“What does the government know about you?”

A few weeks ago, Tangle staff member Russell Nystrom brought up this question in a team meeting. How much? How little? Where do they get the information and what, possibly, could they do with it?

It’s an evocative question and the truth was, I only had a rough idea of the answer. Russell wanted to explore it for a story and I encouraged him to do so — and then he enlisted help from two editors on our team, Lindsey Knuth and Audrey Moorehead. 

Today, I’m proud to share the piece that came out of Russell’s question, which offers a series of eye-opening and thought-provoking answers.  

— Isaac

In 2022, two university researchers set out on a routine search for security vulnerabilities in Android apps when they stumbled across a strange line of code. 

It was malware, collecting location data on users regardless of the permission they granted it, allowing whomever had access to the data the ability to map out relationships between people, places, and devices. The discovery kicked off an investigation that traced the personal data of millions of users of common apps, like Muslim prayer apps and QR-code scanners, to a Panamanian data-harvesting company called Measurement Systems. Looking deeper, the researchers found one more strange connection — The Panamanian malware company collecting the data shared an internet domain with another business: a Virginia defense contractor specializing in U.S. cyberintelligence operations. 

Later that year, a report from the Georgetown Law Center on Privacy & Technology revealed that Immigration and Customs Enforcement (ICE) was sidestepping subpoena requirements and buying up large swathes of Americans’ utility records. According to report coauthor Nina Wang, the data — which included license plates, property records, and employment records — captured a “360-degree view” of the lives of “almost every American.” 

While both cases prompted some immediate action (Google banned the apps that stored the offending code, and major utility companies agreed to stop sharing data with ICE), incidents like these persist, and they’re emblematic of two intrusive and legally questionable methods of gathering information on citizens: 1) The government use of surveillance technologies to passively “drag” the internet and 2) The government purchase of massive amounts of data through commercial data brokers.

That got us thinking: What else does the government know about us? We spoke to several experts in data collection, privacy, and government practices to learn all the information we expect the government to know, as well as what we don’t expect our federal agencies to learn. Today, Tangle staff member Russell Nystrom will also share his thoughts on the government’s most recent data-collection practices and what they portend for the future.

What you tell the government about yourself.

You probably expect the government to know some things about you, like your driver’s license and Social Security numbers. This is personally identifying information that the government has provided for you, and that you’ve probably entered into countless forms. You also might expect certain agencies, like the Internal Revenue Service (IRS) or the Department of Education, to have access to your employment data or student loan records, since you’ve volunteered that information yourself to take advantage of those offices’ services.

Upon reflection, you might realize the government knows quite a lot about you. Every U.S. citizen born since 1933 has had a birth certificate issued by their state government, and since 1946, all live births have been tracked federally by the National Vital Statistics System (NVSS). While each state issues its own unique birth certificates, the federal government requires some basic information to be recorded for statistical purposes, including the location of the birth, the baby’s sex, and (of course) the baby’s full legal name. Additionally, each U.S. citizen is given a Social Security number (SSN) that is permanently tied to their personal identity in federal databases. When you go through a major life event like marriage, you give your updated personal information to your state government, which is required to submit statistical information on marriages and deaths to the NVSS.

The government also collects biometric data on U.S. citizens — and noncitizens — through means that require less explicit forms of consent. This data is collected at ports of entry, in airports, or when someone is apprehended or applying for government documents; the government doesn’t explicitly ask permission to collect the data, but we effectively consent to itby, say, navigating a security checkpoint at an airport. The Transportation Security Administration (TSA), for example, requires individuals who want to opt into its TSA Pre-Check program to provide biometric data, and the agency recently implemented a facial recognition program at security checkpoints within 250 airports (which travelers can opt out of, though federal reports suggest opt-outs are rare — mostly because travelers don’t know they have this option or don’t want to slow the security process down). 

The most notable biometric data-collection program is the Automated Biometric Identification System, or IDENT, run by the Office of Biometric Identity Management within the Department of Homeland Security (DHS), which collects the biometric data of individuals crossing the U.S. border, without explicitly asking for consent to the collection. Additionally, the U.S. Citizenship and Immigration Services (USCIS) collects biometric data on asylum seekers already in the U.S.; in this case, though, asylum seekers consent to the data collection as a condition to continue their asylum application.

Additionally, government programs like Medicare and Medicaid maintain databases of citizens’ insurance and medical needs, while the IRS keeps tax records — including employment information, SSNs, and addresses — in its databases.

The government’s collection methods range from innocuous to intrusive, with no clear set of laws governing citizen data privacy. However, federal agencies are explicitly barred from sharing personal data with each other by the Privacy Act of 1974 (with exceptions for special circumstances, like criminal investigations). Additionally, the Privacy Act requires government agencies that collect large “systems of records” to declare what records they keep and allow citizens to request and amend that data.

While the government discloses a lot of the data it collects on American citizens, there are still some areas where we can’t be sure exactly what is known. For example, the operations of the National Security Agency (NSA) are still largely secretive, even after the efforts of former defense contractor Edward Snowden and other whistleblowers.

That said, the federal government is not a monolith. Our data spans the physical and digital spaces of over 400 federal agencies, departments, and subagencies — not to mention the mountains of records held at the state and local levels. Each federal agency is its own data-aggregating entity, often with their own strict regulations on how that data can be shared across agencies. 

Naturally, this creates some friction in the system. For example, the NSA can’t access IRS data except in cases of active criminal investigations. Internet-law specialist and Electronic Frontier Foundation Executive Director Cindy Cohn said this friction in the data-sharing process can “prevent misuse and protect [the] privacy” of Americans’ data. But this friction comes at the expense of government efficiency — and these concerns about efficiency have led the Trump administration to seek to reduce some of this friction with new efforts to increase data sharing. In short, this means the information you give the TSA through Pre-Check might become readily available to the NSA, with or without a criminal investigation.

What the government learns about you.

We give a lot of data to the government voluntarily, but much of it is taken — either scraped from the internet or bought without our knowledge or consent.