U.S. Spy Agencies Are Getting a One-Stop Shop to Buy Your Most Sensitive Personal Data

The Intercept

22-05-2025

The ever-growing market for personal data has been a boon for American spy agencies. The U.S. intelligence community is now buying up vast volumes of sensitive information that would have previously required a court order, essentially bypassing the Fourth Amendment. But the surveillance state has encountered a problem: There's simply too much data on sale from too many corporations and brokers.
So the government has a plan for a one-stop shop.
The Office of the Director of National Intelligence is working on a system to centralize and 'streamline' the use of commercially available information, or CAI, like location data derived from mobile ads, by American spy agencies, according to contract documents reviewed by The Intercept. The data portal will include information deemed by the ODNI as highly sensitive, that which can be 'misused to cause substantial harm, embarrassment, and inconvenience to U.S. persons.' The documents state spy agencies will use the web portal not just to search through reams of private data, but also run them through artificial intelligence tools for further analysis.
Rather than each agency purchasing CAI individually, as has been the case until now, the 'Intelligence Community Data Consortium' will provide a single convenient web-based storefront for searching and accessing this data, along with a 'data marketplace' for purchasing 'the best data at the best price,' faster than ever before, according to the documents. It will be designed for the 18 different federal agencies and offices that make up the U.S. intelligence community, including the National Security Agency, CIA, FBI Intelligence Branch, and Homeland Security's Office of Intelligence and Analysis — though one document suggests the portal will also be used by agencies not directly related to intelligence or defense.
'In practice, the Data Consortium would provide a one-stop shop for agencies to cheaply purchase access to vast amounts of Americans' sensitive information from commercial entities, sidestepping constitutional and statutory privacy protections,' said Emile Ayoub, a lawyer with the Brennan Center's liberty and national security program.
'ODNI is working to streamline a number of inefficient processes, including duplicative contracts to access existing data, and ensuring Americans civil liberties and Fourth Amendment rights are upheld,' ODNI spokesperson Olivia Coleman said in a statement to The Intercept. Coleman did not answer when asked if the new platform would sell access to data on U.S. citizens, or how it would make use of artificial intelligence.
Spy agencies and military intelligence offices have for years freely purchased sensitive personal information rather than obtain it by dint of a judge's sign-off. Thanks largely to unscrupulous advertisers and app-makers working in a regulatory vacuum, it's trivial to procure extremely sensitive information about virtually anyone with an online presence. Smartphones in particular leave behind immense plumes of data, including detailed records of your movement that can be bought and sold by anyone with an interest. The ODNI has previously defined 'sensitive' CAI as information 'not widely known about an individual that could be used to cause harm to the person's reputation, emotional well-being, or physical safety.' Procurement documents reviewed by The Intercept make clear the project is designed to provide access to this highest 'sensitive' tier of CAI.
The documents provide a glimpse at some of the many types of CAI available, including 'information addressing economic security, supply chain, critical infrastructure protection, great power competition, agricultural data, industrial data, sentiment analysis, and video analytic services.'
While the proliferation of data that can reveal intimate details about virtually anyone has alarmed civil libertarians, privacy advocates, and certain members of Congress, the intelligence community sees another problem: There's too much data to keep organized, and the disorganized process of buying it is wasting money. To address this overabundance, the ODNI is seeking private sector vendors to build and manage a new 'commercial data consortium that unifies commercial data acquisition then enables IC users to access and interact with this commercial data in one place,' according to one procurement document obtained by The Intercept.
The ODNI says the platform, the 'Intelligence Community (IC) Data Consortium (ICDC),' will help correct the currently 'fragmented and decentralized' purchase of commercial data like smartphone location pings, real estate records, biometric data, and social media content. The document laments how often various spy agencies are buying the same data without realizing it. The ODNI says this new platform, which will live at www.icdata.gov, will 'help streamline access to CAI for the entire IC and make it available to mission users in a more cohesive, efficient, and cost-effective manner by avoiding duplicative purchases, preventing sunk costs from unused licenses, and reducing overall data storage and compute costs,' while also incorporating 'civil liberties and privacy best practices.'
'The IC is still adhering to the 'just grab all of it, we'll find something to do with it' mentality.'
While the project's nod to civil liberties might come as some relief to privacy advocates, the project also represents the extent to which the use of this inherently controversial form of surveillance is here to stay. 'Clearly the IC is still adhering to the 'just grab all of it, we'll find something to do with it' mentality rather than being remotely thoughtful about only collecting data it needs or has a specific envisioned use for,' said Calli Schroeder, senior counsel at the Electronic Privacy Information Project.
Once the website is up and running, the procurement materials say the portal will eventually allow users to analyze the data using large language models, AI-based text tools prone to major factual errors and fabrications. The portal will also facilitate 'sentiment analysis,' an often pseudoscientific endeavor purporting to discern one's opinion about a given topic using implicit signals in their behavior, movement, or speech.
Such analysis is a 'huge cause for concern' according to Schroeder. 'It means the intelligence community is still, to at least some degree, buying into the false promise of a constantly and continuously debunked practice,' she said. 'Let me be clear: Sentiment analysis not only does not work, it cannot work. Its only consistent success has been in perpetuating harmful discrimination (of gender, culture, race, and neurodivergence, among others).'
Whether for sentiment analysis or some other goal, using CAI data sets to query an AI crystal ball poses serious risks, said Ayoub. If such analysis worked as billed, 'AI tools make it easier to extract, re-identify, and infer sensitive information about people's identities, locations, ideologies, and habits — amplifying risks to Americans' privacy and freedoms of speech and association,' he said. On top of that, 'These tools are a black box with little insight into training data, metric, or reliability of outcomes. The IC's use of these tools typically comes with high risk, questionable track records, and little accountability, especially now that AI policy safeguards were rescinded early in this administration.'
In 2023, the ODNI declassified a 37-page report detailing the vastly expanding use of such CAI data by the U.S. intelligence community, and the threat this poses to the millions of Americans whose lives are cataloged, packaged, and sold by a galaxy of unregulated data brokers. The report, drafted for then-director of national intelligence Avril Haines, included a dire warning to the public: 'Today, in a way that far fewer Americans seem to understand, and even fewer of them can avoid, CAI includes information on nearly everyone that is of a type and level of sensitivity that historically could have been obtained, if at all, only through targeted (and predicated) collection, and that could be used to cause harm to an individual's reputation, emotional well-being, or physical safety.'
The extent to which CAI has commodified spy powers previously attainable only by well-resourced governments cannot be overstated: In 2021, for instance, The Intercept reported the existence of Anomaly Six, a startup that buys geolocational data leaked from smartphones apps. During an Anomaly Six presentation, the company demonstrated its ability to track not only the Chinese navy through the phones of its sailors, but also follow CIA and NSA employees as they commuted to and from work.
The ICDC project reflects a fundamental dissonance within the intelligence community, which acknowledges that CAI is a major threat to the public while refusing to cease buying it. 'The government would never have been permitted to compel billions of people to carry location tracking devices on their persons at all times, to log and track most of their social interactions, or to keep flawless records of all their reading habits,' the ODNI wrote in its 2022 report. While conceding 'unfettered access to CAI increases its power in ways that may exceed our constitutional traditions or other societal expectations,' the report says, 'the IC cannot willingly blind itself to this information.'
In 2024, following the declassified report and the alarm it generated, the ODNI put forth a set of CAI usage rules purporting to establish guardrails against privacy violations and other abuses. The framework earned praise from some corners for requiring the intelligence community to assess the origin and sensitivity of CAI before using it, and for placing more rigorous requirements on agencies that wish to use the most intimate forms of private data. But critics were quick to point out that the ODNI's rules, which enshrined the intelligence community's 'flexibility to experiment' with CAI, amounted to more self-regulation from a part of the government with a poor track record of self-regulating.
While sensitive CAI comes with more rules — like keeping records of its use, protecting its storage, and some disclosure requirements — these guidelines offer great deal latitude to the intelligence community. The rule about creating a paper trail pertaining to sensitive CAI use, for example, is mandated only 'to the extent practicable and consistent with the need to protect intelligence sources and methods,' and can be ignored entirely in 'exigent circumstances.' In other words, it's not really a requirement at all.
Ayoub told The Intercept he worries the ICDC plan will only entrench this self-policing approach. The documents note that vendors would be tasked to some extent with determining whether the data they sell is indeed sensitive, and therefore subject to stricter privacy safeguards, rather than a third party. 'Relying on private vendors to determine whether CAI is considered sensitive may increase the risk that the IC purchases known categories of sensitive information without sufficient safeguards for privacy and civil liberties or the warrant, court order, or subpoena they would otherwise need to obtain,' he said.
The portal idea appears to have started under the Biden administration, when it was known as the 'Data Co-Op.' It now looks like it will go live during a Trump administration. Elon Musk's so-called Department of Government Efficiency is already working on building and streamlining access to other large repositories of perilously sensitive information. In March, the Washington Post reported that DOGE workers intent on breaking down 'information silos' across the federal government were trying to 'unify systems into one central hub aims to advance multiple Trump administration priorities, including finding and deporting undocumented immigrants.' The documents note that the portal will also be accessible to so-called 'non-Title 50' agencies outside of the national defense and intelligence apparatus.
Ayoub argued the intelligence community can't provide access to its upcoming CAI portal without 'raising the risk that agencies like DHS's Homeland Security Investigations (HSI) would access the CAI database to identify and target noncitizens such as student protestors based on their search or browsing histories and location information.'
While the ODNI has acknowledged the importance of transparency, usernames for the portal will not include the name of the analyst's agency, 'thus obscuring any specific participation from individual participants,' according to the project documents.
'The irony is not lost on me that they are making efforts to protect individuals within the IC from being identified regarding their participation in this project but have no qualms about vacuuming up the personal data of Americans against their wishes and knowledge,' said Schroeder.
Sen. Ron Wyden, D-Ore., a longtime critic of the Fourth Amendment end run posed by CAI, expressed concern to The Intercept over how the portal will ultimately be used. 'Policies are one thing, but I'm concerned about what the government is actually doing with data about Americans that it buys from data brokers,' he said in a statement. 'All indications from news reports and Trump administration officials are that Americans should be extremely worried about how this administration may be using commercial data.'