A security weakness in technology used by most U.S. crime labs to analyze DNA evidence exposed 30 years of case files to potential hacking, according to computer scientists who discovered the vulnerability.
The Wall Street Journal reports that the researchers found that with the help of computer code written by widely available AI software, they could alter data produced from computerized scans of physical DNA evidence without leaving any trace of tampering. The vulnerability likely existed in digital files produced by crime lab machines since 1995, but recent technological advances make potential tampering much easier now, they said.
Laura Gaydosh Combs, a forensic scientist and University of New Haven professor who worked on the research, said the issue affects files considered the gold standard of forensic science. “Effectively, what we have are data files that are legitimately referred to as the gold standard of forensic science that lack the same level of tamper-evident markings that we require for a paper bag,” she said.
Thermo Fisher Scientific, which makes the crime lab equipment used in a majority of facilities, privately acknowledged the vulnerability in July and indicated it was working on a fix, according to messages reviewed by the Journal.
After being contacted by the Journal, the company on Friday issued a security bulletin labeled high severity. The bulletin warned of “a risk for nearly undetectable modification” of certain files “if laboratory controls are circumvented.” In a separate note to customers, the company emphasized that there were no known instances where the vulnerability had been exploited.
Thermo Fisher said in a statement that it has been working closely with the U.S. Cybersecurity and Infrastructure Agency (CISA) since the software issue was raised. The company released a software update that implements digital signatures to add an extra layer of protection to help customers verify that data files have not been modified.
While there is no evidence that bad actors have exploited the security weakness to hack files, the researchers said they have not found a way to detect tampering if it had happened. Someone with an intent to corrupt the digital evidence files would need local or remote access to a lab’s servers and enough knowledge about the way DNA testing works. The vulnerability does not impact the physical DNA material submitted for testing.
DNA evidence has become a central part of criminal investigations and prosecutions, but there have been occasional worries about tampering. In Colorado, a state forensic analyst pleaded guilty in June to four felonies after prosecutors alleged she manipulated evidence and engaged in a variety of misconduct from 2008 to 2023.
For decades, lab machines have taken physical DNA evidence and produced digital analysis files. The threat of tampering with those files has grown since the rise of AI technology that lets amateurs create tools they might not previously have had the skills to develop, the researchers said. In theory, a sophisticated attack could add or remove DNA profiles after crime scene evidence is scanned, creating the impression a suspect was not at the scene or an innocent person was.
Nathan Adams, a systems engineer at Forensic Bioinformatics, an Ohio based DNA consulting company, began testing the issue earlier this year using a public data set of DNA files. Using Anthropic’s Claude, Adams said his first success at changing a file took about 45 minutes.
Some file types have a higher level of encryption, but Adams said a little bit of research led him to a decryption key that has been on the internet for years. In a test viewed by the Journal, Adams’ code was able to combine the scans of two individual DNA profiles into a new file that appeared untouched since 2015. The modified file raised no red flags in the analysis software many labs use.
It is not clear whether the security vulnerability will affect pending or past prosecutions. Defense attorneys regularly mount challenges to DNA collection and analysis in their cases. Such evidence is a common feature in criminal trials, though most people are not convicted or exonerated on DNA evidence alone.
Sarah Chu, the director of policy and reform at the Perlmutter Center for Legal Justice, who worked on the project, said the research highlights lagging protocols in a system where life and liberty are at stake.
There is no central, national regulator in forensic science, she said, leading to a patchwork of security measures at the more than 200 labs that handle everything from forensic evidence to paternity tests. “Lessons learned from other industries haven’t been imported into forensic science in a serious way,” Chu said. “We’ve been behind the ball for so long. That kind of all rolls downhill into this incident.”
Read more at the Wall Street Journal here.
Lucas Nolan is a reporter for Breitbart News covering issues of AI, free speech, and online censorship.