Encrypted by the Family,
Read Only for Reunification

2. The Humanitarian DNA Dilemma

Forensic and kinship genetics have become central to the humanitarian response to separation and loss. Governments, intergovernmental agencies, and non-profits use DNA to identify the missing after conflict and disaster, to reunite children separated at borders, and to return the remains of the disappeared to their families. The forum that occasions this paper convenes exactly the scholars mapping this terrain.

Elizabeth S. Barnert, MD, MPH, a pediatrician at UCLA, holds a 2024 National Institutes of Health award to examine protocols for using DNA to reunify migrant families separated by war, disaster, or immigration policy, guided by the principle that reunification should serve the child. Lindsay A. Smith, PhD, an anthropologist at the University of New Mexico and author of Subversive Genes: Making Human Rights and DNA in Argentina, has traced how forensic DNA moved from a tool built by human rights movements to identify the disappeared into a globalized "humanitarian forensics" whose infrastructures can be turned to other ends. Sara Huston, MS, a research assistant professor in forensic genetics and the forum's moderator, has studied DNA, displacement, and state power directly, including field interviews in Kyiv on the identification of the war dead and displaced.

Across their work a single tension recurs, and the forum states it plainly: genetic databases created for reunification "often must persist beyond the immediate crisis for years or decades, creating risks of secondary uses for other purposes, for law enforcement, immigration enforcement, or other forms of surveillance." The database that is a lifeline in a crisis is a liability after it. Consent obtained from a displaced parent to find a lost child does not, and cannot, anticipate every institution that will later hold the data or every purpose it will be turned to.

3. Why Plaintext Databases Break Their Promise

Most of the safeguards proposed for humanitarian DNA are policy safeguards laid on top of a plaintext database: purpose limitation, access committees, retention schedules, memoranda of understanding, and audit. These are necessary and good. They are also, on their own, fragile in exactly the conditions humanitarian data outlives.

• Persistence outlasts the promise. A retention policy is a promise by whoever holds the data today. Reunification databases are designed to persist for years or decades, across changes of government, mandate, funding, contractor, and jurisdiction. The institution that made the promise is frequently not the institution that holds the data when the pressure to re-use it arrives.
• Consent cannot scope a readable genome. A whole genome is not a single-purpose record. Once it is readable and stored, it can answer questions the person never contemplated: paternity disputes, criminal investigation, immigration adjudication, and re-identification against any other database. Purpose limitation asks people to trust that no one will compute the other things a readable genome makes trivially computable.
• A database is a target. A pooled store of readable genomes is valuable precisely because it is complete and readable. Subpoena, seizure, breach, or a quiet policy change converts a humanitarian asset into a surveillance asset without touching a single line of code.
• Deletion is rarely provable, and sometimes impossible. Backups, replicas, and immutable ledgers make "we deleted it" hard to verify and, in the case of content-addressed immutable storage, technically false.

The pattern Smith describes, in which an identification infrastructure built for human rights is later intensified and redirected, is not a failure of intentions. It is the predictable behavior of a persistent, readable, general-purpose dataset. If we want the promise to hold for decades, the safeguard has to be a property of the data itself, not a policy about the people who hold it.

4. Compute the Match, Not the Genome

The reframing is simple. Reunification does not need a readable genome. It needs the answer to a narrow question, computed correctly, with nothing else disclosed. Kinship is estimated by comparing genotype vectors and measuring how much genetic material two people share. Mathematically this is dominated by inner products and weighted sums over the two vectors, the same shape of computation used across statistical genetics.

Homomorphic encryption is the tool that lets that specific computation run on encrypted inputs. A family encrypts each member's genotype on their own device, under a secret key that only the family holds. The encrypted genotypes can be sent to a humanitarian matching service that computes the relatedness statistic directly on the ciphertext and returns only the encrypted result. The family decrypts that result on their device to learn a single fact, for example a relatedness score or a yes-or-no match against a query. At no point does the service hold a decryptable genome. The database it keeps is a store of ciphertext.

Figure 1. Encrypted kinship match: the genome never leaves the family in the clear

This is not a thought experiment. GenoBank.io already operates this pattern in production for a closely related genomic computation, and the numbers are strong enough to anchor the humanitarian design on real evidence rather than on a promise.

5. Proof at Scale: The SOMOS Homomorphic Ancestry Calculation

SOMOS is GenoBank.io's genetic ancestry service. Its homomorphic mode computes a person's 24-population admixture without ever seeing their genome. The privacy property is structural, not a policy: the person's genotypes are encrypted on their device with a key only they hold, the proprietary SOMOS reference model stays on the server as plaintext, and the only values that ever exist in the clear are the 24 admixture proportions, and only on the person's device.

5.1 How it works

Admixture is estimated by an expectation-maximization procedure over a reference panel of 781 HGDP-derived samples typed at 91,645 ancestry-informative markers, across 24 reference populations. GenoBank's method, which we call BlindDot, exploits a structural fact about that procedure: each update is linear in the genotype vector once the reference frequencies and the running estimate are fixed. Every nonlinear step depends only on values the server already holds in the clear. The genotype is therefore touched only through an encrypted inner product. The genome is encrypted once on the device using the CKKS homomorphic scheme, and each round the server computes those inner products against the plaintext model and returns encrypted scalars that the device decrypts to advance the estimate. Because the ciphertext is only ever multiplied by plaintext and never consumed, there is no growth in multiplicative depth and no need for the expensive bootstrapping step, which is what makes the method practical at genome scale today.

5.2 What it reproduces, measured on real ciphertext

The encrypted computation is not an approximation of the ancestry result. It reproduces it. Two validations matter for the humanitarian argument, because they show that an encrypted, genome-blind computation can be both correct and reliable across different people.

The service is exposed through a single protocol verb, so the encrypted path is a first-class, audited operation rather than a demo:

biofs ancestry somos <serial>              # exact projection in the person's vault
biofs ancestry somos <serial> --encrypted  # genome CKKS-encrypted, server projects blind
biofs ancestry status <job_id>             # 24-population result, released only to the owner

The relevance to reunification is direct. If a genome can be kept encrypted while a server computes a correct 24-population ancestry estimate over it, then a server can compute a correct kinship statistic over encrypted genomes the same way, because kinship is the simpler and more local computation of the two.

6. From Ancestry to Kinship Identity

Ancestry estimation and kinship identification are the same category of problem: linear comparisons of genotype vectors, reduced to inner products and weighted sums, followed by a small nonlinear decision on the result. Ancestry compares one genome against many reference populations. Kinship compares two genomes against each other, or one genome against a set of candidate relatives, and asks how much they share.

The standard measures used in humanitarian kinship work are of exactly this form. Identity-by-state counts matching alleles across markers, which is an inner product. Relatedness coefficients and kinship likelihood ratios are weighted sums over per-marker comparisons, with population allele frequencies as the weights. Each of these can be expressed as ciphertext-times-plaintext arithmetic followed by a single comparison, which is the operation profile BlindDot already runs at genome scale. The encrypted humanitarian match is therefore an engineering extension of a primitive GenoBank has deployed, not a new cryptographic assumption.

6.1 Two marker types, one encrypted primitive: SNPs and STRs

Humanitarian identification does not run on a single kind of genetic marker, and a privacy method that only worked on one of them would be useless for half the field. The DNA-based toolkit for family reunification set out by Stover, Huston, and colleagues in Trends in Genetics (2026), the paper behind this forum, distinguishes the kinship methodologies that reunification actually relies on, and they rest on two different marker types. Direct kinship analysis, the workhorse of missing-persons and disaster-victim identification, compares short tandem repeats (STRs): a compact panel of highly variable loci scored as repeat-length alleles, robust on the degraded, low-quantity DNA recovered from remains, and matched against the STR profiles of first-degree relatives. Genome-wide and database-scale approaches instead compare single-nucleotide polymorphisms (SNPs): from thousands of forensic-identity markers to hundreds of thousands genome-wide, with power for more distant relationships and large candidate searches. Homomorphic encryption covers both, because the two kinship computations share the same shape.

SNPs: dosage vectors

A SNP genotype is an allele dosage, zero, one, or two copies of the counted allele. Every standard relatedness statistic is a sum over that dosage vector. Identity-by-state counts shared alleles. The KING kinship coefficient is a weighted sum of squared genotype differences and heterozygote counts. A relationship likelihood ratio is a sum of per-SNP log-ratios whose weights are the population allele frequencies. Each is an inner product or weighted sum of the encrypted genotype vector against a plaintext model, which is exactly the depth-one ciphertext-times-plaintext operation the SOMOS BlindDot already runs over roughly ninety thousand markers.

STRs: one-hot allele encodings

An STR genotype is not a single dosage but an unordered pair of allele lengths at a multi-allelic locus, so the zero-one-two encoding does not apply. Forensic kinship handles this with a per-locus likelihood ratio: the probability of the observed genotypes under the pedigree hypothesis, for example that recovered remains are the child of two putative parents, divided by the probability under the hypothesis of no relationship, computed from the population allele frequencies and Mendelian transmission. The evidence across the panel combines as the product of these per-locus ratios, which is the sum of their logarithms. To run this under encryption, each locus genotype is encoded on the device as a sparse indicator, a one-hot vector over the possible allele or genotype states. The log-likelihood contribution for every state is a plaintext number, because it depends only on the allele-frequency table and the fixed transmission model, never on the person. The encrypted per-locus term is then the inner product of that one-hot indicator with the plaintext table, and the combined log-likelihood ratio is the sum of those terms across loci. Multi-allelic STRs change the encoding, from a dosage to a one-hot selection, but not the computation. It remains an encrypted indicator against a plaintext model, summed across loci, at multiplicative depth one.

The scientific point is that the choice between SNPs and STRs is a choice of encoding, not of architecture. In the case the DNA Bridge toolkit foregrounds, a recovered body or child whose STR profile is matched against a database of relatives' STR data, homomorphic encryption lets that reference database, the one that must persist for years, exist entirely as ciphertext, and lets the match run without any party ever holding a readable profile. The steps that precede encryption on the device, calling STR alleles from degraded sequence or genotyping SNPs, and the cleartext concerns that do not disappear, population substructure, marker linkage, and relationship priors, are handled exactly as they are in standard forensic kinship. What changes is only that the comparison itself is computed blind.

6.2 The same primitive across the reunification tasks

Two design choices carry over from the ancestry deployment and matter for the humanitarian setting:

• Reveal the decision, not the evidence. The family learns a match or a relatedness score. The service learns nothing. Where even the score should be withheld from the service, a fully-blind mode keeps the result itself encrypted as well, at the cost of the heavier homomorphic machinery that ancestry's practical mode is designed to avoid. The choice is a policy dial, not a rebuild.
• Keys belong to people, not the archive. In the ancestry service the decryption key never leaves the person's device. In a family reunification setting the natural key holder is the family, which leads directly to the Family Vault.

7. The Family Vault: Keys Held by the Family, Not the Archive

A humanitarian kinship system has to hold not one person's key but a family's, and it has to survive the reality that families in crisis are separated, that members join or are found over time, and that custody of a child's data may begin with an agency and later pass to the family. GenoBank designed for this in the Family Vault, presented at the 2024 Blockchain International Scientific Conference in Singapore and protected under US Patent 11,984,203 B1, "Family Vault."

A Family Vault is a single hierarchical-deterministic seed from which each member's wallet is derived along the standard derivation path. One recovery phrase reconstructs the whole family. The head of the vault is often the genealogical anchor; additional branches are the second parent and each child. Every member is bound to their biosamples through their own derived wallet, and the vault records, per member, their role, their bound samples, and one crucial field: a custody status that moves from operator-custodial, where a trusted operator holds the branch on the person's behalf during a crisis, to patient-claimed, where the person or family takes sole control.

In the reunification design, the family's encrypted genomes are stored under this structure. The database that must persist for years is a set of ciphertexts whose keys are held by families, or held custodially with a documented, revocable, claimable path back to the family. There is no master plaintext store, and no single key that unlocks the archive.

8. Governance That Forecloses Misuse Rather Than Forbidding It

Encryption keeps the genome unreadable. Governance decides who may run which computation over it, records that they did, and lets a family withdraw. GenoBank's protocol supplies four properties that turn purpose limitation from a promise into a mechanism.

8.1 Metamorphic Consent as a revocable token

Consent in this model is not a signed form filed once. It is a revocable token, a BioNFT, that grants a specific, scoped permission, for example "use my encrypted genome for kinship matching within this reunification program." Revoking the token withdraws the permission going forward. Consent is treated as an ongoing relationship the person governs, which is what "Metamorphic Consent" names, rather than a static waiver captured at the worst moment of a person's life.

8.2 Every dataset addressed by a biocid, gated and audited

Each encrypted genome and each derived result is addressed by a protocol identifier, a biocid, resolved through a registry and served only through a consent-gated resolver. Nothing is handed out as a raw storage link. A biocid can be checked against the current consent token on every access, so a request to compute over a family's data can be refused the moment consent is revoked, and every access leaves an auditable, on-chain-anchored record. This is the difference between "please do not misuse this" and "this cannot be accessed without a live, checkable permission."

8.3 A real right to erasure

Encrypted genomes are stored on deletable object storage with strong encryption, not on immutable content-addressed networks. This is a deliberate choice: an immutable store cannot honor a right to erasure, because the whole point of immutability is that nothing can be unpublished. Deletable storage lets a family exercise erasure, and combined with family-held keys it offers a second, cryptographic form of deletion. Destroying the key renders the ciphertext permanently unreadable even where a copy survives, which is the closest thing to true erasure that a persistent archive can offer.

8.4 Access control that reveals nothing

Membership and permission checks use privacy-preserving filters rather than a queryable central index of who is in the database. The system can decide whether a given request is permitted without exposing the full set of people it holds, so the access layer itself does not become a roster of the displaced.

9. Answering the Forum's Questions

The forum frames four challenges for the responsible use of DNA in humanitarian settings. The architecture answers each not with a better promise but with a different default.

This does not resolve the deeper questions the forum raises about justice, family, and the politics of identification, which are not engineering questions and should not be answered as if they were. What it does is remove the excuse that privacy and reunification are in tension. They are not. A family can be reunited without anyone ever holding a readable copy of their DNA.

10. Scope, Limitations, and Honest Claims

Precision about what is deployed versus what is proposed matters, especially for a population that cannot afford to be misled.

• Deployed. The SOMOS Homomorphic Ancestry calculation is in production. The exact-reproduction result (r = 1.0000, genome never decrypted, per-operation error at most 1.9 × 10^-7) and the ten-user cohort result (10 of 10, mean r = 0.9958, top five correct for all) are measured, not projected. The Family Vault, revocable BioNFT consent, biocid-addressed gated storage, and deletable-storage erasure are implemented in the GenoBank protocol.
• Proposed. The encrypted kinship and one-to-many reunification matching described in sections 6 and 7 is an engineering extension of the deployed ancestry primitive. It reuses the same cryptography and the same protocol, and it has not yet been built or validated as a humanitarian product. It should be piloted and independently audited before any real family relies on it.
• The privacy-utility boundary is honest. The exact ancestry result is reproduced because the computation projects against the person's own in-vault reference model. A maximally private variant in which the server holds only a fixed public reference model and never sees the genome at all reaches a lower ceiling, on the order of r = 0.87 for ancestry, with dominant signals correct and fine proportions among genetically similar groups redistributed. For a yes-or-no kinship decision the relevant question is match accuracy at a chosen threshold, which must be measured directly for the kinship task rather than inferred from ancestry. We will report those numbers when the kinship pilot is validated, and not before.
• Cryptography is necessary, not sufficient. Homomorphic encryption protects the genome in computation. It does not by itself defend against coerced consent, a compromised device, a malicious operator during the custodial phase, or a state that compels a family to decrypt. Those are governance, threat-model, and human-rights questions, and they are where the scholarship of this forum, not the mathematics, is decisive.

11. Conclusion

The humanitarian use of DNA to reunite families is worth defending, and the way to defend it is to make it impossible to abuse. The risk that a reunification database becomes a surveillance database is not inherent in using DNA to reconnect people. It is inherent in storing readable genomes and keeping them. Change that one choice and the dilemma dissolves.

Homomorphic encryption lets a service establish that two people are related without ever holding a readable copy of either genome. GenoBank.io already runs this pattern in production for ancestry, exactly and reliably, with the genome never decrypted. The same primitive, wrapped in a Family Vault whose keys the family holds, in revocable consent that families govern, and in a right to erasure that is real, turns the persistent reunification database from a standing risk into a set of encrypted files that no future institution can turn against the people it was built to help. A family can rest assured that their DNA remains encrypted and is used only to find each other.

12. References and Sources

1. ELSI Friday Forum, "Humanitarian DNA Uses: Reconnecting Families Amid Crisis and Loss," July 10, 2026. Moderator: Sara Huston, MS. Presenters: Elizabeth S. Barnert, MD, MPH, and Lindsay Smith, PhD. ELSIhub, Center for ELSI Resources and Analysis. elsihub.org
2. DNA Bridge, Stover, E., Hill, K., Madden, D., Bastisch, I., Huston, S., et al. (2026). Genetic traces, global ties: considerations for a DNA-based toolkit approach for family reunification. Trends in Genetics. cell.com/trends/genetics. The two kinship methodologies referenced in Section 6, direct STR analysis and SNP-based comparison, follow this toolkit framing.
3. Barnert, E. S. (2024). NIH-funded research examining protocols for using DNA to reunify migrant families separated by war, disaster, and immigration policy. UCLA Health. healthychild.ucla.edu
4. Smith, L. A. (2017). The missing, the martyred and the disappeared: Global networks, technical intensification and the end of human rights genetics. Social Studies of Science. PubMed 28032532.
5. Smith, L. A. Subversive Genes: Making Human Rights and DNA in Argentina (book manuscript). Department of Anthropology, University of New Mexico.
6. Huston, S. "DNA, Displacement, and State Power: Interviews in Kyiv," presented at the 7th ELSI Congress. ELSIhub directory. elsihub.org/directory/sara-huston
7. Uribe, D. (2024). Empowering Families in the Genomic Era: A Decentralized Data Trust Approach for Ethical Genomics Management. 6th Blockchain International Scientific Conference (ISC2024), Singapore. Journal of the British Blockchain Association.
8. GenoBank.io. US Patent 11,984,203 B1, "Family Vault." Hierarchical-deterministic family biowallets and revocable consent.
9. GenoBank.io. US Patent 11,915,808, custodial biowallet derivation and BioNFT consent tokens.
10. GenoBank.io. SOMOS Homomorphic Ancestry (BlindDot): CKKS-encrypted 24-population admixture projected blind on the server, via the biofs ancestry somos --encrypted protocol verb. Validation: exact single-subject reproduction (r = 1.0000, per-operation error 1.9 × 10^-7) and ten-user cohort (10 of 10, mean r = 0.9958).
11. Cheon, J. H., Kim, A., Kim, M., and Song, Y. (2017). Homomorphic Encryption for Arithmetic of Approximate Numbers (CKKS). ASIACRYPT.
12. OpenMined. TenSEAL: a library for homomorphic encryption operations on tensors.
13. Budowle, B., and van Daal, A. (2008). Forensically relevant SNP classes. BioTechniques, 44, 603 to 610. Grounds the SNP-marker classes used for forensic human identification.
14. Gjertson, D. W., Brenner, C. H., Baur, M. P., et al. (2007). ISFG: Recommendations on biostatistics in paternity testing. Forensic Science International: Genetics. The per-locus and combined likelihood-ratio formalism underlying the STR kinship encoding in Section 6.1.
15. International Commission on Missing Persons (ICMP). DNA-led identification of the missing through STR profiling and kinship matching against biological relatives. icmp.int.