Three years after saying it had stopped buying location data of Americans without a warrant, the FBI acknowledged it has restarted the purchases. During questioning at a Senate Select Committee on Intelligence hearing yesterday, FBI Director Kash Patel said the location data purchases have produced valuable information, and he did not commit to stopping the practice.
In March 2023, then-FBI Director Christopher Wray confirmed that the agency had previously bought location data of US citizens without obtaining a warrant. “To my knowledge, we do not currently purchase commercial database information that includes location data derived from Internet advertising,” Wray, who led the agency during Trump’s first term and during the Biden era, said at the time. “I understand that we previously—as in the past—purchased some such information for a specific national security pilot project. But that’s not been active for some time.”
At yesterday’s hearing, Sen. Ron Wyden (D-Ore.) recounted Wray’s 2023 statement and asked Patel, “Is that the case still and, if so, can you commit this morning to not buying Americans’ location data?”
Patel answered, “The FBI uses all tools to do our mission. We do purchase commercially available information that’s consistent with the Constitution and the laws under the Electronic Communications Privacy Act, and it has led to some valuable intelligence for us.”
Wyden replied, “So you’re saying that the agency will buy Americans’ location data. I believe that that’s what you’ve said in kind of intelligence lingo, and I just want to say as we start this debate, doing that without a warrant is an outrageous end-run around the 4th Amendment. It’s particularly dangerous given the use of artificial intelligence to comb through massive amounts of private information.”
Tom Cotton defends data purchases
Wyden called Patel’s admission “exhibit A for why Congress needs to pass our bipartisan, bicameral bill, the Government Surveillance Reform Act.” The bill, introduced in the Senate by Wyden and Sen. Mike Lee (R-Utah), would generally prohibit the federal government from buying location information on people in the US without a warrant or order under the Foreign Intelligence Surveillance Act (FISA). The bill provision would also protect US residents’ communications content, web browsing history, and Internet search history.
The Supreme Court ruled in 2018 that the government needs a warrant to obtain cell-site location information, time-stamped records generated when a phone connects to a cell site. But the ruling pertained to obtaining the data directly from wireless carriers, not from third-party data brokers. Major wireless carriers have sold customer location data to data aggregators, allegedly without their users’ consent, and are fighting the Federal Communications Commission’s attempt to punish them for the sales. Data brokers typically obtain location data from app makers.
Sen. Tom Cotton (R-Ark.), the Senate Intelligence Committee chairman, defended the FBI’s location data purchases. Cotton compared buying location data to law enforcement searching through a person’s trash.
“I would observe about commercially available data that the key words are commercially available,” Cotton said. “If any other person can buy it and the FBI can buy it and it helps them locate a depraved child molester or savage cartel leader, I certainly hope the FBI is doing anything they can to keep Americans safe. It’s not much different from longstanding Supreme Court precedent that, for instance, says law enforcement can go through trash that you put on the side of the curb because you no longer have a privacy interest in it.”
Congress is debating whether to reauthorize FISA’s Section 702 before an April 19, 2026, expiration date, and under what terms. Cotton said at yesterday’s hearing, “I fully support President Trump’s request for a clean reauthorization of FISA Section 702.” The alternative version pitched by Wyden, Lee, and others would reauthorize Section 702 with changes to scale back surveillance authority.
Wyden followed up on his exchange with Patel by asking the FBI director about his recent allegation that his phone records were subpoenaed by the FBI during the Biden administration. “One more question, Director Patel,” Wyden said. “You, three weeks ago, indicated you were dissatisfied about having your phone records subpoenaed. Do you think the government ought to get a court order to collect phone records?”
Patel answered, “Senator, in my experience the government does get court orders to obtain phone records.”
FBI not alone in buying location data
Wyden separately queried Defense Intelligence Agency Director James Adams about purchases of location data. “In 2021, your agency confirmed that it had purchased and searched domestic location data,” Wyden said. “Is it still your agency’s position that you can buy Americans’ location data without a warrant and, if so, are you still doing it?”
Adams answered that all of the Defense Intelligence Agency’s “purchasing of commercially available information… is passed through legal channels and is in complete compliance with laws,” and “in alignment with the Constitution and protects US persons’ information.”
Wyden also questioned William Hartman, who is chief of the Central Security Service and is leading the US Cyber Command and National Security Agency in an acting capacity. Wyden brought up the 2024 renewal of FISA, in which Congress expanded the category of electronic communication service providers who are required to help the government obtain communications.
Privacy advocates warned during the 2024 debate that the bill would let the federal government access communications equipment used by almost any business in the US. At yesterday’s hearing, Wyden said the 2024 FISA renewal “expanded the type of companies and individuals who could be forced to assist the government in its spying,” and asked Hartman whether “this expansion resulted in any intelligence.”
Hartman answered that the “provision provided us an ability to collect foreign intelligence on personnel outside of the United States,” but declined to discuss more specifics in public. “I would prefer to talk to you about exact specifics in the closed session,” Hartman said to Wyden.
FISA expansion may not have produced much intel
The 2024 update to the law imposed requirements on any “service provider who has access to equipment that is being or may be used to transmit or store wire or electronic communications,” with exceptions for public accommodation facilities, dwellings, community facilities, and food service establishments.
Wyden argued that the 2024 update let the government collect data from “anybody with access to a cable box, a Wi-Fi router, or a server,” and said that Hartman’s response indicated the change did not lead to any valuable intelligence. “This ought to be a warning to every senator that not every new spying power that is sold as urgent and critical actually is,” Wyden said.
Hartman subsequently clarified that “nothing in [Section] 702 gives us the authority to target an American with a cable router or a Wi-Fi device.”
We don’t know whether the topic was addressed further in a closed session, but Wyden’s office told Ars that he was not satisfied with Hartman’s answer. “Not only was the controversial 2024 FISA expansion written so broadly that it gave the government expansive new authority to compel Americans to assist with government surveillance, yesterday the NSA would not even claim that it produced a single piece of intelligence,” Wyden said in a statement provided to Ars. “Congress must repeal this expansion, which is ripe for abuse by the executive branch.”
Separately, the NSA in 2024 admitted buying records from data brokers detailing which websites and apps Americans use.
