🟡 Medium | Source: Schneier on Security
US Immigration and Customs Enforcement (ICE) is purchasing access to credit header data — the personal information collected when individuals open credit card accounts — via commercial data brokers. This data includes names, addresses, and other identifying details, giving ICE a warrantless route to track individuals’ locations and identities. It highlights how government agencies can bypass legal safeguards by purchasing commercially available data rather than compelling its disclosure through legal process.
Security Architect’s Take: Review your organisation’s data handling and third-party sharing agreements to ensure personal data collected for financial or identity purposes cannot flow to data brokers; consider this a concrete example of why data minimisation and strict vendor contracts matter for any SaaS or fintech platform operating in the US.
Original advisory: ICE Is Buying Access to Credit Card Records