Summary
- Documents from the SEC reveal the agency subscribed to the Airlines Reporting Corporation's Travel Intelligence Program, accessing over a billion ticket records.
- The information included personal details like names, credit card information, travel routes, and a system that flagged new bookings of monitored individuals—likely without obtaining a warrant.
- The Airlines Reporting Corporation, which is co-owned by Delta, United, and American Airlines, sold this data until legislative pressure led to its discontinuation in 2025.
According to documents obtained by 404 Media through a Freedom of Information Act request, the Securities and Exchange Commission (SEC) purchased access to a global airline ticketing database containing more than one billion records.
This data originated from the Airlines Reporting Corporation (ARC), a clearinghouse co-owned by American Airlines, Delta Air Lines, and United Airlines. ARC acts as an intermediary between carriers and travel agencies, reselling bookings made via platforms like Expedia and Kayak.
The records included passengers' names, credit card details used for ticket purchases, flight routes, and numbers. Additionally, the SEC's subscription featured an alert system that monitored new bookings for individuals under scrutiny, flagging any travel made within the last 24 hours, with requests ranging from one to 25 alerts daily.
No judicial order was necessary; the agency acquired the data, likely without a warrant.
Although the SEC serves as a financial regulator focused on protecting consumers from insider trading, fraud, and market manipulation, the travel and payment information it purchased mirrors what cryptocurrency holders often leave behind: credit card connections to exchange accounts, flights to conferences, and border crossings. The ability for the state to observe both blockchain transactions and travel itineraries raises concerns about the blurred lines between regulatory oversight and surveillance.
One year into Donald Trump's second term, the SEC has reduced its aggressive stance on crypto enforcement, while leveraging data broker avenues to bypass the warrant requirement that would apply if they sought the records directly.
The IRS has similarly been enhancing its scrutiny of crypto investors using the same strategy. The SEC's investigation into Coinbase last year demonstrated a similar interest in acquiring user data. The issue at hand is not whether the SEC desires this information but rather how it obtains it.
The loophole, revisited
Critics have labeled this the data broker loophole: acquiring what one cannot subpoena. ARC’s Travel Intelligence Program previously provided the same post-9/11 surveillance infrastructure to the FBI, IRS, and Homeland Security before legislative pressure led to its termination in 2025.
Documents that have recently come to light indicate that the program's scope was broader than previously recognized, encompassing foreign-to-foreign travel in addition to domestic trips.
ARC defended its program, stating to 404 Media that TIP "was created following the September 11, 2001, terrorist attacks" and "has likely aided in the prevention and capture of criminals involved in... money laundering" and terrorism, a charge often associated with cryptocurrencies.