The Defense Intelligence Agency, which provides military intelligence to the Department of Defense, confirmed in a memo that it purchases “commercially available” smartphone location data to gather information that would otherwise require use of a search warrant.

The DIA “currently provides funding to another agency that purchases commercially available geolocation metadata aggregated from smartphones,” the agency wrote in a memo (PDF) to Sen. Ron Wyden (D-Ore.), first obtained by the New York Times.

The Supreme Court held in its 2018 Carpenter v. United States ruling that the government needs an actual search warrant to collect an individual’s cell-site location data. “When the Government tracks the location of a cell phone it achieves near perfect surveillance, as if it had attached an ankle monitor to the phone’s user,” Chief Justice John Roberts wrote for the majority in his opinion. “The retrospective quality of the data here gives police access to a category of information otherwise unknowable.”

The reality of the market, however, has created a big fat loophole: There are countless entities on the private market that scoop up, collate, and resell all kinds of personal data from basically everyone in the country. So instead of doing their own searches, law enforcement agencies are just buying the data they want.

Last summer, for example, media reports found that Customs and Border Patrol buys license plate scanner data to track individuals’ movements. Later reports also revealed that CBP and Immigration and Customs Enforcement buy cell phone location data—information the agencies would otherwise be required to get a search warrant to obtain. The Department of Homeland Security inspector general in December opened an investigation to determine if these tactics “adhered to policies related to cell-phone surveillance devices.”

The Secret Service, IRS, and other agencies have also purchased mobile location data, according to media reports.

The DIA explains in the memo that it simply does not think the Carpenter ruling applies to it. “DIA does not construe the Carpenter decision to require a judicial warrant endorsing purchase or use of commercially-available data for intelligence purposes,” the agency wrote. “DIA’s acquisition, use, and storage of commercial geolocation data is governed” not by these civilian law enforcement rules but by the DoD’s own “Attorney General-approved data handling requirements.”

https://arstechnica.com/?p=1736842