PANOPTICON epic odni data purchases
page 5 / 6
Availability of other privacy-protective measures
These are certainly laudable goals, and hopefully ODNI will build off these processes. Ultimately, though, more internal IC processes only go so far. Therefore, Congress should use this framework as a roadmap to establish the scope of—and safeguards for—government data purchases.
For example, while it certainly should be the case that VPS assessments are made prior to acquisition, that is also the case with Privacy Impact Assessments (PIAs), but agencies regularly ignore or delay their obligation to conduct a PIA until well after a program has been implemented. Similarly, requiring the involvement of all relevant parties should be a no-brainer, it’s vital that review mechanisms—whether individual privacy and civil liberties officers or boards like at Treasury or DHS—have sufficient power to act as a meaningful check on CAI acquisitions.
As noted above, Congress has a key role to play in aligning key definitions like sensitive data and de-identified or anonymized data. Congress has an opportunity to bring CAI acquisitions into line with constitutional protections, including by prohibiting the acquisition of Fourth Amendment protected information like location information and internet records. Given its particularly intrusive nature, Congress should also ban bulk collection of Americans’ records. Finally, in addition to resolving these foundational scoping issues, Congress can—and should—mandate the establishment of minimization procedures, including reasonable retention limits, documentation requirements, and limits on searching for information about people in the United States.
Conclusion
The ODNI report confirms what privacy and civil liberties groups have feared for years—that the government continues to evade constitutional protections by purchasing Americans’ data, and that it does so with no safeguards in place. DNI Avril Haines, in a statement to Vox after the report’s release, said ODNI is working on implementing the report’s recommendations and plans to release as much of that framework as possible. ODNI’s continued transparency and commitment to implementing at least some of these recommendations is commendable. However, these recommendations only address part of the government’s data purchases and—given that they are non-binding in nature—do not require any particular safeguards. Therefore, key questions remain about how far the IC is willing to go in implementing strong privacy protections and, given its reluctance to do so in other contexts, hopes should not be too high.
Ultimately, it is up to Congress to protect Americans from warrantless government surveillance. The Davidson-Jacobs NDAA amendment is a clear sign that there is bipartisan appetite for strong reform, and only underscores the extent to which greater reform of the warrantless government surveillance ecosystem is needed this year.
[1] ODNI Senior Advisory Grp., Panel on Commercially Available Information, Report to the Dir. of Nat’l Intel. 21 (Jan. 27, 2022), available at https://www.dni.gov/files/ODNI/documents/assessments/ODNI-Declassified-Report-on-CAI-January2022.pdf [hereinafter ODNI SAG Report].
[2] Id.
[3] Id.
[4] Id. at 14.
[5] Id. at 12.
[6] Letter from ODNI Senior Advisory Grp. to Dir. of Nat’l Intel. Avril Haines 1 (Jan. 27, 2022), available at https://www.dni.gov/files/ODNI/documents/assessments/ODNI-Declassified-Report-on-CAI-January2022.pdf [hereinafter ODNI SAG Letter of Transmittal].
[7] ODNI SAG Report, at 15.
[8] Id. at 2.
[9] Fog Reveal has so far only been linked to state and local law enforcement, whose purchases are not within the scope of this report, but given FBI Director Christopher Wray’s admission that the FBI had purchased commercially available location data based on internet advertising, it is very likely that similar tools exist for consumption by IC elements. See Dell Cameron, The FBI Just Admitted It Bought US Location Data, Wired (Mar. 8, 2023), https://www.wired.com/story/fbi-purchase-location-data-wray-senate/.
[10] ODNI SAG Report, at 22.
[11] Id. at 1.
[12] Id.
[13] Id. at 2.
[14] ODNI SAG Letter of Transmittal, at 2.
[15] Id. at 7.
[16] Id. at 8.
[17] Id.
[18] Id.
[19] Id. at 9.
[20] Id. at 21.
[21] Id. It’s clear from the report that this lack of knowledge has hampered prior attempts at assessing the IC’s purchase of data—a prior data call from ODNI in early 2021 did not return comprehensive results, and the data call for the ODNI SAG report is based on just a sample of CAI acquisitions. Id. at 21.
[22] Id. at 22.
[23] Id.
[24] Id. at 16.
[25] Id.
[26] Unhelpfully, the agency with the “most mature set of standards and processes governing CAI” was entirely redacted. Id. at 26.
[27] Id. at 18.
[28] Id. at 23.
[29] Carpenter v. United States, 138 S. Ct. 2206, 2217 (2018) (quoting United States v. Jones, 565 U.S. 400, 415) (Sotomayor, J., concurring)).
[30] ODNI SAG Report, at 19.