Disaster victim identification

Uses of DNA disaster victim identification

World Trade Center

42.30 To date, the largest single use of DNA identification testing has been to identify the victims of the terrorist attack on the World Trade Center in New York City on 11 September 2001.^[23]

42.31 Some of the victims were identified from dental records, X-rays, fingerprints, scars, rings and other pieces of jewellery—however, most of the remains were not capable of visual or other traditional forms of identification. Therefore, shortly after the attack, police investigators asked the victims’ families for personal items belonging to the missing and, in some cases, for DNA samples from the family members themselves.^[24]

42.32 The New York medical examiner’s office co-ordinated the DNA identification testing program. Due to the volume of bodily samples found, some of the identification work was contracted out to private laboratories. Generally, the laboratory operated by the examiner’s office extracted DNA from the tissue samples found at the site, while the New York State Police Laboratory extracted DNA from the victims’ personal effects, and family members’ samples. Both laboratories forwarded the DNA extracts to two private laboratories—Myriad Genetics Laboratories and Celera—for analysis. Three laboratories were chosen to test 5% of all samples as a quality control for the tests performed at the private laboratories.^[25]

42.33 In February 2002, it was reported that—because many of the police officers who initially collected personal items and samples had not been properly trained to do so—many samples were inadequate for identification. Victims’ families were asked to provide further tissue samples for identification.^[26]

42.34 By 30 November 2002, 1,439 of the estimated 2,795 victims had been identified, including 709 through DNA analysis alone. At that time, the medical examiner held 19,932 body parts in storage, 5,404 of which had been identified.^[27]

Bali nightclub bombings

42.35 DNA identification testing was also used to identify the victims of the terrorist bombing of two nightclubs in Bali, Indonesia on 12 October 2002. Shortly after the bombings, a Joint Investigation Team consisting of Indonesian, Australian and other law enforcement officials was established. The Australian Federal Police’s (AFP) function within the Team included the collection of forensic material from suspects, crime scenes, unknown deceased persons, and from the personal items and blood relatives of the missing persons.^[28] The Inquiry understands that the AFP co-ordinated the forensic identification of the victims, and this was primarily done in the AFP’s forensic laboratory in Canberra.^[29]

42.36 The identification process reportedly involved four stages of examination: first, examination for physical characteristics, such as height, sex, weight, hair and eye colour; second, examination for unnatural markings such as tattoos; third, examination of dental records; and finally, DNA analysis. Due to the nature of the blast, it was estimated that 70% of the victims would need to be identified through DNA analysis.^[30]

42.37 Rather than use the National Criminal Investigation DNA Database system for identification of the bombing victims, the Commonwealth Government established a new DNA database for disaster victim identification (DVI Database).^[31]

42.38 Out of the 221 missing or deceased in Bali, 182 have been identified—including 88 Australians. DNA identification played an important role in this effort: 43 DNA matches were obtained through the DVI Database, while 67 matches were obtained through a kinship database provided by Queensland Health.^[32]

Proposed use for military personnel

42.39 The Australian Defence Force (ADF) has advised the Inquiry that it is considering introducing a policy of collecting a DNA sample from each ADF member for the purpose of identification of human remains. It is proposed that DNA samples would be held in a repository for use in identifying members killed in action or otherwise.^[33]

42.40 The United States’ Department of Defense already collects DNA samples from every service member on active duty or in the reserve armed forces on a mandatory basis. The samples are collected for the purpose of identifying the remains of war casualties. The samples are stored in the Department’s DNA Repository for a period of 50 years but may be destroyed at the request of the donor when he or she leaves the military.^[34]

General comments

42.41 The Bali bombings in October 2002 represented the first mass disaster requiring the Commonwealth to undertake large scale DNA victim identification testing. Obviously, this was an unforeseen incident necessitating a rapid response by the Commonwealth government and the federal, state and territory police services. It was necessary to identify the victims’ remains as quickly as possible so that they could be released to their families for burial. The Inquiry has not heard any significant concerns regarding the operation of the DNA identification program.

42.42 Any future mass disaster—or terrorist attack—whether within or outside Australia, could again result in the need to identify hundreds, or possibly thousands, of victims. While the Commonwealth’s legislative and administrative response to the Bali bombing incident was rapid and effective in those circumstances, the Inquiry considers there is a need to adopt a more structured framework for the identification of mass disaster and other victims in the event that such need arises in future.

Current law and practice

42.43 After the Bali bombings, the Commonwealth Parliament amended the Crimes Act, inserting a new Division 11A into Part 1D of the Act.^[35] The new Division 11A applies in relation to the Bali bombings of 12 October 2002 and any incident occurring outside Australia and Norfolk Island that the Minister determines in writing to be an incident in relation to which the Division applies.^[36] Before making this determination, the Minister must be satisfied that one or more Australian citizens or residents have died in or as a result of the incident and it is appropriate in the circumstances for the Division to apply in relation to the incident.^[37]

42.44 Division 11A contains a definition of ‘permitted purpose’, meaning the purpose of identifying an unidentified person who died in or as a result of an incident to which Division 11A applies, and/or the purpose of conducting a criminal investigation in relation to such an incident.^[38]

42.45 Where Division 11A applies, it modifies the existing provisions of Part 1D of the Crimes Act to permit:

• Commonwealth, State and Territory officials to access a Commonwealth DNA database system for a ‘permitted purpose’;^[39]
• information held on a DNA database system to be disclosed to Australian and foreign law enforcement agencies for a ‘permitted purpose’;^[40]
• matching within the unknown deceased persons index to identify all the body parts belonging to each victim;^[41] and
• the identification of a victim to relatives and friends.^[42]

42.46 The Commonwealth Government established the DVI Database for the identification of the Bali bombing victims. The DVI Database is operated by the CrimTrac agency on behalf of the AFP, and contains four indexes—an unknown deceased persons index; a missing persons index (containing profiles obtained from missing persons’ personal items and blood relatives); a crime scene index; and a suspects index.^[43] As the database has only four of the indexes specified in the legislative definition of a ‘DNA database system’, it technically falls outside that definition.^[44]

Collection and use of information

Crimes Act provisions

42.47 Part 1D of the Crimes Act provides for the reciprocal enforcement of orders for carrying out forensic procedure between the Commonwealth and participating state and territory jurisdictions.^[45]

42.48 The Minister may enter into arrangements with the responsible Minsters of participating jurisdictions for the establishment and maintenance, in one or more of those jurisdictions, of a register of orders for the carrying out of forensic procedures made under Part 1D or corresponding laws of participating jurisdictions.^[46] A person is authorised to carry out the forensic procedure authorised by a registered order anywhere in the Commonwealth. However, a state or territory police officer must comply with Division 6 of Part 1D of the Crimes Act when carrying out a forensic procedure on behalf of the Commonwealth.^[47]

42.49 The Inquiry understands that the AFP was responsible for collecting DNA samples of the Bali bombing victims from the scene of the incident. State and territory police collected forensic material from the missing persons’ personal items and blood relatives from around Australia, and forwarded these to the AFP laboratory for analysis. In some cases, the States and territories may have analysed these samples in their own laboratories before forwarding the sample and profile to the AFP.^[48]

42.50 The AFP has advised the Inquiry that the state and territory police acted as agents of the Commonwealth in collecting the forensic material from victims’ relatives, however no formal agency agreement was entered into between the jurisdictions. These police complied with the federal Crimes Act in collecting the samples, but where state and territory forensic procedures legislation provided higher protections or safeguards, these jurisdictions also complied with their own legislation—thus, state and territory police complied with the requirements of the federal legislation.^[49]

Issues and problems

42.51 The Inquiry is concerned about the lack of any formal arrangement between the Commonwealth and state and territory police services for the collection and analysis of DNA samples. This could lead to uncertainty amongst state and territory police services about the scope of their authority to retain or use those samples and profiles within their own jurisdictions.

42.52 For example, the Northern Territory forensic procedures legislation permits the Commissioner to maintain databases of any information obtained from carrying out intimate or non-intimate procedures under that Act or any other Act.^[50] Hypothetically, if the Northern Territory police collect and/or analyse a DNA sample from a relative of a mass disaster victim on behalf of the Commonwealth, they could decide to upload the profile into the Northern Territory DNA database before forwarding the sample and profile to the AFP. While this might be lawful within the Northern Territory jurisdiction, it would fall outside the nature of their agency relationship.

42.53 The retention or use of a DNA sample or profile within the state or territory jurisdiction would constitute a secondary use unrelated to the purpose for which the relative provided the sample. This could have significant privacy implications where that jurisdiction does not have the same legislative safeguards as the federal Crimes Act.

Inquiry’s views

42.54 The Inquiry considers that the arrangements by which the Commonwealth authorises the States and Territories to act on its behalf in collecting, using, storing or destroying genetic samples (or profiles) for the identification of missing and deceased persons require clarification. Formalisation of these arrangements should better protect the genetic privacy of the relatives of missing and deceased persons by ensuring that the State or Territory does not retain their samples or profiles after forwarding the information to the Commonwealth. It also should provide greater transparency regarding the process, in order to ensure public confidence. In particular, the arrangements should clarify the scope of the States’ and Territories’ authority in acting on behalf of the Commonwealth in these matters.

42.55 One existing means of formalising these arrangements would be through the use of ministerial arrangements pursuant to s 23YUB of the Crimes Act. However, there may be concerns about the constitutionality of such arrangements in light of the High Court’s decision in R v Hughes.^[51] Therefore, the Commonwealth should be conscious of the constitutional constraints, if any, of the exercise of functions by the officers of one polity on behalf of another polity.^[52]

Sharing information

Crimes Act provisions

42.56 Part 1D of the Crimes Act provides that the Minister may enter into agreements with participating jurisdictions for sharing information on a DNA database system for the purpose of criminal investigations or prosecutions. Information from the Commonwealth DNA database system may be transferred to a participating jurisdiction for the purpose of the investigation of, or proceedings in respect of, an offence against the law of that jurisdiction (or vice versa).^[53] As this provision is limited to the context of criminal investigations, it may not always authorise the transfer of information for the purpose of disaster victim identification.

42.57 Shortly after the Bali bombings, the Commonwealth Government expressed concerned at the absence of a legal framework for permitting the States and territories to access the Commonwealth’s DVI Database, or for the Commonwealth to disclose the results of forensic comparison to these jurisdictions. The Explanatory Memorandum to the Crimes Amendment Bill 2002 (Cth) commented:

Under the current provisions, and in the absence of arrangements between the jurisdictions, States and Territories cannot access their DNA database system for the purpose of transferring DNA profiles to the Commonwealth and the Commonwealth cannot disclose the information held (eg, the results of a matching) to the States and Territories.^[54]

42.58 As noted above, the new Division 11A addresses these concerns through new access and disclosure provisions permitting, among other things:

• Commonwealth, state and territory officials to access information stored on a national DNA database system (or a state or territory DNA database system) for the purpose of forensic comparison under the relevant jurisdiction’s forensic procedures legislation, where that comparison is for a ‘permitted purpose’;^[55] and
• the disclosure of information held on a DNA database system to law enforcement agencies, foreign law enforcement agencies, Interpol or any other agency or body prescribed by the regulations, if the disclosure is for a ‘permitted purpose’.^[56]

42.59 Division 11A is limited to incidents occurring outside of Australia and Norfolk Island, and the amended access and disclosure provisions are accordingly limited to these contexts.

Issues and problems

42.60 The process of identifying the Bali bombing victims highlighted several problems with the current regulatory framework. First, the lack of harmonisation among the Australian jurisdictions’ forensic procedures legislation has slowed the process of negotiating ministerial agreements for the sharing of information between jurisdictions. Second, the legislation permitted the sharing of information for criminal investigations or prosecutions only: it did not necessarily extend to sharing information for the purpose of disaster victim identification.

42.61 The new Division 11A of Part 1D of the Crimes Act authorises the transfer of information between the Commonwealth and the States and Territories for a ‘permitted purpose’, being the identification of a person who died as a result of an incident occurring outside Australia. However, these access and disclosure provisions may not sufficiently safeguard the privacy of that information once it has been transferred.

42.62 For example, information stored on a national DNA database system may be transferred to a State or Territory, regardless of whether the latter jurisdiction is a ‘participating jurisdiction’ within the meaning of Part 1D of the Crimes Act, or whether they have entered into a ministerial agreement for the sharing of information. This is contrary to the policy underlying the Model Bill framework.

42.63 As a result, the Commonwealth could disclose information stored on the DVI Database to a jurisdiction does not correspond with Part 1D of the Crimes Act in any way. While the disclosure must be for a ‘permitted purpose’ there is no legislative or administrative safeguard limiting that jurisdiction’s potential secondary or unrelated use of that information.

42.64 While s 23YUD(2) provides that information transferred from one jurisdiction to another must not be recorded, or maintained in any identifiable database after the forensic material must be destroyed in the first jurisdiction, this is limited to information shared for the purpose of a criminal investigation or proceedings.^[57] Therefore, the second jurisdiction technically could place information obtained from the DVI Database on its own database for the purpose of ‘cold hit’ matching, provided that this is lawful under its own legislation.

42.65 The same concerns arise in relation to disclosing information held on the DVI Database to foreign law enforcement agencies. While the access and disclosure may only be conducted for a ‘permitted purpose’ as defined by the legislation, there is no safeguard against potential secondary uses of that information by the jurisdiction or law enforcement agency to which access is given, or the information is disclosed.

42.66 In its submission, the New South Wales Council for Civil Liberties (NSWCCL) expressed the concern that DNA taken from individuals within New South Wales could be shared with overseas jurisdictions that have insufficient legislative protections regarding the privacy of the information. The NSWCCL also noted that:

Concerns have been raised with our council from some of those people providing DNA samples about the future implications. They are concerned about whether that DNA information can or will be used for any other purpose than the Bali identification process, and what protections, if any, are in place to ensure it is not disclosed or misused by the Indonesian authorities … The concern of this council is that while consent may have been obtained for this process the consent may not be fully informed consent … It is difficult to imagine that people desperately trying to recover their loved one’s bodies are able to comprehend the negative consequences of providing this information in an uncontrolled manner.^[58]

42.67 The Privacy Act sets out specific obligations that apply when an organisation transfers personal information outside Australia. Briefly, NPP 9 prohibits the transfer of personal information unless the recipient of the information is subject to a law, binding scheme or contract that upholds principles substantially similar to the NPPs, or the organisation has taken reasonable steps to ensure that the information will not be dealt with inconsistently with the NPPs. However, the AFP is not bound by the NPPs and there is no equivalent IPP regarding the transborder flow of personal information.

Inquiry’s views

42.68 The Inquiry recommends that the Commonwealth amend Division 11A of Part 1D of the Crimes Act to provide that where information stored on the DNA database system is accessed by, or disclosed to, a person for a ‘permitted purpose’, this information only may be used for that purpose. This would clarify that the State, Territory or foreign jurisdiction to which the information is disclosed may not use the information for any secondary or unrelated purpose.

42.69 The Inquiry also recommends that s 23YUD of the Crimes Act be amended to broaden the scope of ministerial agreements for the sharing of information between participating jurisdictions to include the purpose of identification of missing or deceased persons. This would provide an additional safeguard by ensuring that any safeguards for information shared between jurisdictions would apply equally to information shared in this context. Section 23YUD(2) would also apply. This provides that any information transferred under Division 11A must not be recorded, or maintained in any database of information that may be used to discover the identity of a person or to obtain information about an identifiable person at any time after Part 1D of the Crimes Act requires the forensic material to which it relates to be destroyed.

42.70 Finally, where information stored on a DNA database system is disclosed to Interpol or any foreign agency, the Commonwealth must take reasonable steps to ensure that the information transferred will not be held, used or disclosed by the recipient inconsistently with the national minimum standards established in accordance with Recommendation 40–1.