FBI Quietly Forms Secretive Net-Surveillance Unit

By Declan McCullagh, CNET

30 May 12

he FBI has recently formed a secretive surveillance unit with an ambitious goal: to invent technology that will let police more readily eavesdrop on Internet and wireless communications.

The establishment of the Quantico, Va.-based unit, which is also staffed by agents from the U.S. Marshals Service and the Drug Enforcement Agency, is a response to technological developments that FBI officials believe outpace law enforcement's ability to listen in on private communications.

While the FBI has been tight-lipped about the creation of its Domestic Communications Assistance Center, or DCAC - it declined to respond to requests made two days ago about who's running it, for instance - CNET has pieced together information about its operations through interviews and a review of internal government documents.

DCAC's mandate is broad, covering everything from trying to intercept and decode Skype conversations to building custom wiretap hardware or analyzing the gigabytes of data that a wireless provider or social network might turn over in response to a court order. It's also designed to serve as a kind of surveillance help desk for state, local, and other federal police.

The center represents the technological component of the bureau's "Going Dark" Internet wiretapping push, which was allocated $54 million by a Senate committee last month. The legal component is no less important: as CNET reported on May 4, the FBI wants Internet companies not to oppose a proposed law that would require social-networks and providers of VoIP, instant messaging, and Web e-mail to build in backdoors for government surveillance.

During an appearance last year on Capitol Hill, then-FBI general counsel Valerie Caproni referred in passing, without elaboration, to "individually tailored" surveillance solutions and "very sophisticated criminals." Caproni said that new laws targeting social networks and voice over Internet Protocol conversations were required because "individually tailored solutions have to be the exception and not the rule."

Caproni was referring to the DCAC's charge of creating customized surveillance technologies aimed at a specific individual or company, according to a person familiar with the FBI's efforts in this area.

An FBI job announcement for the DCAC that had an application deadline of May 2 provides additional details. It asks applicants to list their experience with "electronic surveillance standards" including PacketCable (used in cable modems); QChat (used in push-to-talk mobile phones); and T1.678 (VoIP communications). One required skill for the position, which pays up to $136,771 a year, is evaluating "electronic surveillance solutions" for "emerging" technologies.

"We would expect that capabilities like CIPAV would be an example" of what the DCAC will create, says Steve Bock, president of Colorado-based Subsentio, referring to the FBI's remotely-installed spyware that it has used to identify extortionists, database-deleting hackers, child molesters, and hitmen.

Bock, whose company helps companies comply with the 1994 Communications Assistance for Law Enforcement Act (CALEA) and has consulted for the Justice Department, says he anticipates "that Internet and wireless will be two key focus areas" for the DCAC. VoIP will be a third, he says.

For its part, the FBI responded to queries this week with a statement about the center, which it also refers to as the National Domestic Communications Assistance Center (even Caproni has used both names interchangeably), saying:

The NDCAC will have the functionality to leverage the research and development efforts of federal, state, and local law enforcement with respect to electronic surveillance capabilities and facilitate the sharing of technology among law enforcement agencies. Technical personnel from other federal, state, and local law enforcement agencies will be able to obtain advice and guidance if they have difficulty in attempting to implement lawful electronic surveillance court orders.

It is important to point out that the NDCAC will not be responsible for the actual execution of any electronic surveillance court orders and will not have any direct operational or investigative role in investigations. It will provide the technical knowledge and referrals in response to law enforcement's requests for technical assistance.

Here's the full text of the FBI's statement in a Google+ post.

One person familiar with the FBI's procedures told CNET that the DCAC is in the process of being launched but is not yet operational. A public Justice Department document, however, refers to the DCAC as "recently established."

"They're doing the best they can to avoid being transparent"

The FBI has disclosed little information about the DCAC, and what has been previously made public about the center was primarily through budget requests sent to congressional committees. The DCAC doesn't even have a Web page.

"The big question for me is why there isn't more transparency about what's going on?" asks Jennifer Lynch, a staff attorney at the Electronic Frontier Foundation, a civil liberties group in San Francisco. "We should know more about the program and what the FBI is doing. Which carriers they're working with - which carriers they're having problems with. They're doing the best they can to avoid being transparent."

The DCAC concept dates back at least four years. FBI director Robert Mueller was briefed on it in early 2008, internal FBI documents show. In January 2008, Charles Smith, a supervisory special agent and section chief in the FBI's Operational Technology Division, sent e-mail to other division officials asking for proposals for the DCAC's budget.

When it comes to developing new surveillance technologies, Quantico is the U.S. government's equivalent of a Silicon Valley incubator. In addition to housing the FBI's Operational Technological Division, which boasts of developing the "latest and greatest investigative technologies to catch terrorists and criminals" and took the lead in creating the DCAC, it's also home to the FBI's Engineering Research Facility, the DEA's Office of Investigative Technology, and the U.S. Marshals' Technical Operations Group. In 2008, Wired.com reported that the FBI has "direct, high-speed access to a major wireless carrier's systems" through a high-speed DS-3 link to Quantico.

The Senate appropriations committee said in a report last month that, for electronic surveillance capabilities, it authorizes "$54,178,000, which is equal to both the request and the fiscal year 2012 enacted level. These funds will support the Domestic Communications Assistance Center, providing for increased coordination regarding lawful electronic surveillance amongst the law enforcement community and with the communications industry." (It's unclear whether all of those funds will go to the DCAC.)

In trying to convince Congress to spend taxpayers' dollars on the DCAC, the FBI has received help from local law enforcement agencies that like the idea of electronic surveillance aid. A Justice Department funding request for the 2013 fiscal year predicts DCAC will "facilitate the sharing of solutions and know-how among federal, state, and local law enforcement agencies" and will be welcomed by telecommunications companies who "prefer to standardize and centralize electronic surveillance."

A 2010 resolution from the International Association of Chiefs of Police - a reliable FBI ally on these topics - requests that "Congress and the White House support the National Domestic Communications Assistance Center Business Plan."

The FBI has also had help from the Drug Enforcement Administration, which last year requested $1.5 million to fund eight additional DCAC positions. DEA administrator Michele Leonhart has said (PDF) the funds will go to "develop these new electronic surveillance capabilities." The DEA did not respond to CNET's request for comment.

An intriguing hint of where the DCAC might collaborate with the National Security Agency appeared in author James Bamford's article in the April issue of Wired magazine. Bamford said, citing an unidentified senior NSA official, that the agency has "made an enormous breakthrough several years ago in its ability to cryptanalyze, or break, unfathomably complex encryption systems" - an obstacle that law enforcement has encountered in investigations.

Eventually, the FBI may be forced to lift the cloak of secrecy that has surrounded the DCAC's creation. On May 2, a House of Representatives committee directed the bureau to disclose "participation by other agencies and the accomplishments of the center to date" three months after the legislation is enacted.