2 December 2017

For professional wiretappers, technology brings challenges and opportunities

Aaron Gregg

Some people regard government surveillance as a necessary evil at best. But in the District’s outer suburbs, covertly listening in on Americans’ phone calls is considered a stable line of business by at least one local company. Steve Bock, the chief executive of wiretapping contractor Subsentio (Latin for ‘to notice secretly’), views his work as a public service in the fight to protect national security. He became part of a generation of entrepreneurs who retooled their careers in the years after the 2001 terrorist attacks on New York and the Pentagon, when the government boosted funding for defense and intelligence efforts.

As the scope of surveillance has expanded, so has Subsentio’s business. Today Subsentio operates a busy assembly line of FBI-requested wiretaps, much of it coordinated out of a nondescript office in Chantilly, Va.

Bock said public scrutiny over surveillance has so far done little to disrupt his company’s business.

“Every time there is a terrorist attack, a country’s parliament or congress will go through their breast-beating and say, ‘We need new laws in place to prevent this,’ ” Bock said. “The fact is, we see communications providers expanding globally, and we see criminals expanding globally.”

The wiretapping business is so big now that some cellphone companies maintain units of “compliance professionals” whose sole function is to aid in tapping lines. Bock said his team of a few dozen, which consists of former telecommunications professionals and former FBI wiretapping professionals, has carried out tens of thousands of wiretaps among them.

The company counts more than 300 phone companies as customers, including the world’s biggest carriers.

“You won’t find anyone who’s done more,” Bock boasted in a recent interview.

The privately held company declined to provide revenue or other financial information about its business.

Federal law requires telecommunications carriers to take certain steps to respond to FBI requests, creating an opportunity for specialized companies such as Subsentio and rivals such as Reston-based VeriSign and a Milpitas, Calif., company called Yaana, with offices in Sterling.

Subsentio became one of the biggest players in the “lawful intercept” market following a succession of targeted acquisitions, including the purchase of the “compliance” unit of rival Neustar, a move that gave the Colorado-based firm a larger foothold in Northern Virginia.

As communications technology has evolved, so has Subsentio’s business. The proliferation of encryption applications and cloud computing in recent years has put up new roadblocks to the company’s older lines of business, nudging Subsentio to seek out new opportunities as it tries to stay competitive.

The company also must negotiate the sometimes-adversarial relationship that exists between the U.S. law enforcement community and phone companies. The issue was thrust into the national conversation when Apple refused to help the FBI break into the iPhone of a man who, with his wife, fatally shot 14 people at a San Bernardino office building in late 2015. It was later disclosed that the FBI hired hackers to break into the phone.

Subsentio executives say they don’t break into encrypted devices, though they sometimes enlist the help of carriers in accessing the information.

Yet there are times when they must turn down FBI requests. Perhaps a wiretap order lacks a signature from a judge or does not include correct dates or references the wrong legal authority. In other cases, they have to tell the FBI they can’t carry out a tap because it falls out of their U.S. jurisdiction, such as when a target is traveling overseas.

Cloud computing creates it own complications, especially when data is split among servers spread across vast distances. A call can sometimes switch to a server on another continent for connectivity reasons, complicating questions of jurisdiction.

“There’s no case law to deal with this,” Bock said.

To address the problem, the company sells a “virtual tap” meant to break calls that are handled online. In April, the company was awarded an export license that let it sell the virtual tap in an undisclosed European country, paving the way for its first steps into the international market.

In a mark of how government surveillance has proliferated in recent years, the legal environment in these countries can be quite permissive. Subsentio Chief Technology Officer Marcus Thomas said that in Australia, for example, they are often required to pull Internet addresses visited by the individuals they are asked to surveil. They’re in discussions with one undisclosed customer about how to expand into Japan.

“We always wondered if our service would one day become obsolete, but that hasn’t been the case . . . we’re open for business,” Bock said. “We’ve found that every administration that’s come through has realized the value of surveillance.”

No comments: