Law Enforcement's Use of Commercially Acquired Information: How Can Congress Strike a Legislative Balance Between Privacy Concerns and National Security Risks in the Absence of Fourth Amendment Protections?

• Pages: 421-437
• Date: 01 November 2025
• Published date: 01 November 2025
• Author: Susannah Gilmore

STUDENT NOTES

Law Enforcement’s Use of Commercially Acquired

Information: How Can Congress Strike a

Legislative Balance Between Privacy Concerns and

National Security Risks in the Absence of Fourth

Amendment Protections?

Susannah Gilmore*

I. INTRODUCTION

Immediately after 9/11, droves of data companies, financial institutions, service

providers, carriers, and search engines opened their records to help law enforcement

locate suspected terrorists.

1

One company in particular —called Matrix— success-

fully identified a hijacker and several of the FBI’s top suspects using only a commer-

cial database.

2

Michael Shnayerson, The Net’s Master Data-Miner, VANITY FAIR (Dec. 2004), https://perma.cc/

4A57-MWK5.

Impressed by its results, the government set aside $8 million to use

Matrix to assist state and local law enforcement investigations.

3

A year later, the

same technology helped catch the D.C. sniper.

4

But by 2005, public concern about

privacy caused the government to withdraw its funding, and the technology was

instead sold to LexisNexis for over $700 million.

5

A new market for data collec-

tion, analysis, and brokerage swiftly emerged. Today, the government is one of

LexisNexis’s biggest customers, routinely purchasing commercial data to aid its

investigations and law enforcement efforts.

6

The modern data brokerage market offers a virtually unlimited supply of personal

data that private buyers and the government can legally purchase and use. In the

past few years, investigations revealed that federal agencies frequently use

Commercially-Available Information (“CAI”) for law enforcement and counterin-

telligence purposes—and they affirmatively assert that no warrant is necessary to

* Susannah Gilmore is a 2025 graduate of the University of Maryland Francis King Carey School of

Law’s evening law program. During law school, she worked full-time at the U.S. General Services

Administration and the National Security Division of the Department of Justice. Susannah also holds a

Bachelor of Arts in Political Science from the University of Virginia. I am endlessly grateful to my

village of mentors, friends, colleagues and family who supported me in my studies during a turbulent

year. © 2025, Susannah Gilmore.

1. ROBERT O’HARROW, NO PLACE TO HIDE 6–7 (2005).

2.

3. Robert O’Harrow, Anti-Terror Database Got Show at White House, WASH. POST. (May 21, 2004).

4. Matthew Hector, Do We Really Have No Place to Hide?, 24 J. Comp. & Info. L. 58, 65 (2005).

5. Robert O’Harrow, LexisNexis to Buy Seisint for $775 Million, WASH. POST. (July 14, 2004).

6. See infra Section II.b.

421

purchase this data.

7

This practice raises Fourth Amendment questions—can the

government legally purchase sensitive and personal data on U.S. individuals

without violating the Constitution? This Article argues that the answer is unfortu-

nately “yes,” because government purchases of commercial data do not constitute

state action and individuals cannot have a reasonable expectation of privacy in

data being offered on the open market. Since the Fourth Amendment does not

prevent the government from purchasing CAI, legislative action is needed to

reduce the amount of U.S. personal data being sold by data brokers and ensure re-

sponsible government use of CAI.

While ample legal scholarship criticizes law enforcement’s use of CAI from a

privacy perspective, there is little discussion of policy arguments in support of

law enforcement’s use of CAI, or in opposition to a blanket prohibition on gov-

ernment purchases of CAI.

8

This Article compares policy arguments supporting

and opposing law enforcement’s use of CAI, ultimately concluding that the cur-

rent national security risks associated with prohibiting law enforcement from

purchasing CAI outweigh individual privacy concerns. This Article also attempts

to draw attention to the negative consequences that a premature restriction of law

enforcement’s use of CAI would have in the field of counterterrorism.

9

That being said, there is still opportunity for Congress to strengthen privacy safe-

guards and ensure that law enforcement is using CAI safely and responsibly. There

is also a severe need for legislation and regulation of data brokerage generally to pre-

vent sensitive data on U.S. individuals being sold to foreign adversaries on the open

market. This presents a serious national security risk that Congress should address

before it overly restricts law enforcement’s ability to purchase CAI. Otherwise, the

United States would be at a global disadvantage in terms of access to data. This

Article concludes by suggesting ideas for future legislation to address both the pri-

vacy and national-security risks associated with CAI while ensuring that the United

States can still maintain effective counterterrorism programs.

10

II. BACKGROUND

Data brokerage originally began by offering software and services to extract

information from public records for background checks.

11

Today, data brokerage

7. See infra Section II.b.

8. A search of legal scholarship from the past four years found only one article criticizing legislative

efforts to prohibit law enforcement from using CAI. See Aaron X. Sobel, End-Running Warrants:

Purchasing Data Under the Fourth Amendment and the State Action Problem, 42 YALE L. & POL’Y

REV. 176, 176-77 (2023). In contrast, there are at least four articles that argue in support of restricting or

entirely prohibiting the law enforcement from using CAI. See, e.g., Dori H. Rahbar, Laundering Data:

How the Government’s Purchase of Commercial Location Data Violates Carpenter and Evades the

Fourth Amendment 122 COLUM. L. REV. 713 (2022); Rhea Bhatia, A Loophole in the Fourth

Amendment: The Government’s Unregulated Purchase of Intimate Health Data, 98 WASH. L. REV.

ONLINE 67 (2024); Matthew Tokson, Government Purchases of Private Data, 59 WAKE FOREST L. REV.

270 (2024); Andrew Wade, The Clocks Are Striking Thirteen: Congress, Not Courts, Must Save Us from

Government Surveillance via Data Brokers, 102 TEX. L. REV. 1099 (2024).

9. See infra Section IV.b.

10. See infra Part V.

11. GINA MARIE STEVENS, CONG. RSCH. SERV., DATA BROKERS: BACKGROUND AND INDUSTRY

OVERVIEW 2–3 (May 3, 2007).

422 JOURNAL OF NATIONAL SECURITY LAW & POLICY [Vol. 15:421