I guess I should be less surprised at this point. Your flight data is being sold to DHS, but the airlines don’t want you to know about that.

According to Wired (Airlines Don’t Want You to Know They Sold Your Flight Data to DHS, written by Joseph Cox and available here), a data broker, called the Airlines Reporting Corporation (ARC), owned by the country’s major airlines, including Delta, American Airlines, and United, collected US travelers’ domestic flight records, sold access to them to Customs and Border Protection (CBP), and then as part of the contract told CBP to not reveal where the data came from, according to internal CBP documents obtained by 404 Media. The data includes passenger names, their full flight itineraries, and financial details.

The documents reveal for the first time in detail why at least one part of the Department of Homeland Security (DHS) purchased such information, and comes after Immigration and Customs Enforcement (ICE) detailed its own purchase of the data. They also show for the first time that ARC tells government agencies not to mention where it sourced the flight data from. 🤫

ARC is owned and operated by at least eight major US airlines, other publicly released documents show. The company’s board of directors include representatives from Delta, Southwest, United, American Airlines, Alaska Airlines, JetBlue, and European airlines Lufthansa and Air France, and Canada’s Air Canada. More than 240 airlines depend on ARC for ticket settlement services.

Yeesh! That’s many of the big ones. Hey, there’s always Qantas! 😉

ARC’s other lines of business include being the conduit between airlines and travel agencies, finding travel trends in data with other firms like Expedia, and fraud prevention, according to material on ARC’s YouTube channel and website. The sale of US fliers’ travel information to the government is part of ARC’s Travel Intelligence Program (TIP).

As Project Counsel Media noted in their coverage of the story here (hat tip for the awareness!), “TIP was established after the Sept. 11 terrorist attacks to provide certain data to law enforcement for the purpose of national security matters and criminal investigations, but appears to have gone far beyond its original mandate.”

Gee, you think? 🙄

A Statement of Work included in the newly obtained documents, which describes why an agency is buying a particular tool or capability, says CBP needs access to ARC’s TIP product “to support federal, state, and local law enforcement agencies to identify persons of interest’s US domestic air travel ticketing information.” 404 Media obtained the documents through a Freedom of Information Act (FOIA) request.

TGFF! (Thank God For FOIA!) 😁

The new documents obtained by 404 Media also show ARC asking CBP to “not publicly identify vendor, or its employees, individually or collectively, as the source of the Reports unless the Customer is compelled to do so by a valid court order or subpoena and gives ARC immediate notice of same.”

A DHS Privacy Impact Assessment (PIA) available online says that TIP data is updated daily with the previous day’s ticket sales, and contains more than one billion records spanning 39 months of past and future travel. The document says TIP can be searched by name, credit card, or airline, but ARC contains data from ARC-accredited travel agencies, such as Expedia, and not flights booked directly with an airline.

It just gets worse, doesn’t it?

Oh, by the way, airlines contacted by 404 Media declined to comment, didn’t respond, or deferred to either ARC or DHS instead. ARC declined to comment. And, ARC has refused to answer oversight questions from Congress. Oh, and CBP’s contract with ARC started in June 2024 and may extend to 2029, according to the documents. Sigh. 😔

You can read more on either the Wired story here, or the Project Counsel Media story here.

So, what do you think? Are you surprised your flight data is being sold to DHS? Wish I was! 😠 Please share any comments you might have or if you’d like to know more about a particular topic.

Image created using Microsoft Designer, using the term “two robots waving bye to one plane heading away from them”. Yes, I added the word “DATA”, and, yes, the AI model can’t count (or determine directions). 🤪

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by my employer, my partners or my clients. eDiscovery Today is made available solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Today should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.