According to Verogen, the company that recently purchased GEDmatch, no user data was downloaded or compromised. But two days later, the genealogy website MyHeritage alerted users to a phishing scheme that targeted people who used both MyHeritage and GEDmatch. In a statement posted online, the company said it suspects the attackers may have gleaned the email addresses from GEDmatch.

Verogen has taken GEDmatch down. The company says it is working with a cybersecurity firm to conduct a forensic review and safeguard the site. That may not be enough to recover users’ trust.

Some already see giving law enforcement access to DNA profiles as controversial. As BuzzFeed News reports, this incident could limit those on both sides of the debate. If GEDmatch can’t keep data safe, users may be less likely to create DNA profiles, which could make it harder for police to use the site to solve cold cases. On the other hand, if GEDmatch can’t limit police access, users who may have made a profile on the condition it wouldn’t be used by law enforcement may not create a profile at all. That means less data for genealogists to work with.

How does a DNA testing service like 23andMe convince you to shell out more when the base results are the same? By rolling out the red carpet, it seems. The company has introduced a $499 VIP Health + Ancestry Service that includes two Health + Ancestry kits, faster lab processing, overnight shipping, a year of “premium” support and, crucially, a 30-minute one-on-one walkthrough of your Ancestry results. Effectively, 23andMe wants to offer a concierge for your genes.

The policy generally limits law enforcement to considering genealogy sites when a candidate sample belongs to a possible culprit, or when a likely homicide victim is unidentified. Prosecutors can greenlight the use of these sites for violent crimes beyond murder and sexual assault, but only when the circumstances create a “substantial and ongoing threat” to the public. Agencies can’t use the sites unless a sample has first been uploaded to the FBI’s DNA profile database and hasn’t produced a match. Also, the investigators in the relevant jurisdiction need to have followed “reasonable investigative leads,” and case info need to be entered into national databases for missing people and violent criminals.

There’s more even after meeting these rules. FBI lab officials have to evaluate the suitability of a sample and suggest “reasonable” alternatives to genealogy sites when possible. The investigators must then agree with prosecutors that genealogy is a suitable option. If they get the go-ahead, they have to explicitly identify themselves as law enforcement to these sites, use only sites that make clear the police have access, keep data as private as possible and obtain consent from third parties before collecting any reference samples. Any analysis on a covertly-obtained sample will require a search warrant, and samples have to be limited to the identification purposes necessary for the case.

If there’s a lead, the case holders have to turn back to conventional investigation methods.

Any genealogy profiles and account info will be treated as confidential, and there are tight controls on what happens if a suspect faces charges. If they’re charged after a genealogy profile has been entered into an open DNA database, the investigators will have to remove that profile. Samples, profiles and accounts have to be destroyed once there’s a verdict, while Department elements have to routinely document instances where genealogy sites were used, including the sites in question and the ultimate outcome.

The temporary policy takes effect November 1st, while a final policy is due in 2020. It’s safe to say there’s a clear goal at this stage — the DOJ wants law enforcement to avoid using genealogy sites as much as possible, and leave an extensive record of what happened. It might not completely alleviate privacy concerns, but it could prevent obvious abuses of sensitive genetic data.

Investigators linked Talbott to the 1987 murders of Canadian couple Jay Cook and Tanya Van Cuylenborg after two of his cousins (from both sides of the family) uploaded their DNA profile to GEDMatch. The database, which also led to the Golden State Killer arrest, allows users to upload their DNA test results from services like Ancestry and 23andMe, so they can find other relatives and create a comprehensive family tree.

CeCe Moore, the genetic genealogist who worked with the authorities on the case, traced the DNA extracted from semen left on Van Cuylenborg’s body to Talbott’s parents through his cousins. His parents only have one son. It was only after he was identified through the database that authorities were able to match his palm print to a print lifted from the scene.

According to Wired, both sides agreed to treat the DNA identification as a tip before the trial even began, and nobody questioned the method used to link Talbott to the case. If more and more cold cases go to trial due to DNA databases, though, there’s bound to be serious discussions on whether using them to solve crimes should be regulated.