Top spy official releases principles on intel agency use of info bought from data brokers

But it falls short on a very key point, says a lawmaker who has been heavily scrutinizing spy agency purchase of commercial bulk data.

The U.S. spy chief on Wednesday published its policies for how intelligence agencies collect and use information from data brokers, but a prominent Hill critic says the guidance doesn’t address a key point about what kind of information it can or can’t obtain.

The “Policy Framework for Commercially Available Information,” or CAI, released by the Office of the Director of National Intelligence (ODNI), describes the fundamental way the intelligence community will approach such data, when something is sensitive enough to warrant additional protections and more. It follows a flurry of government activity designed to address how feds use information from companies that harvest personal information on people and then sell it.

“In keeping with my commitment to share as much as possible about the IC’s activities, we are sharing this framework which provides effective governance for the IC’s handling of CAI while also protecting Americans’ privacy and civil liberties,” Director of National Intelligence Avril Haines said in a statement.

Sen. Ron Wyden, D-Ore., who has been at the forefront of scrutinizing intelligence agency use of data brokers, offered both criticism and praise of the document.

“The framework’s absence of clear rules about what commercially available information can and cannot be purchased by the intelligence community reinforces the need for Congress to pass legislation protecting the rights of Americans,” Wyden said in a statement. “The DNI’s framework is nonetheless an important step forward in starting to bring the intelligence community under a set of principles and policies, and in documenting all the various programs so that they can be overseen.”

What it does address are definitions the intelligence community will employ and principles it will adhere to, such as saying that privacy and civil liberties “shall be integral considerations, timely considered” in the use of information purchased from data brokers. It states that it won’t be used to discriminate against anyone based on things like race or gender, that agencies will assess the original source of the data and its quality and that members of the intelligence community will periodically review implementation of privacy safeguards.

Additional scrutiny of using the data would come into play for “sensitive CAI,” such as “data that captures personal attributes, conditions, or identifiers that are traceable to one or more specific U.S. persons, either through the dataset itself or by correlating the dataset with other available information.”

In a statement accompanying the framework, the ODNI emphasized the need to obtain the data, citing the use of commercial imagery to share perspective with allies and warn of Russian plans to invade Ukraine.

“CAI is invaluable to our work,” the statement reads. “At the same time, we acknowledge that CAI raises new concerns, and we are committed to engaging in our work in a way that is protective of Americans’ privacy and civil liberties.”

Spokespeople for the chairmen of the House and Senate intelligence committees didn’t immediately respond to requests for comment on the framework.

Wyden said he’d be paying attention to how the intelligence community implements the guidance.

“I intend to watchdog this process intently, to ensure that every element of the intelligence community implements the framework, that Congress is fully informed of all these programs, and that the executive branch finally delivers transparency about its acquisition of commercially available data,” he said.

A privacy advocacy group shared Wyden’s mixed verdict on the framework.

“For too long, government agencies have tried to buy their way around our constitutional and statutory protections using taxpayer money. This new framework — if implemented effectively — is an improvement over agencies’ current exploitation of the data broker loophole,” said Chris Baumohl, a law fellow at the Electronic Privacy Information Center. “However, it is not a replacement for Congress passing legislation that would close this loophole once and for all.”

Will Owen, communications director for the Surveillance Technology Oversight Project, said it was “encouraging” to see ODNI “recognize the dangers” inherent in the data broker industry, but the policy framework “does not go far enough.”

“This policy offers a first step toward greater transparency and safeguards for the use of commercially available information, but we need to ban law enforcement from purchasing Americans’ data from data brokers to actually protect our privacy and civil liberties,” he said. “This rogue industry is not ‘invaluable,’ as the ODNI says. It is a corrosive force against Americans’ civil liberties that must be dismantled.”

This story was updated May 8, 2024 with comments from Will Owen.

House intel bill includes provisions on state and local threat intelligence, election security, AI

The House Intelligence Committee advanced its fiscal 2027 authorization legislation Monday.

Dems press DNI nominee Jay Clayton on election security questions, but leave dismayed

ATF cancels controversial commercial geolocation contract

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems