The data came from Airlines Reporting Corporation, a clearinghouse co-owned by American, Delta, and United that sits between carriers and travel agencies, and resold bookings made through sites like Expedia and Kayak.
The records held passengers' names, the credit cards used to buy tickets, departure and arrival cities, and flight numbers. More than that, the SEC's subscription included an alert system that checked new bookings against a list of people it was monitoring, flagging travel from the prior 24 hours, with the agency requesting between one and 25 of these alerts a day.
No court order was needed; the government simply bought the data, likely without a warrant.
The SEC is a financial regulator, not a spy agency. Its job is to protect American consumers from insider trading, fraud, and market manipulation. But the same travel and payment trail it purchased is exactly the one crypto holders leave behind: a credit card tied to an exchange account, a flight to a conference, a border crossing. When the state can watch both the chain and the boarding pass, the line between market cop and surveillance arm gets thin.
The loophole, againCritics call it the data broker loophole: buy what you can't subpoena. ARC's Travel Intelligence Program sold the same post-9/11 surveillance infrastructure to the FBI, IRS, and Homeland Security before pressure from lawmakers forced its shutdown in 2025.
The newly released documents show its reach was wider than known—foreign-to-foreign journeys sat in the system alongside domestic ones.
ARC defended the program. The company told 404 Media that TIP "was established after the September 11, 2001, terrorist attacks" and "has likely contributed to the prevention and apprehension of criminals involved in... money laundering" and terrorism. Money laundering is the charge crypto draws most often.
