Like it or not, almost everything we rely on nowadays collects information about us, including our smartphones, computers, cars, and even household appliances. Those of us unwilling or unable to ditch the grid entirely have had to begrudgingly accept that this data ends up in the hands of marketing giants, which use our information to deliver incessant targeted advertisements. But a newly-declassified report reveals that advertisers aren’t the only ones buying up our data—the US government is a top customer, too.
In Jan. 2022, the Office of the Director of National Intelligence (ODNI) completed a report on “commercially-available information,” or CAI. The ODNI defines CAI as information that can be purchased not only by the government, but also by companies and the rest of the general public. While not all CAI is gleaned from our devices, a lot of it is, with the ODNI admitting that CAI’s “volume and sensitivity” has exploded in recent years thanks to digital technology. There are two things to know about CAI which are explicitly stated in the ODNI’s document: That it can be de-anonymized and matched with individual US residents even after the seller has attempted to anonymize it, and that the ODNI views CAI as a valuable source of intelligence, which is sometimes used for missions whose purposes are redacted in the report.
The 48-pager warns that “few Americans seem to understand, and even fewer of them can avoid,” the extent to which their data is collected. While obtaining intelligence on individual Americans once required “targeted and predicated” action, it’s now a far more casual task to gather sensitive information on “nearly everyone.” This includes information regarding a person’s “racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership,” as well as data related to genetic processing, biometrics, health, or “a natural person’s sex life or sexual orientation.” (As the ODNI points out, these categories have been abused before in the outing of a gay Catholic priest and the unwarranted inspection of Muslim prayer app data.) Particularly sensitive data includes people’s mental health information, travel records, attorney-client information, “persistent location information,” and even library records.
So what is all of this data for? The ODNI—and the rest of the intelligence community—doesn’t totally know. While some purposes are known (and, again, redacted in the report), the ODNI has used this document to call for an improved understanding of how the intelligence community uses CAI. Once those purposes have been explored, the ODNI is also interested in investigating whether those uses justify the potential privacy violations involved in CAI’s collection. Beyond saying that CAI is useful intelligence and that it “may be useful in building and training artificial intelligence models,” (the purposes of which are not stated), the ODNI’s report largely neglects to give its readers a justification for the United States’ CAI buy-ups.
The purpose of the ODNI’s report is purportedly to argue for improved cataloging, standardization, and privacy-protecting guidance for the intelligence community’s 18 entities. The ODNI makes the case for formal procurement documentation that tracks when and how sensitive information arrives on intelligence agencies’ desks; a set of standards and procedures that verify data vendor quality, acquisition logistics, legality, and intended use of data; and stricter approval requirements along the procurement chain. Whether this is meant to truly comfort or just placate Americans is unclear—after all, the ODNI already said sensitive personal data is a valuable tool for the government. Regardless of the regulations put in place, that data could still be used for purposes that make the average subject deeply uncomfortable.
