of people with access to just one of these databases and the audit and security is a complete joke as is the correctness of the information with in it (see Contact-Point Project)

Another is where your child's entire academic record including teachers unqualified evaluations on them and their family, will stay in existence as long as the child is of employable age. Oh and all the data will be made available to "interested parties" like future employers with little or no let or hindrance (but neither you nor your child will be able to see/correct mistakes and lies about them).

This is the sort of power that Stalin would have given both arms and legs for without a second thought.

Lest you think the report is an extreme view by "self interested crackpots with an agenda", have a look at the list of authors and google them etc.

One of the reports authors is a well known and well respected figure in computer security from Cambridge University Ross J Anderson (who has posted to Bruce's Blog on a number of occasions)

From the report a comment on the UK Government that to my eye appears directly aimed at the clique of No 10 who dream up these stupid (back door party fund raising) databases is,

"If you think IT is the solution to your problem, you don't understand IT, and you don't understand your problem"

The introduction by Lord David Shutt has this memorable paragraph,

"Of the 46 databases assessed in this report only six are given the green light. That is, only six are
found to have a proper legal basis for any privacy intrusions and are proportionate and necessary
in a democratic society. Nearly twice as many are almost certainly illegal under human rights or
data protection law and should be scrapped or substantially redesigned, while the remaining 29
databases have significant problems and should be subject to an independent review."

The report concludes at least that one in four of government databases that the report authors where aware of was effectively (ie a Court has not pronounced yet) illegal and that the 16 billion GBP that has been (officially acknowledged as being) spent on them, was a misuse of public funds.

For non UK readers if you normalised that to the US population/$ it would be about 144 Billion USD, which is no small pocket change...

By the way the expression "misuse of public funds" is a polite way of saying "criminal". If you or I where to do the same we would be looking at jail time that would make Bernard Madoff "with the money" 's eyes water.

We have in the UK on the statue books such old crimes as "malfeasance in public office", more often refered to as "Misconduct in Public Office" ( http://www.cps.gov.uk/legal/l_to_o/... ).

It is very broad range in scope is always indictable and carries a maximum of "life in prison" (not 150 year maximum negotiable down to 12years which is what Bernie is looking at).

Unfortunately it is rarely if never used these days the Crown Prosecution Service (CPS) is responsible for deciding if it "is in the public interest to prosecute" or not which is in no way the same as saying if the person is likely to be found guilty (although that is the way it is often expressed)

The CPS look at two asspects to make their decission.

One is a four part guidance as to what the required elements of misconduct in public office are,

1) A public officer acting as such.

2) That wilfully neglects to perform their duty and/or wilfully misconducts themselves.

3) To such a degree as to amount to an abuse of the public's trust in the office holder.

4) Without reasonable excuse or justification.

Of which the third and fourth parts give the CPS a great deal of latitude.

Especially when considered within the light of the second aspect of "life in prison" as the maximum sentence.

However as very unlikely as it is for a holder of "public office" to face being prosecuted there is now a new get out clause,

"Are they really a person in Public Office"

Due to "outsourcing" a number of jobs or roles are now carried out by people paid from the public purse but importantly "not directly so". Frequently they may well have been in "public office" prior to outsourcing and in all other respects are doing exactly the same job.

That is the only difference is that they are currently employed by a "private company" that is directly on contract to part of Government. This covers the range from security guards to consultants (and possibly even Ministers). In the case of the upper end only the gossamer of being paid "not directly so" is the only difference between being and not being in Public Office so acts as a "stay out of jail free card".

The question then arises what of organisations such as OfCom who wield considerable power and get all their "lawful authority" directly from Government as well as their funding, Where many of their employees are still in effect civil servants and appear for all practical purposes to still be carrying out a "public office" role...

HJohnAugust 20, 2009 3:43 PM

This is scary stuff, but framing someone is not new.

Unless I'm misunderstanding, fabricating DNA evidence in a situation like this would require knowing their DNA makeup (as cited in the database). It may require some difficult controls and adjustment, but one technical step would be to segregate the duties. They could still resort to collusion, which is a lessened risk.

Throughout history, we've had to deal with evidence planting, errant eyewitness identification, coerced confessions, etc. Even finger prints can be orchestrated (it isn't impossible to get someone to touch something or use something they have touched).

DNA may not be as fool proof as we thought, but it is still just one more piece of evidence in pursuit of "reasonable doubt".

This is still in its infancy. As stated in the article:" Fortunately, in identifying the problem, the researchers have come up with a solution. DNA inside human cells picks up a chemical modification called methylation; DNA amplified in a test tube doesn't." Just as old techniques were once new ones that matured, methylation testing may become less laborous and more timely.


Douglas KnightAugust 20, 2009 7:06 PM

Bruce,

don't you usually pooh-pooh technical exploits like this? The much bigger problem is that the police send both samples to the same lab, that knows the police want them to match. For that matter, letting the police have a sample from the suspect lets them do anything they want.
(this technique let civilians in on the fun)

Clive RobinsonAugust 20, 2009 11:58 PM

@ aikimark;

"Good news...an Israeli company claims to have a means to detect manufactured DNA."

It's the same people. The Authors of the paper have a start up called "Nucleix Ltd"

See my "August 19, 2009 1:57 PM" post above ( http://www.schneier.com/blog/archives/2009/08/... ).

Or am I missing some subtle humour here?

Clive RobinsonAugust 21, 2009 12:55 AM

@ Douglas Knight,

"The much bigger problem is that the police send both samples to the same lab, that knows the police want them to match"

There was a classic case of this in Scotland a few years ago where a Police Woman was sanctioned by her own force because one of her finger prints "supposedly" was in the crime scene.

Eventually it went to court where it became clear that the fingerprint lab had made a significant mistake and would not admit it (nor does it to this day which undermines the credibility of all it's results).

There are actually two really huge issues with forensic evidence that those in the field do not like to talk about because it reduces their credibility to near zero...

The first is "interpretation", nearly all forensic results are not hard and fast science but art. The results of any test have to be interpreted by an expert in the field of endeavour within the context of the crime and presented to the court as "opinion" (expert hearsay). This means that almost overwhelmingly forensic evidence is "subjective" and has no chance of reaching the "burden of proof" required for a criminal "beyond reasonable doubt".

Worse "opinion" lags "reality" a specific example of this is cocaine residue in US bank notes. It used to be used as an argument that the person had been in contact with a "class a" drug and was either a user or a dealer. After some independent research it was shown that the overwhelming majority of US bank notes in circulation where contaminated with cocaine therefore the residue was to be expected, not the exception.

The second major issue is one of "noise". In any measurement process there are two main issues sensitivity and variation. That is to what level can a test be made and what is the percentage error of the test at any given level.

However there is third issue which is starting to arise which is the very real law of physics that dictates there is a point at which measurements cannot be distinguished from noise.

However noise comes in two forms the "noise floor" which is the physical limit and the "back ground noise" which is usually way above the "noise floor" and is caused by environmental issues.

Most scientific tests are now at a sensitivity where they can measure well bellow the "back ground noise" level.

One of the reasons DNA was seen as a forensic "Gold Standard" was it's supposed "infallibility" at being able to 100% determine the presence (or in argument absence) of a persons DNA at a crime scene.

Unfortunately as I have been well aware since the early 1990's this is a complete nonsense, you only have to take a look at what is involved with a DNA test to realise just how fallible the test is to back ground noise and variations in test conditions and subjectivity of the operator.

This is even before you start thinking about how to "game the test" to make false results (the old garbage in garbage out principle).

What has consistently amazed me is how many people refuse to consider it or even investigate it.

I think you can be safely assured that these researchers would not have published their findings on DNA fallibility if they had not found a solution to sell.

Because history shows us they would have been shuned for trying to "kill the goose that lays the golden eggs" if they had not.

The legal process right from the legislators at the very top down to the meagrest of court clerks does not want problems only solutions. Forensic technicians are only to aware of this, as "expert witnesses" the court wants and needs them to take the "bag of snakes and straighten them out" for the court to make a simple comparison.

Well noise is the true Gordian knot of Forensics brushed under the carpet of faux science by the interpretation that is "expert opinion".

If you go and sit on the side lines of a court you quickly realise that the only evidence judges can deal with is pieces of paper, and the only thing juries rely upon is the perceived credibility of those in the witness box.

The only cases where this is not the case are those for which neither a judge nor jury are required to determine the likely hood of guilt.

In the main Forensic Evidence is to a court proceeding what stage props are for a magician, and like any good magician the legal teams can paint just about any illusion they like with them just by altering the perspective by which the judge and jury view them in...

David MeryAugust 21, 2009 7:54 AM

@John,

"Clive forgot to say that, in the UK, we *do* have a database that will soon contain DNA samples from almost the entire population."

That is not correct. The NDNAD has currently approx. 5.6 million DNA profiles of individuals. The replication rate is usually estimated at 13.7% by the NPIA so the number of individuals whose DNA profile is on the NDNAD is a bit less. That's approx. 7 to 8% of the UK population. Neither the government, nor the opposition has any plan to extend the NDNAD to the whole population.

For an up-to-date overview of the current situation check out some of the responses to the Home Office consultation that closed earlier this month. GeneWatch UK has published several at http://www.genewatch.org/sub-564539 (mine is at http://gizmonaut.net/blog/uk/2009/08/... )


"It has been ruled illegal, but the police have decided to ignore the law and are continuing to build the database anyway."

That's is somehow misleading as well. The ECtHR has ruled in S and Marper v. UK that the UK was breaching the ECHR, but the police have to abide by UK legislation so they're not technically ignoring the law. However most of the current rules are embodied not in legislation but in guidelines issued by the Association of Chief of Police Officers (a private company). Chief constables have a wide discretion, as owners of the DNA samples their forces take, and they could/should indeed ignore the advice from ACPO and be more forthcoming in deleting DNA profiles (and associated records and destruction the DNA samples) of innocents.
See a recap of the six months since the ECtHR ruling at http://gizmonaut.net/blog/uk/2009/06/... and some update at http://gizmonaut.net/blog/uk/2009/08/...

For those on the NDNAD seeking help getting off it, check out http://reclaimyourdna.org/

br -d

P.S. Bruce, if this gets posted, then you must have fixed the MT problem overnight.

aikimarkAugust 21, 2009 1:18 PM

@Clive

I suspected it was the same researchers, which makes these two announcements very similar to an anti-virus company creating a unique virus and then announcing that they offer better protection, since they protect against particular viruses that they just 'discovered'.

Ward S. DenkerAugust 25, 2009 8:31 PM

Shane,

I don't know if you're still following this thread but here's my response to to "C'mon... What's to stop the investigators themselves from planting (or 'finding') all the DNA they want at any crime scene already?"

I did mention that I suspect it's easier to sneak fake evidence into a lockup. Real evidence in there may inadvertently trip up an otherwise perfect frame-up job, since the actual perpetrator may be discovered. This makes introducing false evidence in a fresh crime potentially dangerous to the individual who does it.

After a crime has been unsolved for quite some time, the risk of additional real evidence being discovered which could ruin the frame-up would go down dramatically. Also, because this evidence can be fabricated from nothing but the DNA on file, there's not any need to try and collect DNA which is another point of failure - an increased risk of being caught framing a person.

It's obvious that a frame job can be done even without the technology to fake the DNA itself. It's the ease with which this can now be accomplished and the difficulty of catching those responsible - since the technique is now, literally, down to a science - which makes this such a threat.

Leave a comment

Allowed HTML: <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre>

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..