Data for sale: how loopholes, bossware, and leaks supercharged america's surveillance crisis

By early 2026, federal agencies such as the FBI have been exploiting the so-called 'data broker loophole' to purchase Americans' location and other sensitive data without warrants, sidestepping Fourth Amendment protections. FBI Director Kash Patel openly acknowledged this practice during a Senate hearing, framing it as acquisition of 'commercially available information' consistent with existing laws. This loophole, combined with Section 702 of the Foreign Intelligence Surveillance Act—which authorizes warrantless surveillance of foreign targets but incidentally collects vast amounts of Americans' communications—has enabled mass data collection, including the location data of 98 million individuals simply for downloading a mobile prayer app, disproportionately impacting vulnerable communities.

The convergence of government access to commercial data and advances in AI technology has exponentially amplified surveillance capabilities, prompting vocal resistance from major AI leaders and civil liberties organizations. Groups like the ACLU and the Center for Democracy and Technology warn that integrating AI with data broker loopholes could 'expand the Pentagon’s surveillance powers exponentially,' while OpenAI CEO Sam Altman and others have pledged to oppose the use of AI for mass surveillance. Meanwhile, emerging technologies such as digital currencies raise additional concerns, as highlighted by Rep. Warren Davidson, who cautions that central bank digital currencies could not only monitor transactions but also restrict individuals' financial autonomy.

Amid growing public scrutiny, there is significant bipartisan and bicameral momentum to reform Section 702 and close legal loopholes that enable warrantless surveillance. Lawmakers, including voices like Elizabeth Goytin, advocate for closing the 'backdoor search loophole' by requiring warrants or FISA Title I orders before accessing Americans' communications collected under Section 702. Additionally, there is broad support to address the data broker loophole, aiming to prevent government agencies from bypassing constitutional privacy protections by purchasing sensitive data. This legislative push is underscored by a coalition of over 90 civil liberties organizations warning Congress against endorsing expansive surveillance agendas, such as those championed by Stephen Miller.

Despite bipartisan reform efforts, political dynamics inject uncertainty into the future of surveillance laws. While many lawmakers across party lines express discomfort with unchecked surveillance and advocate for stronger civil liberties protections, the administration and influential congressional leaders like Speaker Johnson remain committed to preserving broad presidential surveillance authority. This tension highlights the ongoing struggle to balance national security interests with the protection of Americans' privacy rights in an era of rapidly evolving technology and data collection practices.

By mid-2026, research led by Stephanie Nguyen at Columbia Law School revealed that nine widely used workplace monitoring platforms, often dubbed 'bossware,' routinely share extensive employee data—including names, email addresses, browsing histories, IP addresses, and device information—with major tech giants like Meta, Google, and Microsoft, as well as advertising firms such as AppLovin. Alarmingly, about a third of these platforms possess the capability to track employees’ precise locations continuously, even when apps operate in the background, raising profound privacy concerns about the invasive nature of such surveillance.

Despite the pervasive adoption of bossware by approximately 78% of employers, transparency remains elusive; when researchers disclosed their findings, less than half of the platform providers responded, often with generic or delayed replies, underscoring a troubling lack of accountability in how these companies handle sensitive worker data. This opacity compounds the risks as these platforms monetize employee information by analyzing usage patterns and network connections to infer behaviors such as engagement levels or intentions to seek new employment, effectively exploiting worker data without meaningful consent.

In response to these findings, experts are urgently calling for robust legal interventions to curb the unchecked surveillance enabled by bossware. They advocate for banning the collection, sharing, and selling of workplace data and restricting invasive features within monitoring apps to safeguard worker privacy, autonomy, and economic security. As the report emphasizes, instituting such protections now is critical to prevent entrenched practices that could permanently erode employee rights in the digital workplace.

By early 2026, glaring vulnerabilities in military data security were laid bare when over 70,000 US Army files—including sensitive personnel information and base schematics—remained exposed for more than a year through a flawed Open Directory Listing, despite a 2024 warning to CISA from security researcher Arkadeep Roy. This prolonged exposure highlights systemic failures within government agencies to promptly address known cybersecurity threats, raising urgent questions about the robustness of military data protection protocols.

Simultaneously, the commercial location data ecosystem has emerged as a critical national security concern, with the U.S. Department of Defense confirming that adversaries exploit data broker practices to surveil and target troops on the battlefield. Senator Ron Wyden has publicly condemned the ad tech industry as a 'national security threat,' urging heightened scrutiny as these off-the-shelf tracking tools reveal intimate details about service members’ locations, movements, and even their homes through mobile apps collecting geolocation and advertising IDs. The FBI’s recommendation for consumers to use ad blockers underscores the recognized risks of pervasive data surveillance.

Further compounding these risks, data brokers openly market detailed personal and location data on U.S. military personnel with minimal verification, offering products like 'Military Families Mailing List' at just 12 cents per record, effectively lowering the barrier for hostile actors to acquire sensitive information. This commodification of military data is exacerbated by parts of the Defense Department itself purchasing commercially available phone location data—including on Americans—without warrants, integrating such data into intelligence workflows despite the inherent security trade-offs. As US Central Command confirmed, multiple threat reports have flagged adversary exploitation of this commercial data to target personnel in active theaters, illustrating a troubling convergence of commercial surveillance infrastructure and national defense vulnerabilities.