Lawmakers warn data protection rules don't protect key sites, including White House and CIA

The Biden administration's new data protection regulations contain significant gaps that leave critical government facilities vulnerable to foreign surveillance, according to lawmakers who reviewed the rules.

The regulations, finalized after nearly a year of development, target the purchase of commercial cell phone location data by adversaries of the United States. The rules aim to prevent hostile nations from acquiring granular tracking information gathered outside sensitive federal installations.

However, congressional critics identified a troubling oversight. The rules fail to adequately protect some of the government's most sensitive locations, including the White House and CIA headquarters. Lawmakers argue this creates a loophole that foreign intelligence services could exploit to monitor movements of top officials and intelligence personnel.

The Biden administration designed the regulations to block adversaries from purchasing data from commercial brokers who aggregate information from smartphone apps and carriers. This location data, when collected near government facilities, can reveal patterns of official activity, personnel movements, and operational schedules.

The specific vulnerabilities in the rules remain classified in congressional briefings, but lawmakers indicate the protections are uneven. Some facilities receive coverage while others, despite their operational importance, fall outside the regulatory framework.

The criticism reflects a broader tension between national security interests and the commercial data broker industry. Companies that collect and sell location information have resisted strict limitations, arguing regulations stifle business operations. The Biden administration attempted to balance these concerns while addressing legitimate security threats.

The gap between the administration's stated intentions and the actual regulatory coverage reveals implementation challenges in protecting against sophisticated foreign intelligence gathering. Lawmakers now pressure the administration to expand and strengthen the rules before adversaries fully exploit the weaknesses.

The issue highlights how emerging technologies and data collection practices outpace government security measures, forcing policymakers to continuously adapt defenses against evolving threats.