Amid a broader effort to curb the electronic surveillance of citizens by U.S. law enforcement and intelligence agencies, a bipartisan group of lawmakers is aiming to shut the door on the government buying and searching through data on Americans obtained from commercial data brokers without court-approved warrants.
The effort is part of lawmakers’ pursuit of multiple paths to reauthorize expiring portions of a law known as the Foreign Intelligence Surveillance Act that allows the government to collect communications of non-Americans located outside the country without a warrant.
Since Americans often communicate with those outside the country, the data collection also ends up sweeping information on citizens and allows the FBI and other agencies to search such data without a warrant, which some lawmakers and civil rights groups say is a violation of the Constitution’s Fourth Amendment prohibitions against such searches.
Lawmakers are primarily focused on trying to stop the FBI and spy agencies from using Section 702 of the surveillance law to search Americans’ data without a warrant in the databases of electronic communications collected from around the globe by the National Security Agency.
But a bipartisan group is also aiming to shut down a back door not governed under any law: U.S. agencies buying vast quantities of data from commercial brokers that collect the information from mobile phones and apps as well as online searches, maps and other data from just about every American.
Privacy and civil liberties advocates say Congress must fix both loopholes to safeguard Americans’ rights.
“We think that’s absolutely critical,” said Noah Chauvin, a counsel in the Liberty and National Security program of the Brennan Center for Justice at New York University’s law school.
Even if Congress tightens warrant requirements under Section 702, “there are a number of authorities that the intelligence agencies can use to acquire the same or similar information,” Chauvin said in an interview. Agencies could turn to “purchases of data from commercial data brokers.”
The House this week will vote on measures to extend the surveillance law. One bill, backed by an overwhelming majority of Republicans and Democrats on the House Judiciary Committee, would extend surveillance authorities for four years while imposing tougher requirements for searches of electronic communications and prohibit the warrantless purchase of Americans’ data from brokers.
The measure “requires all intelligence agencies and the FBI to obtain a warrant from the Foreign Intelligence Surveillance Court before conducting any query of a U.S. person,” Rep. Andy Biggs, R-Ariz., the bill’s sponsor, said last week. “It would also drastically reduce the number of FBI officials authorized to conduct such queries.”
The measure also “closes the data broker loophole to ensure the government cannot make an end run around the Fourth Amendment to purchase the data of Americans,” he said.
The bill includes elements of a more expansive surveillance bill sponsored by Rep. Warren Davidson, R-Ohio, and co-sponsored by Rep. Zoe Lofgren, D-Calif., as well as 12 other Democrats and five Republicans. The Senate companion, sponsored by Sens. Ron Wyden, D-Ore., is also a bipartisan measure.
However, a bipartisan measure approved by the House Intelligence Committee, also heading to the House floor, would extend the authority for eight years but would not prohibit purchase of data from brokers and would impose lighter restrictions on searches of Americans’ data.
In a Dec. 7 letter to House members, Speaker Mike Johnson said Senate Majority Leader Charles E. Schumer and Minority Leader Mitch McConnell had committed to working on whichever measure emerges from the House.
Separately, there’s a third path, as lawmakers included a provision in the conference report of the 2024 defense policy bill that would extend the current spy authority until April without any new conditions, allowing more time for debate.
In the run-up to the debate on surveillance authorities, FBI Director Christopher Wray testified in Congress that placing strict warrant requirements on database searches or cutting off access to commercial data on Americans would risk “blinding ourselves” when it comes to counterterrorism efforts.
Promoting the House Intelligence Committee’s version of the surveillance law, Rep. Michael R. Turner, R-Ohio, chairman of the House Intelligence Committee, has said tougher rules on surveillance and stopping access to commercial data means that “horrific crimes such as child pornography, human trafficking, murder, and even money laundering” could go unpunished.
Intelligence agencies and lawmakers who support the agencies often raise the specter of a boogeyman to get what they want, said India McKinney, director of federal affairs at the Electronic Frontier Foundation, a nonprofit group promoting digital privacy.
“We hear this so often from them, that for me, it starts to stop feeling real and stops feeling like a real threat,” McKinney said in an interview.
Without Congress extending the Section 702 authorities, the provision would expire at the end of the year, meaning the FBI and the spy agencies would not be able to start collecting new data and would only have access until April to data already collected.
Congress in 2008 added Section 702 to the Foreign Intelligence Surveillance Act of 1978 to enable U.S. intelligence agencies to track the online communications of non-U.S. persons living outside the country without having to demonstrate probable cause and obtain court warrants. It also explicitly directed the FBI and spy agencies to minimize retention and use of Americans’ information that could end up in the dragnet.
But despite such safeguards, and under pressure from Congress, the Office of the Director of National Intelligence published reports in the past three years showing that the spy agencies and the FBI have searched through databases on hundreds of thousands of Americans.
A recently declassified order from the Foreign Intelligence Surveillance Court, which reviews applications for electronic surveillance, showed that an FBI analyst in June 2022 queried a database with the last names of a U.S. senator and a state senator because the analyst believed that the lawmakers were being targeted by foreign spy agencies. The Justice Department’s National Security Division found that such searches were not authorized under law.
The Electronic Frontier Foundation, in a report published last year, found that several government agencies — including the FBI, the Drug Enforcement Administration, Immigration and Customs Enforcement, Customs and Border Protection, U.S. Secret Service, Iowa Air National Guard and U.S. Special Operations Command — bought data from brokers.
In 2021 the Defense Intelligence Agency, an arm of the Pentagon, told Wyden, who serves on the Senate Intelligence Committee, that the agency provided “funding to another agency that purchases commercially available” data aggregated from smartphones.
In the absence of a federal data privacy law and despite multiple state privacy regulations, data brokerage is a multibillion-dollar industry that collects and sells extensive personal data on Americans, including physical and mental health information on the elderly, veterans and kids.
In addition to tightening requirements for U.S. agencies obtaining this data, Congress must pass a federal data privacy bill that imposes restrictions on mobile carriers, app developers, online search engines and other tech companies from collecting data on Americans that are not directly relevant to the services provided by companies, said Cody Venzke, senior policy counsel at the American Civil Liberties Union.
“And no privacy legislation is going to meaningfully address the sort of harms that we’re seeing regarding government surveillance, foreign surveillance, predatory advertising, unless it has that data minimization principle,” Venzke said in an interview.
Ryan Tarinelli contributed to this report.