The order allows data brokers and other companies to sell access to large stores storing geolocation data, genomic information and other sensitive personal information to buyers in “countries of concern” such as China, Russia and Iran. government officials have told industry and private groups that the Social expert. The upcoming order was first reported by Bloomberg.
Federal officials have long suspected that information legally purchased from data brokers or stolen by hackers working for foreign governments can be used to spy on or blackmail high-value targets in the United States, including members of Congress and the military. The company has expressed concern about the risk that it could be used for For example, the Washington Post reported in 2021 that China mines Western social media, including Facebook and X, to provide security services with information about foreign targets.
Recent advances in artificial intelligence have also raised concerns that data could be analyzed in more powerful ways, making it possible to profile and spy on activists, journalists, politicians, and more. At the same time, new Chinese laws have restricted foreign access to data that was once available to academics, researchers, and Western companies.
China’s siphoning of tens of millions of Americans’ data through hacking and takeovers has long been a concern for U.S. authorities. A massive Chinese cyber breach of federal employee records discovered in 2014 and a Marriott Hotels database several years later, combined with existing and commercially available information, has led to This raised concerns that the Russian government was building up its capabilities. To track individuals, including undercover CIA personnel.
A former senior U.S. official, speaking on condition of anonymity due to the sensitivity of the matter, said there were “serious negative consequences” as a result of these breaches.
With vast stores of individuals’ genomic, location, health, and financial data now commercially available, officials say foreign adversaries can use their brokers without users’ knowledge or consent. I am concerned that large amounts of information can be purchased from people. For example, there is no law preventing genomics companies from contracting with Chinese companies to sequence genetic samples.
“China uses massive amounts of data collection for surveillance and repression,” said James A. Lewis, a technology policy expert at the Center for Strategic and International Studies. “And the fear is that they might use Americans’ data for malicious purposes.”
At the same time, some analysts said the order would likely be difficult to implement and enforce, and governments would need to find ways to track the flow of commercial data on a global scale.
“Will this be effective in denying access to this data in the face of a persistent and sophisticated foreign adversary?” said Nigel Colley, deputy director of trade policy at the Information Technology and Innovation Foundation. Asked. “At this stage, it is difficult to see how what the administration is doing will be sufficiently targeted and effective.”
Other analysts say the narrowly targeted administration intended by the Biden administration could embolden future presidents and other governments to exert more aggressive influence over the world’s most powerful communications medium. I am concerned that there is a gender.
“My impression is that the administration doesn’t want to fragment the Internet,” said Sam Sachs, a senior fellow at the Paul Tsai China Center at Yale Law School. It added that the data categories appear to be limited. “But with new types of data collection, they could expand as we play whack-a-mole,” she says.
Government officials declined to comment, saying the order had not yet been issued. But they said at a news conference that such action is necessary in the absence of a national data privacy law regulating the collection and sale of sensitive information about U.S. citizens. And they noted that the order merely begins a months-long rulemaking process in which industry and civil society groups can offer suggestions and criticism.
Concerns about the government’s limited ability to address the threat of foreign data misuse also prompted the order. Currently, the most powerful channel is a cross-agency group known as the Committee on Foreign Investment in the United States (CFIUS), which has the power to review and block individual foreign business transactions on national security grounds. The commission says comprehensive policies are needed to guide decision-making in areas involving companies that collect sensitive personal data. The Justice Department, which reviews certain communications licenses for national security risks, has similar concerns.
The order does not extend to Americans’ “expressive” activities such as social media posts and messages or videos on platforms like TikTok. TikTok is a popular video app whose ownership by Chinese tech giant ByteDance has sparked intense debate in Washington over national security. and freedom of expression.
The order does not target specific companies such as TikTok. However, if an app collects large amounts of information, such as location data, that is considered sensitive because it could help identify individuals and their habits, it may not be able to send that information to countries of concern. said the expert.
For each category of restricted data, the controlling authority specifies the amount beyond which transfer is prohibited. For example, a certain number of U.S. individuals in the case of genomic data, a certain number of devices in the case of geolocation data.
Some of the most sensitive include people’s DNA, biometric data, and computer keyboard usage patterns. The goal is not, for example, to prevent an American from sending their DNA to the genomics company 23andMe to find out whether they have distant relatives in China, but the company does sell data in large quantities to China. , will be prohibited from collaborating with Chinese processors. Solid, they said.
U.S. authorities believe that BGI Group, a Chinese company with a U.S. subsidiary, currently operates the National Gene Bank of China, a vast government-owned repository containing genetic data extracted from millions of people around the world. He pointed out that Intelligence officials said they believed Chinese companies were trying to obtain DNA from Americans.
“Genomic data provides a blueprint for future biotech products and capabilities to grow economies, but in the wrong hands it can be weaponized to create genetically engineered pathogens or It could also be exploited to identify and target individuals,” said Michel Lozo, Vice Chair of Genomic Data. Congressional-mandated National Security Commission on Emerging Biotechnology. “Genomic data is a strategic resource, and the United States needs to treat it as such.”
The order covers large amounts of data exchanged as part of a corporate investment, acquisition, or contract, although exceptions may exist if the data exchange meets certain cybersecurity and privacy requirements. There is a gender. The order would exempt multinational corporations and federal contractors from normal financial activities, including companies and government agencies that process payroll data for employees in concerned countries.
Some Commerce Department officials have expressed concern that the plan could harm trade and economic activity, including imposing complex new requirements on companies with international operations, according to some experts. are doing. Administration officials said the order was narrowly determined to minimize negative impacts.
Experts say enforcement will be made difficult by determined adversaries seeking to buy data through third parties in countries outside the United States. “What about using proxies?” Corey said. “How do you expect companies to do their due diligence to figure out who the ultimate owners of the company are? How do they handle the different transactions?”
Whatever rules are ultimately adopted, it is important to have the flexibility to adapt in the future, he said. “This is uncharted territory,” Corey said.
Cate Brown contributed to this report.
