Airlines sell billions of your travel records to the government

Hey there. So a data broker owned by major U.S. airlines is selling masses of customers' travel data to the government. New documents we just got show this includes “5 billion ticketing records for searching capabilities.” Where people went, how they paid, and even where they plan to go in the future are all in this tool, with little indication that a warrant or other legal mechanism is used to search it. The full story and the documents are below.

A data broker owned by the country’s major airlines, including American Airlines, United, and Delta, is selling access to five billion plane ticketing records to the government for warrantless searching and monitoring of peoples’ movements, including by the FBI, Secret Service, ICE, and many other agencies, according to a new contract and other records reviewed by 404 Media.

The contract provides new insight into the scale of the sale of passengers’ data by the Airlines Reporting Corporation (ARC), the airlines-owned data broker. The contract shows ARC’s data includes information related to more than 270 carriers and is sourced through more than 12,800 travel agencies. ARC has previously told the government to not reveal to the public where this passenger data came from, which includes peoples’ names, full flight itineraries, and financial details.

SPONSORED

Protect your digital life from phishing attacks. The YubiKey by Yubico is a physical security key that locks down your personal and business accounts across devices. Unlike other multi-factor authentication (MFA), it requires a physical tap to verify your login—shutting hackers out, even if they have your password.  It safeguards against AI-powered cyberattacks, phishing, online identity scams, and account takeovers. YubiKeys secure over 1,000 accounts including email, social, password managers, productivity tools, developer tools, and more. YubiKeys are securely manufactured in Sweden and programmed in the USA. For a limited time, get $10 off your order of exactly two keys from the YubiKey 5 Series or Security Key Series using the code “404media10” at checkout. Still undefeated. YubiKey is the original passkey. Learn more and get $10 off at yubico.com/404media Get $10 off here

“Americans' privacy rights shouldn't depend on whether they bought their tickets directly from the airline or via a travel agency. ARC's sale of data to U.S. government agencies is yet another example of why Congress needs to close the data broker loophole by passing my bipartisan bill, the Fourth Amendment Is Not For Sale Act,” Senator Ron Wyden told 404 Media in a statement.

ARC is owned and operated by at least eight major U.S. airlines, publicly released documents show. Its board of directors includes representatives from American Airlines, Delta, United, Southwest, Alaska Airlines, JetBlue, and European airlines Air France and Lufthansa, and Canada’s Air Canada. ARC acts as a bridge between airlines and travel agencies, in which it helps with fraud prevention and finds trends in travel data. ARC also sells passenger data to the government as part of what it calls the Travel Intelligence Program (TIP).

TIP is updated every day with the previous day’s ticket sales and can show a person’s paid intent to travel. Government agencies can then search this data by name, credit card, airline, and more.

The new contract shows that ARC has access to much more data than previously reported. Earlier coverage found TIP contained more than one billion records spanning more than 3 years of past and future travel. The new contract says ARC provides the government with “5 billion ticketing records for searching capabilities.”

Screenshots of the documents obtained by 404 Media.

404 Media obtained the contract through a Freedom of Information Act (FOIA) with the Secret Service. The contract indicates the Secret Service plans to pay ARC $885,000 for access to the data stretching into 2028. A spokesperson for the agency told 404 Media “The U.S. Secret Service is committed to protecting our nation’s leaders and financial infrastructure in close coordination with our federal, state, and local law enforcement partners. To safeguard the integrity of our work, we do not discuss the tools used to conduct our operations.” The Secret Service did not answer a question on whether it seeks a warrant, subpoena, or court order to search ARC data.

404 Media has filed FOIA requests with a wide range of agencies that public procurement records show have purchased ARC data. That includes ICE, CBP, ATF, the SEC, TSA, the State Department, U.S. Marshals, and the IRS. A court record reviewed by 404 Media shows the FBI has asked ARC to search its databases for a specific person as part of a drug investigation.

The ATF told 404 Media in a statement “ATF uses ARC data for criminal and investigative purposes related to firearms trafficking and other investigations within ATF’s purview. ATF follows DOJ policy and appropriate legal processes to obtain and search the data. Access to the system is limited to a very small group within ATF, and all subjects searched within ARC must be part of an active, official ATF case/investigation.”

An ARC spokesperson told 404 Media in an email that TIP “was established by ARC after the September 11, 2001, terrorist attacks and has since been used by the U.S. intelligence and law enforcement community to support national security and prevent criminal activity with bipartisan support. Over the years, TIP has likely contributed to the prevention and apprehension of criminals involved in human trafficking, drug trafficking, money laundering, sex trafficking, national security threats, terrorism and other imminent threats of harm to the United States.”

The spokesperson added “Pursuant to ARC’s privacy policy, consumers may ask ARC to refrain from selling their personal data.”

After media coverage and scrutiny from Senator Wyden’s office of the little-known data selling, ARC finally registered as a data broker in the state of California in June. Senator Wyden previously said it appeared ARC had been in violation of Californian law for not registering while selling airline customers’ data for years.