scorecardresearch Skip to main content

DNA research is helping investigators track down suspects in cold cases. But how does it work?

Matthew Nilo is arraigned on rape charges stemming from assaults in Charlestown, in 2007 and 2008 in Suffolk Superior Court in Boston, Monday, June 5, 2023. His attorney, Joseph Cataldo is at left.Pat Greenhouse/Associated Press

The recent arrest of a New Jersey lawyer now charged in connection with a spate of rapes in Charlestown in 2007 and 2008 has highlighted the use of investigative genetic genealogy, a tool police are increasingly employing to solve cold cases.

The technique has helped crack high-profile cases around the country, including that of the notorious Golden State Killer, a former police officer who was accused in 13 murders and 51 rapes across California in the 1970s and 1980s and arrested in 2018.

Investigative genetic genealogy involves comparing DNA left by perpetrators at crime scenes with DNA profiles that people voluntarily submit to ancestry websites. If there’s a match, investigators can examine the family tree of the person who gave their DNA to the site, in an effort to narrow down a suspect.


“First, IGG is a methodology,” said David Gurney, an assistant professor at Ramapo College in New Jersey, who directs the school’s Investigative Genetic Genealogy Center, via email, using the acronym for the technique.

Practitioners of IGG combine genetic genealogy with documentary research to produce leads in cases of violent crime and to help identify human remains, according to Gurney.

“Those leads are then confirmed by law enforcement using traditional DNA methods,” he continued.

Historically, investigators had to rely on a federal DNA database containing profiles of people previously arrested. If a suspect’s DNA profile wasn’t in the system, called CODIS, that person couldn’t be identified.

But ancestry sites have changed the game.

Now authorities can submit an assailant’s autosomal DNA profile to two commercial genealogy databases, GEDmatch and FamilyTree DNA, which are used by consumers to trace their ancestry or locate relatives. Customers must consent before their information is shared with law enforcement.

The GEDMatch website says customers, when uploading their DNA, “can choose what level of privacy” they want for their DNA kit.


Customers that select the Public Opt-In option, the site says, have their DNA placed in a database open to “users (including law enforcement) attempting to identify unidentified human remains, and law enforcement attempting to identify perpetrators of violent crimes. ... The operators of GEDmatch encourage everybody to select this option.”

The companies ultimately provide a list to law enforcement of relatives and the percentage of DNA they share with the submitted sample.

“In many cases, the closest genetic relative of a subject may be a third cousin or more distant,” said Cairenn Binder, who directs Rampao College’s IGG Certificate Program, via email.

“The more distant the genetic relatives, the more challenging the case will be,” Binder said.

While not all customers on the sites agree to make their DNA profile available to investigators, many do.

Binder pointed to a 2022 study that found more than 500,000 users of GEDMatch had opted in to making their profiles available to law enforcement. But not all genetic testing companies make customer DNA profiles available for law enforcement comparisons.

“The only companies that allow for law enforcement searching are FamilyTreeDNA and GEDmatch Pro,” Binder said. “AncestryDNA has been subpoenaed unsuccessfully many times.”

Gurney said Ancestry and MyHeritage have the largest number of DNA profiles in their possession “by far.”

“[I]f they changed their terms of service to allow IGG searching, it would dramatically impact the number of cases that would be resolved with the help of IGG,” Gurney said.


Requests for comment were sent Tuesday to Ancestry and MyHeritage.

In the case of the New Jersey lawyer, Matthew James Nilo, 35, investigators used the technology to identify him as a suspect in April and then surveilled him in the New York area, according to prosecutors and court papers.

Eventually, investigators collected DNA from drinking cups and utensils they watched Nilo use at a corporate event, prosecutors said. When they analyzed the DNA, it allegedly matched samples in the rape kits from the 2007 and 2008 assaults. Nilo has pleaded not guilty.

Gurney said “courts have consistently upheld this practice [of surreptitious DNA collection in public events] and found that it does not violate the 4th Amendment since individuals do not have a privacy interest in DNA they have discarded in public.”

Law enforcement officials haven’t said which relative of Nilo’s submitted a DNA profile to an ancestry site that ultimately led to him being identified as the alleged perpetrator.

The majority of people who have uploaded their DNA profiles to GEDmatch and FamilyTreeDNA are of western European descent, Gurney said. “IGG can and does provide leads in cases involving people from other ethnicities, but on average those cases will take longer,” he said.

Besides identifying suspects, genetic genealogy has also been used to determine the identities of murder victims. Last year, the FBI announced that it had identified “The Lady of the Dunes,” a Cape Cod mystery that had eluded law enforcement for nearly 50 years.


Some civil rights advocates have raised privacy concerns about investigative genetic genealogy and have called for more regulation over the companies’ databases and oversight of police, labs, and genealogists involved in the process. And advocates for survivors of sexual assault say that these types of cold case strategies need to be done in a way that continues to give victims a voice in the process.

One major breakthrough of the technology, experts say, is putting suspects with clean records on the radar of law enforcement, since people who haven’t been arrested aren’t in the federal CODIS system of DNA samples.

“That happens over and over again,” said Barbara Rae-Venter, an investigative genetic genealogy consultant who works with police around the country to help identify suspects in murders and rapes, in a recent interview. “The people we identify have no record. They are not on anybody’s radar.”

But with investigative genetic genealogy, Rae-Venter said, authorities can “identify people who you otherwise would not be able to identify.”

Though it can take time.

“The process can take anywhere from a few hours to many years,” Binder said. “To give a few examples, I worked on the team that identified [serial killer John Wayne] Gacy Victim 5 in eight hours, but I have been working on the case of Apache Junction Jane Doe [in Arizona] for almost five years and she remains unidentified.”

Material from prior Globe stories was used in this report.


Travis Andersen can be reached at