Even the Government Thinks It Should Stop Buying Corporate Surveillance Data

Intern Nicholas Wilson was the primary author of this post.

U.S. government intelligence agencies are buying data about us. The danger to our civil liberties is so extreme that even the Office of the Director of National Intelligence (ODNI) said things have gone too far in a detailed report released in June.

The report explains that federal intelligence agencies, like the NSA and FBI, do more than just conduct their own surveillance: they also buy data from private surveillance companies. This is a powerful partnership: the government’s desire to surveil us aligns well with corporations’ incentives in the surveillance economy. When intelligence agencies buy our data, they do not even follow basic constitutional safeguards—like obtaining warrants—since they say the purchased data is “publicly available.” In other words, since many data brokers will sell our personal data to anyone, intelligence agencies see no reason to treat that data as protected by the Fourth Amendment.

But the report warns that when the government buys data about us, it threatens our privacy and civil liberties, something EFF has been saying for years. The government should not escape warrant requirements simply by paying private surveillance companies. As the report says, commercially available data, just like data the government collects itself, can be “misused to pry into private lives, ruin reputations, and cause emotional distress and threaten the safety of individuals.” This commercially available data “can disclose, for example, the detailed movements and associations of individuals and groups, revealing political, religious, travel, and speech activities.”

The government’s purchases of corporate surveillance data are pervasive. Intelligence agencies are buying up so much data that ODNI was not able to comprehensively review all the purchases. ODNI’s report warned that commercial data “has, at least in part, overtaken current IC [intelligence community] policies that address it.”

Examples from the report illustrate the problem. The FBI and the Coast Guard have both contracted with surveillance tech companies to monitor our social media accounts. And the Department of Homeland Security has used the “Web of Science” tool to identify foreign academic researchers working in the U.S.

The report rightly calls for intelligence agencies to do more to consider the privacy impact of buying and using commercial data. Intelligence agencies should not turn a blind eye to their privacy harms. And they should respect the Supreme Court’s holding in Carpenter v. United States that the government cannot obtain certain personal data, like location data, from private companies without a warrant.

The report also calls for intelligence agencies to conduct a sweeping review to understand how they are buying and using commercial surveillance data. Since these agencies are making so many data purchases that ODNI couldn’t find them all, this review is necessary. And the report is right that the review should cover not just purchases, but also uses of the data—data that is purchased for one purpose can become more threatening when it is later combined with other data sources or used in a different way.

But the report does not solve the problems it identifies. The report is not binding on the Director of National Intelligence or her successors. And the report, even after noting the threat to civil liberties, fails to disavow government use of commercial surveillance data. Instead, it invites intelligence agencies to do their own balancing of privacy harms against national security benefits of intelligence. That is not enough. Intelligence agencies will always have a clear bias towards supposed national security “benefits,” meaning they will inevitably put civil liberties on the chopping block.

Instead, we need changes across government. Legislatures need to pass strong consumer data privacy legislation, so that data brokers have less data to sell the government. Legislatures also need to pass statutory limits on the government, to prevent them from using data brokers to dodge search warrant requirements, and to stop them using reverse warrants. Courts should respect Fourth Amendment precedent by continuing to disallow the government from buying personal data without a warrant.

Government surveillance and corporate surveillance are bad enough on their own. They should not be allowed to join forces.