By Asha S Geire (originally published on July 11 2026 via the The Traveling Privacy Lawyer in Substack)
This is the second in a three-part series. Part One introduced the two primary national security data frameworks currently in force — the DOJ’s Data Security Program and the Protecting Americans’ Data from Foreign Adversaries Act — and explained how they differ from privacy law. Part Three will outline practical steps organizations can take to assess their exposure.
A few caveats before the examples. The intelligence community’s understanding of how foreign adversaries have used commercially acquired data is, by necessity, largely classified. What appears in public reporting represents a portion of what the government knows. Where I describe confirmed incidents, I will say so. Where something is assessed, suspected, or inferred, I will note that as well.
A Pattern That Developed Quietly Over Many Years
The concern about foreign adversary access to bulk American data has been building for at least a decade.
The 2015 breach of the Office of Personnel Management remains one of the most consequential data security incidents in U.S. government history. The attackers exfiltrated personnel records of approximately 21.5 million current and former federal employees and contractors,¹ including millions of SF-86 security clearance application forms. Those forms contain detailed personal information: family members, foreign contacts, financial history, mental health disclosures, and past foreign travel.² American intelligence officials assessed the breach was carried out by Chinese state-sponsored actors — a conclusion later officially confirmed by National Security Adviser John Bolton in 2018, though China denied involvement.³ The data was never found on criminal markets, consistent with intelligence retention rather than criminal exploitation.⁴
Around the same time, Anthem, the large health insurer, was breached in an intrusion attributed by DOJ to a sophisticated China-based hacking group.⁵ The Anthem breach exposed the personal information, Social Security numbers, and employment data of approximately 78.8 million people.⁶ Again, the stolen data did not appear in criminal markets in the way financially motivated breaches typically do. Security researchers noted at the time that the combination of OPM and Anthem data, cross-referenced, could allow a sophisticated actor to build detailed profiles on federal employees and contractors.
These were not isolated events. They reflected a pattern that the Office of the Director of National Intelligence explicitly described in a February 2021 public warning: the People’s Republic of China views bulk personal data, including healthcare and genomic data, as “a strategic commodity to be collected and used for its economic and national security priorities.”⁷ ODNI’s National Counterintelligence and Security Center further noted that China had been collecting large healthcare datasets from the U.S. and other nations “through both legal and illegal means, for purposes only it can control.”⁸
That observation — that legitimate commercial activity was as significant a data vulnerability as direct cyber intrusion — is, I think, the conceptual foundation of the DSP and the PADFAA.
The Commercial Data Ecosystem as a Security Vulnerability
Three more recent incidents illustrate how that vulnerability has continued to develop.
In January 2025, location data broker Gravy Analytics disclosed a breach in which a hacker accessed its Amazon cloud environment using a misappropriated key. Researchers who obtained a copy of the leaked dataset found that it contained location data points including devices located at the White House, the Kremlin, Vatican City, and military bases around the world. By overlapping the location data with the known locations of military facilities, researchers were able to identify individuals likely serving as military personnel.⁹
The source of the data was not a government system. Gravy Analytics sourced much of its location data through real-time bidding, the advertising process in which “all of the bidding advertisers can see some information about your device, including in some cases precise location data,” during a near-instant auction that occurs when a user opens a smartphone app.¹⁰ The apps whose users appeared in the dataset — fitness applications, dating platforms, games — were generally unaware of how their users’ data was being harvested and sold. Weeks before the breach, the FTC had already taken action against Gravy Analytics for unlawfully collecting and selling Americans’ location data, including data tied to sensitive locations such as military bases. The breach surfaced a different dimension of the same problem: the commercial data that powered an advertising business could function, in the wrong hands, as a targeting resource.
Recently, in April 2026, the U.S. Central Command told Congress that it had “received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil US personnel in theater, for Operation Epic Fury.”¹¹ A bipartisan letter sent to the Pentagon on May 28, 2026, signed by fourteen members of Congress, described this as the first public confirmation that adversaries are using commercial location data to target American troops in an active war zone.¹² The data brokers involved obtained that information from smartphone advertising profiles — the same commercial data ecosystem that powered Gravy Analytics’ business model. Congress noted in its letter that the Department of Defense had been briefed on this vulnerability as far back as 2016.¹³
A recent third incident demonstrated a different category of risk. In June 2026, security researcher maia arson crimew found an open directory in the source code of dialog.org — the website of Dialog, a private invitation-only organization cofounded by Peter Thiel — visible to anyone who viewed the page source. WIRED independently verified the contents. The directory exposed sensitive records and personal details of Dialog members, including sitting Trump administration officials, two U.S. senators, the NATO Supreme Allied Commander Europe, a former Middle East chief of intelligence, a sitting ambassador, and executives from major surveillance, data-brokerage, and technology companies.¹⁴ The records — stored in a commercial Airtable database — included each participant’s political leanings, which Dialog had assured members would not be shared. Security Affairs described the result as “a perfect target list for espionage, influence operations, and blackmail.”¹⁵ No adversary conducted a sophisticated intrusion to obtain this information. It was sitting in the page source of a publicly accessible website.
How Much Data Do Adversaries Already Have?
A significant volume of Americans’ sensitive personal data has almost certainly already been acquired by foreign adversaries through a combination of breaches, commercial purchases, and other means. The OPM and Anthem incidents alone exposed detailed records on tens of millions of Americans. The National Public Data breach in 2024, in which a criminal actor exfiltrated approximately 2.9 billion records including Social Security numbers, names, addresses, and phone numbers, added substantially to what is available in criminal and potentially state-sponsored data repositories.¹⁶
The intelligence community’s view, reflected in successive Annual Threat Assessments, is that foreign adversaries — particularly China — have been systematically building databases of Americans’ personal information over many years, combining commercially purchased data with stolen data and data obtained through front companies. DOJ’s own framing of the DSP acknowledges this context directly, noting that countries of concern can use AI “in conjunction with multiple unrelated datasets to identify U.S. persons whose links to the federal government would be otherwise obscured in a single dataset and who can then be targeted for espionage or blackmail.”¹⁷
The question of whether it is too late is a legitimate one discussed seriously in the policy community. My personal view is that while past data cannot be recovered, the marginal value of continued accumulation remains significant. Adversaries who already hold historical data benefit from receiving updated information — current locations, new financial circumstances, changes in employment, updated health status. Limiting future data flows, even imperfectly, reduces the utility of historical datasets over time and constrains the ability of foreign intelligence services to maintain current, actionable profiles on individuals of interest.
The AI Dimension
The threat environment described above was already concerning before the widespread adoption of AI. AI changes the calculus in several ways that are worth understanding.
The first is scale and speed. According to CrowdStrike’s 2026 Global Threat Report, AI-enabled adversaries increased their operations by 89% year-over-year, and China-nexus cyber activity increased 38% in 2025.¹⁸ Large datasets that would previously have required significant analytical resources to process can now be interrogated, cross-referenced, and acted upon at a speed and scale that was not previously feasible.
The second is re-identification. One of the foundational assumptions of data anonymization (that removing names and direct identifiers adequately protects individual privacy ) has been substantially weakened by AI’s ability to cross-reference multiple datasets. As noted above, DOJ’s own DSP preamble reflects this directly, noting that countries of concern increasingly use AI in conjunction with multiple unrelated datasets to identify individuals whose connections to sensitive activities would be obscured in any single dataset.¹⁹ This is precisely why the DSP covers anonymized, pseudonymized, and de-identified data — the regulatory architects understood that technical anonymization no longer provides the protection it once did when adversaries have access to AI-assisted cross-referencing tools and multiple complementary datasets.
The third is the emergence of autonomous AI-enabled operations. In mid-September 2025, Anthropic detected and disrupted what it described as the first documented AI-orchestrated cyber espionage campaign conducted without substantial human intervention. The threat actor, assessed with high confidence to be a Chinese state-sponsored group designated GTG-1002, “manipulated our Claude Code tool into attempting infiltration into roughly thirty global targets and succeeded in a small number of cases.”²⁰ The operation targeted large technology companies, financial institutions, chemical manufacturers, and government agencies, with AI executing 80 to 90 percent of tactical operations independently.²¹ According to Anthropic, “the barriers to performing sophisticated cyberattacks have dropped substantially,” and “less experienced and resourced groups can now potentially perform large-scale attacks of this nature.”²²
The fourth dimension is disinformation. DOJ’s regulatory preamble for the DSP explicitly names “the spread of misinformation and disinformation intended to sow division” as one of the downstream harms that bulk personal data enables when it reaches foreign adversaries.²³ Bulk data on Americans’ political preferences, behavioral patterns, social networks, and geographic patterns can be used to develop and target influence operations with a precision that was not previously achievable. CrowdStrike’s 2026 report noted that adversaries demonstrated “increasing fluency with AI tools” throughout 2025, incorporating the technology into information operations campaigns.²⁴
What This Suggests for Organizations
The intelligence community’s warnings about foreign adversary data collection go back at least to 2015, and the regulatory response reflects a legislative judgment that the commercial data ecosystem had become a material national security vulnerability and that market forces alone would not address it.
The question of whether an organization’s data could be useful to a foreign intelligence service is no longer hypothetical. It is a question that the regulatory framework now requires organizations to take seriously — not because every company is a target, but because the commercial data ecosystem as a whole has proven to be a pathway through which bulk data reaches adversaries regardless of any individual organization’s intent.
In Part Three, I will outline the practical steps organizations can take to assess their exposure under the DSP and PADFAA and what a functional compliance program looks like.
Notes
¹ Office of Personnel Management, “OPM Cybersecurity Incidents,” press release, July 9, 2015. The final total of 21.5 million affected individuals was confirmed in OPM’s July 9 announcement. See also IAPP, “21.5 Million Breached in Second OPM Hack,” IAPP.org, July 9, 2015, https://iapp.org/news/a/21-5-million-breached-in-second-opm-hack.
² FBI Director James Comey, public statement at intelligence conference, June 24, 2015, quoted in IAPP, ibid. Comey stated: “If you have my SF-86, you know every place I’ve lived since I was 18, contact people at those addresses, neighbors at those addresses, all of my family, every place I’ve traveled outside the United States since I was 18 … Just imagine you were a foreign intelligence service and you had that data, how it might be useful to you.”
³ Ian Smith, “Bolton Confirms China Was Behind OPM Data Breaches,” FedSmith.com, September 21, 2018. China’s denial characterized U.S. speculation as “neither responsible nor scientific.” See Ministry of Foreign Affairs of the People’s Republic of China, Spokesperson Hong Lei, regular press conference, 2015, cited in Congressional Research Service, “Cyber Intrusion into U.S. Office of Personnel Management: In Brief,” R44111, 2015, https://www.congress.gov/crs_external_products/R/PDF/R44111/R44111.4.pdf.
⁴ U.S. House Committee on Oversight and Government Reform, “The OPM Data Breach: How the Government Jeopardized Our National Security for More Than a Generation,” September 7, 2016. The Congressional report found no evidence the stolen data appeared in criminal markets, a pattern consistent with state intelligence collection and retention rather than criminal exploitation.
⁵ U.S. Department of Justice, “Member of Sophisticated China-Based Hacking Group Indicted for Series of Computer Intrusions, Including 2015 Data Breach of Health Insurer Anthem Inc. Affecting Over 78 Million People,” press release, May 9, 2019, https://www.justice.gov/archives/opa/pr/member-sophisticated-china-based-hacking-group-indicted-series-computer-intrusions-including. The indictment charged Fujie Wang (王福杰) and a second individual designated as John Doe as members of a hacking group operating in China.
⁶ DOJ indictment, ibid. The indictment states that the defendants “identified and ultimately stole data concerning approximately 78.8 million persons from Anthem’s computer network, including names, health identification numbers, dates of birth, Social Security numbers, addresses, telephone numbers, email addresses, employment information and income data.”
⁷ Office of the Director of National Intelligence, National Counterintelligence and Security Center, “China’s Collection of Genomic and Other Healthcare Data from America: Risks to Privacy and U.S. Economic and National Security,” February 3, 2021, https://www.dni.gov/files/NCSC/documents/SafeguardingOurFuture/NCSC_China_Genomics_Fact_Sheet_2021revision20210203.pdf.
⁸ ODNI NCSC, ibid.
⁹ Lorenzo Franceschi-Bicchierai, “Gravy Analytics Data Broker Breach: Trove of Location Data Threatens Privacy of Millions,” TechCrunch, January 13, 2025, https://techcrunch.com/2025/01/13/gravy-analytics-data-broker-breach-trove-of-location-data-threatens-privacy-millions; Kaspersky, “Geolocation Data Broker Leak,” Kaspersky Blog, January 2025, https://www.kaspersky.com/blog/geolocation-data-broker-leak/53050/.
¹⁰ Kaspersky, ibid.
¹¹ USCENTCOM written response to Sen. Ron Wyden, April 2026, quoted in Iain Thomson, “Troops’ Phones Leaked Location Data to Foreign Adversaries,” The Register, May 28, 2026, https://www.theregister.com/security/2026/05/28/troops-phones-leaked-location-data-to-foreign-adversaries/.
¹² Bipartisan letter from Sen. Ron Wyden, Rep. Pat Harrigan, and twelve additional members of Congress to DoD Chief Information Officer, May 28, 2026, quoted in Thomson, ibid.
¹³ Thomson, ibid. Congress noted the Defense Department received a briefing on this vulnerability from a contractor in 2016 demonstrating the ability to track phones from U.S. special operations bases to locations in active operational areas.
¹⁴ Security Affairs, “Peter Thiel Secret Society Leak Creates a Perfect Target List for Espionage, Influence Operations, and Blackmail,” Security Affairs, June 2026, https://securityaffairs.com/193880/intelligence/peter-thiel-secret-society-leak-creates-a-perfect-target-list-for-espionage-influence-operations-and-blackmail.html. WIRED independently verified the contents of the exposed Airtable database.
¹⁵ Security Affairs, ibid.
¹⁶ National Public Data confirmed the scope of the breach in a disclosure published August 15, 2024. See IBM Security, “National Public Data Breach Publishes Private Data of 2.9B U.S. Citizens,” IBM.com, https://www.ibm.com/think/news/national-public-data-breach-publishes-private-data-billions-us-citizens; TechTarget, “Social Security Number Data Breach: What You Need to Know,” August 2024, https://www.techtarget.com/whatis/feature/Social-Security-number-data-breach-What-you-need-to-know. Note: the total number of unique individuals affected remains uncertain due to the potential presence of duplicate records across the 2.9 billion entries.
¹⁷ U.S. Department of Justice, “Fact Sheet: Justice Department Issues Final Rule to Address Urgent National Security Risks Posed by Bulk Sensitive Personal Data,” December 27, 2024, https://www.justice.gov/archives/opa/media/1382526/dl. See also 28 C.F.R. Part 202 (2025).
¹⁸ CrowdStrike, “2026 Global Threat Report: AI Accelerates Adversaries and Reshapes the Attack Surface,” February 24, 2026, https://www.crowdstrike.com/en-us/global-threat-report/.
¹⁹ DOJ Fact Sheet, December 2024, supra note 17; 28 C.F.R. Part 202 (2025).
²⁰ Anthropic, “Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign,” Anthropic.com, November 14, 2025, https://www.anthropic.com/news/disrupting-AI-espionage. See also Anthropic Threat Intelligence Team, full technical report, https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf.
²¹ Anthropic, ibid. The technical report states that “the threat actor able to leverage AI to execute 80-90% of tactical operations independently at physically impossible request rates.”
²² Anthropic, ibid.
²³ DOJ Fact Sheet, December 2024, supra note 17. The named harms include “espionage, surveillance, sabotage and extortion, cyberattacks, and foreign malign influence operations … including targeting specific U.S. citizen groups such as politicians, journalists, and marginalized communities … [and] the spread of misinformation and disinformation intended to sow division.”
²⁴ CrowdStrike, 2026 Global Threat Report, supra note 18.