Confirmed: The FBI’s Purchase of Americans Data

​Realtors will tell you that the price of a home is all about location, location, location. But in surveillance policy, location is not the only thing that matters.
 
In a recent Senate hearing, Sen. Ron Wyden (D-OR) asked FBI Director Christopher Wray about reports the Bureau was purchasing Americans’ location data. Wray replied that the FBI does not “purchase communications database information that includes location data derived from internet advertisement.”
 
The FBI, Director Wray explained, did purchase such information at some unspecified time in the past, but that was part of a since-discontinued pilot program. A few days later, Department of Justice Inspector General Michael Horowitz testified on the Hill that warrantlessly purchasing location data, in the wake of the 2018 Supreme Court Carpenter opinion, should be considered off-limits.
 
So far, so good.
 
But what about the questions not asked? Our devices generate a lot more information about us than just our location and movements. Data reveal our networks of friends and associates, political beliefs, religious beliefs and worship, sexual lives and preferences, and other deeply sensitive information – the sort of “data” that snoops once had to pick the lock of a diary to learn.
 
The first of these other questions we’d love to ask Director Wray: Is the Bureau still purchasing other sensitive data on Americans? This question comes to mind after Vice’s Motherboard tech blog revealed a contract showing that in 2017 the FBI paid more than $76,000 through a middleman to purchase “netflow” data from a data broker, Team Cymru, which obtained it from internet service providers.
 
This purchase for “netflow” data can include which server communicated with another, giving the FBI the ability to track internet traffic through virtual private networks. It can include websites visited and cookies, digital details that can collectively form a portrait of a user.
 
This purchase was made for the FBI’s Cyber Crime division in 2017. Some more questions for Director Wray:

• Many general counsels of federal law enforcement and intelligence agencies, including the FBI, uphold the legality of purchasing Americans’ personal data from third-party data brokers. Did the FBI buy non-location data on Americans from third-party vendors?

 

• If the answer to the previous question is “yes,” is the FBI still purchasing non-location data of Americans?

 

• Did the data supplied by the contract in the Vice story, and similar contracts, go solely to the FBI’s Cyber Crime unit or was it shared with other parts of the FBI?

 

• Have American citizens been convicted for non-cybercrimes on the basis of such surreptitiously obtained information?

 
It was recently revealed that the FBI made 204,090 U.S. person queries from NSA databases – equivalent to a warrantless search of every citizen of Richmond, Virginia. Director Wray should face these questions in his next hearing. A fuller explanation of what kinds of warrantless data the FBI extracts and uses is, after all, minimal for Congressional oversight.