Tangle - PREVIEW - The Friday Edition: What does the government actually know about you?

Episode Date: September 5, 2025

“What does the government know about you?”A few weeks ago, Tangle staff member Russell Nystrom brought up this question in a team meeting. How much? How little? Where do they get the information and what, possibly, could they do with it?It’s an evocative question and the truth was, I only had a rough idea of the answer. Russell wanted to explore it for a story and I encouraged him to do so — and then he enlisted help from two editors on our team, Lindsey Knuth and Audrey Moorehead.Today, I’m proud to share the piece that came out of Russell’s question, which offers a series of eye-opening and thought-provoking answers.You can subscribe to Tangle by clicking here or drop something in our tip jar by clicking here. Our Executive Editor and Founder is Isaac Saul. Our Executive Producer is Jon Lall.This podcast was hosted by Isaac Saul and edited and engineered by Jon Lall. Music for the podcast was produced by Diet 75 and Jon Lall. Our newsletter is edited by Managing Editor Ari Weitzman, Senior Editor Will Kaback, Lindsey Knuth, Kendall White, Bailey Saul, and Audrey Moorehead.   Hosted on Acast. See acast.com/privacy for more information.

Thank you for your patience. Your call is important. Can't take being on hold anymore? Fizz is 100% online, so you can make the switch in minutes. Mobile plans start at $15 a month. Certain conditions apply. Details at FIS.ca. When does fast grocery delivery through Instacart matter most,

when your famous grainy mustard potato salad isn't so famous without the grainy mustard. When the barbecues lit, but there's nothing to grill, when the in-laws decide that actually they will stay. for dinner. Instacart has all your groceries covered this summer. So download the app and get delivery in as fast as 60 minutes. Plus, enjoy $0 delivery fees on your first three orders. Service fees exclusions and terms apply. Instacart, groceries that over-deliver. From executive producer Isaac Saul, this is Tangle. Hey guys, and welcome to a special episode of the Tangle podcast.

I am Isaac Saul. A few weeks ago, a Tangle staff member named Russell Nystrom brought up a question to me in a team meeting. He said, what does the government know about you? How much? How little? Where do they get the information and what possibly could they do with it? It's an evocative question, and the truth was, I only had a rough idea of the answer. Russell wanted to explore it for a story, and I encouraged him to do so, and then he enlisted

the help from two editors on our team, Lindsay Canuth and Audrey Moorhead. Today, I'm proud to share the piece that came out of Russell's question, which offers a series of eye-opening and thought-provoking answers. To jump into the story, I'm going to pass the mic over to Audrey Moorhead, one of our editors, who's going to give you some background on what exactly we're talking about. In 2022, two university researchers set out on a routine search for security vulnerabilities in Android apps when they stumbled across a strange line of code. It was malware, collecting location data on users regardless of the permission they granted it,

allowing whomever had access to the data, the ability to map out. relationships between people, places, and devices. The discovery kicked off an investigation that traced the personal data of millions of users of common apps, like Muslim prayer apps and QR code scanners, to a Panamanian data harvesting company called Measurement Systems. Looking deeper, the researchers found one more strange connection. The Panamanian malware company collecting the data shared an internet domain with another business, a Virginia defense contractor specializing in U.S. cyber intelligence operations.

Later that year, a report from the Georgetown Law Center on Privacy and Technology revealed that immigration and customs enforcement was sidestepping subpoena requirements and buying up large swathes of Americans' utility records. According to report co-author Nina Wang, the data, which included license plates, property records, and employment records, captured a 360-degree view of the lives of almost every American. While both cases prompted some immediate action, Google banned the apps that stored the offending code and major utility companies agreed to stop sharing data with ICE, incidents like these persist, and they're emblematic of too intrusive and legally questionable methods of gathering information on citizens. Number one, the government use of surveillance technologies to passively drag the internet, and number two, the government purchase of massive amounts of data through commercial data brokers. That got us thinking. What else does the government know about us?

We spoke to several experts in data collection, privacy, and government practices to learn all the information we expect the government to know, as well as what we don't expect our federal agencies to learn. Today, Tanglestaffer Russell Nistram will also share his thoughts on the government's most recent data collection practices and what they pretend for the future. But first, let's talk a little bit about what you tell the government about yourself. You probably agree.

expect the government to know some things about you, like your driver's license and social security numbers. This is personally identifying information that the government has provided for you, and that you've probably entered into countless forms. You also might expect certain agencies, like the Internal Revenue Service or the Department of Education, to have access to your employment data or student loan records, since you've volunteered that information yourself to take advantage of those offices services. Upon reflection, you might even realize the government knows quite a lot about you. Every U.S. citizen, born since 1933, has had a birth certificate issued by their state government.

And since 1946, all live births have been tracked federally by the National Vital Statistics System. While each state issues its own unique birth certificates, the federal government requires some basic information to be recorded for statistical purposes, including the location of the birth, the baby's sex, and of course, the baby's full legal name. Additionally, each U.S. citizen is given a social security number that is permanently tied to their personal identity in federal databases. When you go through a major life event like marriage, you give your updated personal information to your state government, which is required to submit statistical information on marriages and deaths to the NVSS.

The government also collects biometric data on U.S. citizens or non-citizens through means that require less explicit forms of consent. This data is collected at ports of entry, in airports, or whenever someone is apprehended or applying for government documents. The government doesn't explicitly ask permission to collect the data, but we effectively consent to it by, say, navigating a security checkpoint at an airport. The Transportation Security Administration, for example, requires individuals who want to opt into its TSA pre-check program to provide biometric data, and the agency recently implemented a facial recognition program at security checkpoints within 250 airports, which travelers can opt out of, though federal reports suggest opt-outs are rare, mostly because travelers don't know they have this option or don't want to slow the security process down. The most notable biometric data collection program is the automated biometric identification system, or IDENT,

run by the Office of Biometric Identity Management within the Department of Homeland Security. which collects the biometric data of individuals crossing the U.S. border without explicitly asking for consent to the collection. Additionally, the U.S. Citizenship and Immigration Services Office collects biometric data on asylum seekers already in the U.S. In this case, though, asylum seekers consent to the data collection as a condition to continue their asylum application. Additionally, government programs like Medicare and Medicaid maintain databases of citizens' insurance, and medical needs, while the IRS keeps tax records, including employment information, SSNs, and addresses in its databases. The government's collection methods range from innocuous to

intrusive, with no clear set of laws governing citizen data privacy. However, federal agencies are explicitly barred from sharing personal data with each other by the Privacy Act of 1974, with exceptions for special circumstances like criminal investigations. Additionally, the Privacy Act requires government agencies that collect large systems of records to declare what records they keep and allow citizens to request and amend that data. While the government discloses a lot of the data it collects on American citizens, there are still some areas where we can't be sure exactly what is known. For example, the operations of the National Security Agency are still largely secretive, even after the efforts of former defense contractor Edward Snowden and other

whistleblowers. That said, the federal government is not a monolith. Our data space, the physical and digital spaces of over 400 federal agencies, departments, and sub-agencies, not to mention the mountains of records held at the state and local levels. Each federal agency is its own data aggregating entity, often with its own strict regulations on how that data can be shared across agencies. Naturally, this creates some friction in the system. For example, the NSA can't access IRS data except in cases of active criminal investigations. Internet Law Specialist and Electric Frontier Foundation executive director Cindy Cohn said this friction in the data sharing process can prevent misuse and protect the privacy of Americans' data.

But this friction comes at the expense of government efficiency, and these concerns about efficiency have led the Trump administration to seek to reduce some of this friction with new efforts to increase data sharing. In short, this means the information you give the TSA through pre-check might become readily available to the NSA with or without a criminal information. We'll be right back after this quick break. Thank you for your patience. Your call is important. Can't take being on hold anymore? Fizz is 100% online so you can make the switch in minutes. Mobile plans start at $15 a month. Certain conditions apply. Details at fizz.ca. When does fast grocery delivery through Instacart matter most,

when your famous grainy mustard potato salad isn't so famous without the grainy mustard. When the barbecues lit, but there's nothing to grill, when the in-laws decide that actually they will stay for dinner. Instacart has all your groceries covered this summer. So download the app and get delivery in as fast as 60 minutes. Plus, enjoy $0 delivery fees on your first three orders. Service fees exclusions and terms apply. Instacart.

groceries that over-deliver. Now let's go to Associate Editor Lindsay Canuth for what the government learns about you. We give a lot of data to the government voluntarily, but much of it is taken, either scraped from the internet or bought without our knowledge or consent. Using programs called bots, crawlers, and spiders, the government regularly collects website visitor data, like IP addresses,

discerns internet usage patterns, and monitors social media platforms, according to the General Service Administration. Guidelines on the GSA website for government agencies engaged in scraping include ensuring your scraping bot is transparent about who you are and why you're scraping data, and considering scraping during off-peak hours to avoid overloading servers. The federal government is also increasingly purchasing consumer data from private companies. According to a 2024 Grandview Research report, governments around the world are the biggest consumers of data, overtaking even statistically intensive industries like banking, financial services, insurance, and health care.

Through buying private records like personal communications or cell phone data, the government ends up with a large amount of information about you that you never consented to, give, like your work email address, college major, or the name of your primary physician. Accenture, Equifax, Experian, and Thompson Reuters are just a few of the many private companies that collect raw data from all over, public records, cookies, IP tracking, other commercial data brokers, and aggregate it into large and customized sets. By all measures, the global industry of commercial data brokering is booming. The data broker market size, was almost $300 billion in 2024, and it's projected to grow by 7.3% annually for the next

eight years. These data sets, whether they're available for purchase or not, are often anonymized. But as journalist Byron Tao explained in his 2024 book, Means of Control, the pieces can easily be connected to re-identify their source. Even if I was just an anonymized number. My behavior was as unique as a fingerprint, even in a sea of hundreds of millions of others, Tao writes. There's no way to anonymize my identity in a data set like geolocation. This failure of anonymization poses unique benefits for parts of the government concerned with law enforcement and national security, think the NSA, DHS, the FBI, the CIA, and police departments around the country. All of these places are free to collect biometric data,

when conducting criminal investigations or preventing border violations. As one Maryland state trooper explained, picture getting a suspect's phone, that in the extraction of data being able to see every place they'd been in the last 18 months plotted on a map you filter by date ranges. The success, he said, lies in the secrecy. With all the avenues that exist to gather information about us, we wanted to learn more about what the government is legally constrained from knowing.

For that, we spoke with American Civil Liberties Union cybersecurity lawyer Jennifer Granik, whose seminal work in the space led Senator Ron Wyden to call her the NBA All-Star of Surveillance Law. Granik explains that the government considers not just our online, but our offline behaviors to be fair game because, quote, anyone can see it. As the government doesn't consider what we do outside to be private, federal agencies collect information about us through a surveillance network of cameras and drones. As of 2018, China, which we often consider to be the poster child for mass surveillance, operate in an estimated 349 million cameras. That's one camera for every four Chinese citizens. Well, the U.S. had roughly 70 million.

That's one for every 4.6 American citizens. Though the U.S.'s sprawling network has plenty of detractors, its benefits for public safety are often emphasized by law enforcement. Just take late last year when the national circulation of a few images, scraped from thousands of hours of video footage, enabled New York police to apprehend Luigi Mangione, the man accused of killing United Health Care CEO Brian Thompson. They apprehended him in the back booth of a Pennsylvania McDonald's.

On devices that generate user data, however, Granik noted that we do hold some constitutional and statutory rights that prevent non-consensual collection. For one, the Privacy Act of 1974 and the E-Government Act of 2002, they place limits on how federal agencies can use our personal records. And the Fourth Amendment guards against unreasonable searches, and it technically requires the government to obtain a warrant when a search interferes with our, quote, reasonable expectation of privacy.

Cases like Riley v. California from 2014 and Carpenter v. United States from 2018 have extended Fourth Amendment protections to cell phones and geolocation data. Additionally, in a bipartisan, 219 to 199 vote in April 2024, the U.S. House passed the Fourth Amendment is Not for Sale Act, a bill to close the loophole that currently allows data brokers to sell Americans' personal information to law enforcement without oversight. The Senate received the bill last year, but it has yet to take it under consideration. Granite called the decades-old legal framework around data privacy, quote, super outdated. remarking that understanding the government's data collection methods requires coming face to face with the increasingly complex pathways that our information travels between different government agencies and private corporations that use it, share it, and commodify it.

Everybody has a reason to be concerned about surveillance, she said. If people take away from this that there are not enough legal protections for our data, that is the correct takeaway. We'll be right back after this quick break. Thank you for your patience. Your call is important. Can't take being on hold anymore? FIS is 100% online, so you can make the switch in minutes. Mobile plans start at $15 a month.

Certain conditions apply. Details at FIS.C. What's better than a well-marbled ribeye sizzling on the barbecue? a well-marbled ribby sizzling on the barbecue that was carefully selected by an Instacart shopper and delivered to your door. A well-marbled ribby you ordered without even leaving the kitty pool. Whatever groceries your summer calls for, Instacart has you covered. Download the Instacart app and enjoy $0 delivery fees on your first three orders. Service fees, exclusions, and terms apply.

Instacart, groceries that over-deliver. So you might be wondering, how is the government collecting all this data, some of it without our consent, well, we just let them? The answer is twofold. First, many Americans are either ambivalent or ignorant to what is happening. And two, the government can justify data collection and sharing by pointing to all the benefits the country reaps from these practices. One of those benefits is improved government services for consumers. From a citizen's perspective, government data sharing can make navigating government assistance more streamlined. Currently, many Americans have to provide the same data, your name, your Social Security number, your date of birth, to multiple governmental agencies separately, filling out forms with the same information repeatedly. But with increased interdepartmental data sharing, citizens could fill out a form once, and all the agencies,

agencies would have access to that same data. While this might sound like a small benefit for an individual, this efficiency gain becomes hugely important at a national scale. Not only could improve data sharing reduce the billions of hours Americans spent filling out government paperwork, it could also boost the take-up rate of eligible Americans receiving government aid. Currently, about 12% of eligible recipients of the Supplemental Nutrition Assistance Program SNAP do not receive benefits.

and 19% of people eligible for the earned income tax credit do not claim the credit. Lesser-known programs like the Women Infants and Children's Program have even lower participation rates, with just over half of all eligible Americans participating. A system that automatically determines eligibility for these benefits and then enrolls qualified Americans could help millions of people access billions of dollars in aid. Another benefit that comes from data and data sharing is combating fraud. A recent government accountability office analysis found that the government misspent $925 billion over the last four fiscal years by making erroneous payments. These improper payments mostly occurred for two reasons.

One, failure to access available data. In this case, the agency making the incorrect payment actually had access to the data that would have prevented the waste, but for whatever reason, they failed to use it. For example, an agency could have had access to the Social Security Administration. death master file, failed to check it, and then sent a payment to a deceased individual. This was the largest waste cause outlined, responsible for about 67% of all improper payments in fiscal year 2024. The second reason is a lack of access to data held elsewhere. This type of error occurs when the agency making the incorrect payment could have prevented

its error by referencing an existing database, but they didn't have access to this database. It accounted for about 8.8 to 20.6% of improper payments over the last four fiscal years. So an increase in data sharing could help address both causes of wasteful spending. In preparing to share data, agencies might move their own information into more modern databases or analysis tools. While the primary goal of this data modernization would be to enable sharing, it could have the secondary effect of making these databases also more accessible and easier to use for the civil servants who use it for day-to-day functions.

Another benefit is security. Government data collection in the digital age was kicked off by the events of September 11, 2001. In the aftermath of 9-11, both private companies and the government realized they had all the data necessary to flag the perpetrators as potential terrorists. Their failure to prevent the tragedy was, quote, a failure to connect the dots, Byron Tao wrote in means of control, and a missed opportunity to capitalize on the disparate threads of data that the FBI, the CIA, and even the FAA had in the

months and days leading up to the tragedy. In the immediate aftermath, some individuals in the government recognized the potential of shared government databases to mitigate future threats. While the program that followed from that idea, called Total Information Awareness, was ultimately shut down, the government has continued to explore methods of data sharing to mitigate national security threats. For example, Section 314 of the 2001 Patriot Act facilitated information sharing between financial organizations in order to identify possible terrorist activity and report it to the government. Additionally, in 2008, Congress enacted Section 702 of the Foreign Intelligence Surveillance Act, FISA, which enables the NSA to collect the communications data of foreign persons

in order to monitor potential terrorist activity. The NSA says that U.S. citizens' data may be collected incidentally as part of this effort. Also, more recently, the cybersecurity and infrastructure security agency established in 2018 offers information-sharing programs between the federal government and state, local, and territorial governments, as well as private entities in order to prevent cyber attacks on the U.S. government or corporations. In recent years, the U.S. intelligence agencies and the Department of, Department of Defense have cooperated with Palantir to better streamline their data. Palantir co-founder John Lonsdale claims that their technology has already helped prevent

attacks and neutralize U.S. adversaries. Additionally, a 2024 GAO report found that better information sharing between agencies might help protect government funding from misuse by foreign entities. The final benefit I want to talk about is crisis response. Matt Whitinger, one of the nation's leading experts on government waste during the COVID-19 pandemic, walked us through the shortcuts that states and agencies took when distributing aid in the pandemic years. Federally, he said, agencies shifted to a pay-and-chaise model, where they distributed aid broadly and then tried to claw back improperly dispersed funds. Several states made similar tradeoffs.

For example, California stopped cross-checking certain databases, like matching unemployment recipients against prison roles, which made it easier for inel. eligible applicants to be approved. This meant that California is a total great. Hey everybody. This is John, executive producer for Tangle.

We hope you enjoyed this preview of our latest Friday edition. If you are not currently a newsletter subscriber or a premium podcast subscriber and you are enjoying this content and would like to finish it, you can go to readtangle.com and sign up for a newsletter subscription, or you can

sign up for a podcast subscription or a bundled subscription, which gets you both the podcast and the newsletter, and unlocks the rest of this episode, as well as ad-free daily podcasts, more Friday editions, Sunday editions, bonus content, interviews, and so much more. Most importantly, we just want to say thank you so much for your support. We're working hard to bring you much more content and more offerings, so stay tuned. I will join you for the daily podcast on Monday. For the rest of the crew, this is John Law signing off. Have a fantastic weekend, y'all. Peace.

Our executive editor and founder is me, Isaac Saul, and our executive producer is John Lull. Today's episode was edited and engineered by John Loll. Our editorial staff is led by managing editor Ari Weitzman with senior editor Will Kback and associate editor's Audrey Moorhead, Bailey Saul, Lindsay Canuth, and Kendall White. music for the podcast was produced by Diet 75 and John Law. And to learn more about Tangle and to sign up for a membership, please visit our website at readtangle.com. Thank you for your patience.

Your call is important. Can't take being on hold anymore? FIS is 100% online, so you can make the switch in minutes. Mobile plans start at $15 a month. Certain conditions apply. Details at FIS.ca. When does fast grocery delivery through Instacart matter most, when your famous grainy mustard potato salad isn't so famous without the grainy mustard?

When the barbecues lit, but there's nothing to grill. when the in-laws decide that actually they will stay for dinner. Instacart has all your groceries covered this summer, so download the app and get delivery in as fast as 60 minutes. Plus, enjoy $0 delivery fees on your first three orders. Service fees exclusions and terms apply. Instacart, groceries that over-deliver.