A quiet outrage has built up against the “Quantico
Circuit,” a high-speed wiretap connection that allegedly links the FBI’s
Quantico headquarters to a high-speed switching center belonging to Verizon
Wireless.
Discovered in 2003 by security consultant Babak Pasdar while working for
Verizon, the so-called Quantico Circuit is a 45 megabit DS-3 line that connects
one of Verizon’s main switching offices to an undisclosed destination somewhere
in Quantico, Virginia. In a brief to Congress filed by Tom Devine of the
Government Accountability Project, Pasdar says the Quantico Circuit enjoyed a
“unique” exemption from “all security measures and access control,” and that
his supervisors refused to answer questions on the circuit’s nature:
“They repeatedly winked, smiled, asked his question back, and refused to
answer or explain,” wrote
Devine (DOC).
More recently, representatives John Dingell, Edward Markey, and Bart Stupak
from the House Energy and Commerce Committee dispatched a series of “Dear
Colleague” letters (PDF) in an effort to raise awareness of potential
privacy concerns and gather additional information: the circuit’s details are
especially important to FISA updates currently making their way through Congress,
some of which could grant the government powerful new wiretap abilities.
Anecdotal evidence suggests the destination to be the FBI’s Quantico
facility, which is the nerve center of the bureau’s electronic surveillance
operations. Wired’s Threat Level reports Pasdar’s claims to be “nearly
identical” to allegations in a 2006 lawsuit, which alleges Verizon Wireless
of maintaining an “unprotected” transmission line at one of its main
datacenters:
“Because the data center was a clearing house
for all Verizon Wireless calls, the transmission line provided the Quantico recipient
direct access to all content and all information concerning the origin and
termination of telephone calls placed on the Verizon Wireless network as well
as the actual content of calls.
“The transmission line was unprotected by
any firewall and would have enabled the recipient on the Quantico end to have
unfettered access to Verizon Wireless customer records, data and information.
Any customer databases, records and information could be downloaded from this
center.”
Information obtained by Freedom of Information Act filings from the
Electronic Frontier Foundation reveal a network of at least 40 such circuits,
which are part of a point-and-click interface known as DCSNet, or the “Digital
Collection System Network.”
The Quantico circuit is of particular concern, as both Pasdar and the 2006
lawsuit describe a practically unprotected wiretap connection running straight
into the heart of Verizon’s phone system – giving the FBI direct access to
customer data without having to go through the telco's normal process. “When
you're building something like this deeply into the telecommunications
infrastructure, when it becomes so technically easy to do, the only thing that
stands between legitimate use and abuse is the complete honesty of the persons
and agencies using it and the ability to have independent oversight over the
system's use,” says Lauren Weinstein, who is co-founder of the advocacy group
People for Internet Responsibility. She describes the problem as a question of,
“who watches the listeners?”
The FBI says that it follows all necessary legal procedures, and that the
circuit Pasdar describes does not exist. In an interview with the Washington
Post, FBI Technology director Anthony Di Clemente said that all telecom
circuits to Quantico are one-way, built solely to receive data from carriers.
Al Gidari, an industry lawyer that assists telecoms with wiretap requests,
confirmed the FBI’s statements and noted that investigators currently “have to
rely on a human being at a telecom calling up every 15 minutes to send law
enforcement the data.”
He adds that the FBI is pushing for an “automatic feed,” although they do
not currently have one. Such a line would work “continuously,” providing
real-time data regardless of when you’re “checking the weather on your mobile
device or making a call.”
“It’s full tracking capability. It’s a scary proposition,” said Gidari.
But Pasdar, now CEO of security consultancy Bat Blue, described a circuit
technically capable of everything Gidari described the FBI as wanting. The line
he encountered allowed “unfettered” to Verizon’s internal network, with less
security than Verizon’s internal network. “Even the telecom's own branch
offices were firewalled, with strictly limited and controlled access to
specified data center systems. By contrast, the Quantico Circuit had
uncontrolled, blanket access to all systems.”
Devine urges Congress to consider the Quantico circuit's implications: “Mr.
Pasdar believes that for an informed choice about what it means to grant
telecom immunity, Congress must obtain definitive answers to these type
questions. He believes the operation's entire scope must be subjected to public
scrutiny before excusing telecoms from legal accountability, whether or not the
Quantico Circuit went to the government. If the telecom practices he witnessed
are not an aberration, the answers will tell us whether in reality the concept
of privacy – let alone the right – still exists for any communications
involving mobile phones.”