Surprise, surprise, the US government is buying personal information, including location data, from commercial data brokers — and it may be worse than we knew, according to a report from the US Office of the Director of National Intelligence (ODNI), an office headed by director Avril Haines, a US cabinet official who oversees the US intelligence community, which includes a host of military intelligence agencies, as well as the FBI, CIA, NSA, and others.

The report, covered by The Wall Street Journal, concludes government agencies have been buying huge amounts of “commercially available information” (or CAI) from the open market. It admits the information resembles something only dedicated government surveillance would once have produced, calling it “of a type and level of sensitivity that historically could have been obtained, if at all, only through targeted (and predicated) collection.” It also sounds as though it’s hard to actually know what any given agency is doing with any of the data.

The report was requested by Oregon Senator Ron Wyden, who once warned that the US could become an “irreversible surveillance state” if personal digital data collection continued to grow. It was prepared by ODNI in January 2022 and only declassified last week.

The ODNI paints a picture of a government indiscriminately sucking up data. In a series of recommendations, it urges the US intelligence community (IC) to catalog how it’s using the data — something it calls a “complex undertaking” that will require carefully reviewing things like procurement contracts. “The IC cannot understand and improve how it deals with CAI unless and until it knows what it is doing with CAI,” it says.

Worryingly (and perhaps unsurprisingly), despite companies’ assurances that the data they collect can’t be tied to you, the ODNI acknowledges that it’s “often possible” to deanonymize people by cross-referencing the data. The issue “raises significant issues related to privacy and civil liberties,” says the report, citing that as the reason the community needs to be careful with the data.

Where does all this data come from? Basically everywhere:

CAI Increases the Power of the Government. The government would never have been permitted to compel billions of people to carry location tracking devices on their persons at all times, to log and track most of their social interactions, or to keep flawless records of all their reading habits. Yet smartphones, connected cars, web tracking technologies, the Internet of Things, and other innovations have had this effect without government participation. While the IC cannot willingly blind itself to this information, it must appreciate how unfettered access to CAI increases its power in ways that may exceed our constitutional traditions or other societal expectations.

But contrasting those issues, the ODNI doesn’t recommend ceasing the use of CAI, writing, “CAI clearly provides intelligence value… whether reviewed by humans and/or by machines.” While it doesn’t say if machine processing is being used for simple searches and filtering or advanced artificial intelligence systems like facial recognition, the government has been using AI for surveillance purposes for some time.

As the report points out, commercially available information falls under the same legal category as publicly available data, despite being highly sensitive. That lets government entities do an end run around normal legal protections afforded by legislation or court rulings that require a warrant and probable cause. In 2018, for instance, the Supreme Court ruled that smartphone location data is protected by the “illegal search and seizure” clause of the Fourth Amendment. But it doesn’t seem to matter when the data can be bought openly.

Wyden’s surveillance warning feels more prescient than ever in 2023. We’ve been covering government intelligence agencies’ interest in the personal data our devices generate for most of The Verge’s existence, and it shows data collection everywhere: in your weather apps, your mental health apps, and even your TV. Google’s ad sales business is built on it, and social media relies on access to it to make money.

In a 2020 interview with The Verge, Wyden discussed how data collection — and the government’s interest in buying that data — has become a problem, telling Nilay Patel and Adi Robertson, “I think what you’ve read about and heard about is just the tip of the iceberg.”

Wyden has introduced multiple pieces of legislation, some going back before that 2013 warning, such as his Geolocation Privacy and Surveillance or GPS Act, which would have barred law enforcement from collecting smartphone GPS information without a warrant (this was, of course, before the Supreme Court ruling along those lines).

Since this report, Wyden has put his name on privacy legislation to address the practices mentioned in the report. For instance, the UPHOLD Privacy Act, introduced in March this year, would bar collection of personally identifiable health data for targeted advertising, as well as the sale of precision location data to data brokers.