Forensic Science Professor Helps Discover Vulnerability in Technology Commonly Used to Analyze DNA

What started with an unexpected connection at a national conference grew into a research collaboration examining a critical question in forensic science: How secure is digital DNA evidence?

A chance meeting at the annual American Academy of Forensic Sciences last year turned into a collaboration that began to examine how secure digital data is when it comes to forensic DNA evidence.

At the 2025 American Academy of Forensic Sciences meeting in Baltimore, MD, University of New Haven Professor Laura Gaydosh Combs, Ph.D., of the Forensic Science Department, crossed paths with systems engineer Nathan Adams of Forensic Bioinformatic Services.

The connection was anything but random, as Dr. Combs was familiar with Adams' work examining standards for software verification and validation.

The two kept in touch after the conference, which included conversations about the industry, sharing various articles with each other, and ultimately leading to them sharing similar questions about various topics.

Eventually, this collaboration would lead to the discovery of a security vulnerability in a commonly used technology that analyzes DNA evidence. In fact, the first instrument generating .fsa files was released in the mid-1990s, meaning 30 years of data in crime labs, research, and medical testing facilities were at risk of being hacked.

The discovery has drawn national attention, including an exclusive story in the Wall Street Journal, and prompted important conversations about the security of forensic evidence in an increasingly digital world.

'A vulnerability is a hole in the fence…'

A vulnerability, Dr. Combs explained, is a weakness that can be exploited and can cause a negative impact on the integrity of information.

"A vulnerability is a hole in the fence," she said, referring to a term used by cybersecurity expert Kevin Dyer who was part of team of researchers with Dr. Combs. "An exploit is when you go through the hole in the fence instead of unlocking the gate. So, what we're describing is what is possible, and has always been possible."

The security weakness that this team of researchers discovered was found in technology that is commonly used by crime labs across the country, made by a company called Thermo Fisher Scientific.

Specifically, with the help of generative AI, it was discovered that DNA evidence data files, such as .hid and .fsa files, could be modified without detection.

So, while the vulnerability is likely to have existed for quite some time, technological advances, she said, are making the possibility of tampering with evidence easier.

Dr. Combs referenced the type of tamper-proof markings that are required for something such as a paper bag containing evidence, saying that the technology in question lacks the same level of security.

The concern? The system contained a weakness that could potentially be exploited, especially as emerging technologies make challenging technical tasks much easier to overcome.

Before generative AI, specific technical knowledge would have been needed to exploit the vulnerability they discovered, including familiarity with the files and, potentially, the ability to write code.

'The solution is to…'

Dr. Combs said what once took about 45 minutes could ultimately be accomplished in three minutes using Anthropic's AI tool Claude. She also said it's important to note that during this research, Adams intentionally did not use code or any other means to alter the AI tool. It was strictly through conversation.

"The bar to entry has been lowered by the presence of generative AI," she said. "And so, the solution is to repair the hole in the fence, and to not assume that the hole is too hard to get through."

The security weakness was flagged back in May by the researchers. At the end of July, Thermo Fisher Scientific issued a security notice  about the vulnerability, acknowledging the detection and stating it had released a security update to add another layer of protection.

The company also stated that there have not been any known instances where this weakness was exploited to impact actual casework.

This team is continuing its work on this project because they have not yet found a reliable means of detecting tampered files, and there is not a determined process to authenticate data produced prior to the updates released by Thermo. 

What Comes Next?

This discovery continues to receive significant attention.

Dr. Combs and Adams were asked to speak to Australian Laboratory Services shortly after the Wall Street Journal article came out. The team has also been contacted by various industry professionals who have taken an interest in the discovery.

Dr. Combs also recently presented the findings to the University's CyberAICorps: SFS scholars, and she will be joining other experts at the 79th Annual American Academy of Forensic Sciences' (AAFS) Scientific Conference taking place in February.

Several documents and findings are available on the University of New Haven's website, including a recording of a webinar that the researchers hosted, which has been viewed by hundreds of people.

The release of their findings and research, Dr. Combs said, will hopefully help reach industry professionals who will take an interest and even potentially find something else that they haven't yet.

"So far, nobody has been able to find a reliable indicator of tampering," she said. "So, we are actively encouraging people to look at our data, see if you can find a reliable indicator that we have not been able to find in the existing data."

Dr. Combs said their work is ongoing.

Find additional information about the research, the recorded webinar, disclosure letter, the security bulletin from Thermo Fisher Scientific, and more, here.