Exclusive: State Dept. gives law enforcement, intelligence agencies unrestricted access to Americans' personal data

The State Department is giving law enforcement and intelligence agencies unrestricted access to the personal data of more than 145 million Americans, through information from passport applications that is shared without legal process or any apparent oversight, according to a letter sent from Sen. Ron Wyden to Secretary of State Antony Blinken and obtained by Yahoo News.

The information was uncovered by Wyden during his ongoing probe into reporting by Yahoo News about Operation Whistle Pig, a wide-ranging leak investigation launched by a Border Patrol agent and his supervisors at the U.S. Customs and Border Protection’s National Targeting Center.

On Wednesday, Wyden sent a letter to Blinken requesting detailed information on which federal agencies are provided access to State Department passport information on U.S. citizens.

“​​I write to express serious concern that the Department of State is providing law enforcement and intelligence agencies with unfettered access to personal data, originally collected through passport applications, of the more than 145 million Americans with a passport,” states the letter sent to Blinken, a copy of which was obtained by Yahoo News.

Wyden, D-Ore., wrote that “the breadth of this access highlights the potential for other abuses. In a July 13, 2022, briefing for my office, State Department officials confirmed that 25 other federal agencies have access to the Department’s database of passport applications.”

According to documents posted on a Department of Homeland Security website, data collected on U.S. citizens include: names, addresses, birth dates, biometric data like fingerprints and facial images, email addresses, phone numbers, gender, race, Social Security numbers and other types of personal information.

“The [State] Department's mission does not include providing dozens of other government agencies with self-service access to 145 million Americans’ personal data,” the letter states. “The Department has voluntarily taken on this role, and in doing so, prioritized the interests of other agencies over those of law-abiding Americans. While there is a legitimate role for the use of this information by law enforcement, the current unregulated system of interagency access to millions of Americans’ records goes far beyond what a reasonable person would expect or tolerate.”

Wyden wrote that while the department isn’t legally required to provide other agencies with such access, it “has done so without requiring these other agencies to obtain compulsory legal process, such as a subpoena or court order.”

It is unclear if the 25 law enforcement and intelligence agencies have different levels of access or how many people at these agencies have access to the full data set. In a meeting with Wyden in May, the State Department said they would be unable to break down the numbers by agency, only State Department and non-State Department, according to the letter.

The revelations come amid several probes from Wyden’s office stemming from allegations that a border patrol agent misused government databases to pursue a rogue leak investigation into a reporter and her relationship with a congressional staffer. The DHS Office of Inspector General launched a probe into these allegations and the work of the Border Patrol agent’s supervisor and co-worker at CBP’s National Targeting Center, which was established after 9/11 to help identify and thwart threats coming from overseas.

The OIG investigation, detailed in an unredacted report spanning more than 500 pages, formed the basis of Yahoo News’ reporting on Operation Whistle Pig. “Abuses of this access came to light through a report of investigation by the Department of Homeland Security Office of lnspector General (OIG) into activities at Customs and Border Protection (CBP),” the letter states.

Wyden’s letter cites a public redacted version of the report because, despite years of repeated requests, DHS has still not provided him with the fully unredacted report.

DHS did not respond to Yahoo News’ questions about the report.

The Office of the Inspector General told Yahoo News it could not provide information on why Congress has not received the fully unredacted report. “To preserve the integrity of our work and protect our independence, we do not discuss our communications with Congress,” the office said via email.

The investigation into a reporter and her relationship with a congressional aide began when Jeffrey Rambo of the Counter Network Division was assigned to come up with a plan to track forced labor being used to mine cobalt in the Democratic Republic of Congo. There were — and currently are — no policies in place governing the use of the country’s most sensitive databases by the Counter Network Division, a CBP unit designed as a bridge between law enforcement agencies and the intelligence community.

This led to the use of several sensitive government databases — including the State Department’s passport database known as the Consular Consolidated Database — to gather detailed personal data on the reporter, the congressional aide and members of the reporter’s family. According to the copy of the unredacted OIG report of investigation obtained by Yahoo News, Rambo also obtained the passport photos of the reporter and aide using the State Department passport database that is the focus of Wyden’s letter.

“A CBP officer in a unit that was supposed to be looking into forced labor abuses inappropriately accessed the passport application of a U.S. journalist for purposes of ‘vetting’ the journalist. The search was intended to identify ‘additional selectors’ (e.g., email addresses or phone numbers) associated with the journalist as well as information on the journalist’s family members,” Wyden wrote.

“In the normal course of criminal investigations and intelligence collection, federal officers must rely on legal processes, including subpoenas and National Security Letters, in order to obtain subscriber information and similar records. The fact that many of the same records are readily available to federal agents through direct access to State Department passport applications removes any checks and invites exactly the kind of abuses detailed in the OIG report.”

Rambo, his supervisor and another CBP employee at the National Targeting Center were referred for potential criminal prosecution for possible charges that included misuse of government computers and databases. The Department of Justice declined to prosecute and all three remain in their jobs. CBP’s Office of Professional Responsibility is currently investigating allegations of misconduct against a CBP employee connected to Operation Whistle Pig. Last month, an investigator contacted Yahoo News asking for the identities of sources of information cited in Yahoo News’ reporting. (Yahoo News declined the request.)

Wyden is asking the State Department to come up with plans to make sure law enforcement use of passport data is for legitimate purposes and is consistent with privacy protections commonly used elsewhere in the government.

The State Department did not respond to Yahoo News’ questions about Wyden’s letter and if it would come up with the plan his office requested.

Civil liberties advocates told Yahoo News that they were also alarmed at the State Department providing personal data on Americans to law enforcement and intelligence agencies.

“The use of passport data to vet Americans for no justifiable purpose sets off alarm bells,” said Rachel Levinson-Waldman, managing director of the Liberty & National Security Program at the Brennan Center for Justice. “This data includes such sensitive information as an applicant’s Social Security number, date of birth, gender identity and every name they have ever used.”

Levinson-Waldman said that if the data being accessed by law enforcement and intelligence agencies isn’t tracked, then it is ripe for abuse by those who access it.

“If the State Department has no mechanism to vet the purposes for which government agents seek to access this data, it is extremely vulnerable to misuse and abuse, whether to conduct unsanctioned fishing expeditions on political antagonists or to stalk a former domestic partner,” she said. “Senator Wyden’s inquiries are critical, and the State Department should take immediate steps to significantly tighten access to this data and track the uses to which it is put.”