WASHINGTON — A military arm of the intelligence community buys commercially available databases containing location data from smartphone apps and searches it for Americans’ past movements without a warrant, according to an unclassified memo obtained by The New York Times.

... The disclosure sheds light on an emerging loophole in privacy law during the digital age: In a landmark 2018 ruling known as the Carpenter decision, the Supreme Court held that the Constitution requires the government to obtain a warrant to compel phone companies to turn over location data about their customers. But the government can instead buy similar data from a broker — and does not believe it needs a warrant to do so.

... Mr. Wyden [the Oregon Senator for whom the memo was prepared] has made clear that he intends to propose legislation to add safeguards for Americans’ privacy in connection with commercially available location data. In a Senate speech this week, he denounced circumstances “in which the government, instead of getting an order, just goes out and purchases the private records of Americans from these sleazy and unregulated commercial data brokers who are simply above the law.”

... In November, Vice’s Motherboard tech blog reported that Muslim Pro, a Muslim prayer and Quran app, had sent its users’ location data to a broker called X-Mode that in turn sold it to defense contractors that work with the U.S. military. Muslim Pro then said it would stop sharing data with X-Mode, and Apple and Google said they would ban apps that use the company’s tracking software from phones running their mobile operating systems.

... The Defense Intelligence Agency appears to be mainly buying and using location data for investigations about foreigners abroad; one of its main missions is detecting threats to American forces stationed around the world.

But, the memo said, the unidentified broker or brokers from which the government buys bulk smartphone location data does not separate American and foreign users. The Defense Intelligence Agency instead processes the data as it arrives to filter those records which appear to be on domestic soil and puts them in a separate database.