Cybersecurity Policy Report, ODNI Offers Guidelines on Agencies’ Use of Data Brokers, (May 9, 2024)

By Tom Leithauser

U.S. intelligence agencies should refrain from using information about Americans purchased from data brokers unless they can certify that the data is necessary for their mission and obtain approval from top-level officials, according to a new policy issued by the Office of the Director of National Intelligence (ODNI).

The ODNI’s policy on the use of “commercially available information” (CAI) was released yesterday and follows the recommendations of a senior advisory group assigned to study the privacy and civil liberties implications of the use of CAI by the intelligence community (IC) (CPR, June 15, 2023June 15, 2023).

“Commercial entities are collecting and aggregating unprecedented amounts of personal data through networked computing applications. This data comes from a variety of sources including cell phones, cars, household appliances, and other personal devices,” the policy explains.

“Some of these commercial entities make such information available to a diverse set of purchasers, including for-profit and non-profit entities, foreign adversaries, and domestic and transnational organizations,” it notes.

“Like these other purchasers, elements of the Intelligence Community (IC) lawfully access, collect, and process such commercially available information (CAI) in pursuit of mission imperatives, and the information often provides critical intelligence value,” it says.

“At the same time, these datasets can reveal sensitive and intimate personal details and activities. The IC’s access to and collection and processing of this information is subject to numerous laws and policies governing intelligence activities,” the policy adds.

The policy establishes guidelines for the IC’s acquisition, storage, and use of “sensitive” and “non-sensitive” CAI. “Establishing categorical distinctions between ‘sensitive’ and ‘non-sensitive’ data is challenging in a digital environment where the types and volume of data and processing methods to aggregate and draw insights from that data are expanding rapidly. Nevertheless, this Policy Framework is intended to establish a uniform baseline for all IC elements to categorize and handle CAI,” it says.

It defines sensitive CAI as any dataset that contains “a substantial volume of personally identifiable information (PII) regarding U.S. persons” or data “that captures personal attributes, conditions, or identifiers that are traceable to one or more specific U.S. persons, either through the dataset itself or by correlating the dataset with other available information.”

The definition extends to data that reveals an Americans’ “race or ethnicity, political opinions, religious beliefs, sexual orientation, gender identity, medical or genetic information, financial data, or any other data the disclosure of which would have a similar potential to cause substantial harm, embarrassment, inconvenience, or unfairness to the U.S. person or U.S. persons described by the data.”

The policy calls for the heads of intelligence agencies or their delegates to authorize operations involving sensitive CAI and requires agencies to determine “whether the value of accessing or collecting the Sensitive CAI likely outweighs the privacy and civil liberties risks, data integrity and quality risks, security risk, and any other risks not detailed above, that cannot reasonably be mitigated.”

The policy framework was developed “in recognition of the fact that a series of developments have made CAI increasingly important to our work, while at the same time raising novel issues related to privacy and civil liberties,” according to an ODNI statement.

“Today, not only is an astounding amount of CAI already available to the public, but various actors, including adversaries, also have access to increasingly advanced analytic tools that rely on, among other things, artificial intelligence, to exploit such information in new ways that exacerbate existing threats,” the statement says.

“Put simply, the combination of an increasing amount of readily available data regarding the activities of individuals—often perceived as not especially sensitive on its own—and increasingly sophisticated analytic tools can in the aggregate raise significant privacy and civil liberty concerns,” it adds.

The policy is designed to be layered on top of existing rules, including guidelines issued by the Department of Justice, and “establishes a common baseline for how IC elements access, collect, and process Sensitive CAI, while allowing individual IC elements flexibility to experiment in the manner best suited to both meet the element’s operational needs and protect privacy and civil liberties,” according to the ODNI.

The ODNI directed IC elements to implement the policy “as quickly as possible, and, in all cases, by August 2024.”

The IC’s acquisition of Americans’ information from data brokers has been criticized by privacy advocates as a way for intelligence agencies to bypass legal restrictions that would otherwise require the agencies to obtain the information through a subpoena or probable-cause warrant.

Sen. Ron Wyden (D., Ore.), who has been outspoken on the topic, today said the ODNI policy represented an important step on protecting Americans’ privacy, but he called for legislation to establish clear rules on government agencies’ use of data brokers.

“The framework’s absence of clear rules about what commercially available information can and cannot be purchased by the intelligence community reinforces the need for Congress to pass legislation protecting the rights of Americans,” Sen. Wyden said in an e-mailed statement.

“The DNI’s framework is nonetheless an important step forward in starting to bring the intelligence community under a set of principles and policies, and in documenting all the various programs so that they can be overseen,” he said.

“I intend to watchdog this process intently, to ensure that every element of the intelligence community implements the framework, that Congress is fully informed of all these programs, and that the executive branch finally delivers transparency about its acquisition of commercially available data,” he added.

MainStory: TopStory FederalLegislation DataPrivacy