FBI finally admits to buying location data on Americans, horrifying experts

FBI director denied that the agency currently purchases location data.

Ashley Belanger – Mar 9, 2023 12:41 pm | 288

FBI Director Christopher Wray, left, and National Security Agency Director Gen. Paul Nakasone, testify during the Senate Select Intelligence Committee hearing on worldwide threats on Wednesday, March 8, 2023. Credit: Tom Williams / Contributor | CQ-Roll Call, Inc.

At a Senate Intelligence Committee hearing yesterday, FBI Director Christopher Wray confirmed for the first time that the agency has in the past purchased the location data of US citizens without obtaining a warrant, Wired reported.

This revelation, which has alarmed privacy advocates, came after Sen. Ron Wyden (D–Ore.) asked Wray directly, “Does the FBI purchase US phone-geolocation information?” Wray’s response tiptoed around the question but provided a rare insight into how the FBI has used location data to surveil Americans without any court oversight.

“To my knowledge, we do not currently purchase commercial database information that includes location data derived from Internet advertising,” Wray said. “I understand that we previously—as in the past—purchased some such information for a specific national security pilot project. But that’s not been active for some time.”

Americans are protected against unreasonable searches under the Fourth Amendment, and the Supreme Court has said that government agencies accessing location data without a warrant can be considered in violation of Fourth Amendment rights. But privacy advocates like the Electronic Frontier Foundation (EFF) have continually found evidence that federal agencies, including the FBI, have relied on a legal loophole to continue purchasing location data that agencies otherwise may not legally be able to access.

During the hearing, Wray said the FBI does not currently purchase location data and has “no plans to change that” right now. Instead, the FBI has a “court-authorized process” for seizing data, which may or may not be easier than obtaining a warrant. Wray didn’t specify how that process works.

The FBI and EFF did not immediately respond to Ars’ request for comment. [Update: Electronic Frontier Foundation Senior Staff Attorney Adam Schwartz told Ars, “US government agencies must not be allowed to do an end run around the Fourth Amendment by buying private information from data brokers who collect information about the precise movements of hundreds of millions of people without their knowledge or meaningful consent. This extremely sensitive information can reveal where we live and work, who we associate with, and where we worship, protest, and seek medical care.” Demand Progress policy attorney Sean Vitka told Ars that there is “no sense of the scale” of how widely location data is used by government agencies, noting that “people like Senator Wyden have been asking the intelligence agencies to be transparent, and they have absolutely failed.”]

Feds purchasing location data remains a privacy concern

Wray’s comments come after years of scrutiny of federal agencies’ covert location data gathering. Last year, the EFF reported that within the past few years, “data brokers and federal military, intelligence, and law enforcement agencies have formed a vast, secretive partnership to surveil the movements of millions of people.”

The data that Wray pointed to—commercial databases including data gathered for online advertising—is only a small subset of the location data out there. Mobile devices can be used to track location data, and the EFF found that popular weather, coupon, and navigation apps also gathered location data that has been used by federal agencies to monitor US citizens. In 2020, The Wall Street Journal reported that the Department of Homeland Security had purchased location data on millions of Americans from data brokers like Venntel. More recently, the EFF revealed that Venntel appeared to be the same location data source of increasingly secretive warrantless local police efforts.

No federal law meaningfully guarantees online privacy in the US. To address privacy concerns, Congress has sought to pass new laws for decades, but no bill has made it through both chambers, and no bill has been designed to eradicate the risk of authorities purchasing data. Even the American Data Privacy and Protection Act, which lawmakers from both parties seemed to consider a significant step forward, doesn’t prevent law enforcement agencies from collecting data, Wired noted.

Rather than focus exclusively on restricting law enforcement agencies’ sketchy data purchases, some privacy experts told Wired they’re pushing for enforcement of the Fair Credit Report Act to include a requirement that data brokers gain consent for selling consumer data. That would at least ensure citizens are aware of when sensitive data may be shared with police.

Vitka told Wired that if the FBI ever decides to purchase location data in the future, it should be more “forthcoming” with details so that Americans know when the FBI considers that an appropriate measure.

Suggesting that Congress should ban the FBI and other federal agencies from ever purchasing location data, Vitka said that Wray’s statements to the committee are “horrifying” enough to warrant investigating the agency’s past purchase of sensitive US data.

“The public needs to know who gave the go-ahead for this purchase, why, and what other agencies have done or are trying to do the same,” Vitka told Wired.