U.S. News: U.S. Spy Agencies Adopt Rules For Buying Data on Americans

"WASHINGTON -- U.S. spy agencies will limit how they buy and use troves of data about Americans gleaned from thousands of smartphone apps and other personal devices such as cars and internet-connected household appliances, according to a new policy directive released Wednesday.

The directive establishing the new rules, issued by Director of National Intelligence Avril Haines, applies to all U.S. intelligence agencies, including the Central Intelligence Agency and National Security Agency. 

It won't mandate that agencies obtain a warrant before purchasing or searching the data, a requirement sought by some lawmakers.

The framework sets out rules for how to collect and analyze commercially available data on foreigners and Americans, but grants each agency "flexibility to experiment" in how they approach using the data.

"This is information that can be purchased by pretty much anyone, including, frankly, individuals overseas," said Jason Barrett, a senior official for open-source intelligence. U.S. spy agencies, he said, are trying to ensure that they are lawfully using the data with ample privacy protections in place while still relying on it to "help us more quickly identify threats."

Such data, which intelligence agencies refer to as commercially available information, has exploded in volume and has begun to replicate and in some cases replace more traditional surveillance techniques. Often, the purchased data acts as the first stream of intelligence to security threats that can prompt analysts to hunt for additional information through other means.

The framework's release follows a series of articles in The Wall Street Journal revealing that U.S. intelligence agencies, military units and federal law-enforcement agencies buy personal information on Americans.

The 12-page framework affords greater protections to what is described as sensitive information, defined as data sources that are known or expected to contain a large volume of material about Americans or U.S. companies or could be used to identify specific American individuals -- even if that data is anonymized.

It also limits capturing data that could contain sensitive activities of Americans, such as information that could reveal personal affiliations or the exercising of rights such as speech and worship. Limits include restrictions on accessing data, identifying mission needs, and filtering or anonymizing data whenever possible.

Lawmakers in both parties have recently expressed concern about what they see as a largely unregulated market of data brokers in which the U.S. government could potentially buy information that it can't legally collect using its own surveillance techniques.

The House narrowly passed a bipartisan bill in April prohibiting law enforcement and intelligence agencies from purchasing commercially available data about Americans without a court order. The Senate appears unlikely to vote on it, and administration officials have opposed it.

Sen. Ron Wyden (D., Ore.) welcomed the framework as a vital step for accountability and transparency but said it was overly vague. 

"The framework's absence of clear rules about what commercially available information can and cannot be purchased by the intelligence community reinforces the need for Congress to pass legislation protecting the rights of Americans," said Wyden." [1]

1. U.S. News: U.S. Spy Agencies Adopt Rules For Buying Data on Americans. Volz, Dustin.  Wall Street Journal, Eastern edition; New York, N.Y.. 09 May 2024: A.3.