U.S. Customs and Border Protection is buying the personal information of passengers on major U.S.airlines through a little-known intermediary organization, according to a new report.
404 Media revealed Tuesday that it obtained a copy of a data-sharing contract between the federal agency and the Airlines Reporting Corporation, which provides ticket transaction settlement services between airlines and travel agencies. According to Wired, which worked with 404 Media to break the news, CBP uses the data to help federal, state, and local law enforcement agencies keep tabs on the “U.S. domestic air travel” of “persons of interest.”
As part of the contract, the Airlines Reporting Corporation asked CBP not to reveal where the data came from unless ordered to by a court.
The information allegedly includes passenger names, their flight itineraries, and financial details. A separate document from the Department of Homeland Security, of which CBP is a part, shows the agency has over a billion such records spanning 39 months of past and future travel. Federal agents can search the database by name, credit card number, or airline.
According to Wired, the data sold by the Airlines Reporting Corporation comes from accredited travel agencies, not the airlines themselves, so a traveler who buys directly from a carrier won’t have their data show up in the company’s records.
Industry Involvement
A DHS report claims the Airlines Reporting Corporation is “owned and operated by eight U.S. major airlines,” though it did not identify them. The company’s website shows its board of directors includes executives from American, Delta, United, Southwest, JetBlue, and Alaska, in addition to Air Canada, Air France, and Lufthansa.
In a statement, U.S. Senator Ron Wyden of Oregon called the Airlines Reporting Corporation a “shady data broker” and said he would push for answers from the industry.
“ARC has refused to answer oversight questions from Congress, so I have already contacted the major airlines that own ARC — like Delta, American Airlines, and United — to find out why they gave the green light to sell their customers’ data to the government,” Wyden said.
CBP defended the data-sharing arrangement in a statement to Wired.
“CBP is committed to protecting individuals’ privacy during the execution of its mission to protect the American people, safeguard our borders, and enhance the nation’s economic prosperity,” a spokesperson told the magazine. “CBP follows a robust privacy policy as we protect the homeland through the air, land, and maritime environments against illegal entry, illicit activity, or other threats to national sovereignty and economic security.”
The contract began in June 2024 and may extend to 2029, the documents show.
In May, U.S. Immigration and Customs Enforcement, better known as ICE and separate from CBP, revealed it had purchased information from the Airlines Reporting Corporation. This prompted 404 Media to investigate, and its reporters found that several other government agencies have obtained data from the company in the past.
Aside from CBP, the list includes the Secret Service, the Securities and Exchange Commission, the Drug Enforcement Administration, the U.S. Air Force, the U.S. Marshals Service, the Transportation Security Administration, and the Bureau of Alcohol, Tobacco, Firearms, and Explosives.
