By Albert Fox Cahn and Justin Sherman
Congress may soon tell us what price the Pentagon puts on our constitutional rights—that is, how much it pays to circumvent the Fourth Amendment and buy information on Americans.
Just a few weeks ago, the House made this a possibility when it added a requirement to the 2022 military budget that the Defense Department disclose any purchases of commercially available data on citizens’ smartphones and web browsing.
While it sounds far-fetched, this happens more than you might think.
The FBI, Department of Homeland Security, Immigration and Customs Enforcement, and other law enforcement agencies routinely buy information on Americans—ranging from internet activity to GPS locations—without needing a warrant or having to disclose that behavior.
In June 2020, for example, the company MobileWalla secretly surveilled people at Black Lives Matter protests and used their phone location data to identify specific things about them. It’s all enabled by the data brokerage industry, where companies collect, buy, and sell data on people with virtually no regulation—and where the Fourth Amendment does not apply.
This kind of unregulated surveillance means it’s time for Congress to go broader. Many agencies and organizations (beyond just the Defense Department) buy Americans’ data without their knowledge, without disclosures, and without any kind of warrant or meaningful oversight. It’s time the public better understood what was happening, and regulators put an end to this practice.
Data brokerage is a multi-billion-dollar industry (indeed, some of the largest players like Acxiom and Oracle rake in millions and billions a year alone), yet most people have never heard of these companies in their life. These private entities can legally collect, infer, analyze, sell, license, and share your age and race, gender, and sexual orientation, political preferences and beliefs, whereabouts and GPS locations—and even health information concerning Alzheimer’s, pregnancy, HIV/AIDS, as well as other extremely sensitive data points.
A frequent data broker defense goes, “well, it’s not illegal.” And because U.S. privacy law is weak, that is unfortunately true.
Law enforcement organizations have spent millions of dollars to access commercially available information on Americans, leveraging data brokers’ opportunism and exploiting loopholes in constitutional and privacy law.
Immigration and Customs Enforcement (ICE), local police, and others have bought data to literally track people’s locations without warrants, without robust oversight, and without those people ever knowing it. Other actors buy this data, too, including health insurance companies profiling individuals, criminal scammers deceiving elderly people, and abusive individuals hunting down survivors of domestic and intimate partner violence.
Policymakers have paid less attention to data brokers and many other data-collectors, at least in recent years, choosing instead to focus on the companies that gather our information directly—especially tech giants like Google, Facebook, Amazon, Twitter, and TikTok. Yet, the dangers of putting the Constitution up for sale keep growing, and the industry remains incredibly opaque to regulators and the public.
Congress needs to copy the transparency requirements it added to the military budget and apply them to the entirety of the federal government—disclosing how federal agencies buy data on Americans without warrants, what kind of data that is, and what the government has done with it.
In tandem, members of Congress need to support the “Fourth Amendment Is Not For Sale Act,” a bipartisan bill supported by 20 senators, that would close the loophole that law enforcement and intelligence agencies use to buy data on Americans and surveil them without constraints.
But the need for action extends far beyond the Beltway. Public information isn’t just up for the highest federal bidder—it’s being purchased by state and local police as well. But states don’t need to wait on Congress to take the first step. Already, New York has one pending bill that would dramatically restrict police power to purchase information. At a minimum, states must tell the public when public agencies are using our tax dollars to purchase our data.
The Biden administration can act, too.
Currently, state and local police departments get billions in federal funds with few strings attached. But the Department of Justice can require local agencies to disclose whenever they’re using public funds to purchase private data. Similarly, the White House could mandate that all federal agencies report to the public when this strategy is used as part of any investigation—or tell them to cease doing so entirely.
The sad truth is that none of this should be necessary. The only reason why legislatures and the executive branch need to act now is because the courts have failed to keep pace with changes in the past.
Technological advances have dramatically changed how and how much of our data is retained. These changes have allowed huge companies to retain a perpetual log of our every movement. And under our Constitution, the courts have held that it’s all up for grabs.
The Fourth Amendment puts numerous restrictions on how and when the government can force companies to provide data, but none on how they can choose to sell it. This analog logic makes no sense in the digital age, giving us protections from searches that ignore how modern surveillance is conducted.
That status quo is simply not sustainable. A country where the police can purchase intimate information about anyone, at any time, is not compatible with a democracy.
Congress should move forward with new disclosure requirements, but if its members fail to act, the Biden administration must. Lawmakers across the country must move forward with measures to protect our data from this sort of abuse as well.
In time, the courts can catch up and breathe new life into the constitutional provisions that once protected our privacy. But until that day comes, every other branch of government must act.