At a Senate Intelligence Committee hearing yesterday, FBI Director Christopher Wray confirmed for the first time that the agency has previously purchased the location data of US citizens without obtaining a warrant, Wired reported.
That revelation, which has alarmed privacy advocates, came after Sen. Ron Wyden (D-Ore.) asked Wray directly: “Does the FBI buy phone geolocation information in the US?” Wray’s response skirted the question, but provided a rare insight into how the FBI used location data to track Americans without judicial oversight.
“To my knowledge, we do not currently purchase commercial database information that includes location data derived from Internet advertising,” Wray said. “I understand that we have previously – as in the past – purchased some such information for a specific national security pilot program. But that hasn’t been active for quite some time.”
Americans are protected from unreasonable searches under the Fourth Amendment, and the Supreme Court has said that government agencies accessing location data without a warrant can be seen as violating Fourth Amendment rights. However, privacy advocates such as the Electronic Frontier Foundation (EFF) continue to find evidence that federal agencies, including the FBI, are relying on a legal loophole to continue buying location data that the agencies may not legally have access to.
During the hearing, Wray said the FBI does not currently purchase location data and has “no plans to change that” at this time. Instead, the FBI has a “court-authorized process” to seize data, which may or may not be easier than obtaining a warrant. Wray did not elaborate on how that process works.
The FBI and EFF did not immediately respond to Ars’ request for comment. [Update: Electronic Frontier Foundation Senior Staff Attorney Adam Schwartz told Ars, “US government agencies must not be allowed to do an end run around the Fourth Amendment by buying private information from data brokers who collect information about the precise movements of hundreds of millions of people without their knowledge or meaningful consent. This extremely sensitive information can reveal where we live and work, who we associate with, and where we worship, protest, and seek medical care.” Demand Progress policy attorney Sean Vitka told Ars that there is “no sense of the scale” of how widely location data is used by government agencies, noting that “people like Senator Wyden have been asking the intelligence agencies to be transparent, and they have absolutely failed.”]
Federal agencies purchasing location data remains a privacy concern
Wray’s comments come after years of scrutiny of data collection from secret federal agencies. Last year, the EFF reported that in recent years, “data brokers and federal military, intelligence and law enforcement agencies have formed a massive, secret partnership to track the movements of millions of people.”
The data Wray pointed to—commercial databases including data collected for online advertising—is only a small subset of the location data out there. Mobile devices can be used to track location data, and the EFF found that popular weather, coupon and navigation apps also collected location data that has been used by federal agencies to track US citizens. In 2020, the Wall Street Journal reported that the Department of Homeland Security had purchased location data on millions of Americans from data brokers such as Venntel. More recently, the EFF revealed that Venntel appeared to be the very source of location data of increasingly secret warrantless efforts by local police.
No federal law effectively guarantees online privacy in the US. To address privacy concerns, Congress has tried to pass new laws for decades, but no bill has passed both houses, and no bill is designed to eliminate the risk of authorities buying data. Even the US Privacy and Data Protection Act, which lawmakers from both parties seemed to see as a major step forward, does not prevent law enforcement agencies from collecting data, Wired noted.
Instead of focusing solely on restricting law enforcement purchases of data, some privacy experts told Wired they are pushing for Fair Credit Reporting Act enforcement to include a requirement that data brokers obtain consent for the sale consumer data. This would at least ensure that citizens know when sensitive data can be shared with the police.
Vitka told Wired that if the FBI ever decides to buy location data in the future, it should be more “upfront” with details so Americans know when the FBI deems it an appropriate measure.
Suggesting that Congress should bar the FBI and other federal agencies from buying location data, Vitka said Wray’s statements to the committee were “scary” enough to warrant an investigation into the agency’s past purchase of sensitive US data .
“The public needs to know who gave the go-ahead for this purchase, why and what other agencies have done or are trying to do the same,” Vitka told Wired.