FBI Spent Tens of Thousands of Dollars on Bulk Data Collection

The FBI’s cybersecurity division has been purchasing bulk internet data from a little-known tech firm based in Florida, Motherboard reports. Team Cymru, which calls itself a “global leader in cyber threat intelligence,” sells access to bulk web traffic and claims it can provide clients access to a “super majority of all activity on the internet.” It has previously been found selling its services to a number of other federal agencies.

Motherboard came into the details of the FBI’s contract with the company via a Freedom of Information Act request. The 4-page FOIA document is heavily redacted and doesn’t given much away about the broader purpose of the bureau’s data acquisition. However, it does show that, in 2017, the government paid a total of $76,450 for the information haul. Just what the bureau’s Cyber Division ended up doing with that data isn’t exactly clear, although Motherboard notes that the data in question is what is known as “netflow” data, which, in some cases, can allegedly be used to track cybercriminal activity. Companies like Cymru typically purchase the data from internet service providers, then resell it to law enforcement agencies, Motherboard states.

The FBI isn’t the first federal agency to be found purchasing data from Team Cymru. Last September, it was reported that multiple agencies within the U.S. military had spent millions of dollars to procure a powerful internet monitoring tool from the Florida firm, dubbed “Augury.” According to advertising materials, Augury allows a user access to bulk internet traffic logs. In some cases, the data being provided could include “access to people’s email data, browsing history, and other information such as their sensitive internet cookies,” the outlet reported.

Until recently, Cymru also apparently had a relationship with a somewhat less obvious partner: the internet’s most well-known privacy browser, Tor.

Indeed, last year, Tor users began to question why the project appeared to have an infrastructure partnership with the creepy Florida company. “Why is Tor being hosted on Team Cymru’s network, a data broker known to sell internet backbone data to companies [?],” one forum user questioned, in May of 2022. The user posted a screenshot that appeared to show a DNS lookup of the Tor project that tracked back to Team Cymru. Another user pointed out that Rabbi Rob Thomas, the CEO of the company, appeared to be a member of the Tor Project’s board of directors.

In October of 2022, after Cymru’s contract with the U.S. military was publicly revealed, Tor officially announced it would be halting its partnership with the data broker. Previously, Cymru had provided “hardware and other resources” to the privacy network, according to Tor Project executive director Isabela Fernandes. It’s unclear just how extensive that partnership was—or what, exactly, it was being used for. Citing “conflicts of interest,” Fernandes announced that Tor no longer found it “tenable to continue to accept Team Cymru’s donations of infrastructure.”