Joseph James DeAngelo, the “East Area Rapist” suspect arrested on Tuesday for a string of brutal rapes and murders in California the 1970s and 1980s, was caught using genetic information posted online on genealogical websites, according to a report by the Sacramento Bee today.

DeAngelo, whose notorious crime spree also earned him the moniker “Golden State Killer,” was tracked down when authorities began comparing DNA from the crime scenes to online databases and found matching relatives, the Sacramento County District Attorney’s Office confirmed to reporters. From the Bee:

The effort was part of a painstaking process that began by using DNA from one of the crime scenes from years ago and comparing it to genetic profiles available online through various websites that cater to individuals wanting to know more about their family backgrounds by accepting DNA samples from them, said Chief Deputy District Attorney Steve Grippi.

The investigation was conducted over a long period of time as officials in Sacramento County District Attorney Anne Marie Schubert’s office and crime lab explored online family trees that appeared to have matches to DNA samples from the East Area Rapist’s crimes, Grippi said. They then followed clues to individuals in the family trees to determine whether they were potential suspects.

Last week, the information investigators had gathered led them to DeAngelo, who matched the right age range for the suspect and was known to have lived in the areas where the crimes occurred.

Sacramento Sheriff’s deputies set up surveillance on DeAngelo’s home and obtained his DNA from “something he discarded,” comparing that sample to the crime scene samples. After a positive match, and a confirmation with “a second, more robust sample,” police arrested DeAngelo.

Authorities have not provided many details on exactly how the original DNA data from DeAngelo’s relatives was obtained, or identified the website or websites they used.

Both 23andMe and Ancestry, two of the largest DNA testing companies, have denied providing law enforcement with DNA data, according to Motherboard reporter Sarah Emerson.

https://twitter.com/SarahNEmerson/status/989624346841772032

https://twitter.com/SarahNEmerson/status/989625670660603904

Neither 23andMe nor Ancestry post their customers’ data online in any sort of public or searchable format; the only profiles you can access are your own, and those belonging to people who have expressly granted you permission.

However, there are several other websites like GEDMatch and MyHeritage, that allow people to take their “raw DNA data” — a file you can download from a 23andMe, Ancestry, or other DNA testing profile — and upload it.

Generally, people are willing to forgo privacy concerns and do this in order to participate in research or to track down birth parents, adopted children, or other missing or unknown relatives.

It’s not entirely clear that people uploading their DNA to such websites intended — or expected — their DNA to be accessed by law enforcement and used to arrest one of their relatives. And what privacy rights do you as an individual have against your relatives sharing their DNA data and that being used against you?

This is undoubtedly a question that will have to be resolved by the courts. Familial DNA is being used by law enforcement to solve crimes with increasing frequency. One of the first uses in the United States was the 2005 arrest of the “BTK killer,” Dennis Rader, who was identified after officials subpoenaed a tissue sample obtained from his daughter’s Pap smear.

A 2016 Los Angeles Times article described several cases that had been solved by searching existing offender DNA databases for relative matches with DNA from crime scenes, noting that “[c]ivil liberty groups expressed alarm, saying the searches raised significant ethical and privacy concerns,” but anticipating that the technique would gain widespread acceptance.

With law enforcement now having access to not just the DNA obtained from those already in the criminal justice system, but potentially millions of law-abiding Americans who think they are just learning more about their family trees, the privacy implications are immense.

Follow Sarah Rumpf on Twitter: @rumpfshaker.