NSA Purchases Internet Metadata To Spy on You Without a Warrant

A new letter from Sen. Ron Wyden (D–Ore.) reveals that the agency admitted the practice nearly three years ago but would not allow him to reveal it.

The National Security Agency (NSA) is the latest intelligence agency spying on Americans without a warrant by buying access to their data.

That revelation comes from a letter released last week from Sen. Ron Wyden (D–Ore.) to Director of National Intelligence Avril Haines. "As you know," Wyden wrote, "U.S. intelligence agencies are purchasing personal data about Americans that would require a court order if the government demanded it from communications companies."

Now, Wyden writes, the snoop in question is the NSA, which is "buying Americans' domestic internet metadata." Such information "can reveal which websites they visit and what apps they use," according to a press release from Wyden's office.

Wyden is right that Haines is likely already aware of the practice: A report from the Office of the Director of National Intelligence (ODNI) completed in January 2022 (but only declassified in June 2023) found that the intelligence community "currently acquires a significant amount of [commercially available information] for mission-related purposes," information which "can include credit histories, insurance claims, criminal records, employment histories, incomes, ethnicities, purchase histories, and interests" and "in some cases social media data."

Data brokers collect and package this data for sale. Often this information is purchased by other companies for purposes like advertising, but increasingly, government agencies are purchasing the information for their own purposes: During the COVID-19 pandemic, the Centers for Disease Control and Prevention purchased cellphone location data in order to monitor compliance with lockdown orders; the IRS paid for similar data in an effort to track criminal suspects.

"Until recently, the data broker industry and the intelligence community's (IC) purchase of data from these shady companies has existed in a legal gray area, which was in large part due to the secrecy surrounding the practice," Wyden wrote. "The secrecy around data purchases was amplified because intelligence agencies have sought to keep the American people in the dark."

Wyden says he actually learned the NSA was buying Americans' internet metadata in March 2021, but the agency "refused…to clear the unclassified information for public release" for nearly three years. "It was only after I placed a hold on the nominee to be the NSA director that this information was cleared for release." Wyden includes letters from NSA officials written in December 2023, agreeing to allow the information to be released.

In Carpenter v. United States in 2018, the Supreme Court ruled that it was a violation of the Fourth Amendment for law enforcement to access cellphone location data without a warrant. The 2022 ODNI report noted that under Carpenter, "acquisition of persistent location information (and perhaps other detailed information) concerning one person by law enforcement from communications providers is a Fourth Amendment 'search' that generally requires probable cause." But since "the same type of information on millions of Americans is openly for sale to the general public," intelligence agencies "treat the information as" publicly available and "can purchase it."

Similarly, Under Secretary of Defense for Intelligence and Security Ronald Moultrie advised Wyden that "I am not aware of any requirement in U.S. law or judicial opinion," including Carpenter, that intelligence agencies "obtain a court order in order to acquire, access, or use information, such as [commercially available information], that is equally available for purchase to foreign adversaries, U.S. companies, and private persons as it is to the U.S. Government."

That explanation is cold comfort when, as Wyden's press release noted, spy agencies can "us[e] their credit card to circumvent the Fourth Amendment." The intelligence community previously seemed to understand this, with the 2022 ODNI report noting that while it "cannot willingly blind itself to this information, it must appreciate how unfettered access to [commercially available information] increases its power in ways that may exceed our constitutional traditions or other societal expectations." The collection of such data could also "raise the risk of mission creep," as information "collected for one purpose may be reused for other purposes."