Well, That’s Everyone: Senator Wyden Letter Confirms The NSA Is Buying US Persons’ Data From Data Brokers

Buying domestic data from data brokers is just something the government does all the time. Bypassing restraints enacted by the Supreme Court, federal agencies (along with local law enforcement agencies) are hoovering up whatever domestic data they can from private companies all too happy to be part of the problem.

Sure, the government can pretend the Third Party Doctrine applies here. But chances are that most of this data being collected by phone apps and other services isn't being collected with the full knowledge of device users. This is the sort of thing that's hidden in the deep end of Terms of Use boilerplate, suckering people out of all kinds of data because they made the mistake of assuming a seemingly-innocuous match-3 game wouldn't attempt to ping their phone's location and tie it to specific device IDs.

So, this latest news - as revealed by Senator Ron Wyden - is only surprising in terms of which agency is involved.

U.S. Senator Ron Wyden, D-Ore., released documents confirming the National Security Agency buys Americans' internet records, which can reveal which websites they visit and what apps they use. In response to the revelation, today Wyden called on the administration to ensure intelligence agencies stop buying personal data from Americans that has been obtained illegally by data brokers. A recent FTC order held that data brokers must obtain Americans' informed consent before selling their data.

The U.S. government should not be funding and legitimizing a shady industry whose flagrant violations of Americans' privacy are not just unethical, but illegal," Wyden wrote in a letter to Director of National Intelligence (DNI) Avril Haines today. To that end, I request that you adopt a policy that, going forward, IC elements may only purchase data about Americans that meets the standard for legal data sales established by the FTC."

You'd think the NSA would be able to obtain this data without having to buy it from sketchy third-party vendors. I mean, it has erected one of the most pervasive surveillance apparatuses in the world. It's completely capable of engaging in domestic surveillance. And, indeed, it often does! So why would it need to purchase something it can obtain (more legitimately[?]) from its own dragnets and risk having part of its collection techniques exposed?

There's no clear answer to that question, other than it's pretty easy to spend government money when you've got plenty of it. Wyden's letter [PDF] goes into a bit more detail, but (for obvious reason) it's not the equivalent of sneaking damning documents out of an NSA data center and handing them over to journalists after exiting the country.

That being said, it took Wyden holding a top NSA position hostage for the government to admit it was buying data from brokers to engage in domestic surveillance.

The secrecy around data purchases was amplified because intelligence agencies have sought to keep the American people in the dark. It took me nearly three years to clear the public release of information revealing the NSA's purchase of domestic internet metadata. DoD first provided me with that information in March, 2021, in response to a request from my office for information identifying the DoD components buying Americans' personal data. DoD subsequently refused a request I made in May, 2021, to clear the unclassified information for public release. It was only after I placed a hold on the nominee to be the NSA director that this information was cleared for release.

Wyden asks each IC [Intelligence Community] element" to open an investigation into the purchase of data from data brokers, as well as an FTC investigation into the business practices of the data brokers themselves. Each IC component is also asked to provide an inventory of personal data purchased" from data brokers.

Wyden's letter deals with all data purchased from brokers, but specifically exposes the NSA's acquisition of internet browser records, which show which sites users visit and which apps they use. The NSA's denial - delivered to Wyden late last year - claims the NSA isn't doing something else entirely.

[N]SA does not buy and use location data collected from phones known to be used in the United States either with or without a court order.

That's the only firm denial in the letter and it only says things about location data, which isn't what Wyden is expressing his concern about.

However, the NSA - in the same 2023 letter - admitted to doing exactly what Wyden accused it of:

NSA does buy and use commercially available netflow (i.e., non-content) data related wholly to domestic internet communications and internet communications where one side of the communication is a U.S. Internet Protocol address and the other is located abroad.

The NSA is admitting to domestic surveillance. Not the best look for an agency still hoping to resuscitate its reputation following several years of damning leaks, investigations, and inadvertent exposures. We already know the NSA is fully capable of inadvertently" sweeping up US persons' data and communications with its Section 702 collection. That's the thing the FBI constantly abuses to engage in domestic surveillance. It should never need to buy this data from brokers because it has always been able to obtain it otherwise.

This appears to be the NSA collecting even more just because the situation presented itself, rather than for any demonstrated national security need. And that's the sort of thing no American should be willing to treat as government business as usual.