In a startling revelation, it has come to light that numerous government agencies, including the FBI, Department of Defense, National Security Agency, Treasury Department, Defense Intelligence Agency, Navy, and Coast Guard, have been acquiring extensive quantities of personal information of US citizens from commercial data brokers. The internal report from the Office of the Director of National Intelligence, partially declassified and released on June 9, 2023, sheds light on the immense scale and invasive nature of the consumer data market, which directly enables mass surveillance of individuals.
The report unveils the extent of data collected, encompassing not only individuals’ whereabouts and connections but also their beliefs and predictions about future behavior. This revelation emphasizes the significant risks posed by the acquisition of such data and calls upon the intelligence community to adopt internal guidelines to address these concerns.
As an attorney specializing in privacy, electronic surveillance, and technology law, as well as a researcher and law professor, I have dedicated years to studying and advising on the legal issues highlighted in the report. The urgency surrounding these issues continues to grow. Today, commercially available information, coupled with ubiquitous decision-making artificial intelligence and generative AI technologies like ChatGPT, amplifies the threat to privacy and civil liberties, granting the government access to sensitive personal data beyond what could be collected through court-authorized surveillance.
But what exactly is commercially available information? According to the report, it is a subset of publicly available information that goes beyond what can be easily found through a simple online search. It comprises personal information collected by commercial data brokers from a vast array of sources. These brokers aggregate and analyze the data, making it available for purchase by various entities, including government agencies. Notably, some of this information is private, confidential, or legally protected.
The sources and types of data within commercially available information are staggering. They include public records, publicly available information, and data derived from internet-connected devices such as smartphones, smart home systems, cars, and fitness trackers. These devices harness data from embedded sensors, cameras, and microphones. Additionally, data is sourced from apps, online activities, texts, emails, and even healthcare provider websites.
The range of data encompasses details like location, gender, sexual orientation, religious and political views, physical health information, speech patterns, emotional states, behavioral insights, shopping patterns, and social connections.
This wealth of data provides companies and governments with a comprehensive view of the “Internet of Behaviors” – a combination of data collection and analysis aimed at understanding and predicting human behavior. By analyzing various data points, including location and activities, and utilizing scientific and technological approaches such as psychology and machine learning, the Internet of Behaviors offers a detailed map of an individual’s past, present, and predicted future actions, providing a means to influence their behavior.
The amalgamation of commercially available information with powerful AI capabilities yields unprecedented power, intelligence, and investigative insights. It offers a cost-effective way to surveil almost everyone, surpassing the capabilities of traditional electronic surveillance tools like wiretapping and location tracking. While the government’s use of electronic surveillance tools is heavily regulated by federal and state laws, the procurement of commercially available information is cheaper, provides richer data and analysis, and operates with minimal oversight or restrictions compared to direct government data collection.
The threats posed by this widespread collection and utilization of commercially available information are profound. It amplifies the government’s power to surveil its citizens outside the bounds of legal frameworks and opens the door to potentially unlawful use of the data. For instance, there are concerns that location data obtained through commercially available information, rather than through a warrant, could be used in investigations and prosecutions related to sensitive matters like abortion.
The report also highlights the pervasiveness of government purchases of commercially available information and the lack of proper documentation regarding agency practices. The Office of the Director of National Intelligence itself acknowledges the difficulty in fully determining the extent and nature of the data being acquired and how it is being utilized by various agencies.
The legality of government agencies purchasing commercially available information is complex due to the diverse sources and types of data involved. While there is no legal prohibition on collecting information already in the public domain or otherwise publicly available, the declassified report reveals that nonpublic information, including data that is typically protected by US law, is part of the data being acquired. This creates a legal gray area, as the mixture of private, sensitive, confidential, or lawfully protected data raises questions about the legitimacy of its collection.
Despite the increasingly sophisticated and invasive nature of commercial data aggregation over the years, Congress has yet to pass a comprehensive federal data privacy law. This lack of regulation creates a loophole that allows government agencies to circumvent electronic surveillance laws and accumulate vast databases that artificial intelligence systems can learn from and use without significant oversight or restriction. The erosion of privacy resulting from these practices has been a concern for over a decade.
The report issued by the Office of the Director of National Intelligence highlights the urgent need for effective data privacy laws and responsible AI regulation. Implementing such laws would safeguard personal information from both government agencies and corporations, protecting individuals’ privacy rights. It would also ensure proper oversight and accountability in the utilization of AI technologies, preventing their misuse for manipulative purposes.
To address these issues, representatives like Ted Lieu have introduced bipartisan proposals for a National AI Commission, while Senator Chuck Schumer has put forth an AI regulation framework. By enacting data privacy laws and tightening regulations around commercial data practices, Congress can mitigate the risks posed by the unchecked acquisition and use of personal information.
In conclusion, the declassified report serves as a wake-up call, exposing the extent to which government agencies are purchasing US citizens’ personal data from commercial data brokers. The report underscores the need for greater scrutiny, oversight, and regulation to protect privacy and civil liberties in the face of the growing power of commercially available information and AI technologies. It is imperative for policymakers to take swift action to enact robust data privacy laws and establish responsible AI regulations, safeguarding individuals’ rights in the digital age.