Research: The Data-Broker Loophole

This page documents the data-broker loophole: the gap between what the government may compel and what it may purchase. Every claim below about a real person, agency, or company carries a source; where a characterization or an intent is at issue, it is attributed to whoever made it — the court, the agency, the regulator, or the named actor — and never asserted in our own voice. The structural reading at the end (that the purchase substitutes for a warrant the government could not obtain) is grounded in the sourced record and attributed as analysis, not offered as a claim that any named person arranged a specific unlawful transaction.

The mechanism in one line: doing the collection directly is a Fourth Amendment search; buying the same records from a private company on the open market is, under current law, not. The purchase launders the prohibition.

The constitutional baseline

Carpenter v. United States, 585 U.S. 296 (2018), held that the government’s acquisition of a person’s historical cell-site location records is a Fourth Amendment search that generally requires a warrant. The Court drew the line at the government compelling the data from a carrier. It did not reach the government buying commercially available data on the open market — the precise gap the rest of this page documents (U.S. Supreme Court slip opinion, Carpenter v. United States (2018); case page, Justia).

The loophole, admitted by the government itself

The Office of the Director of National Intelligence’s own declassified report on Commercially Available Information (CAI) — prepared by a Senior Advisory Group, dated January 2022, released in June 2023 — states plainly that the Intelligence Community purchases CAI, that CAI now includes information which would previously have required legal process to compel, and that in the wrong hands such data could be used to “cause harm to an individual’s reputation, emotional well-being, or physical safety.” The IC conceded, in writing, that buying the data sidesteps the process that compelling it would require (ODNI, Senior Advisory Group Panel on Commercially Available Information (Jan. 2022, declassified 2023); archived copy).

Who bought, from whom

The documented pattern is federal agencies purchasing location and other data from brokers rather than seeking it through legal process. Reported buyers include Immigration and Customs Enforcement, Customs and Border Protection, the FBI, and the IRS; reported brokers include Venntel, Babel Street, and X-Mode Social / Outlogic. The specific agency purchases are attributed to agency records and contemporaneous reporting compiled by the Electronic Frontier Foundation (EFF, location data brokers — issue and reporting index).

The commercial side of that trade has been found unlawful. In January 2024 the Federal Trade Commission ordered X-Mode Social and its successor Outlogic to stop selling sensitive location data — the first such order the agency had issued — barring the use, sale, or disclosure of precise location data revealing visits to sensitive sites (FTC, order prohibiting X-Mode Social / Outlogic from selling sensitive location data (Jan. 9, 2024)). A parallel action against InMarket Media followed the same week, barring InMarket from selling or licensing precise location data (FTC, order against InMarket Media (Jan. 18, 2024)). The FTC orders are facts of public record; they concern the brokers’ commercial conduct, not any finding against a particular agency purchaser.

The attempted fix — which proves the loophole is real

The Fourth Amendment Is Not For Sale Act (H.R. 4639, 118th Congress) would bar the government from buying data it would otherwise need a warrant or court order to obtain. The House passed it in April 2024 (H.R. 4639, Fourth Amendment Is Not For Sale Act (118th Congress)). A legislature does not draft a statute to close a loophole that is not there. The bill is the existence proof, in Congress’s own hand, that “buy it instead of compelling it” is the operative practice.

Why the revolving door is the transmission belt

The loophole needs a private seller, and the seller’s value to the government rises with its access to — and credibility with — the government, which is exactly what a former agency director, official, or police chief supplies on a vendor’s board. The physical-surveillance firms that recur across this research (Axon, Flock Safety, Verkada, SoundThinking, Clearview AI, Palantir, ID.me) sit on the sell side of this transaction, and their boards and executive ranks carry former officials who ran the agencies now buying.

The revolving door and the data-broker loophole are one mechanism seen from two ends: the official rotates out to the vendor; the vendor sells back to the agency the thing the agency could not lawfully collect itself. Documented as structure — the board seats and the purchases are each a matter of record — the “laundering” reading is our attributed analytic thesis, not an assertion that any named person arranged a specific unlawful purchase. The board rosters and the agency-vendor flows are catalogued in the companion tools: the revolving-door tracker maps the official-to-vendor rotations, and the convergence table sets the vendors against the capabilities they sell back.

Verdict

The government cannot warrantlessly collect the data (Carpenter). It buys it instead — the Intelligence Community admits as much in its own CAI report — from brokers the FTC has found selling it unlawfully, and Congress has drafted a statute specifically to stop the purchase. The firms doing the selling are staffed, at the board level, by the kind of former officials who used to run the buyers. That is not a set of coincidences; it is a market built on the exact gap between what the state may compel and what it may purchase. What stays attributed stays attributed: the specific agency purchases (to agency records and EFF’s reporting index), and the “laundering” reading (to this page’s structural analysis). No named person is charged here with arranging a specific unlawful transaction.

Related research

• Security Industry Capture & Surveillance Vendors — the sell-side cohort in full: the surveillance firms and the officials on their boards.
• NSA / Snowden Surveillance Infrastructure — the compelled-collection side of the same ledger, from PRISM to Section 702.
• Vehicle Control Infrastructure — location data at the source: connected-car telemetry as a broker feedstock.
• The Universal Capture Mechanism — the general pattern this loophole is one instance of.
• Revolving-Door Tracker · Convergence Table — the live vendor / official maps this page draws on.