Government sets rules for spy agencies buying commercial data on Americans

The government has put together new rules to guide how U.S. spy agencies buy and use mounds of highly personal information from smartphone apps, automobiles and other connected devices. 

The new framework policy, from the Office of the Director of National Intelligence, does not require agencies to get a warrant before buying or searching commercially available information, or CAI.

“We produced this framework in recognition of the fact that a series of developments have made CAI increasingly important to our work, while at the same time raising novel issues related to privacy and civil liberties,” DNI said in a statement released with the framework. “Today, not only is an astounding amount of CAI already available to the public, but various actors, including adversaries, also have access to increasingly advanced analytic tools that rely on, among other things, artificial intelligence, to exploit such information in new ways that exacerbate existing threats.”

The issues are expected to become more acute. 

“These trends are only expected to accelerate as more of our daily lives are connected to the digital world,” DNI said in the statement. “Put simply, the combination of an increasing amount of readily available data regarding the activities of individuals – often perceived as not especially sensitive on its own – and increasingly sophisticated analytic tools can in the aggregate raise significant privacy and civil liberty concerns.”

Data brokers collect, pool and sell vast troves of personal data from phones, cars, household appliances and other personal devices. Buyers include other businesses, nonprofits, the U.S. government and foreign adversaries, according to the DNI framework. 

Under the framework, the U.S. intelligence community must use the information “in furtherance of a validated mission or administrative need or function.” It requires intelligence agencies to use “appropriate safeguards” and says “protection of privacy and civil liberties” will be a consideration. It prohibits otherwise constitutionally-banned practices such as discrimination based on “ethnicity, race, gender, gender identity, sexual orientation, or religion.”

Director of National Intelligence Avril Haines said the framework “provides effective governance for the [intelligence community’s] handling of CAI while also protecting Americans’ privacy and civil liberties.”

U.S. Sen. Ron Wyden, D-Ore., said the framework was vague. 

“The framework’s absence of clear rules about what commercially available information can and cannot be purchased by the intelligence community reinforces the need for Congress to pass legislation protecting the rights of Americans,” Wyden said. “The DNI’s framework is nonetheless an important step forward in starting to bring the intelligence community under a set of principles and policies, and in documenting all the various programs so that they can be overseen.”

Wyden said he plans to watch how the framework is implemented “to ensure that every element of the intelligence community implements the framework, that Congress is fully informed of all these programs, and that the executive branch finally delivers transparency about its acquisition of commercially available data.”