AT&T Inc. (NYSE:T) provides the Central Intelligence Agency with foreign call logs, including internationally placed calls made by U.S. citizens, for $10 million a year without a court order or any other sort of official pressure. If one of the numbers belongs to a U.S. customer the number is apparently masked to satisfy legal constraints, but metadata is still included, reports Jacob Kastrenakes for The Verge.

AT&T Wireless

AT&T foreign call sales

This program is different from the ongoing National Security Agency revelations mostly because it seems to be legal. The NSA and CIA are barred from spying on Americans, but spying on other people is pretty much the reason they exist, so this type of relationship isn’t surprising, even if it’s troubling for privacy advocates. The CIA wants the logs so that it can act quickly in case it gets a tip it wants to follow up on, and it can get around the restrictions that require U.S. citizens’ numbers to be masked by bringing in the Federal Bureau of Investigation, who is allowed to investigate Americans.

The larger issue is what information people can reasonably expect to be treated as private. While tapping U.S. citizens’ phones and listening to conversations without a warrant is still illegal (which isn’t to say it doesn’t happen), apparently any metadata related to that call can be sold on the market. You could argue that providing this information to the CIA is different than putting it up for sale, but there’s no reason to think that AT&T Inc. (NYSE:T) wouldn’t sell the information to someone else. No one would have expected the credit bureau Experian to sell social security numbers, driver’s license numbers, and bank account information on millions of Americans to identity thieves, but they did and so far there hasn’t been any real blowback.

So for now, AT&T Inc. (NYSE:T) is selling call logs to the CIA in the name of stopping terrorism (while turning a profit). When that information becomes useful to marketers or some other Big Data company, they’ll probably sell it to them as well. To expect anything else in the absence of strong privacy protection laws seems a bit naïve.