US agencies buy vast quantities of personal information on the open market – a legal scholar explains why and what it means for privacy in the age of AI

<p><strong><a href="https://theconversation.com/profiles/anne-toomey-mckenna-169100">By Anne Toomey McKenna</a>, <em><a href="https://theconversation.com/institutions/university-of-richmond-766">University of Richmond</a> </em></strong></p>
<p>Numerous government agencies, including the FBI, Department of Defense, National Security Agency, Treasury Department, Defense Intelligence Agency, Navy and Coast Guard, have purchased vast amounts of U.S. citizens’ personal information from commercial data brokers. The revelation was published in a partially declassified, internal <a href="https://www.dni.gov/index.php/newsroom/press-releases/press-releases-2023/item/2390-dni-haines-statement-on-declassified-report-on-commercially-available-information">Office of the Director of National Intelligence report</a> released on June 9, 2023.</p>
<p>The report shows the breathtaking scale and invasive nature of the consumer data market and how that market directly enables wholesale surveillance of people. The data includes not only where you’ve been and who you’re connected to, but the nature of your beliefs and predictions about what you might do in the future. The report underscores the grave risks the purchase of this data poses, and urges the intelligence community to adopt internal guidelines to address these problems.</p>
<p>As a privacy, electronic surveillance and technology law <a href="https://www.annetoomeymckenna.com/">attorney, researcher and law professor</a>, I have spent years researching, <a href="https://papers.ssrn.com/sol3/cf_dev/AbsByAuth.cfm?per_id=2643050">writing</a> and advising about the legal issues the report highlights.</p>
<p>These issues are increasingly urgent. Today’s commercially available information, coupled with the now-ubiquitous decision-making artificial intelligence and generative AI like ChatGPT, significantly increases the threat to privacy and civil liberties by giving the government access to sensitive personal information beyond even what it could collect through court-authorized surveillance.</p>
<h2>What is commercially available information?</h2>
<p>The drafters of the report take the position that commercially available information is a subset of publicly available information. The distinction between the two is significant from a legal perspective. Publicly available information is information that is already in the public domain. You could find it by doing a little online searching.</p>
<p>Commercially available information is different. It is personal information collected from a dizzying array of sources by commercial data brokers that aggregate and analyze it, then make it available for purchase by others, including governments. Some of that information is private, confidential or otherwise legally protected.</p>
<figure><a href="https://images.theconversation.com/files/534454/original/file-20230627-16-adjj2j.JPG?ixlib=rb-1.1.0&amp;q=45&amp;auto=format&amp;w=1000&amp;fit=clip"><img decoding="async" src="https://images.theconversation.com/files/534454/original/file-20230627-16-adjj2j.JPG?ixlib=rb-1.1.0&amp;q=45&amp;auto=format&amp;w=754&amp;fit=clip" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px" srcset="https://images.theconversation.com/files/534454/original/file-20230627-16-adjj2j.JPG?ixlib=rb-1.1.0&amp;q=45&amp;auto=format&amp;w=600&amp;h=288&amp;fit=crop&amp;dpr=1 600w, https://images.theconversation.com/files/534454/original/file-20230627-16-adjj2j.JPG?ixlib=rb-1.1.0&amp;q=30&amp;auto=format&amp;w=600&amp;h=288&amp;fit=crop&amp;dpr=2 1200w, https://images.theconversation.com/files/534454/original/file-20230627-16-adjj2j.JPG?ixlib=rb-1.1.0&amp;q=15&amp;auto=format&amp;w=600&amp;h=288&amp;fit=crop&amp;dpr=3 1800w, https://images.theconversation.com/files/534454/original/file-20230627-16-adjj2j.JPG?ixlib=rb-1.1.0&amp;q=45&amp;auto=format&amp;w=754&amp;h=362&amp;fit=crop&amp;dpr=1 754w, https://images.theconversation.com/files/534454/original/file-20230627-16-adjj2j.JPG?ixlib=rb-1.1.0&amp;q=30&amp;auto=format&amp;w=754&amp;h=362&amp;fit=crop&amp;dpr=2 1508w, https://images.theconversation.com/files/534454/original/file-20230627-16-adjj2j.JPG?ixlib=rb-1.1.0&amp;q=15&amp;auto=format&amp;w=754&amp;h=362&amp;fit=crop&amp;dpr=3 2262w" alt="A chart with four columns and three rows" /></a><figcaption><span>The commercial data market collects and packages vast amounts of data and sells it for various commercial, private and government uses.</span><br />
<span><span>Government Accounting Office</span></span></figcaption></figure>
<p>The sources and types of data for commercially available information are mind-bogglingly vast. They include public records and other publicly available information. But far more information comes from the nearly ubiquitous internet-connected devices in people’s lives, like cellphones, <a href="https://spectrum.ieee.org/smart-home-devices-can-reveal-the-health-status-of-individuals">smart home systems</a>, cars and fitness trackers. These all harness data from sophisticated, embedded <a href="https://theconversation.com/ftc-lawsuit-spotlights-a-major-privacy-risk-from-call-records-to-sensors-your-phone-reveals-more-about-you-than-you-think-189618">sensors, cameras and microphones</a>. Sources also include data from apps, online activity, texts and emails, and even <a href="https://www.hipaajournal.com/meta-facing-scrutiny-over-use-of-meta-pixel-tracking-code-on-hospital-websites/">health care provider websites</a>.</p>
<p>Types of <a href="https://www.dni.gov/files/ODNI/documents/assessments/ODNI-Declassified-Report-on-CAI-January2022.pdf">data include</a> location, gender and sexual orientation, religious and political views and affiliations, <a href="https://www.ftc.gov/business-guidance/blog/2022/07/location-health-and-other-sensitive-information-ftc-committed-fully-enforcing-law-against-illegal">weight and blood pressure, speech patterns, emotional states, behavioral information about myriad activities, shopping patterns</a> and family and friends.</p>
<p>This data provides companies and governments a window into the “<a href="https://doi.org/10.1109/ISCON52037.2021.9702450">Internet of Behaviors</a>,” a combination of data collection and analysis aimed at understanding and predicting people’s behavior. It pulls together a wide range of data, including location and activities, and uses scientific and technological approaches, including psychology and machine learning, to analyze that data. The Internet of Behaviors provides a map of what each person has done, is doing and is expected to do, and provides a <a href="https://doi.org/10.1016/j.sintl.2021.100122">means to influence a person’s behavior</a>.</p>
<figure><iframe loading="lazy" src="https://www.youtube.com/embed/pFg3_bW78Ms?wmode=transparent&amp;start=0" width="440" height="260" frameborder="0" allowfullscreen="allowfullscreen"></iframe><figcaption><span>Smart homes could be good for your wallet and good for the environment, but really bad for your privacy.</span></figcaption></figure>
<h2>Better, cheaper and unrestricted</h2>
<p>The rich depths of commercially available information, analyzed with powerful AI, provide unprecedented power, intelligence and investigative insights. The information is a cost-effective way to surveil virtually everyone, plus it provides far more sophisticated data than traditional electronic surveillance tools or methods like wiretapping and location tracking.</p>
<p>Government use of electronic surveillance tools is extensively <a href="https://bja.ojp.gov/program/it/privacy-civil-liberties/authorities/statutes/1285">regulated by federal</a> and state laws. The U.S. Supreme Court has ruled that the Constitution’s <a href="https://www.law.cornell.edu/constitution/fourth_amendment">Fourth Amendment</a>, which prohibits unreasonable searches and seizures, requires a warrant for a wide range of digital searches. These include wiretapping or <a href="https://supreme.justia.com/cases/federal/us/389/347/">intercepting a person’s calls</a>, texts or emails; <a href="https://www.law.cornell.edu/supremecourt/text/10-1259">using GPS</a> or <a href="https://www.supremecourt.gov/opinions/17pdf/16-402_h315.pdf">cellular location information</a> to track a person; or <a href="https://supreme.justia.com/cases/federal/us/573/373/">searching a person’s cellphone</a>.</p>
<p>Complying with these laws takes time and money, plus electronic surveillance law restricts what, when and how data can be collected. Commercially available information is cheaper to obtain, provides far richer data and analysis, and is subject to little oversight or restriction compared to when the same data is collected directly by the government.</p>
<h2>The threats</h2>
<p>Technology and the burgeoning volume of commercially available information allow various forms of the information to be combined and analyzed in new ways to understand all aspects of your life, including preferences and desires.</p>
<figure><iframe loading="lazy" src="https://www.youtube.com/embed/vc7_TKN0kfw?wmode=transparent&amp;start=0" width="440" height="260" frameborder="0" allowfullscreen="allowfullscreen"></iframe><figcaption><span>How the collection, aggregation and sale of your data violates your privacy.</span></figcaption></figure>
<p>The Office of the Director of National Intelligence report warns that the increasing volume and widespread availability of commercially available information poses “significant threats to privacy and civil liberties.” It increases the power of the government to surveil its citizens outside the bounds of law, and it opens the door to the government using that data in potentially unlawful ways. This could include <a href="https://www.scientificamerican.com/article/yes-phones-can-reveal-if-someone-gets-an-abortion/">using location data obtained via commercially available information rather than a warrant</a> to investigate and prosecute someone for abortion.</p>
<p>The report also captures both how widespread government purchases of commercially available information are and how haphazard government practices around the use of the information are. The purchases are so pervasive and agencies’ practices so poorly documented that the Office of the Director of National Intelligence cannot even fully determine how much and what types of information agencies are purchasing, and what the various agencies are doing with the data.</p>
<h2>Is it legal?</h2>
<p>The question of whether it’s legal for government agencies to purchase commercially available information is complicated by the array of sources and complex mix of data it contains.</p>
<p>There is no legal prohibition on the government collecting information already disclosed to the public or otherwise publicly available. But the nonpublic information listed in the declassified report includes data that U.S. law typically protects. The nonpublic information’s mix of private, sensitive, confidential or otherwise lawfully protected data makes collection a legal gray area.</p>
<p>Despite decades of increasingly sophisticated and invasive commercial data aggregation, Congress has not passed a federal data privacy law. The lack of federal regulation around data <a href="https://theconversation.com/what-is-fog-reveal-a-legal-scholar-explains-the-app-some-police-forces-are-using-to-track-people-without-a-warrant-189944">creates a loophole</a> for government agencies to evade electronic surveillance law. It also allows agencies to amass enormous databases that AI systems learn from and use in often unrestricted ways. The resulting erosion of privacy has been <a href="https://ssrn.com/abstract=2905131">a concern for more than a decade</a>.</p>
<h2>Throttling the data pipeline</h2>
<p>The Office of the Director of National Intelligence report acknowledges the stunning loophole that commercially available information provides for government surveillance: “The government would never have been permitted to compel billions of people to carry location tracking devices on their persons at all times, to log and track most of their social interactions, or to keep flawless records of all their reading habits. Yet smartphones, connected cars, web tracking technologies, the Internet of Things, and other innovations have had this effect without government participation.”</p>
<p>However, it isn’t entirely correct to say “without government participation.” The legislative branch could have prevented this situation by enacting data privacy laws, more tightly regulating commercial data practices, and providing oversight in AI development. Congress could yet address the problem. Representative Ted Lieu has introduced the <a href="https://lieu.house.gov/media-center/press-releases/reps-lieu-buck-eshoo-and-sen-schatz-introduce-bipartisan-bicameral-bill">a bipartisan proposal for a National AI Commission</a>, and Senator Chuck Schumer has proposed <a href="https://www.washingtonpost.com/technology/2023/06/21/ai-regulation-us-senate-chuck-schumer/">an AI regulation framework</a>.</p>
<p>Effective data privacy laws would keep your personal information safer from government agencies and corporations, and responsible AI regulation would block them from manipulating you.<!– Below is The Conversation's page counter tag. Please DO NOT REMOVE. –><img decoding="async" loading="lazy" style="border: none !important; box-shadow: none !important; margin: 0 !important; max-height: 1px !important; max-width: 1px !important; min-height: 1px !important; min-width: 1px !important; opacity: 0 !important; outline: none !important; padding: 0 !important;" src="https://counter.theconversation.com/content/207707/count.gif?distributor=republish-lightbox-basic" alt="The Conversation" width="1" height="1" /><!– End of code. If you don't see any code above, please get new code from the Advanced tab after you click the republish button. The page counter does not collect any personal data. More info: https://theconversation.com/republishing-guidelines –></p>
<p><strong><em>About the Author:</em></strong></p>
<p><a href="https://theconversation.com/profiles/anne-toomey-mckenna-169100">Anne Toomey McKenna</a>, Visiting Professor of Law, <em><a href="https://theconversation.com/institutions/university-of-richmond-766">University of Richmond</a></em></p>
<p>This article is republished from <a href="https://theconversation.com">The Conversation</a> under a Creative Commons license. Read the <a href="https://theconversation.com/us-agencies-buy-vast-quantities-of-personal-information-on-the-open-market-a-legal-scholar-explains-why-and-what-it-means-for-privacy-in-the-age-of-ai-207707">original article</a>.</p>
<p>&nbsp;</p>