I talked about FISA & the Data Broker Loophole in my first De-Google article on Search & ChatGPT alternatives a couple weeks ago, but after learning some new information I wanted to dive deeper on what this actually looks like.
If you already know about FISA and the Data Broker Loophole and want to take action, here’s what to do:
Contact Your Reps: 202-953-1892
Sample Script: Hello, my name is [NAME] and I am your constituent in [CITY, STATE]. I’m calling to urge you to vote NO on FISA. In its current form, the bill has a data broker loophole that allow the government to ignore the Fourth Amendment and buy our data without a warrant. I don’t want the government or ICE using AI and my data to surveil me and my community. I am asking you to stand with the bipartisan coalition that believes the Fourth Amendment is Not for Sale. You need to make sure this bill doesn’t pass. How you vote will determine how I vote this year.
Call out establishment and corporate Democrats on social media
Key targets: Jim Himes (CT), Gregory Meeks (NY), Rosa DeLauro (CT), Dan Goldman (NY), Hakeem Jeffries (NY), Katherine Clark (MA), Pete Aguilar (CA), Adam Smith (WA)
You can take all of these actions and more through my “Stop Gov’t Surveillance” actions on Chilli. This situation will be moving rapidly through April 20th and I will continue to update actions there. If you want to stay up to date definitely follow me on Chilli for the latest.
For those who are unaware, America’s surveillance laws have a Data Broker Loophole which allows US government agencies to buy your data without a warrant, even though a court order would be needed to demand that same data from phone or tech companies. Since the US has no federal privacy protections in place, unlike the GDPR in Europe, Americans’ data can be bought and sold incredibly easily.
ICE is buying your data, right now. It doesn’t matter if you’re an American citizen or not.
ICE buys your location, phone number, address, license plate, and social media data through Penlink, a surveillance data broker, and Reuters.
Yes, THAT Reuters, the news company.
Reuters has a whole data business called CLEAR, and $27.3 million dollars in contacts with ICE. (Contracts here, here, & here.) One of the biggest sources of Reuters’ data is state DMVs, which can legally sell your address, phone number, driving history, driver ID to third parties like debt collectors, private investigators, and data brokers like Reuters. From 2024 through October 2025, states made at least $282 million by selling your personal data. State DMVs claim that the money goes to covering road maintenance costs and maintaining driving record databases, but I don’t think states should have to sell our information to be able to afford to maintain roads and databases. Maybe if we taxed the rich and had more public funding states wouldn’t feel the need to sell our data to make ends meet….
Penlink is owned by private equity firm Spire Capital since 2022, and merged with Cobwebs after Spire Capital purchased them in 2023. Cobwebs was founded by former members of the Israeli special forces and intelligence units in 2015, and their core products are Tangles and Webloc. Penlink has $10.6 million dollars in contacts with ICE – a $2.3 million ICE contract for use of their Webloc and Tangles software and an $8.3 million dollar contract for their PLX Investigative Software Suite. The Citizen Lab has a great analysis of Penlink, Webloc, and Tangles if you want to dig in further.
Tangles pulls publicly available data from social media platforms, including Facebook, Instagram, Twitter, LinkedIn, SnapChat, TikTok, and Reddit, dating apps like Tinder, Venmo, and the web. Government agencies like ICE that purchase services from Penlink can search Tangles for keywords, or personal identifiers like names, emails, or phone numbers to identify online accounts like on social media. Once they have the account, they can then analyze what someone has posted, their interactions, relationships, activities, & interest. With Tangles, they can monitor and profile individuals, analyze geolocation information extracted from posts and photos, and scan your network to identify groups. Tangles also uses facial recognition to enable governments to search for someone based on their photo.
Webloc hijacks real-time bidding (RTB) advertising data from apps on your phone to collect location data and other information like interests, demographics, and more that would be relevant to advertisers, but not meant for surveillance. Webloc then packages that into a database for governments or other organizations to search.
Example Webloc profile:
The way RTB works for ads within apps on your phone is that in the milliseconds before an ad is displayed, there is an auction happening behind the scenes. Thousands of companies get data about you, like your location, interests, and other parameters so they can bid to show you an ad. The highest bidder wins. But surveillance companies, like Penlink and Webloc, have infiltrated the process in order to collect and sell data to government agencies like ICE.
If an app has ads within it, it is incredibly likely that they use RTB as part of their ad serving, aka deciding what ads to show within the app. Even the app owners may not be aware that their users’ advertising data is being hijacked this way, since it’s done through advertising data exchanges versus direct data selling partnerships. RTB data from popular apps like Candy Crush, MyFitnessPal, pregnancy and cycle trackers, and more can be utilized by Webloc. You can find a full list of apps here, and I highly recommend deleting any apps that you aren’t using consistently or are just for fun (like games) to avoid your data being collected.
Cut Off the Spigot is entirely community-funded. Help me reach my sustainable funding goal of 1,000 paid subscribers by May 31st!
More info on paid benefits here – lots to come this month, and 20% off merch has been extended through May 31st!
You may be saying to yourself – I’m not doing anything illegal, I’m a US citizen, does it matter if ICE has my information?
First – just because you’re a US citizen doesn’t mean ICE won’t arrest you, as they’ve already arrested over 170 American citizens as of November 2025.
Second, state law enforcement are using these tools already. Texas State Police have purchased Webloc. They can use this tool to identify women who have traveled out of Texas to visit an abortion clinic in another state. In fact, RTB data was used by a far-right organization to track women who had visited 600 different planned parenthood offices in 48 states.
Third – the FBI may come after you for domestic terrorism.
Last week, Ken Klippenstein published fantastic reporting on the FBI’s New Political Pre-Crime Center. Trump signed the National Security Presidential Memorandum 7 (NSPM-7) last September, which directs the FBI, Justice Department & other agencies to focus on “leftist” political violence in America and not only go after these “leftists”, but to disrupt these individuals or groups before their actions result in violent political acts. As Klippenstein so aptly put it:
Through a budget request, Klippenstein found that the FBI runs a dedicated NSPM-7 Joint Mission Center that is proactively identifying domestic terrorists motivated by any of the following beliefs:
“anti-Americanism,”
“anti-capitalism,”
“anti-Christianity,”
“support for the overthrow of the U.S. Government,”
“extremism on migration,”
extremism on “race,”
extremism on “gender,”
“Hostility towards those who hold traditional American views on family,”
Hostility towards those who hold traditional American views on “religion,” and
Hostility towards those who hold traditional views on “morality.”
These are incredibly broad categories that could be defined all sorts of ways to justify investigation. For example – I’m Buddhist, if I post about my religion on social media could that be construed as “anti-Christianity”?
If the FBI purchases your data through surveillance brokers like Penlink, it can trawl your social media for posts related to these beliefs, like anti-Trump posts, and location data to find if you went to a protest or similar demonstration events.
FBI Director Kash Patel confirmed that the FBI is buying location data just a few weeks ago at a Congressional hearing. Right now, it does not look like the FBI has a contract with Penlink, but there are many companies selling this type of data.
OpenAI and the Pentagon reached a deal in February to utilize it’s AI tools within the military’s classified systems. This means surveillance agencies, previously limited by human constraints – there’s only so many agents who can only look through so many documents in a day – are now turbocharged. And with the Data Broker Loophole in place, US agencies can just buy your data and feed it into their AI systems to create a profile on you, all without a warrant.
What this actually looks like
Take “The Gospel” and “Lavender,” the Israeli Defense Forces’ AI decision support systems. The Gospel identifies bombing targets like buildings, equipment, and key infrastructure, while Lavender identifies suspicious people (aka people targets) through social connections, communication patterns, and movement profiles. Which sounds awfully similar to data Penlink provides.
Before The Gospel, human Israeli intelligence agents could generate 50 bombing targets in a year by piecing together information. Now, The Gospel can generate 100 targets in a day and recommend real-time which ones to attack. Lavender has an accuracy rate of 90% based on internal Israeli reviews, and analysts spend typically only 20 seconds reviewing a target for accuracy, mostly to check whether or not the target was male. On average 10% of targets are innocent, which scaled to the level of thousands of bombings means a lot of people were likely killed or injured based on erroneous AI targets.
The IDF went from identifying 50 targets to 36,500 targets in a year, or a 730X increase, with AI tools.
With OpenAI’s technology, the US government can quickly scale up surveillance programs to support ICE or even potentially the FBI’s new NSPM-7 Joint Field Office’s work. While the government is unlikely to be using AI to identify bombing targets to hit questionable Americans, you can see how the scale can impact who and how they’re investigating.
Hallucinations in the Data
Beyond AI incorrectly identifying people as targets for Israel, we’ve seen real-life implications of AI errors in the US already. Last year, a grandmother was in jail for nearly 6 months and lost her home, her car and her dog because AI facial recognition wrongly identified her.
Because the US does not have a federal privacy law, your data is available to be bought and sold by data brokers.
Because states don’t have adequate infrastructure funding [in my opinion because they do not tax the rich enough] or federal privacy laws to stop them, your DMV data is potentially sold off by your own state to data brokers.
Because there are no federal privacy laws to stop them, surveillance data brokers are hijacking the real-time bidding advertising ecosystem for phone apps and your location data is likely available to them.
Because the FISA Data Broker Loophole exists, your data (that isn’t protected by federal privacy laws) can be bought by US federal agencies from data brokers without a warrant. Like the FBI buying your location data.
Because the FBI is buying your location data, they can use it as part of their new domestic terrorism Joint Mission Center investigations, that focus on essentially anti-MAGA stances.
Because the government and Pentagon have a partnership with OpenAI, your data can now be analyzed at a never-before-seen scale.
Cut Off the Spigot is entirely community-funded. Help me reach my sustainable funding goal of 1,000 paid subscribers by May 31st!
More info on paid benefits here – lots to come this month, and 20% off merch has been extended through May 31st!
Take action! Closing the Data Broker Loophole is a winnable fight.
Speaker Mike Johnson is trying to pass FISA reauthorization before April 20th, when it ends, without closing the Data Broker Loophole. Democrat Jim Himes from Connecticut supports the FISA extension and is actively whipping up support from other Democrats to follow suit. These Establishment Democrats want to hand Trump the keys to mass surveillance – we cannot let that happen.
Contact Your Reps: 202-953-1892
Sample Script: Hello, my name is [NAME] and I am your constituent in [CITY, STATE]. I’m calling to urge you to vote NO on FISA. In its current form, the bill has a data broker loophole that allow the government to ignore the Fourth Amendment and buy our data without a warrant. I don’t want the government or ICE using AI and my data to surveil me and my community. I am asking you to stand with the bipartisan coalition that believes the Fourth Amendment is Not for Sale. You need to make sure this bill doesn’t pass. How you vote will determine how I vote this year.
Call out establishment and corporate Democrats on social media
Key targets: Jim Himes (CT), Gregory Meeks (NY), Rosa DeLauro (CT), Dan Goldman (NY), Hakeem Jeffries (NY), Katherine Clark (MA), Pete Aguilar (CA), Adam Smith (WA)
You can call your rep, comment on social media & other actions through my “Stop Gov’t Surveillance” actions on Chilli. This situation will be moving rapidly through April 20th and I will continue to update actions to take there. If you want to stay up to date definitely follow me there for the latest.
There is no perfect solution to completely protect yourself, but you can take some steps to mitigate risk.
Delete all apps on your phone that you don’t actually use, and consider deleting ones that you use sparingly.
Check your remaining apps against this list. While there may be apps that you can’t delete because you need to use them for one reason or another, you can at least evaluate if keeping it is worth it or not.
Make your social media private. If you aren’t using social media to promote yourself, your business, etc, update your profile to private to mitigate surveillance.
If you want to go even harder, use Signal for all or the majority of your messaging and calls. Though, make sure that the message previews are turned off.
This is all pretty scary info, but my goal is not to merely alarm you. We can fight to close the Data Broker Loophole, and take steps to protect ourselves.
We can do this!💪
Check out CutOffTheSpigot.com for resources, merch, and more.
Follow me on TikTok, Instagram, YouTube, BlueSky or UpScrolled for recap videos, and subscribe for the latest & greatest every Friday. Thanks for reading <3
Cut Off the Spigot is entirely community-funded. Help me reach my sustainable funding goal of 1,000 paid subscribers by May 31st!
More info on paid benefits here – lots to come this month, and 20% off merch has been extended through May 31st!
