New Pentagon Budget Could Force Military to Disclose Data Buys

The House of Representatives approved changes to next year’s military budget requiring the Department of Defense to start disclosing any purchases of smartphone or web browsing data for which a warrant would ordinarily be required last month.

The House’s approval is a sign that Congress is growing increasingly concerned with the military and federal government’s acquisition and use of Americans’ personal data. Whether the Senate will embrace the House’s push for additional transparency remains to be seen. Until now, almost no members of Congress have spoken publicly of the amendment, which would have wide-reaching ramifications for digital privacy.

The amendment would force the Department of Defense (DOD) to begin disclosing publicly whether it commercially obtains data that could be used to track the movements of citizens and residents of the United States. Its inclusion in the final budget for the next fiscal year depends the outcome of congressional negotiations currently underway in the Senate.

In July, the House of Representatives approved its own budget: a whopping 3,854-page bill known as the National Defense Authorization Act (NDAA). The amendment requiring DOD to start reporting the purchases was passed along with it.

Specifically, the Jacobs-Davidson Amendment — named for Rep. Sara Jacobs, a Democrat of California, and Rep. Warren Davidson, a Republican of Ohio — would require the DOD to publish on its own website a report about its collection of location data from phone calls, text messages, or internet traffic. The requirement would apply to DOD’s many intelligence offices, including those involved in law enforcement, security, and reconnaissance that rely on machine learning tools and artificial intelligence, such as Project Maven.

The DOD would have to disclose any such data obtained “in exchange for anything of value,” either domestically or abroad, and describe generally in each case what kind of data was purchased.

“This is a really modest amendment,” said Rep. Davidson, one of the House sponsors. “I just says, look, you’re buying all this data — what are you buying?”

None of the amendment’s provisions compel the DOD to halt or alter anything about the way it already collects or uses the data, Davidson said. Nor does it authorize the launch of any big, expensive study. “It doesn’t even ask ‘why’ you’re buying it. It’s pretty benign,” he said. “But it’s a first step towards transparency. People should know what the Department of Defense is buying.”

The Senate’s version of the NDAA, filed last month by Sens. Jack Reed and Jim Inhofe, the Democratic chair and outgoing ranking Republican on the Senate Armed Services Committee, respectively, does not currently contain the language found in the Jacobs-Davidson amendment. The Senate bill is also, at time of writing, only a quarter the size of the one passed by the House last month.

Nearly two dozen civil society organizations are preparing to launch a campaign to demand the language be included, Gizmodo has learned.

Sean Vitka, senior policy counsel for Demand Progress — one of the advocacy groups behind the effort — said the text is critical and the best hope that Congress has at forcing the NSA and other agencies to disclose the kinds of data they’re buying.

“If government agencies have secretly operationalized purchasing domestic internet records, the consequences for privacy would be truly staggering,” said Vitka. “Further, it would reflect abysmally on Director of National Intelligence Avril Haines’s promises to be transparent about whether the government is buying its way around the Fourth Amendment.”

In a declassified memo obtained by the New York Times last year, the Defense Intelligence Agency (DIA) acknowledged having purchased smartphone data that could be used to track Americans’ movements. The agency said it had searched the database multiple times over a two and half year period for a handful of investigations.

The U.S. Special Operations Command, which conducts covert or “black ops” missions, likewise acknowledged in November 2020 that it had purchased location data from a company reported to sell data to numerous agencies, including the Secret Service and U.S. Immigration and Customs Enforcement (ICE). According to Motherboard, one of the databases acquired by the Pentagon was constructed by using data from a Muslim prayer app downloaded over 98 million times.

There is no indication that the government has broken any laws with these purchases. And for some lawmakers, that’s precisely the problem. While the Supreme Court has held the Constitution requires the government to get a warrant to compel companies to surrender location data, according to the military, that doesn’t mean it can’t buy it.

According to The Wall Street Journal, the Department of Homeland Security has also purchased access to a database mapping the movements of millions of people across the country.

“The abuses here take your breath away,” Sen. Ron Wyden, a 20-year veteran of Senate Intelligence Committee, said during a hearing in 2021.

Supporters of the Jacobs-Davidson amendment have only a few opportunities to see it attached to the final bill signed by President Biden. House and Senate leaders could agree to include it early on during informal talks likely already underway; a negotiating step known as “preconferencing”. Or Sen. Reed could add it to his own bill with an amendment in the nature of a substitute. Reed’s bill was added to the Senate calendar this month, meaning Majority Leader Sen. Chuck Schumer could call it up for a vote anytime.

“Sen. Wyden has been working to try get the same language in the Senate version of the NDAA, and I hope he succeeds,” Davidson told Gizmodo. (A Wyden spokesperson confirmed his efforts.)

“Congresswoman Jacobs deserves a lot of credit for attaching her amendment to the defense bill,” Wyden, a Democrat of Oregon, told Gizmodo. “Americans absolutely deserve to know whether the Pentagon is purchasing location data generated by our phones, or other data.”

Should early efforts fail and the Senate end up passing a version of the NDAA without the reporting requirements, House leaders could still fight for them when the chambers meet in conference to hammer out a bicameral compromise.

“As a digital native, I’ve been working a lot on the federal government’s role in protecting our privacy, and especially our digital privacy,” Rep. Jacobs said. “And that sometimes includes protecting our information from the government.”

“Right now, a legal loophole allows the Department of Defense to obtain Americans’ digital information, including location data, without a warrant or due process,” she said. “I’m proud to be leading a bipartisan amendment with Congressman Davidson to help promote transparency, rein in mass surveillance, and preserve Americans’ right to privacy.”

Most members of the Senate Committee on Armed Services did respond to requests for comment sent Thursday. A spokesperson for Sen. Tim Kaine said the Virginia Democrat was looking into the amendment. A spokesperson for Sen. Tommy Tuberville, a Republican of Alabama, said he’d try to speak to the senator about it.

Intelligence components of the DOD collect data on what it calls “U.S. persons” under Executive Order 12333, rules which authorize foreign intelligence activities not regulated under federal statute. The attorney general, in consultation with the director of national intelligence, approves the rules. “U.S. persons” includes, by default, anyone located inside in the United States, unless the government has specific knowledge they aren’t a citizen or permanent resident. (With overseas data, the exact opposite is true.)

The intelligence community currently includes nine separate DOD elements, including the National Security Agency. Each military service, including the Space Force, has its own intelligence unit.

During her confirmation hearings in January 2021, Avril Haines, the Biden administration’s pick for director of national intelligence, said she was unfamiliar with the degree to which the government was already purchasing commercially available data. But she promised to bring more transparency to the process.

“I would seek to try to publicize, essentially, a framework that helps people understand the circumstances under which we do that, and the legal basis we do that under,” Haines said, in response to a question by Sen. Wyden. “I think that’s part of what’s critical to promoting transparency generally,” Haines added, “so people have an understanding of the guidelines under which the intelligence community operations.”

A Wyden spokesperson said they were unaware if Haines had followed through on her promise, which earned her the senator’s approval. Haines was confirmed on Jan. 20, 2021 — two days before the Times published the Defense Intelligence Agency’s memo describing its use of commercial data. The Office of the Director of National Intelligence did not respond to a request for comment.

“I’ve been fighting for years now to put a spotlight on when and how the government is using its credit card to end-run the Fourth Amendment and buy our data without a warrant or any court oversight,” Wyden told Gizmodo. “My investigation and this amendment are all about making sure Americans have the facts on what the government is doing with our personal data.”

Last year, Wyden was joined by Rep. Jerrold Nadler, chair of the House Judiciary Committee, in introducing legislation aimed at banning law enforcement and intelligence agencies from buying data that normally requires a warrant. The pair of bills, known as the Fourth Amendment Is Not For Sale Act, has earned wide praise from staunch privacy defenders, such as the Electronic Frontier Foundation.

Nadler, who’s opposition to warrantless data collection is well known, was joined Tuesday by Rep. Bennie Thompson, the chair of the Homeland Security Committee, in sending a letter to Attorney General Merrick Garland, along with the heads of the FBI and five other federal agencies. The pair are demanding access to the fine details of any commercial deals that might include Americans’ personal data, a practice they believe is “pervasive” and happening in total secrecy.

“While law enforcement investigations necessitate some searches,” the chairmen wrote, “improper government acquisition of this data can thwart statutory and constitutional protections designed to protect Americans’ due process rights.”