The Biden administration is preparing an executive order that seeks to prevent foreign adversaries from accessing troves of highly sensitive personal data about Americans and people connected to the US government, according to a document obtained by Bloomberg News.

The administration plans to soon unveil the new executive order, which will direct the US Attorney General and Department of Homeland Security to issue new restrictions on transactions involving data that, if obtained, could threaten national security, according to three people familiar with the matter, who asked not to be named as the details are still private.

The draft order focuses on ways that foreign adversaries are gaining access to Americans’ “highly sensitive” personal data - from genetic information to location - through legal means. That includes obtaining information through intermediaries, such as data brokers, third-party vendor agreements, employment agreements or investment agreements, according to a draft of the proposed order.

In addition, organizations owned, controlled or operated by “countries of concern” are often obligated to hand such data over to the government when asked. The document Bloomberg obtained didn’t name specific foreign adversaries.

The White House National Security Council declined to comment. Contents of the executive order could still change. Bloomberg reviewed a draft that hadn’t yet been finalized.

‘Extraordinary threat’

The White House sees the exploitation of such data by other countries as an “unusual and extraordinary threat” to national security and foreign policy, according to a draft of the executive order. By accessing Americans’ highly sensitive data, “countries of concern” can engage in malicious activities, such as espionage, cyberattacks and blackmail, providing a strategic advantage over the US, the document said.

The US is concerned that this data could be more efficiently mined with artificial intelligence, according to the draft document, and used to track and build profiles of Americans and federal employees. Access to sensitive data tied to people and locations associated with the government or military can be used to reveal insights about them that threaten national security, it said.

“Countries of concern can use artificial intelligence to target US persons for espionage or blackmail by, for example, recognizing patterns across multiple unrelated datasets to identify potential individuals whose links to the Federal Government would be otherwise obscured in a single dataset,” the draft said.

The Biden administration is focused on developing the new regulations while “minimizing disruption to commercial activity” and maintaining global relationships focused on trade, science and economic interests, it said.

Genomic data

The administration is particularly concerned about the collection of data on political figures, journalists, academics, activists and members of marginalized communities, as well as patient data obtained through health-care providers and researchers, according to the document.

US national security officials have repeatedly warned that China has amassed massive amounts of personal data on Americans, through hacking and other methods. For instance, the Office of the Director of National Intelligence said in February of 2021 that China “has collected large health-care data sets from the US and nations around the globe, through both legal and illegal means.”

ODNI warned at the time that the collection of Americans’ genetic information endangers economic and national security, as well as individual privacy. “Losing your DNA is not like losing a credit card,” it said. “You can order a new credit card, but you cannot replace your DNA. The loss of your DNA not only affects you, but your relatives and, potentially, generations to come”

Many Chinese companies are licensed to perform genetic testing or whole genome sequencing on patients in the US health-care system, according to ODNI.

The draft order outlines concerns about foreign countries’ access to the Americans’ genomic data. The Biden administration said it intends to take action to prevent exploitation of that data, while still continuing to advance taxpayer-funded scientific research and the sharing of electronic health records between systems.

New regulations

In addition to protecting highly sensitive personal data of Americans, the proposed order also seeks to protect US “government-related data.” That includes information linked to current or recent employees, contractors and officials across the federal government, including the military, that could threaten national security.

The order calls for new regulations that prohibit or restrict people in the US from engaging in any transactions that gives adversarial countries access to government-related data or sensitive personal data or that poses an unacceptable national security risk. Biden administration officials will identify classes of transactions that will be prohibited, the draft document said.

The Biden administration will also propose new security requirements and establish a mechanism to monitor whether transactions comply with those requirements. The new regulations will be subject to public notice and comment.