San Francisco Crime Lab Regularly Searched Victim DNA for Criminal Matches

An example of how lack of regulation leads to practices that damage public faith in policing

DNA and handcuffs

Last week, in San Francisco, a scandal about the county crime lab’s unethical use of DNA collected from rape kits and victim swabs came to light. Here is some of the initial reporting from the Washington Post:

The San Francisco district attorney’s stunning claim that California crime labs are using DNA from sexual assault survivors to investigate unrelated crimes shocked prosecutors nationwide, and advocates said the practice could affect victims’ willingness to come forward.

District Attorney Chesa Boudin said he became aware of the “opaque practice” last week after prosecutors found a report among hundreds of pages of evidence in the case against a woman recently charged with a felony property crime. The papers referred to a DNA sample collected from the woman during a 2016 rape investigation.


The newspaper said the woman was tied to a burglary in late 2021 during “a routine search” of a San Francisco Police Department crime lab database. The match came from DNA gathered from the same laboratory listed in a report on the sexual assault, The Chronicle reported.

Boudin said someone at the crime lab told his office the practice was a standard procedure. According to Rachel Marshall, Boudin’s spokeswoman, that person was crime lab Director Mark Powell.

Boudin used his prosecutorial discretion to drop the charges against the woman stating that the use of that DNA evidence in this way was a violation of constitutional rights. Since the initial reporting, the scope and extent of this practice have come more into focus:

For the last seven years, the department’s crime lab has also been keeping all processed DNA – including, for example, from victims of violent crimes, child victims, or individuals entirely uninvolved in the crime like roommates and consensual partners – according to the police chief and a copy of the lab’s standard operating procedures obtained by USA TODAY.

“Any DNA that our lab tests, or comes across, goes in that database,” Police Chief Bill Scott told USA TODAY last week. This could include DNA at crime scenes that, for example, may belong to victims of child abuse including molestation, violent crimes like robbery, assault like a stabbing, or even property crimes, if DNA sampling is applicable.


DNA belonging to consensual sexual partners in rape cases is put into the database in order to exclude them from a suspect’s DNA, said Scott, adding that he believed the use of such a database has long been an “accepted practice” beyond the San Francisco Police Department.


The scope of how many victims or volunteers may have had their DNA queried by the department’s crime lab and matched to unknown suspect DNA to solve a criminal case over the last seven years is unknown. Scott said the department was only aware of this incident, but pledged to look at prior matches to determine whether victim DNA was used.

From a purely functional side, it’s easy to understand why a police lab might engage in this practice. After all, if you spend years building a DNA database, why not use it for investigations–especially if it can solve crimes?

However, from a bioethical and professional practice perspective, it’s hard adequately articulate how damaging this practice is for the perception and practice of law enforcement:

Good lord,” said retired San Diego Police detective Carlton Hershman, who called the disclosure a “nuclear bomb.” He investigated more than 1,300 sexual assault cases in his career.

“That’s just inappropriate, in my opinion. You can’t take just a swath of people and throw them in the databank,” Hershman said. “I don’t care if you’re a career criminal, I don’t care if you’re a gang member and you’ve been shot. Your DNA should not be dumped in with suspects. That’s not how we operate.”

“As far as I know, it’s not a widespread practice,” said Ilse Knecht, director of policy and advocacy at the Joyful Heart Foundation, which assists survivors of sexual assault, domestic violence and child abuse.

Knecht and others fear the effect on sexual assault victims, many of whom are already reluctant to report their experiences to law enforcement. Experts say only a third of sexual assaults are reported to authorities.

The possibility — however remote — that an accuser’s DNA could be used against them could throw up additional barriers.

“I think anybody can understand how survivors would be fearful of reporting after hearing this story,” Knecht said.

Nelson Bunn, executive director of the National District Attorneys Association, said he did not personally know of crime labs using DNA in such a manner. Rape-kit DNA should only be used in sexual assault investigations, he said.

“Otherwise, trust would be eroded,” he said, citing “a detrimental effect on justice for victims of sexual assault.”

A common complaint directed at over-policed communities is their perceived lack of cooperation in police investigations. This is a prime example of the type of behavior that can lead communities, writ large, to distrust police. Even if you were a victim of a crime, would you willingly submit DNA if you knew that it might be run against any past or future case?* It’s especially important to consider that in light of the fact that the Justice Department’s 2020 Criminal Victimization report estimates that less than 23% of sexual assaults are reported to the police.

Rather than focus on the bioethical implications of this (which I hope to your chosen deity are abundantly clear), I want to call attention to how our fragmented criminal legal system enables this to happen. To help with this a quick bit of grounding:

Unlike other countries, there is no centralized criminal legal system in the US. Instead we have over 52 separate criminal legal systems (one for each state + DC + Federal + Territorial + Military + Tribal…). Each has a different set of laws and oversights. However, since investigations and trials take place at the large municipality and county level, the reality is we have well over 3,000 criminal legal systems in the US. Because of that fragmented nature, the locus of control and regulation is typically at the local level.

This has implications for many things, including the regulation of DNA evidence:

California law allows local law enforcement crime labs to operate their own forensic databases that are separate from federal and state databases. The law also lets municipal labs perform forensic analysis, including DNA profiling, using those databases — without regulation by the state or others.


Local databases like the one maintained by the San Francisco Police Department, are not held to the same standards or regulation as the federal DNA database maintained by FBI, which strictly prohibits most victim DNA from being uploaded.

As a result, policies that aren’t spelled out in statute are mainly self-determined, law enforcement and forensic experts say. For example, there is no purge schedule for the DNA samples in the San Francisco crime lab database, other than for minor victims, whose profiles must be purged after two years under a 2019 state law, Scott said. He said the department would first focus on eliminating harm to victims before looking at whether it needs to institute any purge schedule and how that might work.

The CA legislation allows shadow databases like the one used in San Francisco to operate with little to no oversight (at either the state or local level) often without the knowledge of other agencies in the same jurisdiction. In the case of San Francisco, the only reason this was detected is a line prosecutor happened to notice a reference to the search in the prosecution file.

Each state’s laws are structured differently, but the reality is that in much of the country, oversight of DNA evidence is lax, at best. And in places where it does exist, it may not be significantly empowered to act. For example:

A similar practice was documented in Bristol, Massachusetts, where the state’s Forensic Science Oversight Board noted in a report last year that its DNA database included DNA profiles belonging to victims, family members and consensual sexual partners for exclusionary purposes. The board urged the legislation prohibiting such aggregation of DNA records.

This ultimately gets us to the challenge of criminal legal reform in the US: it’s exceptionally hard to accomplish. Even if we were not gridlocked at the federal level, Washington has little power over law enforcement in States. This means that reforming and improving the handling of victim DNA evidence requires passage of regulatory laws by each state/territory/tribal/etc governing body. That is a LOT of work and while we are waiting for it to happen, shadow DNA databases, like the one in San Francisco, will continue to grow and be used (more often than not without any knowledge).

Aside: the police have a long record of proactively collecting biometric data with very little regulation. As a child of the ’80s and early ’90s, I remember being fingerprinted for “identification” during the moral panic that sprung up around the kidnapping and murder of Adam Walsh. I have yet to find any sources that confirm whether or not those prints were sequestered for use only in victim identification or if they could be used in criminal investigations as well.

* – You might be wondering why this might be concerned for victims of domestic violence. The sad truth is that because of the destabilizing factors that lead to and are created by domestic violence, there are many cases where victims of domestic violence are also system-involved as well. Unfortunately, there is currently no easy way to track the extent of this.

FILED UNDER: Crime, Law and the Courts, Policing, Science & Technology, US Politics, , , , , , ,
Matt Bernius
About Matt Bernius
Matt Bernius is a design researcher working to create more equitable government systems and experiences. He's currently a Principal User Researcher on Code for America's "GetCalFresh" program, helping people apply for SNAP food benefits in California. Prior to joining CfA, he worked at Measures for Justice and at Effective, a UX agency. Matt has an MA from the University of Chicago.


  1. Sleeping Dog says:

    We should be surprised by this? Of course law enforcement would do this.

  2. Mister Bluster says:

    Aside: the police have a long record of proactively collecting biometric data with very little regulation. As a child of the ’80s and early ’90s, I remember being fingerprinted for “identification” during the moral panic that sprung up around the kidnapping and murder of Adam Walsh. I have yet to find any sources that confirm whether or not those prints were sequestered for use only in victim identification or if they could be used in criminal investigations as well.

    Here in Jackson County, Illinois there was fingerprinting of children by some agency at the local mall at that time. The procedure was to fingerprint the child and give the only copy of the prints to the parents or legal guardian.

  3. Matt Bernius says:

    @Mister Bluster:
    I was too young at the time to remember what happened to the prints, or if multiple copies were made. Today most fingerprinting is digital, so that creates its own issues in terms of storage and transmission.

  4. Mister Bluster says:

    @Matt Bernius:..fingerprinting

    I can only speak for Jackson County with any certainty. However I seem to remember that the procedure was adopted as it was being done in other jurisdictions.
    I have never had the pleasure of being booked. I do remember providing a thumbprint when I took a Civil Service test for employment at the United States Postal Service here in Sleepytown. That was at least 40 years ago. I wonder if I filed a request through the Freedom of Information Act I could get it back. (HA!)*
    The only other memorable event at a Post Office to affect my life was in 1966 when I signed up for the draft at the Selective Service Office in the basement of the Harvey, Illinois PO while I was still in High School. No fingerprinting then.
    I remember a gal at a desk behind the counter grinning and saying “I hope they don’t get you!”

    *Never got the Post Office job.
    Never got drafted either.

  5. Kathy says:

    FYI The State Department took my fingerprints in 2012 as part of the tourist visa application (I don’t recall if the same happened the prior time in 2000). Fingerprints are also scanned on arrival at a US airport (at least in vegas and Houston), and that’s by a different department.

    I wonder who else gets access to them.

    On the other hand, I’ve been fingerprinted by the state of Mexico when getting a driver’s license, and by the federal government when renewing the voter ID card/voter registration.

  6. Mu Yixiao says:

    The FBI has a full set of my prints on file. I had to submit them when I got my teaching license–because I had been out of the state for more than 3 consecutive months in my life.

    And I’ve had to submit a thumbprint (digitally) at airports and when getting my passport renewed.

    But I’m smart enough to wear leather gloves when (allegedly!) committing any serious crimes–and promptly burning them afterwards.

    But with these new blood thinners I’m on, I’m screwed on DNA evidence. A couple minutes playing with a kitten, and my bedsheets ended up looking like set dressing from an episode of Dexter.

    On the serious side: Another set of sources of DNA that people aren’t thinking about are places like 23 and Me. Police love these companies. They can get DNA samples–sometimes/often without warrants–and do all sorts of tracing. One of my aunts submitted her DNA “just for fun”, so I can be readily identified based on that information.

  7. mattbernius says:

    @Mu Yixiao:

    Another set of sources of DNA that people aren’t thinking about are places like 23 and Me.

    I considered mentioning them, however I need to do a bit more research into their use in law enforcement before commenting.

  8. Mu Yixiao says:
  9. Matt Bernius says:

    @Mu Yixiao:
    TY. My quick scan of that editorial and legal provisions around that topic immediately tell me that any response needs to be in a separate post.

  10. Sleeping Dog says:


    The NY Times magazine from a few weeks ago had a long article on a woman who is the go to person for ferreting out likely matches from DNA procured from 23 and Me type companies to that involved in crime scenes. Can’t remember her name, Carol something.

  11. Matt Bernius says:

    @Sleeping Dog:
    Ok, adding that to the research stack! TY!

  12. Just nutha ignint cracker says:

    @Kathy: On my second annual registration at the Daejeon (ROK) Immigration Office, I was fingerprinted as part of the process. I simply assumed that any government agency (and probably significant numbers of private ones) that asked for them would be provided a copy.

  13. Just nutha ignint cracker says:

    @Mu Yixiao: I had to provide them simply because I was receiving a teaching license, but I’ve always wondered about why my report from the feds comes back several weeks earlier than is typical. It’s almost as if they don’t have to look hard to find my master file because it always in someone’s active drawer.

    I suppose that it’s because once you’ve visited someone in prison and they discover you have a vowel at the end of your name, you’re never that far away from being “a person of interest” in some RICO investigation.

  14. Just nutha ignint cracker says:

    @Just nutha ignint cracker: (And I suspect that the SDS and Black Panther meetings I attended in high school probably don’t help either.)

  15. DaveD says:

    @Matt Bernius: I honestly don’t think it actually matter wrt fingerprinting either digital or hard copy. A lot of people like to thin of the police doing CSI type stuff. But there was a week between my last arrest and sentencing and I was fingerprinted both times. Asked why the CO said they change. Taking DNA upon conviction has been the smart move forward because that doesn’t change. The downside is that DNA is collected upon intake and supposed to be destroyed if you aren’t convicted. The police state in this country has shown zero ability to police itself and will continue to violate fourth amendment rights whenever they feel they can.