Spy agencies acquire commercial data with little coordination and few controls

Andrew Brookes/Getty Images

The purchase of sensitive commercial data that is potentially traceable to individual Americans could be subject to new restrictions, according to a newly declassified report from the Office of the Director of National Intelligence.

The U.S. intelligence community is taking advantage of massive growth in commercial information and intelligence services worldwide to acquire financial, social media, telecommunications, employment and other data on individuals around the world, including U.S. persons who are notionally subject to constitutional protections.

The acquisition and ingestion of this information is done with few restrictions and little coordination across the 18 agencies that make up the intelligence community, according to a partially redacted report from the Office of the Director of National Intelligence released on Monday. 

The report, compiled and released in part at the urging of Sen. Ron Wyden, D-Ore., found that only a few intelligence agencies have internal best practices in place around the collection of commercial data from vendors. The report recommends that the intelligence community establish and adopt common practices to mitigate the risks of the collection of personal data on Americans that would otherwise require a warrant to obtain.

“The executive branch must exercise much stronger oversight of this practice, issue guidance to agencies about the legal status of commercial data and provide transparency to the American people about how it interprets the law,” Wyden said in a statement. “If the government can buy its way around Fourth Amendment due-process, there will be few meaningful limits on government surveillance."

Wyden also hopes to pass legislation "to put guardrails around government purchases, to rein in private companies that collect and sell this data and keep Americans’ personal information out of the hands of our adversaries."

The report makes it clear that the boom in commercial data gleaned from disparate sources like mobile apps, loyalty programs from retailers, real estate records, employment data and more, is a boon to open source intelligence collection and the IC doesn't intend to curtail acquisition of such records anytime soon.

"The widespread availability of [commercially available information] regarding the activities of large numbers of individuals is a relatively new, rapidly growing and increasingly significant part of the information environment in which the IC must function," the report states. "We believe that CAI is extremely and increasingly valuable and important for the conduct of modern intelligence activity, both as a source of [open source intelligence] and to support, enrich and enable other [intelligence] disciplines." The report goes on to state that CAI "may be useful in building and training artificial intelligence models."

The ODNI report recommends certain checks on the acquisition of CAI, including provisions that deal with the "volume, proportion and sensitivity" of data, including evaluations of the “potential for substantial harm, embarrassment, inconvenience or unfairness to U.S. persons if the information is improperly used or disclosed.” 

The report notes that "profound changes in the scope and sensitivity of CAI have overtaken traditional understandings, at least as a matter of policy. Today’s publicly available CAI is very different in degree and in kind from traditional [publicly available information]."

Some important issues include how to prevent the deanonymization of data and how to filter information on people inside the United States from those outside of it. Specific recommendations include developing "a multi-layered process" to catalog the kinds of commercial data acquired by intelligence agencies by looking at contracts, data intake and data use by agencies. 

Once the extent of CAI use is understood, the IC can create standards for the acquisition and use of such data, to be tailored to different elements of the community to meet their varying needs and missions. As part of this effort, the report states, "the IC should develop more precise guidance to identify and protect sensitive CAI that implicates privacy and civil liberties concerns."

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.