The National Security Agency has been buying Americans\u2019 web browsing data from commercial data brokers without warrants, intelligence officials disclosed in documents made public by a US senator Thursday.<\/p>\n\n\n\n
The purchases include information about the websites Americans visit and the apps that they use, said Oregon Democratic Sen. Ron Wyden, releasing newly unclassified letters<\/a> he received from the Pentagon in recent weeks confirming the sales.<\/p>\n\n\n\n The disclosures are the latest evidence that government agencies routinely buy sensitive information about Americans from commercial marketplaces that they would otherwise be required to obtain via court order.<\/p>\n\n\n\n And it comes amid rising concerns that foreign governments are doing the same; CNN reported earlier this week that the Biden administration is preparing an executive order <\/a>meant to curb foreign purchases of US citizens\u2019 personal data.<\/p>\n\n\n\n Wyden\u2019s disclosure was earlier reported by The New York Times<\/a>.<\/p>\n\n\n\n The NSA\u2019s purchases include \u201cinformation associated with electronic devices being used outside\u2014and, in certain cases, inside\u2014the United States,\u201d wrote Paul Nakasone, the NSA\u2019s director, in a letter to Wyden dated Dec. 11.<\/p>\n\n\n\n The purchases involve what Nakasone described as netflow data, or the technical information generated by devices as they use the internet.<\/p>\n\n\n\n While the data purchased from data brokers does not involve the content of Americans\u2019 communications, Nakasone wrote, the data is \u201crelated to wholly domestic internet communications and internet communications where one side of the communication\u201d is located inside the United States and the other side is located abroad.<\/p>\n\n\n\n Nakasone added that the NSA does not purchase cellphone location data of Americans or location data generated by automotive infotainment systems in the United States.<\/p>\n\n\n\n In a statement to CNN, the NSA affirmed that it buys the data from private vendors.<\/p>\n\n\n\n \u201cNSA purchases commercially available Netflow data for its cybersecurity mission, to include but not limited to inform the Agency\u2019s collection, analysis, and dissemination of cyber threat intelligence,\u201d an NSA official said. \u201cAt all stages, NSA takes steps to minimize the collection of U.S. person information, to include application of technical filters.\u201d<\/p>\n\n\n\n The NSA uses the commercially purchased data to support its cybersecurity and foreign intelligence missions, according to Nakasone\u2019s letter and the NSA official. The NSA\u2019s mission includes defending US military networks from foreign hacking.<\/p>\n\n\n\n In response to Wyden\u2019s further questions, a top Defense Department intelligence official, Ronald Moultrie, wrote that agencies that purchase the data are responsible for complying \u201cwith existing law, regulation and policy, including the Fourth Amendment.\u201d<\/p>\n\n\n\n And Allison Nixon, chief research officer at cybersecurity firm Unit 221B, said there were plenty of legitimate uses for netflow data that can help protect organizations against cyberattacks and do not involve spying on people.<\/p>\n\n\n\n \u201cNetflow is useful for tracking malware and [distributed denial of service] attacks,\u201d Nixon told CNN. \u201cIt\u2019s not useful for finding who\u2019s having abortions and calling the suicide hotline.\u201d<\/p>\n\n\n\n \u201cNetflow is one of the reasons your antivirus can catch malware, and it\u2019s one of the reasons your bank can detect credit card fraud before you do,\u201d Nixon said.<\/p>\n\n\n\n Wyden, one of Congress\u2019 most vocal privacy advocates, said he spent nearly three years pushing to be able to disclose the NSA practice and only succeeded when he placed a hold on the nomination of Nakasone\u2019s successor for NSA director, Lt. Gen. Timothy Haugh. In a similar disclosure in 2021, Wyden revealed <\/a>that the Defense Intelligence Agency had purchased commercially available smartphone location data without a warrant.<\/p>\n\n\n\n As part of Thursday\u2019s announcement, Wyden wrote a letter to the Biden administration urging it to stop the warrantless surveillance of Americans through the purchases of internet data.<\/p>\n\n\n\n \u201cThe U.S. government should not be funding and legitimizing a shady industry whose flagrant violations of Americans\u2019 privacy are not just unethical, but illegal,\u201d Wyden wrote to Avril Haines, the director of national intelligence.<\/p>\n\n\n\n \u201cAlthough the intelligence agencies\u2019 warrantless purchase of Americans\u2019 personal data is now a matter of public record, recent actions by the Federal Trade Commission (FTC), the primary federal privacy regulator, raise serious questions about the legality of this practice,\u201d Wyden added.<\/p>\n\n\n\n In a report that was declassified last year<\/a>, Haines\u2019 office acknowledged the risks posed by the easy availability of Americans\u2019 personal data and recommended that US spy agencies catalog and develop procedures for protecting data they acquire by commercial means.<\/p>\n\n\n\n Wyden\u2019s reference to the FTC reflects recent moves by privacy regulators to crack down on data brokers, including bans on the sale of certain personal information <\/a>by two companies, InMarket Media and Outlogic, formerly known as X-Mode.<\/p>\n\n\n\n