USA: CIA collects financial data worldwide

The CIA has come under fire for a previously unknown surveillance program: the intelligence agency has been collecting and analyzing financial data worldwide since 2016 – largely without any data protection restrictions. Where the data comes from and what is done with it is unclear.

Secret Service Committee not informed until 2021

Since 2016, the CIA has been analyzing international financial data in order to uncover financial flows of terrorist organizations and related links. In the course of this, databases with financial data are systematically searched according to predefined criteria – and without data protection requirements. As a consequence, this means that largely uncontrolled mass surveillance of sensitive personal data is taking place, in the context of which, for example, business and private relationships can be identified.

The responsible intelligence committee of the U.S. Senate was informed about the activities and results only in February 2021. The two Democratic senators Ron Wyden and Martin Heinrich saw this as a problem and subsequently demanded the publication of a report by the Privacy and Civil Liberties Oversight Board, which examined the activities of the CIA in more detail.

Reagan-era legal basis

The basis for the data collection and analysis is a decree issued by U.S. President Ronald Reagan in 1981. This decree, which is largely openly worded, authorizes intelligence agencies to monitor companies and institutions as soon as they have a relationship with foreign organizations or employees – which is almost always the case. There are basically no restrictions under data protection law.

This is problematic because the CIA has no right in principle to collect or analyze data from U.S. citizens. The two senators mentioned above now fear that the program, which became public in 2021, will circumvent this restriction. Even beyond this legal problem, the CIA’s actions are problematic because the program relies on worldwide mass surveillance of financial data and thus openly violates privacy and data protection rights of people who do not have U.S. citizenship – which is unproblematic under U.S. law. It is also worth noting in this context that the sources of the analyzed data are unknown.

A report published by the CIA on this topic is largely redacted and therefore hardly informative. All that is known is that both structured and unstructured data are used, i.e., data that is both coherent and intercepted from individual sources.