Security fears over FBI contracting out highly sensitive surveillance documents

The FBI has contracted out with a private firm to handle, distribute and monitor highly sensitive surveillance documents, in an arrangement veteran FBI agents consider a potential privacy and counterintelligence risk.

Since 2015, the FBI has entrusted a national-security professional services contractor, Aveshka, to prepare, organize, courier and disseminate surveillance materials, including documentation leading to court orders under the Foreign Intelligence Surveillance Act (Fisa), the legal wellspring of domestic national-security surveillance.

Neither the company nor its employees have been accused of any wrongdoing, but national security has come under renewed scrutiny in the wake of the arrest last week of a Booz Allen Hamilton employee on suspicion of stealing National Security Agency computer code. FBI veterans and other surveillance experts consider the bureau to be effectively inserting a private firm as a middleman in surveillance, which they consider an inherent and seemingly unnecessary security vulnerability.

“The FBI here is literally giving out the keys to the national security kingdom,” said Jim Wedick, a 35-year FBI agent who retired in 2004.

“Being a courier for Fisa material, you literally have all information needed to identify both subjects and informants. Something any adversary would want. It’s the choke point for information.”

Bob Martin, a senior vice-president at Aveshka, said the contract began in 2015 and was worth less than $1m. Aveskha employees, he said, “relatively junior folks”, work within the FBI’s Fisa unit, which prepares, handles and organizes the basis for surveillance applications under the law for the secret Fisa court. The surveillance applications are prepared by the FBI but can concern surveillance from other intelligence agencies, including the NSA.

An online job posting from the firm describes its responsibilities as including “prepar[ing] Fisa documents which shall include the review and selection of relevant documents and other materials”; “[d]eliver and pickup FISA, FISA orders, and other classified documents to and from Executive Management, the Department of Justice, and other sources at scheduled times/dates”; and “[d]isseminat[ing] FISA orders and add[ing] document to electronic files and data repositories”, including the FBI’s database for tracking Fisa cases.

Martin told the Guardian the bulk of the firm’s functional responsibilities were “supporting the logistics operation” of the FBI concerning Fisa-related documents. He said he believed Aveshka employees working on the contract for the FBI held top-secret clearances and involved physically couriering the Fisa-relevant documents.

Ed Shaw, who retired from the FBI in 2014 after a 25-year career, said that ensuring Aveshka personnel held security clearances mitigated the risk of a surveillance leak. But Shaw said the material contained within Fisa submissions were amongst the most sensitive classified material the US government possessed, particularly when concerning renewals of surveillance-court orders.

“That’s how did the Fisa surveillance go, what did you get, was it worthwhile,” said Shaw, who for 18 months worked in the FBI’s security compliance unit, which investigates people for mishandling classified information. “To get a renewal, you have to show [the court] that you’re getting relevant information. It’s oozing with content.”

Several FBI veterans and outside experts noted that over decades, private contractors have become interwoven with the national-security apparatus, though usually for functions outside the agencies’ core competencies, such as designing and maintaining information-technology systems.

“Preparing Fisa documents – talk about an inherently governmental function,” agreed former FBI counterterrorism agent Michael German.

“We have a private contractor that’s preparing a wiretap request. That seems dangerous … Certainly the FBI has people who can walk across the street to the Department of Justice and deliver a Fisa package.”

Booz Allen Hamilton contractor Harold Thomas Martin III has been arrested on suspicion of taking highly classified information from the NSA. The episode has prompted a new wave of warnings about potential vulnerabilities resulting from contracting, particularly since Booz Allen also employed NSA whistleblower Edward Snowden. Privacy and security experts, however, point out that the history of US counterintelligence debacles is a story replete with risks from agency employees, such as the FBI’s Robert Hanssen and the CIA’s Aldrich Ames.

“I don’t think that private contractors are necessary more of a security risk than government employees,” said Jennifer Granick of Stanford law school’s Center for Internet and Society. As an attorney, Granick noted, preparation of court materials “often entails a lot of mundane stuff that’s not substantive.”

But a congressional aide, who was not cleared to speak for the record, considered the FBI contract bizarre.

“It is very odd to me anybody on outside government would be responsible for building the binder of Fisa materials and couriering it to place to place,” the staffer said.

Steven Aftergood, an intelligence specialist with the Federation of American Scientists, called the Aveshka contract a “sign of the times”, as private firms are increasingly enmeshed in the most sensitive national-security functions the government performs.

“By definition, this introduces some new vulnerabilities. Contractors, who are driven by a profit motive, will often provide superior service. But they may also cut corners in the name of efficiency that should not be cut,” Aftergood said.

Martin, the Aveshka vice-president, did not respond to additional requests for information on the FBI contract. FBI spokesman Christopher Allen declined comment.