Personal information about active-duty U.S. service members is cheap, easy to buy and widely advertised by data brokers who sell Americans’ data, according to a Duke University study published Monday.
The researchers behind the study said they purchased a variety of data including names, phone numbers, addresses and sometimes even information like the names of service members’ children, their marital status, net worth and credit rating, often for as little as 12 cents per person. In total, the researchers bought nearly 50,000 service members’ records for a little over $10,000.
The research has prompted fears that a lack of major regulation in the data brokerage sector may constitute a national security risk. Senators who received an advance look at the Duke study said in emailed statements that it highlighted the need for action.
“This report further solidifies the need to address this gaping hole in the protection of U.S. servicemembers,” said Sen. Bill Cassidy, R-La. “We must act in the interest of national security and protect those who defend our nation.”
Sen. Ron Wyden, D-Ore., called the findings “a sobering wake-up call for policy makers that the data broker industry is out of control and poses a serious threat to U.S. national security.”
The study found more than 500 data broker websites that advertised information on service members, though some refused to sell that information when they realized the buyers were academic researchers. Others required a nondisclosure agreement. The Duke researchers ultimately purchased thousands of records from three brokers, which they did not name.
Justin Sherman, a fellow at Duke’s Sanford School of Public Policy, which conducted the study, said the findings highlight a side of privacy regulation that’s less often discussed.
“We have this interesting policy gap, which is our privacy conversations are primarily about consumer privacy,” Sherman said. “And that’s really important, but they don’t think much about national security.”
Some brokers offered records specific to certain areas, which could help a purchaser determine where an active-duty military service member is stationed.
The availability of service members’ data is considered a national security concern because it can be used by foreign spies to identify and court Americans with access to state secrets.
“Information on people that you don’t want being approached by foreign intelligence services being reasonably easy to acquire is not a good situation,” Jeff Asher, a former CIA officer, told NBC News.
A panel commissioned by the Office of the Director of National Intelligence released a report this July that found U.S. intelligence agencies routinely purchase such “commercially available information” on Americans with little issue or oversight.
“There is also a growing recognition that CAI, as a generally available resource, offers intelligence benefits to our adversaries,” the panel found.
A Pentagon spokesperson didn’t respond to a request for comment.
Some countries, particularly in the European Union, have strict regulations to guide industry practices of collecting, packaging, buying and selling personal information. U.S. law has put some limitations on medical data and information on young children, but Congress has failed to agree on a general data privacy bill.
“And not to sound like a broken record, but our country desperately needs a comprehensive consumer privacy law here, to limit the collection, retention and sale of sensitive personal information from the start,” Wyden said.
