ODNI Declassified Report On CAI January 2022

The Office of the Director of National Intelligence’s Senior Advisory Group Panel on Commercially Available Information submitted a report to the Director on twenty‑seventh January, two thousand twenty‑two. The document, titled “Report on Commercially Available Information,” is notable because it provides the Intelligence Community’s first comprehensive assessment of the role, value, and policy challenges of data that can be purchased on the open market. The report was approved for release by the Office of the Director of National Intelligence on sixth June, two thousand twenty‑three. It was made publicly available through The Black Vault archive, under the entry for the ODNI declassified report on CAI, January 2022. The declassification authority is the Director of National Intelligence, and the release was part of a routine FOIA‑related disclosure. The document opens with a formal letter to the Honorable Avril Haines, Director of National Intelligence, in Washington, District of Columbia. It states: “With this letter, we transmit our ninety‑day report on commercially available information, or CAI. We appreciate your commissioning the report and the assistance of your office and other Intelligence Community elements in this time‑sensitive undertaking.” The report’s terms of reference required it to (1) describe the role of CAI in intelligence collection and analysis; (2) reflect on the existing framework for protecting privacy and civil liberties; and (3) make recommendations to the Intelligence Community regarding how, and under what circumstances, an IC element should collect, use, retain, and disseminate CAI. The panel notes that it does not provide an independent legal analysis, but follows the IC’s own approach to policy questions. Key highlights are enumerated: 1. There is today a large and growing amount of CAI that is available to the general public, including foreign governments, their intelligence services, private‑sector entities, and the IC itself. 2. CAI clearly provides intelligence value, whether considered in isolation or in combination with other information, and whether reviewed by humans or by machines. At the same time, it raises significant issues related to privacy and civil liberties. The widespread availability of CAI concerning the activities of large numbers of individuals is a relatively new, rapidly growing, and increasingly significant part of the information environment in which the IC must function. 3. Under IC elements’ rules and procedures, CAI—because it is also publicly available information—is less strictly regulated than other forms of information acquired by the IC. The panel observes, however, that profound changes in the scope and sensitivity of CAI have overtaken traditional understandings. Today’s publicly available CAI is very different in degree and in kind from traditional publicly available information. 4. The panel offers three recommendations concerning the acquisition and treatment of CAI by the IC. • First, the IC should develop a multi‑layered process to catalog, to the extent feasible, the CAI that IC elements acquire. This will require attention to procurement contracts, data acquisition processes, data flows, and data use. The panel argues that the IC cannot understand and improve how it deals with CAI unless it knows what it is doing with CAI. • Second, based on the knowledge gained from that process, the IC should develop a set of standards and procedures for CAI, governing and requiring regular re‑evaluation of acquisition and use decisions. The panel supplies several points that could be included in those standards, while recognizing the need for adaptation across different IC elements with distinct CAI needs and missions. • Third, the IC should develop more precise guidance to identify and protect sensitive CAI that implicates privacy and civil liberties concerns. The panel offers suggestions for the development of such guidance. The panel emphasizes a single most important point: CAI is increasingly powerful for intelligence and increasingly sensitive for individual privacy and civil liberties, and the IC therefore needs to develop more refined policies to govern its acquisition and treatment. The report does not prescribe those policies, but it is intended to assist the IC in their development. The executive summary reiterates that CAI is a subset of publicly available information, distinct from commercial information that is exclusively available to governments. The volume and sensitivity of CAI have expanded in recent years due to advances in digital technology, including location‑