Airlines don’t want you to know they sold your flight data to the Department of Homeland Security
Data Broker Owned by major airlines in the country (including Delta, American Airlines) and Manchester United (United), the domestic flight records of U.S. travelers were collected, visited to the Customs and Border Protection Agency (CBP) (CBP), and then as part of the contract, the contract told CBP that the CBP did not disclose where the data came from, according to CBP documents obtained by 404 media. The data includes passenger names, their complete flight itinerary, and financial details.
A portion of the Department of Homeland Security (DHS) CBP said it needed this data to support state and local police to track people’s air travel across the country, a purchase that shocked civil liberties experts.
For the first time, the documents reveal in detail why at least DHS purchased such information and detailed its own purchase of data in Immigration and Customs Enforcement (ICE). The documents also show for the first time that data brokers call Airline Reporting Corporation (ARC), tell government agencies, not to mention where it gets flight data.
“Through a shady data broker they own, called ARC, the major airlines are selling sensitive information from government bulk access to Americans, revealing where they fly and the credit cards they use,” Senator Ron Wyden said in a statement.
Other publicly released documents show that ARC is owned and operated by at least eight American airlines. The company’s board includes representatives from Delta, Southwest Airlines, American Airlines, Alaska Airlines, JetBlue and Lufthansa and Air France, as well as Air Canada. More than 240 airlines rely on arcs for ticket settlement services.
ARC’s other businesses include being a pipeline between airlines and travel agencies, finding data trends with other companies like Expedia, and preventing fraud. Travel information for selling U.S. leaflets to the government is part of the ARC Travel Intelligence Program (TIP).
The recently obtained document contained a work statement describing why an institution would purchase specific tools or capabilities, he said the CBP needed to use the ARC’s prompt product to “support federal, state and local law enforcement agencies to identify the U.S. domestic air travel ticketing information for people with interest.” The 404 media obtained the document through the Freedom of Information Act (FOIA).
The new documents obtained by the 404 Media also indicate that the ARC requires that the CBP “do not publicly identify suppliers or their employees alone or collectively, as the source of reports, and notify the ARC immediately unless a valid court order or subpoena forces the client to do so.”
The job statement shows that tips can indicate a person’s intention to pay and tickets purchased through travel agencies in the United States and its territory. The data from the Travel Intelligence Program (TIP) will provide “visibility of ticketing information for the subject or interested person’s family travel and ticketing obtained through the U.S. and its territorial travel agencies,” the document said. They added that in administrative and criminal cases, the data will be “critical”.
The online-available DHS Privacy Impact Assessment (PIA) says the prompt data is updated daily with ticket sales on the previous day and contains more than 1 billion records covering 39 months of past and future travel. The document says it is possible to search for a name, credit card or airline, but ARC contains data from ARC-approved travel agencies, such as Expedia, rather than flights booked directly with airlines. “If passengers buy tickets directly from the airline, the searches conducted by ICE won’t appear in the ARC report,” Pia said. The data affects us and non-Americans, which means it does include information about U.S. citizens.
“While obtaining domestic airline data (such as many other transactions and purchase records) is not required overall, but a legal process should still be passed to ensure independent oversight and limit data collection to records that support investigations,” Jake Laperruque, deputy director of the Security and Surveillance Program at the Center for Democracy and Technology, introduced 404 media outlets. “As with many other types of sensitive and revealing data, the government appears to intend to use data brokers to surround important guardrails and restrict how to purchase.”
According to the document, the CBP contract with ARC began in June 2024 and may be extended to 2029. CBP Contract 404 Media obtained the transaction for $11,025. Last Tuesday, the Public Procurement Database added $6,847.50 to the contract, saying it is exercising “optional first grade”, meaning it is extending the contract. The documents have been edited, but briefly mentioned the OPR or Professional Responsibility Office of CBP, partially investigating corruption among CBP employees.
