SEC Bought Airline Data to Track Global Flights Without a Warrant

Newly obtained SEC documents show the markets regulator paid for access to more than a billion airline ticketing records. The dataset covered flights between foreign countries, not just trips touching U.S. soil. The agency that polices securities fraud was running warrantless queries on who flew where.

State of Surveillance Editorial Team

TL;DR: The Securities and Exchange Commission purchased access to more than a billion airline ticketing records from the Airlines Reporting Corporation, according to SEC documents obtained by 404 Media. The records covered flights between foreign countries, not just U.S. domestic travel. The data was almost certainly searched without a warrant. ARC stopped selling the records last year after 404 Media reporting and a November 2025 letter from four members of Congress to the airline CEOs who own ARC. The agency that polices securities fraud was a buyer in the same warrantless-flight-tracking market that has pulled in the FBI, Secret Service, ICE, DHS, and IRS.

What the SEC Bought

Joseph Cox reported at 404 Media on August 4, 2026, that the SEC bought access to what the agency's own documents describe as more than a billion airline ticketing records. The dataset covered "not just U.S. domestic flights or those landing in the country, but also flights between foreign countries, and flights entirely within foreign countries" [1].

ARC, the Airlines Reporting Corporation, was the source. Delta, United, and American were among the airlines that sold the data through ARC, an airline-owned intermediary most travelers have never heard of [1][2]. ARC is co-owned by United, American, Delta, Southwest, JetBlue, Alaska, Lufthansa, Air France-KLM, and Air Canada, and processes booking data from more than 240 airlines and 10,000 U.S.-based travel agencies. Each ticket carries the passenger's name, credit card number, departure and arrival cities, flight dates, flight numbers, and the agency that sold it [3][4].

The product ARC sold to the SEC, the FBI, Secret Service, ICE, DHS, ATF, TSA, State Department, and IRS was called the Travel Intelligence Program, or TIP. It offered searchable ticketing records with daily name-alert functionality and "automatic and recurring searches" so that agencies would be notified as soon as tickets matching certain criteria were booked [2][3][4]. The September 15, 2025 404 Media disclosure put the underlying dataset at about 5 billion plane ticket records covering roughly half of all tickets booked worldwide [4]. The November 17, 2025 congressional letter described a 39-month active window covering approximately 722 million ticket transactions [3].

Why a Markets Regulator Was Searching Flights at All

The August 4 article is blunt about the legal posture. The newly obtained records "provide additional insight into the breadth of data that airlines were selling without their customers' knowledge, and that law enforcement agencies were tapping into, likely without a warrant" [1]. The SEC did not respond to requests for comment on why a markets regulator needs that kind of reach [1][4].

This is the warrant gap that has become familiar across federal agencies. When a ticket is booked directly with an airline, agencies generally need a subpoena or court order to obtain it. When the same ticket is booked through a travel agency that feeds ARC, agencies can buy the data from a broker and skip the warrant. The November 17, 2025 congressional letter makes the contrast explicit: because ARC only has data on tickets booked through travel agencies, agencies seeking information about Americans who book directly with an airline must issue a subpoena or obtain a court order. "But ARC's data sales still enable government agencies to search through a database containing 50% of all tickets booked without seeking approval from a judge" [3]. The September 2025 404 Media investigation reported that ARC had at points instructed agencies not to disclose the source or pipeline of the passenger data they were buying, which would have hidden the lack of a warrant from anyone reviewing the resulting case file [4].

The November 17, 2025 letter was also clear that the SEC purchase was already public-record material before 404 Media obtained the internal documents. "Publicly available government contracting records show that the Securities and Exchange Commission has also purchased data from ARC" [3]. The new 404 Media reporting shows what the SEC actually got for that purchase: foreign-to-foreign flight records, daily name alerts, and a database that DHS had described in its own contracting documents as "an unparalleled intelligence resource" [1][3].

What Changed in the Last Year

Two things broke the market. The first was reporting. 404 Media's September 15, 2025 story on the 5 billion-record dataset named the buying agencies and the warrantless pipeline [4]. The second was a November 17, 2025 letter from Senator Ron Wyden, Congressman Andy Biggs, Congressman Adriano Espaillat (chair of the Congressional Hispanic Caucus), and Senator Cynthia Lummis to the CEOs of the nine airlines that own ARC. The letter, cc'd to the Secretary of Transportation and the FTC chair, asked the airlines to "immediately stop the sale of Americans' travel records to government agencies" [3].

ARC responded by winding TIP down. ARC president and CEO Lauri Reishus told lawmakers that "all TIP customers, including the government agencies referenced in your letter, were notified on November 12, 2025, that TIP is sunsetting this year," and that the program was "no longer aligned with ARC's core goals of serving the travel industry" [2]. ARC's office notified Espaillat on November 14, 2025 [2]. The 404 Media August 2026 article reports that ARC "stopped selling airline ticketing records after repeated coverage from 404 Media and pressure from lawmakers last year" [1].

Espaillat called the shutdown a model. "This is what we do. This is how we're fighting back. Other industry groups in the private sector should follow suit" [2]. Wyden was sharper: "it shouldn't have taken pressure from Congress for the airlines to finally shut down the sale of their customers' travel data" and "selling off their customers' data to the government and anyone with a checkbook is bad for business" [2].

What Stays After the Program Closes

ARC has stopped selling ticketing records, but the documents 404 Media obtained in August 2026 show that the SEC's purchase covered foreign-to-foreign flights the agency has no obvious domestic authority to search. The November 17, 2025 letter made a sharper point about the IRS: the IRS confirmed to Wyden that it did not conduct the Privacy Impact Assessment required by the E-Government Act of 2002 before buying Americans' travel data from ARC, and only completed the review after receiving Wyden's oversight request in June 2025. The IRS also confirmed it had not conducted a legal review to determine whether the purchase requires a warrant [3].

That is the throughline connecting this story to every other commercial-data-broker story we have covered. When the buyer is a federal agency and the seller is a private intermediary, the warrant requirement that applies to direct requests for the same data is the only thing standing between a subpoena-based investigation and a bought-record investigation. The data broker loophole is closed by individual programs going dark, one at a time. The mechanism that lets the next program open stays in place.

That mechanism is the same one the Pentagon, the IRS, and ICE have been using to buy phone location, driving routes, and browsing histories. The data-broker loophole explainer walks through how a federal agency turns a commercial purchase into a warrantless surveillance pipeline. The Pentagon commercial location data article traces the same shape through military procurement and adtech. The SEC's airline purchase is a third instance of the same pattern, run through a different seller.

The 17 attorneys general who asked Congress to close the loophole in 2026 are still waiting for a hearing [5]. Until that hearing happens, the next ARC, the next TIP, and the next SEC are one contract away.

What to Watch

The TIP sunset date. ARC notified TIP customers on November 12, 2025 that the program was sunsetting this year. The next signal is the actual cutoff date and whether ARC publishes it, and what happens to historical TIP data already in agency hands [2].

The SEC's own records. The August 4, 2026 disclosure came from SEC documents obtained by 404 Media. The SEC has not commented. The first FOIA request, congressional inquiry, or court filing that names a specific SEC investigation will turn the program from a budget line into a litigated record [1].

Any successor program. ARC is the only public-facing name in the airline data-broker market right now. If a new intermediary, or a renamed ARC product, picks up where TIP left off, the data broker loophole has just changed its logo.

The loophole hearing. Seventeen attorneys general asked Congress to require a warrant for any federal purchase of location, travel, or communications data from a broker. The story to watch is whether that hearing happens before another federal agency buys another billion records.

Sources

  1. 404 Media, Joseph Cox - "The SEC Bought Airline Data to Monitor Flights Worldwide" (August 4, 2026). https://www.404media.co/the-sec-bought-airline-data-to-monitor-flights-worldwide/
  2. 404 Media, Joseph Cox - "Airlines Will Shut Down Program That Sold Your Flights Records to Government" (November 18, 2025). https://www.404media.co/airlines-will-shut-down-program-that-sold-your-flights-records-to-government/
  3. Senator Ron Wyden, Rep. Andy Biggs, Rep. Adriano Espaillat, Sen. Cynthia Lummis - Letter to Airline Executives on ARC Sale of Americans' Travel Records (November 17, 2025). https://papersplease.org/wp/wp-content/uploads/2025/11/letter-to-arc.pdf
  4. 404 Media, Joseph Cox - "Airlines Sell 5 Billion Plane Ticket Records to the Government for Warrantless Searching" (September 15, 2025). https://www.404media.co/airlines-sell-5-billion-plane-ticket-records-to-the-government-for-warrantless-searching/
  5. State of Surveillance - 17 Attorneys General Ask Congress to Close the Data-Broker Loophole (2026). /news/17-attorneys-general-congress-mass-surveillance-data-broker-loophole-2026