THE LAB FOUND MALE DNA. THE REPORT SAID IT DIDN’T.

The instrument produced a result. The official report said the result did not exist.

That is the cleanest way to enter the case of Yvonne “Missy” Woods, the former Colorado Bureau of Investigation DNA analyst sentenced on September 8 to ten years in prison. Woods pleaded guilty in June to four felonies—cybercrime, first-degree perjury, attempting to influence a public servant and forgery—under an agreement that required a prison sentence of eight to sixteen years. The terms run concurrently: ten years on cybercrime, six years each on perjury and attempting to influence a public servant, and three years on forgery. A restitution hearing is scheduled for November 12.

The sentencing closes the criminal prosecution. It does not close the system failure.

Prosecutors say Woods manipulated DNA data from 2008 through 2023. They identified 52 laboratory reports containing false statements and a fifty-third report whose wording was technically accurate but appeared designed to discourage a detective from acting. Hundreds of additional cases contained altered values in the laboratory notes without producing a false final report. CBI’s broader career review listed 1,045 impacted cases by August 2025. Those numbers describe different universes and should not be collapsed: an “impacted” case is not automatically a false report, a wrongful conviction or a lost prosecution.

The most brutal subset involves 32 reports by women and children who said they had been sexually assaulted. These were among 41 matters tied to Woods’s charged conduct in which no suspect was criminally charged. According to the First Judicial District Attorney’s Office, Woods deleted analytical values indicating that male DNA was present and then reported that no male DNA had been found. The false negative stopped potential follow-up—additional testing, comparison and investigation—before the evidence could reach the stage of identifying anyone.

That distinction matters. Woods did not “delete male DNA” in the simple physical sense suggested by viral captions. The proven description is that she deleted values in the analytical record. Male DNA in a sample also does not, by itself, identify an assailant or prove an assault; context, controls, profiles and comparison work still matter. Prosecutors said their investigation did not establish false DNA identifications, false comparisons or false positive results. What the manipulation destroyed was a truthful handoff to the next stage of the investigation.

The absence was manufactured. The lost opportunity is real. The eventual outcome of each case remains case-specific and, in many instances, unknown.

The scandal began with a missing value, not a dramatic match.

In September 2023, an intern working inside CBI found DNA data missing from a sample Woods had processed in 2018. CBI describes the discovery as part of a management-initiated research project; the district attorney identifies the person who spotted the anomaly as an intern. Both accounts can be true. The point is not the intern’s rank. It is that a cross-check outside the ordinary production path saw something the production path had accepted.

CBI placed Woods on administrative leave on October 3. Kansas Bureau of Investigation personnel assisted with an internal inquiry beginning in early November. Woods retired on November 6, after nearly thirty years at CBI, and the South Dakota Division of Criminal Investigation began an independent criminal investigation the next day. CBI released a partially redacted, 94-page internal-affairs report in June 2024. The state continued reviewing Woods’s career while prosecutors built a criminal case from conduct they believed could be proved beyond a reasonable doubt.

The criminal complaint originally carried 102 counts. The plea consolidated them into four convictions while requiring Woods to accept responsibility for the full criminal course described by prosecutors. One perjury conviction arose from false testimony in a first-degree-murder trial. Of twelve false reports associated with cases in which a suspect was charged, three cases went to trial: one conviction and two acquittals. Six others ended in plea agreements, two were dismissed and one defendant remained in warrant status when the district attorney published the sentencing account.

Those figures resist a single political use. This is not a scandal that belongs only to defendants or only to victims. A false negative can abandon a victim and spare an offender from scrutiny. A corrupted record can also poison a conviction, conceal exculpatory information or make a reliable result impossible to trust. The same analyst’s work can injure people on opposite sides of a courtroom because the common dependency is not ideology. It is the integrity of the evidence.

There were warnings before the intern.

CBI’s own account places an earlier warning in 2014, when a coworker questioned Woods’s testing and raised concerns with a technical leader. In 2018, she was accused of manipulating data, removed from casework and reassigned while the matter was reviewed. She was later reinstated. CBI says the results of that process were not escalated to the agency’s then-director or to leadership of the Colorado Department of Public Safety. The agency has said additional investigations were examining how the 2018 process was handled.

The public record does not establish that every person who encountered a concern understood its later significance. It does not establish a coordinated managerial cover-up. It does establish that two opportunities to treat the problem as potentially systemic did not produce durable containment. Woods returned to casework after the 2018 review. The pattern remained undiscovered until 2023.

That is where the “lone bad analyst” explanation becomes insufficient. Individual agency is central: Woods admitted crimes and received a prison sentence. But a forensic laboratory is designed on the premise that no result should depend on one person’s honesty alone. It is a quality system—a chain of procedures, retained data, peer review, proficiency testing, corrective action, audits and management responsibility intended to keep one analyst’s mistake or misconduct from becoming the state’s scientific voice.

CBI’s internal investigation said Woods concealed activity from technical review and that existing review processes did not detect her tampering. That finding does not erase the deception. It tells us which defense the deception defeated.

A technical review is supposed to reach behind the report.

The FBI Director’s current Quality Assurance Standards for Forensic DNA Testing Laboratories, effective July 2025, are not retroactive and therefore cannot be used as a shortcut verdict on CBI’s compliance in older cases. They are useful as a public description of what a modern DNA quality system is meant to preserve.

The standards require enough analytical documentation for another qualified person to evaluate what was done and interpret the data. They require technical and administrative review of every case file and report. For forensic casework, technical review reaches the notes, worksheets and electronic data; analytical controls; DNA types and their supporting raw or analyzed data; interpretations; statistics where applicable; and the final report. The system is supposed to reconcile the conclusion with the material underneath it.

It also requires semiannual external proficiency testing for analysts and an annual laboratory audit, with an outside audit at least every two years. When nonconformities are detected in casework, proficiency tests, testimony or audits, laboratories must have a process for documented corrective action. A corrective-action plan is supposed to look for causes, set actions and time frames, and identify preventive measures where possible.

These controls answer different failure modes. Proficiency testing asks whether a person can correctly perform a test under assessment. Case review asks whether a particular result is supported. Audits ask whether the laboratory follows its declared quality system. Corrective action asks whether a detected problem was actually contained and prevented from recurring. Passing one does not prove the others worked. A person can perform well when observed, manipulate selected case files, and exploit a review workflow that trusts the record presented to it.

That last sentence is a model, not a finding about the exact method Woods used in every case. CBI has publicly said she deleted and altered data, omitted material facts, failed to document required actions and concealed misconduct from technical review. The detailed permissions, software logs, version histories and reviewer screens that made those acts possible are not fully exposed in the public summaries. Without them, nobody outside the investigations can honestly specify the complete attack path.

But we can identify the security principle. If the same person can alter a value, shape the case notes that explain it and present the resulting record for review without an immutable trace visible to the reviewer, peer review may become a review of the analyst’s edited world. A control that sees only the curated record does not independently verify the record.

The failure was longitudinal.

A case-by-case review asks: does this report appear supported by this case file? A longitudinal review asks different questions: does one analyst suppress male-DNA values unusually often; do raw files and recorded notes diverge; do deletions cluster by person, sample type, instrument or outcome; did the pattern change after a complaint; are reviewers repeatedly accepting the same unusual shortcut?

The first question is necessary. The second set can reveal a pattern that no single case makes obvious.

The 2023 discovery appears powerful precisely because it crossed the boundary of routine case completion. A research project encountered an older sample and noticed that a value expected in the record was missing. Once investigators looked across cases, similar alterations and deletions emerged. In control language, a local anomaly became a population signal.

That produces an inference worth stating plainly: CBI’s defenses were more effective at processing the file in front of them than at detecting an analyst-level pattern across time. The inference could be revised by fuller records. It is nevertheless consistent with the warning history, the reinstatement, the scale of the subsequent review and the eventual research-project discovery.

A serious repair therefore cannot end with retesting Woods’s cases. Retesting addresses outputs. The institution also has to reconstruct permissions, logs, supervision, escalation and reviewer independence. Otherwise the state learns which files were damaged without learning why the damage stayed invisible.

The controls should assume trusted people can become the threat.

Forensic laboratories cannot operate by distrusting every scientist at every moment. They can stop converting professional trust into unchecked technical authority. The design target is not omniscient surveillance of employees. It is a record whose critical transitions can be reconstructed and a response system that treats credible integrity warnings as threats to every dependent case.

Raw instrument output should be preserved in a write-protected or append-only form, with later edits recorded as new versions rather than silent replacements. Deletions and changes to analytical values should generate durable, reviewer-visible events tied to a person and time. Critical workflow steps should separate the ability to generate or edit an interpretation from the ability to approve its release. Reviewers should be able to compare the final report with the original instrument data without relying on an analyst-selected subset.

Laboratories also need analyst-level quality telemetry. That does not mean ranking scientists by conviction rates or pressuring them to produce inculpatory results; those incentives would corrupt the science in another direction. It means searching for unexplained deviations in editing, omissions, reruns, interpretation changes and reporting patterns, then assessing them with statistical caution and case context. An anomaly is a request for review, not proof of misconduct.

Warnings need explicit escalation rules. A concern involving possible data manipulation is not an ordinary performance dispute. It should trigger preservation of records, independent technical examination, a defined stop-work threshold, a documented decision about the analyst’s existing cases and notification to leadership with authority outside the immediate chain. Reinstatement should require an affirmative evidence record, not merely the absence of a completed accusation. Every decision should be reviewable later by someone who did not make it.

Finally, the people downstream need a usable repair process. Victims, defendants, defense counsel, prosecutors, investigators and courts cannot act on a bare list of “impacted” files. Each case needs a reason code: what changed, whether a report was false, whether source material remains, whether retesting is possible, what later decision relied on the work and who is responsible for notice. The district attorney correctly says each case must be evaluated on its own evidence and procedural history. Individual review still needs a common data structure or the remediation becomes a thousand bespoke mysteries.

Ten years is accountability. It is not a checksum.

A prison sentence answers whether the state proved criminal responsibility and what punishment follows. It does not certify the remaining evidence, repair an abandoned investigation, restore the lost time of a victim or defendant, explain every management decision, or calculate the final public bill. Colorado’s work continues through case review, litigation, retesting, restitution and institutional reform.

CBI has acknowledged that it took too long to discover the manipulation. It says it changed policies, added safeguards and commissioned outside review. The First Judicial District Attorney sits on a Forensic Services Committee created in response to the misconduct. Those are necessary signals. The public test will be whether the reforms can be described at the same level of specificity as the failure: which data are immutable, which edits are logged, what a reviewer sees, what anomaly thresholds exist, how warning escalation works, who can halt casework and how independent auditors verify that the controls operate in practice.

The scandal’s viral form says a woman deleted male DNA in 32 sexual-assault cases and got ten years. That version is broadly anchored in the sentencing record, but it leaves the wrong shape in the mind. The data were not merely erased from a screen. They were converted into official absence. The official absence moved downstream carrying the authority of a forensic laboratory. Earlier warnings did not stop it. Ordinary review did not expose it. A research project and an intern did.

Woods is going to prison. The remaining defendant is a system that allowed edited evidence to become institutional fact.