Many government agencies, including the FBI, Department of Defense, National Security Agency, Treasury Department, Defense Intelligence Agency, Navy, and Coast Guard, purchased large quantities of personal information of US citizens from commercial data brokers. The revelation was published in a partially declassified internal report from the Office of the Director of National Intelligence released on June 9, 2023.
The report shows the mind-boggling scale and pervasive nature of the consumer data market and how this market directly enables the wholesale surveillance of people. The data includes not only where you’ve been and who you’ve connected with, but also the nature of your beliefs and predictions about what you might do in the future. The report highlights the serious risks posed by the purchase of this data and urges the intelligence community to adopt internal guidelines to address these issues.
As a lawyer, researcher and professor of privacy, electronic surveillance and technology law, I have spent years researching, writing and advising on the legal issues brought to light by the report.
These problems are increasingly urgent. Today’s commercially available information, coupled with now ubiquitous business intelligence and generative AI-like ChatGPT, dramatically increases the threat to privacy and civil liberties by giving government access to sensitive personal information even beyond what it might collect through the courts. authorized supervision.
What information is commercially available?
The report writers believe that commercially available information is a subset of publicly available information. The distinction between the two is important from a legal point of view. Publicly available information is information that is already in the public domain. You might find it by doing a little research online.
Commercially available information is different. This is personal information collected from a dizzying array of sources by commercial data brokers who aggregate and analyze it, then make it available for purchase by others, including governments. Some of this information is private, confidential or otherwise protected by law.
The sources and types of data for commercially available information are incredibly vast. They include public records and other publicly available information. But a lot more information comes from the nearly ubiquitous internet-connected devices in people’s lives, like cellphones, smart home systems, cars and fitness trackers. All of this leverages data from sophisticated built-in sensors, cameras and microphones. Sources also include data from apps, online activities, text messages and emails, and even healthcare provider websites.
Data types include location, gender and sexual orientation, religious and political opinions and affiliations, weight and blood pressure, speech patterns, emotional states, behavioral information on a myriad of activities , shopping habits, family and friends.
This data offers businesses and governments a window into the “Internet of Behaviour,” a combination of data collection and analysis aimed at understanding and predicting people’s behavior. It gathers a wide range of data, including location and activities, and uses scientific and technological approaches, including psychology and machine learning, to analyze this data. The Internet of Behavior provides a map of what each person has done, is doing, and is expected to do, and provides a way to influence a person’s behavior.
Better, cheaper and without restrictions
The wealth of commercially available information, analyzed with powerful AI, delivers unprecedented power, intelligence, and investigative insight. Information is a cost-effective way to monitor virtually anyone, and it provides much more sophisticated data than traditional electronic surveillance tools or methods like wiretapping and location tracking.
The government’s use of electronic surveillance tools is largely regulated by federal and state laws. The US Supreme Court has ruled that the Constitution’s Fourth Amendment, which prohibits unreasonable searches and seizures, requires a warrant for a wide range of digital searches. These include wiretapping or intercepting a person’s calls, text messages or emails; use GPS or cellular location information to track a person; or search for a person’s cell phone.
Complying with these laws takes time and money, and the Electronic Surveillance Act limits what, when, and how data can be collected. Commercially available information is cheaper to obtain, provides much richer data and analysis, and is subject to little oversight or restriction compared to when the same data is collected directly by the government.
The threats
Technology and the growing volume of commercially available information make it possible to combine and analyze various forms of information in new ways to understand all aspects of your life, including preferences and desires.
The report from the Office of the Director of National Intelligence warns that the growing volume and widespread availability of commercially available information pose “significant threats to privacy and civil liberties.” This increases the government’s power to monitor its citizens outside the bounds of the law and opens the door for the government to use this data in potentially illegal ways. This could include using location data obtained through commercially available information rather than a warrant to investigate and prosecute someone for abortion.
The report also documents both the extent of government purchases of commercially available information and the random nature of government practices regarding the use of this information. The buying is so widespread and the agency practices so poorly documented that the Office of the Director of National Intelligence cannot even fully determine how many and what types of news agencies are buying, and what the various agencies are doing with the data.
Is it legal?
The question of whether it is legal for government agencies to purchase commercially available information is complicated by the range of sources and the complex mix of data they contain.
There is no legal prohibition for the government to collect information already disclosed to the public or otherwise publicly available. But the nonpublic information listed in the declassified report includes data that U.S. law generally protects. The mix of non-public information with private, sensitive, confidential or legally protected data makes collection a legal gray area.
Despite decades of increasingly sophisticated and invasive business data aggregation, Congress has failed to pass a federal data privacy law. The lack of federal data regulation creates a loophole for government agencies to evade electronic surveillance law. It also allows agencies to accumulate huge databases from which AI systems learn and use in often unlimited ways. The resulting erosion of privacy has been a concern for more than a decade.
Data Pipeline Limitation
The report from the Office of the Director of National Intelligence acknowledges the astonishing loophole that commercially available information provides to government surveillance: “The government would never have been allowed to force billions of people to wear tracking devices on their person. at any time, to log in and track most of their social interactions or keep impeccable records of all their reading habits.Yet smartphones, connected cars, web tracking technologies, the Internet of Things and other innovations have had this effect without government involvement.
However, it is not entirely correct to say “without the participation of the government”. The legislature could have prevented this by enacting data privacy laws, regulating data business practices more tightly, and providing oversight for the development of AI. Congress could still fix the problem. Representative Ted Lieu presented the bipartisan proposal for a national commission on AI, and Senator Chuck Schumer proposed an AI regulatory framework.
Effective data privacy laws would protect your personal information from government agencies and corporations, and responsible AI regulation would prevent them from manipulating you.
Anne Toomey McKenna is a visiting professor of law at the University of Richmond.