The national DNA database

I feel that people are quite torn on this subject. Like myself many people like the idea that if a crime is committed (especially as serious one such as murder or rape) then enabling the police to quickly identify the culprit is a great benefit to society; but like myself many people don't like the idea of being listed in the database if they have done nothing wrong.  We also do not trust the government to safeguard the information held about us.

I think the case for the DNA database is quite clear. A man tested after being pulled over by police for drink driving later turned out to be the person who committed a rape 27 years earlier. There are numerous stories along these lines. If there were a national database with everyone's DNA on it then we wouldn't need to wait 27 years to catch the offender, these people could be caught almost immediately - stopping them from committing more crimes against other people.

I think the national DNA database is workable as long as certain conditions are met. The first condition is that data held about people is only made available to certain organisations, these would include

The information should only be made available when investigating sexual crimes, violent crimes, or burglary. This would include the planning of such crimes, for example somebody planning a terrorist attack in which lives would be lost. This information should never be transported on laptops, memory cards, CDs, etc. The database should be the only place this information exists, with no exceptions.

Preventing other uses

It may sound a bit sci-fi but we have no idea what a person's full DNA information may be used for in the future. At the moment it might be possible for insurance companies to examine the DNA, determine you are a high risk, and increase your health insurance premiums. To prevent this kind of abuse in the future I propose that the actual DNA structure should not be stored in the database at all, in fact it should be destroyed immediately after being analysed so that no record exists of anybody's full DNA information. I propose the procedure should be something like this

  1. A DNA sample is taken.
  2. The DNA pattern is obtained from the sample.
  3. The DNA pattern is processed using a one-way function (more on this below).
  4. The resulting data is recorded against the individual.

For people who are not familiar with one-way functions here is a simple example. If you pick up any book and write down the first letter from each page you will end up with a series of letters which are quite unique, but there is no way that you can take this information and reverse the operation in order to give you back the original contents of the book.

There are many techniques in computer software for doing the same thing with data. If we were to take 10 markers from the DNA, push them through a one-way function, and then only store the result of that function we would have no way of reconstructing the original DNA sequence from the person providing the sample.  Without a full sample it wouldn't be possible to ascertain facts about the person's genetic makeup.  In addition to this the one-way function employed would also make it impossible to determine the first letter on each page, so no DNA information at all would be derivable from the data stored.

Performing a DNA check

When a DNA check is required the procedure would be

  1. A DNA sample is taken from the crime scene.
  2. It is transformed through the same one-way process.
  3. An approved employee uses fingerprint verification to access the DNA database software.
  4. The result of the transformation is checked against the database.
  5. A list of potential matches is provided.
  6. A DNA sample is taken from the individual to confirm it matches the DNA from the crime scene.

Transforming the DNA sample through a one-way function may result in more than one person having the same values in the database. Although very improbable it is still possible that two or maybe three people can have DNA which results in the same data once processed. This wont mean that the person is automatically considered guilty, it just means that we are able to rule out the vast majority of the population immediately. Once a list of potential matches is obtained (which in most cases would be a single person) the police can investigate where these people were at the time the crime was committed and demand a full DNA comparison if necessary, which is then compared to the crime scene sample using the latest techniques for DNA comparison.

Conclusion

I think this approach satisfies the following criteria.

When it comes to authorities holding data on the population I am one of the least trusting people there are, I am certain that eventually every system can be manipulated in some way. If we are to benefit from such a great power we must justify it against its risks, when these risks are in the future they are unknown and therefore judging the risks is hard to do. This is why I have tried to come up with a way which will render the data of such little value that it is not worth abusing if a way were to be found of doing so.

The only information of any use within a stolen copy of this database would really be the personal data. I believe this should merely be a unique identifier for a person, this could be one or more of the following

  1. National insurance number - would need to be issued at birth
  2. Passport number and country of issue

Anyone without a national insurance number would be a non UK national and would therefore have a passport identifier. Anybody within the UK without a passport is untracable anyway and there is no reliable way of identifying this person.