A security weakness in the technology used by most of the nation’s crime labs to analyze DNA evidence exposed 30 years of crime files to the risk of being hacked, according to a group of forensic and computer scientists.
A security weakness in the technology used by most of the nation’s crime labs to analyze DNA evidence exposed 30 years of crime files to the risk of being hacked
The researchers found that with the help of computer code written by widely available AI software, they could alter the data produced from computerized scans of physical DNA evidence without leaving any trace they had tampered with the records. The vulnerability is likely to have existed in the digital files produced by crime-lab machines since 1995, but recent technological advances make potential tampering much easier now, they said.
“Effectively, what we have are data files that are legitimately referred to as the gold standard of forensic science that lack the same level of tamper-evident markings that we require for a paper bag,” said Laura Gaydosh Combs, a forensic scientist and University of New Haven professor who worked on the research.
The company that makes the crime-lab equipment used in a majority of facilities, Thermo Fisher Scientific, privately acknowledged the vulnerability in July and indicated it was working on a fix, according to messages reviewed by The Wall Street Journal. The researchers flagged the security threat in May.
After being contacted by the Journal, the company on Friday issued a security bulletin, labeled high severity, that warned of “a risk for nearly undetectable modification” of certain files “if laboratory controls are circumvented.”
The company in a separate note to customers emphasized that there were no known instances where the vulnerability had been exploited.
“We have been working closely with the U.S. Cybersecurity and Infrastructure Agency since the software issue was raised,” the company said in a statement to the Journal. “We appreciate the work of forensic researchers on this topic, and we have released a software update that implements the use of digital signatures to add an extra layer of protection that moving forward will help customers verify that data files have not been modified.”
While there is no evidence that bad actors have exploited the security weakness to hack files, the researchers said they haven’t found a way to detect tampering if it had happened. Someone with an intent to corrupt the digital evidence files would need local or remote access to a lab’s servers and enough know-how about the way DNA testing works. The vulnerability doesn’t impact the physical DNA material submitted for testing.
DNA evidence is a central and reliable part of criminal investigations and prosecutions, but there have been occasional worries about tampering. In Colorado, a state forensic analyst pleaded guilty in June to four felonies after prosecutors alleged she manipulated evidence and engaged in a variety of misconduct from 2008 to 2023.
For decades, lab machines have taken physical DNA evidence and produced digital analysis files. The threat of tampering with those files has grown since the rise of AI technology that lets amateurs create tools they might not previously have had the skills to develop, the researchers said. In theory, a sophisticated attack could add or remove DNA profiles after crime-scene evidence is scanned, creating the impression a suspect wasn’t at the scene or an innocent person was.
Nathan Adams, a systems engineer at Forensic Bioinformatics, an Ohio-based DNA consulting company, began testing the issue earlier this year, using a public data set of DNA files.
Using Anthropic’s Claude, Adams said his first success at changing a file took about 45 minutes.
Some file types have a higher level of encryption, but Adams said a little bit of research led him to a decryption key that has been on the internet for years.
In a test viewed by the Journal, Adams’s code was able to combine the scans of two individual DNA profiles into a new file that appeared untouched since 2015. The modified file raised no red flags in the analysis software many labs use.
It isn’t clear whether the security vulnerability will affect pending or past prosecutions. Defense attorneys regularly mount challenges to DNA collection and analysis in their cases. Such evidence is a common feature in criminal trials, though most people aren’t convicted or exonerated on DNA evidence alone.
Sarah Chu, the director of policy and reform at the Perlmutter Center for Legal Justice, who worked on the project, said the research highlights lagging protocols “in a system where life and liberty are at stake.”
There is no central, national regulator in forensic science, she said, leading to a patchwork of security measures at the more than 200 labs that handle everything from forensic evidence to paternity tests.
“Lessons learned from other industries haven’t been imported into forensic science in a serious way,” Chu said. “We’ve been behind the ball for so long. That kind of all rolls downhill into this incident.”
