Senator Ron Wyden (D-OR) released a letter Thursday alleging that the US National Security Agency (NSA) buys Americans’ internet browsing information from commercial brokers without a warrant. According to the letter, US intelligence agencies are acquiring data about Americans from private data brokers, and have been for several years.

Senator Wyden likened federal agencies purchasing  private records without a warrant to “using [a] credit card to circumvent the Fourth Amendment.” Wyden also argued that Federal agencies were purchasing consumer data in a manner which violates the FTC’s rules on data selling. In 2021, Wyden revealed that the Defense Intelligence Agency (DIA) had collected location data from Americans’ phones.

Paul Nakasone, four-star general and commander of the US Cyber Command, also wrote to Senator Wyden about the NSA’s practices with commercially available information (CAI). Nakasone reported that the NSA may collect information from electronic devices, but does not collect phone or automobile location data. The NSA does buy “commercially available netflow data”,which Nakasone called “critical to protecting the US Defense Industrial Base.”

An appended letter to Senator Wyden from Ronald Moultrie, the Under Secretary for Defense and Intelligence and Security in the Department of Defense (DOD), stated that Moultrie was:

…not aware of any requirement in U.S. law or judicial opinion, including the Supreme Court’s decision in Carpenter v. United States, that DOD has to obtain a court order in order to acquire, access, or use information, such as CAI, that is equally available for purchase to foreign adversaries, U.S. companies, and private persons as it is to the US Government.

Senator Wyden addressed a letter to the Director of National Intelligence requesting the Intelligence Community (IC) “conduct an inventory of the personal data purchased by the agency about Americans” to determine whether the inventoried data “meets the standards for legal personal data sales outlined by the FTC,” and if the data does not “promptly purge the data.” Wyden also stated that, if the IC has a specific need for such data, that their need should “be conveyed to Congress, and, to the greatest extent possible, to the American public.”