The Combined DNA Index System

Report No. 01-26
September 17, 2001
Office of the Inspector General

A core function of the Department of Justice is solving crime, which includes aiding state and local law enforcement agencies to do the same. On an increasing basis, the use of DNA profiles (a computerized record containing DNA characteristics used for identification) has aided their effort. Accordingly, the Department initiated grant programs to strengthen DNA capabilities in state and local laboratories and, on March 18, 1998, the Attorney General asked a commission to address key DNA issues.

To further the use of DNA in solving crime, the Federal Bureau of Investigation (FBI) created a hierarchy of DNA profile indexes, the Combined DNA Index System (CODIS). CODIS is a national DNA information repository maintained by the FBI that allows state and local crime laboratories to store and compare DNA profiles from crime-scene evidence and convicted offenders. The goal of the system is to match case evidence to other previously unrelated cases or to persons already convicted of other crimes. Newspapers across the country have printed stories concerning crimes that were solved using DNA analysis and CODIS. The use of DNA profiles in solving crimes has become an increasingly powerful tool for law enforcement agencies, as shown in the following examples.

• In May 2000, CODIS was instrumental in solving the 1977 murder of a 6-year old girl in Reno, Nevada. Beginning in 1977, various forensic tests were performed on the child's clothing, which was found in a dumpster a few miles from Reno, but the case remained unsolved. In 1994, the perpetrator's DNA profile was developed from the clothing. The DNA profiles of numerous suspects were compared to the perpetrator's profile but no matches resulted. In May of 2000, a second DNA profile from the clothing was developed, using newer technology. When the second DNA profile was entered into CODIS, it matched with the DNA profile of a 57-year old convicted sex offender. The offender lived in the area and had been on parole since his release from prison in 1976. The suspect pled guilty to kidnapping and murder in October 2000 and was sentenced the following month.

• In June 1999, CODIS linked three unsolved sexual assault cases in Florida to six unsolved sexual assault cases in Washington, D.C. DNA evidence was crucial in the Florida cases because none of the victims were able to describe the offender and no other physical evidence was left at the crime scenes. In early July 1999, the perpetrator of the nine assaults, who was deceased, was identified through DNA analysis.

The criminal justice system has also relied on DNA evidence to prove the innocence of individuals wrongly convicted of crimes. According to the Innocence Project at the Cardozo Law School, as of April 26, 2001, DNA evidence was instrumental in freeing 87 innocent people from prison nationwide, including 10 people on death row. CODIS might have prevented the incarceration of these innocent people by helping to identify the perpetrators of the crimes for which they were convicted or by excluding them as suspects in those crimes.

The fact that DNA profiles are such a powerful tool for the criminal justice system emphasizes the potential for misuse of the information in CODIS. There are fears that, without strict controls over CODIS, information in the databases might be used for purposes other than law enforcement. During testimony before the National Commission on the Future of DNA Evidence (Commission), the Associate Director of the American Civil Liberties Union expressed concerns about the misuse of DNA databases. He testified that government databases inevitably undergo something he called "function creep." He stated that function creep occurs when databases that are created for one discrete purpose eventually take on new functions and purposes despite the initial promises of their creators.

The legislation authorizing CODIS, the DNA Identification Act of 1994 (Act), required the FBI to develop quality assurance standards that would ensure the integrity of the DNA records entered into the system. The Act placed strict limitations on the data allowed in CODIS and the use of that data. Prior to our audit, CODIS laboratories were not audited to determine whether the profiles in CODIS were complete, accurate, and allowable. Although CODIS-participating laboratories were audited to determine if they were compliant with the quality assurance standards, there was no system in place to ensure that laboratories adequately resolved audit findings. Furthermore, the FBI was not informed of the laboratories' audit results. Rather, the laboratories contributing DNA profiles to the national index simply certified that they had been audited and that they were in compliance with the legislation and quality assurance standards.

CODIS Program

State and local crime laboratories that participate in CODIS perform DNA analysis on specimens from crime-scene evidence and convicted offenders. The FBI provides participating laboratories with special software, free-of-charge, that organizes and manages the DNA profiles and related information. The software also enables participating laboratories to compare DNA profiles and notifies the appropriate laboratories when two or more DNA profiles match. The Forensic Science Systems Unit, part of the FBI's Laboratory Division, was directly involved in the development of all aspects of CODIS and continues to oversee the program.

According to the FBI, it began using Scientific Applications International Corporation (SAIC) in 1995 to develop CODIS software, software upgrades, provide training and technical assistance to software users, and to physically maintain and secure the national index of DNA profiles. The national index is maintained on government-owned equipment at the contractor's facility. The FBI owns all rights to the CODIS software. For fiscal years 1990 through 2000, SAIC received a total of $42.3 million for its work on CODIS. The FBI's contract with SAIC is broken up into many subtask orders, each of which covers a segment of the software development and maintenance. One of three methods is used to determine SAIC's compensation under a specific task order: cost plus award fee, cost plus fixed fee, or fixed fee.

Two separate CODIS databases were reviewed for this audit. The forensic database contains DNA profiles obtained from crime-scene evidence for persons whose identity is not known with certainty. The convicted offender database consists of DNA profiles from persons convicted of crimes in state or local courts, where the applicable state legislation permits the creation of a DNA record for convicted persons. There is a wide variation among states regarding which criminal statutes require convicted offenders to provide a DNA sample, as shown in the following table.

Type of Offense	Number of States Requiring a DNA Sample from Convicted Offenders
Sex Offenses Offenses Against Children Murder Assault and Battery Kidnapping Robbery Burglary All Felonies Attempted Crimes (rape, murder, etc.) Juvenile Offenders (qualifying crimes)	50 42 44 34 38 26 25 7 34 26
Source: Summary of State DNA Database Laws prepared for the FBI, March 2001

In addition, 35 states require that individuals convicted of a qualifying crime in the past, and incarcerated on the date the law became effective, submit a DNA sample for inclusion in CODIS. Further, nine states made the law retroactive for convicted offenders on parole when the law became effective and ten states made the law retroactive for convicted offenders on probation at the time the law became effective.

The FBI organized CODIS as a hierarchy that includes national, state, and local indexes known as the National DNA Index System or NDIS (national index), the State DNA Index System or SDIS (state index), and the Local DNA Index System or LDIS (local index). DNA profiles are uploaded into the national index from the state indexes and into the state indexes from the local indexes. The forensic laboratories at each level of the CODIS hierarchy decide which DNA profiles will be uploaded to the next level. The FBI maintains the national index, and each state participating in CODIS is required to select one crime laboratory to maintain its state index. The laboratory in each state that maintains the state index also maintains its own local index. None of the CODIS indexes contain any personal identifying information related to the DNA profiles. For each profile, the indexes identify the sample number and laboratory that performed the DNA analysis. The laboratory that contributed a DNA profile to CODIS must consult its own records to determine where or with whom a specific DNA sample originated. The following chart illustrates the CODIS hierarchy.

Example of System Hierarchy within CODIS

National Index (maintained by the FBI)
State Index Laboratory Berkeley, CA	State Index Laboratory Springfield, IL	State Index Laboratory Tallahassee, FL
Local Index Laboratories: CA DOJ Berkeley DNA Laboratory Orange County Sheriff's Office San Bernardino County Sheriff's Dept.	Local Index Laboratories: Illinois State Police, Joliet Illinois State Police, Chicago Illinois State Police, Morton Illinois State Police, Metro-East Illinois State Police, Springfield Illinois State Police, Carbondale Illinois State Police, Rockford Du Page County Sheriff's Office	Local Index Laboratories: Tallahassee Regional Crime Lab Jacksonville Regional Crime Lab Orlando Regional Crime Lab Tampa Regional Crime Lab Broward County Sheriff's Dept. Miami-Dade Police Department Palm Beach County Sheriff's Office

As of February 2001, there were 36 state index laboratories ² in 34 states uploading DNA profiles to the national index. There were 62 local index laboratories uploading DNA profiles to state index laboratories. The fact that a state laboratory uploads profiles to the national index does not mean that all local laboratories in the state upload DNA profiles to the state index. Some local crime laboratories do not perform DNA testing, and those that do may either choose not to participate in the state index or may be working to meet the requirements necessary to participate in the state index.

The FBI incorporated two important safeguards into CODIS: (1) participating laboratories can only upload DNA profiles to the next level of the hierarchy since the system is not set up to allow a laboratory to download DNA profiles from another laboratory; and (2) participating laboratories can only access their own indexes. As a result, each laboratory can only make changes to its own index and a laboratory cannot query another laboratory's local index, the state indexes, or the national index. When a laboratory uploads profiles to the next level, the uploaded profiles are automatically compared to the profiles contained in the index at that level. When there is a possible match between two or more profiles, the laboratories that submitted the specific profiles are notified. The notification indicates the specimen numbers and laboratories involved in the potential match. It is then the responsibility of the laboratories to contact each other and run confirmatory tests to determine whether or not the DNA profiles actually match.

The FBI's contractor tested the CODIS software as it was developed. Next, the software was provided to approximately 14 state and local laboratories for preliminary testing as part of a CODIS pilot program. In December 1997, eight state laboratories began submitting DNA profiles as part of an acceptance test of the national index. In addition, the Department of Commerce's National Institute of Standards and Technology (NIST) and the University of Illinois at Chicago jointly conducted a study on the feasibility of blind proficiency testing that tested the CODIS software matching capabilities. One of the test subjects was the FBI laboratory which received case evidence from two states over a period of months in 1997 that, unbeknownst to the laboratory, were created by NIST for testing purposes. In addition, the FBI was given the same samples as another test subject to determine if the CODIS system would correctly identify an interstate CODIS hit. According to documentation provided to the FBI laboratory about the test, it obtained the correct results and the CODIS software correctly identified the match.

Federal DNA Grant Funds

The DNA Identification Act of 1994 authorized $40 million over a 5-year period for a grant program that would provide funds to states and units of local government for programs intended to develop or improve a forensic laboratory's capability to analyze DNA. The Office of Justice Programs, National Institute of Justice (NIJ), administered the Laboratory Improvement Program (LIP), a competitive grant program in which laboratories vied for grant funds through the grant proposal process. Grant applicants were required to certify that: (1) DNA analysis performed at their laboratory meets or exceeds the quality assurance standards issued by the Director of the FBI, (2) the laboratory and each analyst performing DNA analysis undergo external proficiency testing every 180 days, and (3) DNA samples and analysis results are disclosed only in accordance with the Act.

The Antiterrorism and Effective Death Penalty Act of 1996 authorized $468 million for the State Identification System (SIS) grant program. The purpose of this 4-year grant program was to expand states' compatibility and integration with one or more of three identification systems maintained by the FBI: (1) the Integrated Automated Fingerprint Identification System, (2) the National Crime Information Center system, (3) and CODIS. Unlike the LIP program, eligibility for the SIS grants was determined solely by whether the states' DNA legislation mandated the collection of DNA samples from each person convicted of a felony of a sexual nature. The SIS program, administered by the Bureau of Justice Assistance (BJA), was a formula grant program in which all states that met the eligibility requirement received an equal portion of the available grant funds each year.

The Byrne Formula and the Local Law Enforcement block grant programs, overseen by the BJA, also provided funding for DNA-related projects. However, these grant programs were not limited to DNA-related projects. Grantees were allowed to use the funds for any number of approved purposes. The funds for these two block grant programs and the SIS grant program were awarded to an administrative agency in each state that was responsible for overseeing the use of the funds.

2. The two remaining state index laboratories are the FBI laboratory in Washington, D.C., and the U.S. Army laboratory in Georgia. These laboratories do not receive profile uploads from local index laboratories. The FBI laboratory contributes forensic profiles developed from crime-scene evidence submitted by state or local law enforcement agencies for DNA analysis, from evidence in federal crimes, and from crimes committed in the District of Columbia or on government land. The U.S. Army laboratory contributes forensic profiles for crimes that fall under the military's jurisdiction.