The director of the National Security Agency confirmed that the agency buys Americans' browsing data from an intermediary without prior authorization.
Senator Ron Wyden blocked the nomination of National Security Agency Director Timothy Hoge until the agency answers his questions about collecting Americans' location and Internet data.
Wyden said he has been trying for three years to publicly denounce the NSA's purchase of Americans' Internet records.
Current NSA Director Paul Nakasone confirmed to senators in a letter dated December 11 that the agency obtained this information from intermediaries.
“NSA obtains various types of commercial information for foreign intelligence, cybersecurity, and other authorized mission purposes to advance its signals intelligence and cybersecurity missions,” Nakasone wrote.
“This may include information about electronic devices used outside the United States and, in some cases, within the United States,” she added.
Nakasone said the agency will not obtain or use location data from phones known to be used in the United States, with or without a court order.
She noted that the agency does not obtain or use location data collected from vehicle remote control systems known to be in the United States.
An NSA spokesperson said that despite its value to national security and cybersecurity, the agency rarely uses this data.
“At all stages, the NSA is taking steps to limit the collection of US personal data, including by implementing technical filters,” the spokesperson said.
Wyden called the practice illegal. "Such records could indicate that Americans are seeking help from a suicide hotline or a hotline for survivors of sexual assault or domestic violence," he added.
The Senator called on Director of National Intelligence Avril Haines to issue an order to the US intelligence community to stop purchasing data from Americans without their consent.
Haines also called for the intelligence community to conduct an inventory of personal data on Americans obtained by the agency, including location data and online metadata.
Any data that doesn't meet the FTC's standards for selling personal information should be deleted, Wyden said.
It's worth noting that the issue of US federal agencies purchasing cell phone location data is not new: In 2020, it was revealed that Customs and Border Protection was doing so, and the following year, Wyden claimed that the Defense Intelligence Agency had been purchased by the US. Cell phone location data was used.