A CODIS database search is a software comparison: a profile developed from crime scene evidence is run against the FBI's National DNA Index System, which per FBI published counts holds more than 14 million convicted-offender profiles and over a million arrestee profiles, looking for an exact match at the number of loci the system requires. When nothing matches exactly, some states allow a second kind of query — familial searching — that looks for near matches, because near matches usually mean a relative.
Both searches depend on the same chain: collection, analysis, profile upload, comparison. Each link has rules, and the differences between an exact hit and a familial lead are where most of the public confusion lives.
What is CODIS and what does it contain?
The Combined DNA Index System is the FBI's program for linking DNA evidence across jurisdictions. Laboratories upload profiles into several indexes: convicted offenders and, in states that collect at arrest, arrestees; forensic profiles developed from crime scene evidence; relatives of missing persons; and, in some states, people convicted of specific offenses such as certain felonies. Eligibility for upload is set by federal law and by each state's collection statute.
The database is decentralized by design. Profiles are held at the state level and indexed nationally, and the FBI sets the technical rules for what counts as a profile and a match. The Supreme Court upheld arrestee DNA collection in Maryland v. King in 2013, holding that cheek-swab collection from people arrested for serious offenses is reasonable under the Fourth Amendment — a ruling that shaped how much the offender indexes have grown since.
How does a database search actually work?
A lab develops a short tandem repeat profile from evidence, typically at 20 loci under the current FBI core standard, and uploads it to the forensic index. The software then compares it against eligible indexes. An exact match at the required number of loci generates a candidate hit, which triggers a laboratory confirmation: the contributing lab re-runs the profile, the match is verified, and only then do investigators act on it. A database hit is a lead that requires confirmatory testing, not proof by itself.
Most uploads do not hit anything, and the absence of a hit is information too: it means no person in the database matches, not that no person committed the offense. The database covers a fraction of the population, and its composition reflects decades of state collection laws — which offenses trigger collection, and when — rather than any sampling design.
Who may be uploaded, and who decides?
Eligibility is statutory. State laws determine which convictions require a sample, and since the Supreme Court's 2013 ruling in Maryland v. King, many states also collect from people arrested for serious offenses, with profiles removed if the case does not proceed. Congress set the federal framework in the DNA Identification Act of 1994 and later amendments, which govern what indexes exist and what quality standards laboratories must meet to participate. The practical consequence is that two states with similar crime patterns can hold very different databases.
Deletion is the quieter policy question. A profile lawfully entered can outlast the reason it was collected unless the statute provides for expungement, and procedures for requesting removal vary widely. Civil liberties organizations and state lawmakers have periodically revisited these provisions, particularly for arrestee profiles, without reaching a uniform national answer. For a reader, the operative rule is local: what is in the database, and for how long, is a question each state's statute answers for itself.
Related stories: What police records management systems store, and why data quality varies · What courts require before probabilistic genotyping reaches a jury.
What is familial searching, and how does it differ?
Familial searching deliberately looks for partial matches. Relatives share a predictable portion of their DNA profile: a full sibling typically shares most alleles at most loci, a parent-child pair shares one allele at every locus. The software ranks near matches by likelihood ratios, and laboratories follow ranked candidates with additional testing, most commonly Y-STR analysis of the male line, before any candidate is treated as a genuine lead.
Only a minority of states run formal familial search programs; California established the first in 2008, and others have followed with written policies requiring that ordinary database searches come up empty first. Maryland has banned the practice by statute. The table below summarizes the distinction.
| Feature | Standard CODIS hit | Familial search lead |
|---|---|---|
| What matches | Exact profile match | Partial match suggesting a relative |
| What it indicates | The contributor's profile matches the evidence | The contributor may be related to the source |
| Availability | Nationwide under FBI rules | State programs only, with written policies |
| Confirmation | Laboratory re-testing | Additional testing plus investigation |
Where does forensic genealogy fit?
Since 2018, investigative genetic genealogy has operated outside CODIS entirely. The 2018 arrest in the Golden State Killer case, identified through searches of a public genealogy website, began a practice in which investigators upload crime scene DNA to consumer databases and build family trees from distant matches. This method can implicate people with no profile in any government database, which is why it has solved cases CODIS never hit — and why it raised novel privacy questions that regulators and some state legislatures have since addressed with consent rules for the databases involved. It is a separate technology from familial searching, though the two are often confused.
What are the limits and the controversies?
Familial searching expands the consequences of one person's profile to that person's relatives, who never consented to collection; critics, including some state legislators and the authors of several law review analyses, argue it concentrates scrutiny on the communities already most represented in offender databases. Defenders point to solved cold cases. Both observations are accurate, and the states that run programs have generally responded with policy restraints rather than resolution of the underlying disagreement.
Technically, the limits are the database's own: profiles are only as complete as the laboratories' uploads, and interpretive questions about degraded or mixed evidence are handled by the laboratory before upload. A search can only return what has been properly entered, and an investigation can only be as careful as the confirmation steps that follow the hit.
For more context, read What courts require before probabilistic genotyping reaches a jury.
For more context, read discovery platforms.
For more context, read records management system.