Last week began with the tenth anniversary of the start of Edward Snowden’s disclosures about how U.S. intelligence agencies siphoned the personal data of billions of people around the world. And it ended with a stark warning about how mass surveillance has since become even more entrenched in our lives.
On Friday, the Office of the Director of National Intelligence—the U.S. intelligence community’s oversight body—declassified and published a January 2022 report by a group of ODNI advisors. The report was about how easy it is these days for agencies to buy commercially available personal information, and the experts (whose identities were redacted) warned the ODNI that the U.S. intelligence rulebook is too out-of-date to protect people’s privacy and civil liberties in this context.
U.S. intelligence is relatively constrained in how much it can spy on people’s private personal information within the country, which is why the very first Snowden revelation about the National Security Agency collecting U.S. Verizon customers’ call records was so scandalous. (The rest were mostly about the U.S. spying on foreigners, and Big Tech is still feeling the pain from those.)
But American spies can do what they want with publicly available information, a category that includes commercially available information (CAI). So for example, they’d need probable cause to get permission to track someone’s location without violating the Fourth Amendment, but there’s nothing stopping them from just buying location-tracking data and ad-targeting profiles—which are absurdly detailed these days—from data brokers, then de-anonymizing the information to identify and track Americans.
“Today, in a way that far fewer Americans seem to understand, and even fewer of them can avoid, CAI includes information on nearly everyone that is of a type and level of sensitivity that historically could have been obtained, if at all, only through targeted (and predicated) collection, and that could be used to cause harm to an individual’s reputation, emotional well-being, or physical safety,” the advisors warned Director of National Intelligence Avril Haines.
This is not to say the ODNI’s advisors aren’t fans of such information—they see a lot of potential for American spies, but also severe risks to the public. “CAI is increasingly powerful for intelligence and increasingly sensitive for individual privacy and civil liberties, and the [intelligence community] therefore needs to develop more refined policies to govern its acquisition and treatment,” they wrote.
Their first recommendation was for the intelligence community to actually figure out what data was being bought by which agencies. Then, they said, it should come up with new standards and procedures for acquiring and using the data, while drawing up safeguards for particularly sensitive information.
Another solution, of course, would be for the U.S. to enact federal data protection legislation that goes beyond today's meager rules which protect only information pertaining to kids or health.
As my predecessor Jacob Carpenter reported in August, the Federal Trade Commission (FTC) sued data broker Kochava for acquiring and selling precise location data. However, a federal judge last month dismissed the case because the FTC couldn’t prove actual harm to the consumers whose location histories were being sold. Europe’s General Data Protection Regulation (GDPR), by way of comparison, doesn’t require any such proof for regulators to crack down on privacy-busting data-sharing—though admittedly, a few fines here and there have so far failed to stop industry-standard data-trading practices that critics call “the world’s biggest data breach.”
Time will tell if the GDPR one day manages to bring the data-broker industry to heel, in the quest to protect Europeans’ privacy rights. But either way, it would be a real shame if the U.S. didn’t try to do the same for its citizens. After all, if your own senior intelligence advisors say your civil liberties are at risk, there’s a problem.
More news below.
Want to send thoughts or suggestions to Data Sheet? Drop a line here.
David Meyer
Data Sheet’s daily news section was written and curated by Andrea Guzman.
