Documents obtained by 404 Media through a Freedom of Information Act request show the U.S. Securities and Exchange Commission bought access to a global airline ticketing database holding more than 1 billion records.
The data came from Airlines Reporting Corporation, or ARC, a clearinghouse co-owned by American, Delta, and United. It sits between airlines and travel agencies and resold bookings made through sites such as Expedia and Kayak.
The records included passenger names, the credit cards used to purchase tickets, departure and arrival cities, and flight numbers.
The SEC subscription also included an alert system. It checked new bookings against a list of people the agency was monitoring and flagged travel from the previous 24 hours. The documents show the SEC requested between one and 25 of those alerts a day.
According to the report, no court order was needed because the government bought the data rather than compelling it directly, meaning the access likely came without a warrant.
The SEC is a financial regulator charged with protecting U.S. consumers from insider trading, fraud, and market manipulation. The report said the travel and payment trail it purchased overlaps with the kind of records crypto holders can leave behind, including a credit card tied to an exchange account, a flight to a conference, and a border crossing.
A year into Donald Trump’s second presidency, the report said the SEC has pulled back from major crypto enforcement, while the data-broker route lets agencies bypass the warrant they would likely need if they sought the records directly.
The story also said the Internal Revenue Service has been expanding its surveillance of crypto investors through a similar playbook. It pointed as well to the SEC’s Coinbase probe a year ago as another sign of the agency’s interest in user data.
The “data broker loophole” returns to the spotlight
Critics describe the practice as the “data broker loophole”: buying information that agencies cannot obtain by subpoena.
ARC’s Travel Intelligence Program, according to the report, previously sold the same post-9/11 surveillance infrastructure to the FBI, IRS, and Department of Homeland Security before pressure from lawmakers forced its shutdown in 2025.
The newly released documents indicate the system reached further than previously understood. They show foreign-to-foreign trips appeared in the database alongside domestic travel.
ARC defended the program. The company told 404 Media that TIP “was established after the September 11, 2001, terrorist attacks” and “has likely contributed to the prevention and apprehension of criminals involved in... money laundering” and terrorism.
The report added that money laundering is one of the allegations most often directed at the crypto sector.