Spy agencies acquire commercial data with little coordination and few controls

The U.S. intelligence community is taking advantage of massive growth in commercial information and intelligence services worldwide to acquire financial, social media, telecommunications, employment and other data on individuals around the world, including U.S. persons who are notionally subject to constitutional protections.

The acquisition and ingestion of this information is done with few restrictions and little coordination across the 18 agencies that make up the intelligence community, according to a partially redacted report from the Office of the Director of National Intelligence released on Monday. 

The report, compiled and released in part at the urging of Sen. Ron Wyden, D-Ore., found that only a few intelligence agencies have internal best practices in place around the collection of commercial data from vendors. The report recommends that the intelligence community establish and adopt common practices to mitigate the risks of the collection of personal data on Americans that would otherwise require a warrant to obtain.

“The executive branch must exercise much stronger oversight of this practice, issue guidance to agencies about the legal status of commercial data and provide transparency to the American people about how it interprets the law,” Wyden said in a statement. “If the government can buy its way around Fourth Amendment due-process, there will be few meaningful limits on government surveillance."

Wyden also hopes to pass legislation "to put guardrails around government purchases, to rein in private companies that collect and sell this data and keep Americans’ personal information out of the hands of our adversaries."

The report makes it clear that the boom in commercial data gleaned from disparate sources like mobile apps, loyalty programs from retailers, real estate records, employment data and more, is a boon to open source intelligence collection and the IC doesn't intend to curtail acquisition of such records anytime soon.

"The widespread availability of [commercially available information] regarding the activities of large numbers of individuals is a relatively new, rapidly growing and increasingly significant part of the information environment in which the IC must function," the report states. "We believe that CAI is extremely and increasingly valuable and important for the conduct of modern intelligence activity, both as a source of [open source intelligence] and to support, enrich and enable other [intelligence] disciplines." The report goes on to state that CAI "may be useful in building and training artificial intelligence models."

The ODNI report recommends certain checks on the acquisition of CAI, including provisions that deal with the "volume, proportion and sensitivity" of data, including evaluations of the “potential for substantial harm, embarrassment, inconvenience or unfairness to U.S. persons if the information is improperly used or disclosed.” 

The report notes that "profound changes in the scope and sensitivity of CAI have overtaken traditional understandings, at least as a matter of policy. Today’s publicly available CAI is very different in degree and in kind from traditional [publicly available information]."

Some important issues include how to prevent the deanonymization of data and how to filter information on people inside the United States from those outside of it. Specific recommendations include developing "a multi-layered process" to catalog the kinds of commercial data acquired by intelligence agencies by looking at contracts, data intake and data use by agencies. 

Once the extent of CAI use is understood, the IC can create standards for the acquisition and use of such data, to be tailored to different elements of the community to meet their varying needs and missions. As part of this effort, the report states, "the IC should develop more precise guidance to identify and protect sensitive CAI that implicates privacy and civil liberties concerns."