Loading story…
The Airlines Reporting Corporation (ARC), a data broker owned by major airlines, has announced it will discontinue its Travel Intelligence Program (TIP), which sold hundreds of millions of customer travel records to US government agencies. This decision follows a letter from ARC's CEO to lawmakers, prompted by bipartisan pressure after revelations that the Internal Revenue Service (IRS) accessed ARC's extensive travel database without a warrant, violating federal law and agency policy. The database included detailed information on individuals' flight itineraries and credit card transactions, covering approximately 722 million ticket transactions over a 39-month period.
Lawmakers criticized ARC for enabling 'prospective surveillance' by allowing government agencies to set up automated alerts for new matching reservations, effectively bypassing higher legal standards for monitoring future activity. The controversy intensified after it was revealed that the IRS did not conduct a privacy impact assessment or legal review before purchasing the data. ARC's move to halt the TIP comes amid ongoing scrutiny over the privacy implications of selling such sensitive travel data to government entities without adequate oversight or legal safeguards.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
ARC CEO Lauri Reishus informed lawmakers that the company would discontinue the Travel Intelligence Program, which had provided government agencies access to large-scale airline ticketing and travel records. The move followed reporting and congressional scrutiny over warrantless government access to the data.
A bipartisan group of U.S. lawmakers pressed airline CEOs to shut down ARC's Travel Intelligence Program after scrutiny of government access to the travel database. They also criticized the system's ability to support prospective surveillance through alerts on future reservations.
The IRS obtained access to ARC's Travel Intelligence Program data without completing required privacy and legal reviews, including determining whether a warrant was needed. Sen. Ron Wyden later said the IRS admitted the purchase violated federal law and IRS policy.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Airlines Reporting Corporation (ARC), owned by eight US airlines, has made at least five billion passenger records available to US government agencies via a searchable database. This data, collected from over 12,800 travel agencies and 270 global carriers, includes names, itineraries, and financial details, and is sold under the Travel Intelligence Program. The scale of data sharing is significantly larger than previously reported, raising ongoing privacy concerns.
Jun 29, 2026
Sen. Ron Wyden and Rep. Shontel Brown asked the Government Accountability Office to investigate whether the Department of Transportation has failed for more than four decades to enforce airline passenger-data privacy protections. Their request cites allegations that Airlines Reporting Corporation, an airline-owned data broker, sold federal agencies access to roughly 722 million passenger travel records without warrants or court oversight, alongside reports of DEA traveler profiling and payments to airline employees for private passenger information. The lawmakers said DOT has not publicly brought privacy-enforcement cases or issued civil penalties despite major incidents affecting hundreds of millions of travelers. They also requested scrutiny of DOT's oversight model and coordination with the DEA, and asked GAO to determine the status, findings, and any enforcement outcomes from the department's March 2024 review of data-collection and use practices at the 10 largest U.S. airlines, whose responses and results have not been publicly released.
Aug 27, 2026
US government agencies are facing renewed scrutiny over their use of **commercially available data**—including data derived from the online advertising ecosystem—to track people without a warrant. Reporting cited in one account says **Customs and Border Protection (CBP)** used “commercially available marketing location data” tied to the same ad-tech systems that power targeted advertising, reinforcing long-standing concerns that surveillance advertising infrastructure can be repurposed for government monitoring. The reporting frames the issue as direct evidence that location data harvested for ad targeting can also support state surveillance. At the same time, **FBI Director Kash Patel** told the Senate Intelligence Committee that the bureau purchases commercially available information, after being pressed on whether the FBI buys data that could be used to track Americans. Sen. **Ron Wyden** argued that purchasing such data without a warrant is a workaround to **Fourth Amendment** protections and renewed calls for legislative limits, including the **Government Surveillance Reform Act**. Together, the reports show that both border and federal law enforcement agencies are relying on the commercial data broker and ad-tech ecosystem for intelligence and location-tracking purposes, intensifying the policy debate over privacy, warrant requirements, and the broader security implications of pervasive data collection.
Jun 29, 2026