Italian NDNA database. The devil is in the details

On June 30, 2009, the Italian Parliament finally passed Law No. 85 that ratifies the Prum Convention and forms the legal ground for the creation of an Italian National DNA Database (NDNAD.)

Although this law might have benefited from UK and USA court experience in the field of DNA forensics, the current text indicates that neither British nor American case law have been taken into consideration. Furthermore, the law is flawed by a foggy understanding of the technicalities behind DNA profiling and sloppy wording that certainly will not facilitate the work of lawyers, prosecutors or judges. Just to highlight a few of these inconsistencies, it must be noted that art. 8 (Attivita` del laboratorio centrale per la banca dati nazionale del DNA – Activity of NDNA Database Central Laboratory) lacks any general provision that would oblige all the responsible parties to adopt serious and adequate security measures against unauthorized access, data tampering, and illegal handling of data and information.

Furthermore, art. 9 (Prelievo di campione biologico e tipizzazione del profilo del DNA – Mandatory DNA Sample Collection and DNA Profile Sequencing) states nothing about the need for a properly established chain of custody. It is crucial that the collected sample be processed, both technically and administratively, in such a way that it would be impossible for a “planted” or “altered” sample to be used. This requirement was proven vitally important in the OJ Simpson trial (held between 1994 and 1995 at the Los Angeles Court in the USA) where the value of DNA evidence was successfully challenged by the defendant due to law enforcement gaffes.

As if this wasn’t enough, nothing is said about the effect of an improperly managed chain of custody on admissibility of the samples as evidence in Court. This is an issue similar to the one raised in the computer forensics field, where there is an vigorous ongoing debate about the admissibility/reliability of digital (volatile) information presented in Court without a documented and technically well-grounded chain of custody (the relevance of this issue is enhanced by the recent finding that DNA samples can be easily faked without expensive facilities.)

This same lack of perspective can be observed in art. 10 (Profili del DNA tipizzati da reperti biologici acquisiti nel corso di procedimenti penali – DNA Profiles Sequenced from Biological Samples gathered during Criminal Investigations). (Its impact on due process and the right of defense are addressed in the analysis of art. 12). This section deals with sample tracing and access to data. Law enforcement officers can access the NDNA database without prior authorisation from the prosecutor or the judge that is responsible for the investigation involving the sample or profile in question (under Italian law, law enforcement bodies are under the direction and control of the public prosecutor). Since the article is silent about the matter, only future court decisions will determine whether prior authorization is needed to access the NDNA database, thus leaving wide open a window of several years in which “anything can happen”. It is worth pointing out that there is no mention of defense and victim’s lawyers in this provision, thus making it impossible for them to make reasonable discovery demands.

The third provision in art. 12 neither requires the positive identification of the personnel accessing the NDNA database and material in the central lab, nor the secure logging of access to and activity involving the profile and sample.

Art.13 too raises concerns (Cancellazione dei dati e distruzione dei campioni biologici – Data Erasire and Destruction of Biological Samples). Provision 3 doesn’t clearly identify who is in charge of ordering the destruction of samples and profiles. It would have been far more appropriate (and easier) to say that samples, profiles and all of its related information cannot be used during the trial. A judge in the preliminary investigation, preliminary hearing or trial – depending on the stage of the trial – orders the destruction of both profiles and samples from the NDNA database, the central laboratory and any other place where this information is stored (e.g. prosecutor’s docket, law enforcement investigator files, etc.)

Art. 14 deals with punishment for a public officer that communicates or uses data and information without authorization, or for purposes other than those stipulated specifically in the law. Well, the punishment is incredibly light: a jail term of between one and three years. This means that by pleading guilty (up to 1/3 of a reduction in term) and obtaining a further 1/3 reduction for the “attenuanti generiche” (generic circumstances that decrease the severity of the punishment), a defendant could face a final jail term of less than six months that could be avoided by simply paying a fine. Given the magnitude of the matter, one would expect to find harsh punishments rather than the equivalent of a light slap on the hand.

Two final remarks:
The first one is about technology. The law says nothing about strategic technological choices. Of course it is not to be expected that a law will enter into the maze of ICT and molecular biology oddities. Naturally a series of subordinate administrative acts will be adopted by the ministries concerned. But what the law might have (and should have) layed down was the inclusion of principles such as the use of non-proprietary file formats and technologies (thus avoiding the technological “locked-in” syndrome that allowed ICT multinationals to create a de facto monopoly since the cost of converting huge quantities of information to a different format was so high as to discourage the shift).

The second one concers the “vicious loop” in assessing crime impact and crime spreading. By excluding white collar crime profiles from the NDNAD, the law can alter crime-related statistics. If all you can find in the NDNAD are violent crimes committed by Africans or Balkan immigrés and undocumented migrants (they will hardly be involved in stock exchange frauds), prosecutors will find easier to investigate these crimes, with the potential result being an injection of “hidden racism” into the justice system.

To put it briefly: crime statistics are based upon prosecutory investigations and trials, but if prosecutory investigations are based upon the NDNA database, the only crimes that will be scrutinized by politicians will be those that fall into the NDNA database.