A declassified report from the Office of the Director of National Intelligence (ODNI) reveals the extent to which U.S. intelligence agencies routinely purchase vast amounts of “commercially available information” (CAI) - including sensitive data on American citizens - from private companies.
The document, prepared by outside advisors for ODNI and marked SECRET//FOUO, warns that this data acquisition poses significant risks to privacy, civil liberties, and democratic oversight.
“Today’s CAI is more revealing, available on more people, less possible to avoid, and less well understood than traditional public information,” the report states. “Asserting that modern CAI is materially indistinguishable from traditional PAI is like saying a ride on horseback is indistinguishable from a flight to the moon.”
🕵️♂️ What Is CAI?
CAI includes digital data bought or licensed by the U.S. government - often from brokers like LexisNexis, CoreLogic, and Thomson Reuters. It may include:
-
Location tracking from smartphones
-
Online purchases and browsing history
-
Social media activity
-
Voting registration and criminal records
-
Biometric, health, and financial information
This type of data is available to private companies - and foreign governments - but the ODNI report argues the scale and sensitivity of this information has outpaced existing oversight mechanisms.
🔓 The Legal Loophole
Because CAI is deemed “publicly available,” U.S. intelligence agencies are not required to obtain a warrant or apply traditional Fourth Amendment protections when accessing it. The report highlights this glaring contradiction:
Law enforcement requires a warrant for persistent location data under Carpenter v. United States.
Intelligence agencies can buy the same data - covering millions of Americans - from commercial vendors without a warrant.
This loophole allows U.S. intelligence to effectively circumvent constitutional protections by outsourcing surveillance to the private sector.
💼 Who’s Buying?
According to the report, at least 18 U.S. intelligence agencies are acquiring CAI - including the CIA, NSA, DIA, and DHS. Some contract examples listed include:
-
The FBI purchasing social media monitoring tools from ZeroFox
-
The DIA obtaining smartphone location metadata through commercial channels
-
DHS analysts using tools like CLEAR and Web of Science to identify foreign affiliations
“CAI can reveal sensitive and intimate information about personal attributes, private behavior, social connections, and speech,” the report notes. “It can be misused to pry into private lives, ruin reputations, and cause emotional distress.”
⚠️ The Risks
The report raises serious warnings:
-
Deanonymization: Even “anonymized” data can often be re-identified using other datasets.
-
Civil Liberties: CAI can expose individuals’ political beliefs, protest attendance, religious practices, and private communications.
-
Mission Creep: Data collected for one purpose could easily be used for others.
-
No Escape: Americans often cannot opt out of this surveillance - and rarely know it’s happening.
“The government would never have been permitted to compel billions of people to carry tracking devices… Yet smartphones and the internet have had this effect without government participation.”
🛑 Recommendations
The ODNI report makes three key recommendations:
-
Create a system-wide inventory of all CAI being acquired and used by U.S. intelligence.
-
Develop new standards for the acquisition and ongoing use of CAI, including vendor vetting and data sensitivity reviews.
-
Introduce guidance to protect sensitive CAI, especially that which can identify U.S. persons.
Despite its critical tone, the report does not prohibit CAI use - but urges smarter, more transparent, and privacy-aware policies.
🔮 Why It Matters
This report, though buried in bureaucratic language, exposes a quiet transformation of U.S. surveillance - from wiretaps to wallet purchases, from intercepts to ad trackers.
The fact that this information is for sale doesn’t make it any less invasive. And the fact that foreign powers can also access it doesn’t make it any less of a threat to American civil liberties.
The public deserves to know: The U.S. government is not just watching - it’s buying.