Security news that informs and inspires

New Bill Would Bar Federal Agencies From Buying Data


The Fourth Amendment Is Not For Sale Act targets loopholes in the law that permit data brokers to sell American’s private data to government agencies without a court order.

A newly-proposed bill would crack down on federal agencies using “legal loopholes” to collect massive amounts of information on Americans without a court order.

The bill, which was first discussed in August but wasn’t formally proposed until Wednesday, is called The Fourth Amendment Is Not For Sale Act and was introduced by Sen. Ron Wyden (D-Ore.), along with 19 other senators as part of a bipartisan effort. It targets loopholes in the law that allow the government to purchase Americans' private information from data brokers without getting the warrant typically required by the Fourth Amendment.

“The Fourth Amendment Is Not For Sale Act closes major loopholes in federal privacy law and ensures that the Electronic Communications Privacy Act, which regulates law enforcement access to Americans’ information, and the Foreign Intelligence Surveillance Act, which regulates the intelligence agencies, are the exclusive means by which the government can surveil Americans,” according to Wyden.

Wyden said, laws exist that block government agencies from accessing data from companies like AT&T and Verizon without a warrant. For instance, The Stored Communications Act bars companies that provide phone, messaging, data storage or data processing services from voluntarily disclosing customer information to the government. However, government agencies and law enforcement can skirt these regulatory efforts by turning to third-party firms, particularly in the marketing industry, which access and sell data without a direct relationship to customers.

“While it would be unlawful for app developers to sell data directly to the government, a legal loophole permits app developers to sell data to a data broker, which can then sell that data to the government,” according to Wyden. “According to media reports, other data brokers have tracked people at places of worship and at protests.”

The relationship between federal agencies and data brokers has in recent years been under a growing spotlight. For instance, in June reports broke out that the Internal Revenue Service (IRS) had purchased a commercial database from a Virginia-based government contractor called Venntel Inc., in order to attempt to track potential criminal suspects. The database contained location data collected from millions of Americans’ smartphones.

Recently, the U.S. government's involvement with Clearview AI, which provides facial recognition software based on a database of billions of photos that have been compiled from various social media websites, has also raised privacy concerns. This week, 70 advocacy groups, including the American Civil Liberties Union (ACLU), called on the Department of Homeland Security (DHS) to clarify its relationship with Clearview AI. Media reports have previously pointed to the DHS, Immigrations and Customs Enforcement (ICE) and Customs and Border Patrol (CBP) paying for access to Clearview AI software.

The new bill would crack down on this type of behavior by requiring the government to get a court order in order to compel data brokers to disclose data. This would be the same kind of court order needed to force tech or phone companies to disclose data, according to Wyden. In addition, the bill would bar law enforcement and intelligence agencies from buying data about people in the U.S. abroad, if the data was obtained from a user’s account or device, or via “deception, hacking, violations of a contract, privacy policy, or terms of service.”

The bill also closes holes that could permit the intelligence community to buy metadata about Americans’ international calls, texts and emails to family and friends abroad, and obtain records about their web browsing of foreign websites. And, it would take away the Attorney General’s authority to grant civil immunity to providers and other third-party companies for assistance with surveillance that’s not required or permitted by statute. Providers can instead retain immunity for surveillance assistance ordered by a court.

The Fourth Amendment Is Not For Sale Act joins a slew of other regulatory efforts that hone in on citizens’ private data. Another recently-proposed draft bill, for instance, aims to curb the export of U.S. citizens’ personal data to “potentially hostile foreign nations.”

This more recently proposed bill is “tailored to the data broker loophole," said Sean Vitka, senior policy counsel for Demand Progress.

“The government is buying troves of info from data brokers, which is a wild abuse of power and a circumvention of the Constitution,” said Vitka. “The issue here is that the purchase of data has become an exploding concern. You have data brokers, these shadowy sets of companies, which have been secretly or opaquely compiling not just information about people, but complete profiles of people.”