Airlines Are Selling Your Data to the Government
29:13 Share

I think you're on mute. Workday starting to sound the same? I think you're on mute. Find something that sounds better for your career on LinkedIn. With LinkedIn Job Collections, you can browse curated collections by relevant industries and benefits, like FlexPTO or hybrid workplaces, so you can find the right job for you. Get started at LinkedIn.com slash jobs. Finding where you fit. LinkedIn knows how.

This message is brought to you by Apple Pay. Forget your wallet, it's all good. Because with Apple Pay, you can pay with a simple tap of your iPhone, the wallet you never forget, at millions of places worldwide, including websites, apps, and anywhere you see the contactless symbol.

Security is built in with Face ID, so you don't have to worry about your cards getting lost or stolen. And the best part, you still earn the card rewards, points, and cash back you love. So say goodbye to the buy fold. Add your card to Apple Wallet and start paying the Apple way. Terms apply. In a few weeks, I'm going to get on a plane with my family. We'll take some time to see grandparents, go on a little vacation, and have some beach time.

And I know that when I get on that flight, the airline will have a lot of information about me. And so will TSA. That makes sense. But according to Joseph Cox at 404 Media, my information could also be sold to Customs and Border Protection.

So what we found through records that we've requested through DHS, Customs and Border Protection and other agencies as well, is that various parts of the US government are buying access to people's flight itineraries from a data broker, essentially,

actually owned by the country's major airlines. So to flip it around the other way, the airlines are selling your flight itineraries to the government without a warrant and to agencies you may not necessarily think need access to that data immediately. So, you know, if I'm flying to Georgia, it's a domestic flight. I'm just going to the beach. They might have that info.

Yeah. So what happens is when you go and book a flight through a travel agent, you know, a website or even a physical one, that data gets sent to a company called the Airlines Reporting Corporation, ARC, and that is the company that's owned by the airlines. It's basically like this middleman organisation that funnels the purchase from the travel agent to the airlines.

Publicly released documents show that ARK is owned and operated by at least eight major airlines. ARK can use its data to do things like illustrate travel patterns. They'll build trends from it and be like, oh, look, this number of passengers were traveling through XYZ this time last year. Maybe that could be useful for post-COVID analysis or something like that. But that's not all they're doing.

On the side, they're also selling it to the government, which is just something we see all the time when it comes to sensitive and personal information, is that it'll be gathered by a company for one purpose, and then it'll be flipped around and sold to government agencies for an entirely other use case that people didn't anticipate.

Today on the show, how the major airlines are selling your data to the federal government. Oh, and they don't want you to know. I'm Lizzie O'Leary, and you're listening to What Next TBD, a show about technology, power, and how the future will be determined. Stick around. ♪

Whether you're gearing up for back-to-back meetings or tackling an endless to-do list, your morning sets the tone for it all. That's why I should start with the perfect cup of coffee. Enter Trade. I started by taking Trade's quiz, which consists of a few questions that help determine your coffee recommendations. I love how simple Trade makes it to discover new roasters and coffees to try. The descriptions make it exciting to figure out which bag suits you, and it makes it easy to try something new without feeling overwhelmed by all the options available.

Trade's experts have taste-tested thousands of coffees to curate over 450 amazing roasts. If that first bag isn't quite right, Trade will replace it for free until they nail it. Plus, you're supporting local roasters. It's a win-win. Right now, Trade is exclusively offering What Next TBD listeners 50% off your one-month trial at drinktrade.com slash TBD.

That's drinktrade.com slash TBD for 50% off your one month trial. drinktrade.com slash TBD.

This episode is brought to you by Agency. While single agents can handle specific tasks, the real power comes when specialized agents collaborate to solve complex problems. But there's a fundamental gap. There is no standardized infrastructure for these agents to discover, communicate with, and work alongside each other.

That's where Agency comes in. The Agency is an open-source collective building the Internet of Agents, a global collaboration layer where AI agents can work together.

It will connect systems across vendors and frameworks, solving the biggest problems of discovery, interoperability, and scalability for enterprises. With contributors like Cisco, Crew AI, Langchain, and MongoDB, Agency is breaking down silos and building the future of interoperable AI. Shape the future of enterprise innovation. Visit agency.org to explore use cases now.

That's A-G-N-T-C-Y dot O-R-G.

I've often thought of the big airlines as competitors. But in this case, Joseph says, they co-own the Airlines Reporting Corporation, or ARC. So on the board of directors of ARC, you have Delta, Southwest, United, American Airlines, Alaska, JetBlue, and there's also the European Airlines, Lufthansa and Air France, and then Canada's Air Canada as

as well. According to the documents we got, ARC is owned by at least eight of the major US airlines. They don't necessarily spell it out incredibly clearly, but when I spoke to the office of Senator Ron Wyden and got a statement from them, they specifically pointed to United and Delta and American. Of course, those are the major airlines that most people are going to end up using at some point.

Help me understand what this company does, because the airlines already have a lot of my information anyway. Why would they need a data broker?

They already have your information for their own purposes. Of course, they need your information to book a flight, to organize your travel, all of that. But that is really valuable data. You can see where people are coming and going, and not even just in the past or in the near future, you know, say the same day. With ARK data, the government and any of other ARK's customers can potentially tell where

where and when somebody is going to be traveling to in the future. You know what I mean? Usually when I cover...

the sale of data through brokers to the government, that sort of thing. It's either historical data or it's real-time data, such as smartphone location information. This one is interesting because it's data actually about the future, which is a very novel thing to cover. So you'd be able to see, and I'm going to use myself as the example, that in July, I, Lizzie O'Leary, am going to Savannah.

Yeah. So going through the documents, it says that ARK has access not just to tickets that have been issued for people on flights, but they also have intent to travel, which is somebody has bought a ticket and they plan to travel in the future, which again makes it a very interesting thing.

uh, story journalistically, but of course for intelligence, law enforcement, and it seems even military agencies, that is really, really powerful data. If you're looking for somebody in particular, uh, and you can search this system by their name or their credit card sometimes, which I found particularly interesting, you can then figure out, oh, this person is probably going to be at this airport at this time.

Does this apply to any ticket or just one that I bought from a third-party purchasing site, like a travel agent or Expedia?

So it looks like it just applies to flights that you've booked through a travel agent. When I was going through some of the other documents published by DHS, they suggested that if you go to an airline website and you book it directly, ARC does not capture or sell that data because presumably ARC is not able to sit in the middle of that transaction. It's not between the travel agent and the airline. You're just going straight to the airline.

On the one hand, in the post-9-11 world, I am not all that surprised that the airlines would give a lot of this information to the government or sell, I suppose, more accurately. But one of the things I'm very interested in is in the contract you got, ARC specifically asked the federal government to not publicly identify vendor or its employees individually or collectively. So they don't want the public to know that they're doing this?

In our initial version of the article, we didn't really emphasize that, and I almost actually cut it. And then my editor and co-founder Jason Kebler went through, highlighted that bit, and essentially said, that's really insane. You need to emphasize that. And I'm glad he said that, and I'm glad we did that. But that actually happens a fair bit in the data broker industry. I remember covering the sale of location data

to law enforcement such as the Secret Service and Customs and Border Protection, again, actually. And in contracts there, there were explicit mentions saying, you cannot use this in a court case. You cannot mention us in a court case. And I can't

really say why the airlines didn't want that or other surveillance companies or data brokers don't want that. But it's not a great look for the airlines to be facilitating your travel and then on the side selling details of your flights to government agencies without your presumably informed consent. I'm sure the airlines and ARC can or would argue that they have obtained consent from somewhere in the small print. I asked them to point me to that small print and they did not

I'm sure they would argue that they have obtained consent. I can't think of any situation where they've got informed consent because nobody knows that this is going on. So how can they possibly consent to it? Yeah, what did they say when you asked them? So when I approached ARC for comment, they said it sounded like my article was based on the findings of an earlier article

investigation from the Lever, which wrote about ICE's purchase of this data. So ARC basically said nothing, which is infuriating because I have very specific questions that I want to ask them and get answers to. They did tell the other journalists who covered this that this program was created post 9-11, which absolutely makes sense. Air travel and air security changed

obviously, drastically after 9-11. So you can see why this would be made. But now it's decades later and we're only just starting to learn about this. What did CBP say when you reached out to them?

So initially Customs and Border Protection disputed my reporting and said, we have no evidence of this. You need to talk to ICE. I told them, no, I'm pretty sure this is you. I'm looking at the contract right now and it says Customs and Border Protection, Times New Roman, bold, high-profile.

highlighted. They then get back to me and they said, actually, yes, we do have this contract. And this one specifically is for the Office of Professional Responsibility, which is sort of their internal watchdog. So if a CBB official does something bad or illegal or corrupt, the idea is that this internal affairs unit

of Customs and Border, investigates them, and that's why they need this data. Now, I'm sure a lot of people would say, "Well, that's a pretty good use case. You want DHS and its arms and its sectors to be able to catch agents doing bad things or corrupt things." Totally agree with that. I still think it's wild and interesting that they're buying this data. And it's almost irrespective of the use case.

This would probably be an article that we would cover because people simply don't know the data selling is happening in the first place. So it's very possible that there are other governmental agencies that are buying data from ARK and we just don't know yet. Yeah, I actually have the list in front of me because there's sort of two stages to the reporting. First, I will go through public US procurement databases and I will search for transactions with ARK. And those include obviously Customs and Border.

for the Secret Service, SEC, DEA, the Air Force, US Marshals Service, TSA, and ATF. Now, we don't know why all of those agencies bought it, because we have to wait for the records to come back. That's sort of the second stage of reporting, and that can take some investigative work and some time. But I'd be very interested to know what any and all of those agencies are doing with this data. And again, maybe it turns out it's a legitimate use case,

But I feel like we should probably know what they're doing with the data. When he was researching this story, Joseph dug through government procurement databases, which show that ARK has been selling data to various government agencies for years, including in the Biden administration.

Some of these recent sales, including to ICE and an update to this contract with Customs and Border Protection, they are, of course, happening during the current political climate of the second Trump administration. And I think, most importantly, during the administration's mass deportation efforts. It is impossible to sort of...

separate the sale of that data from that context because that's simply the time in which it's being sold and which is being used. So this data, you know, maybe in the previous administration or even one before that, it was going to be used in a different way. I don't think we really have answers to those questions yet. But right now, it is being sold to this administration with its own set of priorities and motivations. After the break, when law enforcement buys data...

They don't need to go to the trouble of getting a warrant. This message is brought to you by Apple Pay. Forget your wallet, it's all good. Because with Apple Pay, you can pay with a simple tap of your iPhone, the wallet you never forget, at millions of places worldwide, including websites, apps, and anywhere you see the contactless symbol.

Security is built in with Face ID, so you don't have to worry about your cards getting lost or stolen. And the best part, you still earn the card rewards, points, and cash back you love. So say goodbye to the buy fold. Add your card to Apple Wallet and start paying the Apple way. Terms apply. This podcast is brought to you by Smalls. Is your cat ready for a diet upgrade? Then you need Smalls Cat Food, named the best overall cat food by cats.com.

Smalls cat food is packed with ultra-high protein and made with preservative-free ingredients, giving your cat the high-quality meal they deserve. And it's delivered right to your door. After switching to Smalls, 88% of cat owners reported noticeable improvements in their cat's overall health. The team at Smalls is so confident your cat will love their product, you can try it completely risk-free.

Give your cat the food they deserve for a limited time only because you're a What Next TBD listener. You can get 35% off Smalls plus an additional 50% off your first order by using code TBD. That's an additional 50% off when you head to Smalls.com and use promo code TBD. Again, that's promo code TBD for an additional 50% off your first order plus free shipping at Smalls.com.

The Hoover Dam wasn't built in a day. And the GMC Sierra lineup wasn't built overnight. Like every American achievement, building the Sierra 1500 heavy duty and EV was the result of dedication. A dedication to mastering the art of engineering. That's what this country has done for 250 years.

and what GMC has done for over 100. We are professional grade. Visit GMC.com to learn more. Assembled in Flint and Hamtronick, Michigan and Fort Wayne, Indiana of U.S. and globally sourced parts. The government could get flight information from ARC the old-fashioned way, with a warrant.

But buying it, Joseph says, makes things a lot easier for them. Law enforcement agencies really, really like it when they can just pay for access to information. They don't have to go to a judge to get a warrant and then they go to the company and then they present the warrant and then they get given the information. Law enforcement do this all the time with...

you know, Apple or Twitter or Meta or Snapchat or whoever. And that's good. There's a legal mechanism there for accessing the data and that's going to be used in countless legitimate and important investigations that happen every single day. Um,

That can take time and it takes a lot of paperwork. So if law enforcement can simply buy their way to information, they've historically shown that they really like to do that because it bypasses that paperwork and they can kind of do more with the data. This ARC material contains billions of data points. So if you're able to just search through it,

You can kind of do things you wouldn't be able to do if you just filed a single warrant. Maybe you could search for a lot of people. Maybe you could search for people who don't have probable cause that they've done some sort of crime. And again, governments have done this with smartphone location data, which actually probably should require a warrant, but they've simply bought it. They've done it with utility data and internet backbone information as well. Cops love...

to buy data so much that even Senator Ron Wyden has tried to pass legislation that would ban this sort of sale and purchase and force agencies to get a warrant.

When you talked to Wyden, he said that ARK was shady. Did he mean the company or just sort of this practice of purchasing data, you know, instead of going to a judge, showing probable cause, getting a warrant? My interpretation of the quote is that it's two things. It's both the legal mechanisms that you just laid out, but it's also just the

almost the facts of the story, which is that we're all flying on these airlines and we don't know and don't expect them to then sort of double dip on that data. We're already paying to have no leg room on economy on whatever flight and paying, you know, to put our luggage in these tiny little... Or to use our face as a boarding pass. Right, that as well. And then on top of all of that, they're also selling your information to the government.

Do we know what exactly CBP is doing with this data that it's buying? I mean, I know that that may be too difficult a question to ask, but what could you do with it?

Well, CBP says it's only using it for the internal affairs section of the agency, and that's all well and good. But once you gain access to this information, there isn't really a limit on what you can do with it. I haven't seen, for example...

in the contracts. I haven't seen any sort of clause that says, you can't use this to investigate somebody who has no probable cause. You can't use this to investigate a political enemy. You can't use this to investigate really anything. In the contract, there doesn't seem to be any sort of caveat on the actual use of that data. I'm sure companies selling this sort of information sort of defer to law enforcement agencies. Yeah.

you know, to decide that. But it shows that sort of there's no guardrails on it. You purchase it and you can do whatever you want, it seems. You have spent a lot of time reporting on the intersection of kind of data collection and law enforcement. You wrote a whole book about one of the biggest sting operations ever. Why is data

data so attractive to law enforcement? And as you have reported this, have you seen the kind of traditional guardrails that might exist around, say, going into someone's home, a physical space, keep pace with going into someone's digital space?

Yeah, there is a massive disconnect between the physical world and the digital world. And of course, arguably, there shouldn't be a difference because our digital lives have just as much impact on the physical as really anything else. So yeah, as you allude to, if you're going to go search

somebody's apartment or house or place a GPS tracker on their vehicle or something like that, you're going to need a search warrant. If you're doing some sort of other digital surveillance, maybe you would need a subpoena or at least some sort of court order. It really varies about that. It really varies sort of on the invasiveness of the technology. But

When all of this data is out there to be accessed by different agencies in different ways, agencies absolutely turn to it. Joseph and his colleagues have followed how various governments, local, state and federal, are harnessing data from private surveillance companies. At 404 Media, we've been doing a lot of coverage about Flock, which is a surveillance company that sells drugs.

automatic license plate readers across the country. And like listeners have maybe even seen these cameras in their own communities. What we found was that local cops in Texas, for example, were looking for somebody who received an abortion, but they searched cameras all over the country. And that was without a warrant as well. So clearly... Just by buying the data? Just by buying access. They've bought access to this tool.

and then they're able to query it. So it's not exactly parallel to this ARC data, but there are all of these pockets of these different technologies where it really looks like the law hasn't caught up in some way. It is case by case on the technology and the data and the agency using it. But I think this is probably what privacy advocates and activists would say, well, this is why the US needs some sort of

federal overarching piece of privacy legislation, which the country doesn't have. And I mean, there's absolutely no indication it's going to have it anytime soon. There are a couple of states that have data protection laws and privacy laws. You know, if you live in Illinois or California, one of these states that has a more robust legal privacy infrastructure,

Do you have any extra protection? Well, you're supposed to. But then as we found that, again, with the flock example, sometimes law enforcement agencies are still looking up that data as well. When it comes to the ARC...

flight material, we haven't seen any indication that it doesn't include people from California or Illinois. Now, maybe we're wrong on that and maybe they just haven't made it explicit, but there's nothing in the company's marketing or in the internal CPP documents that we got that says, oh, by the way, this doesn't include Californians' data. So presumably that's impacted here as well. If someone is listening to this conversation and thinking, wait a minute, I

I don't want information from my Delta ticket to be sold to CBP. Is there anything they can do? The only sort of precaution I've seen if somebody wishes to do that is that you go to the airline, you know, and you book a flight that way. Now, of course, law enforcement can still access that data, but it's going to be through

some sort of legal mechanism, right? It's going to be maybe TSA is monitoring then they can have a tip-off to CPP. Maybe another part of DHS goes through some sort of legal process to obtain that data. I don't think anybody would argue that law enforcement shouldn't be able to get airline data in circumstances, in limited and justified and legitimate circumstances. But the wholesale...

bulk selling of this data is not that. You broke this story last week. What kind of a response have you gotten so far?

Mostly the people are very, very mad at the airlines, which again... I mean, people love to be mad at airlines. Well, exactly. That is why I think we decided to emphasize the sort of cover-up in the piece, because people are already very, very mad at airlines, and then they have the audacity to sell this information to the government as well. Of course, I'm kind of paraphrasing the critiques I've seen on Blue Sky and elsewhere. But yeah, people seem...

Pretty mad. And I mean, just journalistically, I'm now interested in, again, what lawmakers may do. Maybe they'll ask questions of ARC and the airlines. I know the office of Senator Ron Wyden has already queried those parties and hasn't really got a response yet, at least as far as I know. We'll see. But I just want to know what the other agencies are doing with the data as well. Joseph Cox, as always, it is completely fascinating to talk to you. Thank you. Thank you so much for having me.

Joseph Cox is a co-founder of 404 Media and host of the 404 Media podcast. And that is it for our show today. What Next TBD is produced by Patrick Fort. Our show is edited by Evan Campbell. TBD is part of the larger What Next family. And if you like what you hear, the best way to support us is by joining Slate Plus.

you get all your Slate podcasts, including this one, ad-free. Just head on over to slate.com slash whatnextplus to sign up. All right, we'll be back next week with more episodes. I'm Lizzie O'Leary. Thanks for listening.