Loading story…
Sen. Ron Wyden and Rep. Shontel Brown asked the Government Accountability Office to investigate whether the Department of Transportation has failed for more than four decades to enforce airline passenger-data privacy protections. Their request cites allegations that Airlines Reporting Corporation, an airline-owned data broker, sold federal agencies access to roughly 722 million passenger travel records without warrants or court oversight, alongside reports of DEA traveler profiling and payments to airline employees for private passenger information.
The lawmakers said DOT has not publicly brought privacy-enforcement cases or issued civil penalties despite major incidents affecting hundreds of millions of travelers. They also requested scrutiny of DOT's oversight model and coordination with the DEA, and asked GAO to determine the status, findings, and any enforcement outcomes from the department's March 2024 review of data-collection and use practices at the 10 largest U.S. airlines, whose responses and results have not been publicly released.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
Sen. Ron Wyden and Rep. Shontel Brown asked the Government Accountability Office to investigate DOT's alleged failure to enforce airline passenger-data privacy protections, including the status of its 2024 review and coordination with the DEA. GAO confirmed receipt of the request.
The Department of Homeland Security issued a public request to contractors for a replacement airline-passenger surveillance system after Airlines Reporting Corporation ended government record sales.
The Airlines Reporting Corporation ended sales of passenger travel records to government agencies. Lawmakers said the airline-owned broker had provided warrantless access to a database containing about 722 million records.
404 Media reported that an airline-owned data broker sold Customs and Border Protection access to travelers' flight information.
Then-Transportation Secretary Pete Buttigieg announced an industrywide review seeking information from major U.S. airlines about their passenger-data privacy policies and procedures.
A 2016 Justice Department audit found that the Drug Enforcement Administration paid airline employees millions of dollars to obtain private passenger data from some Americans.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sen. Ron Wyden and Rep. Greg Casar have asked the U.S. Government Accountability Office to investigate how federal agencies use hacking tools and spyware against Americans, seeking an unclassified public report on the scope, frequency, safeguards, and legal processes behind those operations. The request targets agencies including the FBI, DEA, ICE Homeland Security Investigations, and the Secret Service, and argues that federal law enforcement has used such capabilities for more than 25 years with far less transparency than exists for traditional wiretap authorities. The lawmakers asked the GAO to examine how agencies acquire and secure hacking tools, whether government personnel have misused them, what is disclosed to courts when warrants are sought, and how Rule 41 authorities are used for court-approved hacking. The push comes amid broader scrutiny of U.S. government spyware practices, including ICE's acknowledged work with spyware firm **Paragon**, and follows concerns that stolen government hacking tools have previously been repurposed by foreign adversaries against **Ukraine** and cryptocurrency users.
Aug 21, 2026
The Airlines Reporting Corporation (ARC), a data broker owned by major airlines, has announced it will discontinue its Travel Intelligence Program (TIP), which sold hundreds of millions of customer travel records to US government agencies. This decision follows a letter from ARC's CEO to lawmakers, prompted by bipartisan pressure after revelations that the Internal Revenue Service (IRS) accessed ARC's extensive travel database without a warrant, violating federal law and agency policy. The database included detailed information on individuals' flight itineraries and credit card transactions, covering approximately 722 million ticket transactions over a 39-month period. Lawmakers criticized ARC for enabling 'prospective surveillance' by allowing government agencies to set up automated alerts for new matching reservations, effectively bypassing higher legal standards for monitoring future activity. The controversy intensified after it was revealed that the IRS did not conduct a privacy impact assessment or legal review before purchasing the data. ARC's move to halt the TIP comes amid ongoing scrutiny over the privacy implications of selling such sensitive travel data to government entities without adequate oversight or legal safeguards.
Jun 29, 2026The Airlines Reporting Corporation (ARC), owned by eight US airlines, has made at least five billion passenger records available to US government agencies via a searchable database. This data, collected from over 12,800 travel agencies and 270 global carriers, includes names, itineraries, and financial details, and is sold under the Travel Intelligence Program. The scale of data sharing is significantly larger than previously reported, raising ongoing privacy concerns.
Jun 29, 2026