US Customs Police Paid Contractors to Monitor the Dark Web

Immigration and Customs Enforcement has paid Flashpoint around $150,000, according to public records and documents obtained by Motherboard.

Joseph Cox

Joseph Cox

Police comb through material seized as part of Operation Hyperion. Image: US Immigration and Customs Enforcement/YouTube

Law enforcement aren't tackling the dark web alone. According to public records and documents obtained by Motherboard, a section of the Department of Homeland Security has paid contractors around $150,000 for dark web monitoring services.

The move shows the increasing presence of so-called threat intelligence companies, that aim to provide corporate and government clients with access to information gleaned from hacking forums, drug marketplaces, and other sections of the digital underground.

The public listing describing what Flashpoint's services were for.

The payments were made to Flashpoint, a company that offers products such as intelligence reports, automated alerts, and an API for access to dark web data, according to the company's website. Flashpoint says it uses human analysts and automation to monitor the internet, and customers can access historical and "near real-time data" too.

Flashpoint doesn't just offer information by itself though; clients can communicate directly with company analysts "to facilitate tailored threat investigations and deeper analyses of what is most relevant to your organization," the website continues.

In August 2014, the DHS's Immigration and Custom Enforcement (ICE) paid $149,000 for "law enforcement mission critical requirement of data and analysis on illicit activity conducted on online social networks, especially those accessed via the internet's 'dark web,'" from September 2014 to August 2015, according to a public listing of the transaction.

An order for supplies or services, obtained by Motherboard via the Freedom of Information Act, indicates that the total sum was split into two payments for $50,000, and one for $49,000. (ICE redacted what these different payments related to, stating that their release would disclose techniques and/or procedures for law enforcement investigations).

According to the document, ICE may have received other, more recent services from Flashpoint too, stretching to at least August of this year.

ICE has been behind a number of dark web arrests and operations. The agency was recently part of a worldwide awareness campaign from law enforcement, designed to highlight that purchasing illegal goods on the dark web may not be as anonymous as some think. ICE was also involved in the arrest of a poison vendor in 2014, and more recently, was linked to the bust of a man who allegedly offered murder-for-hire services on the dark web.

"In order to protect the integrity of our investigations, U.S. Immigration and Customs Enforcement (ICE) generally does not discuss law enforcement tools and techniques. The agency routinely works with the private sector to acquire tools that enable our agency to keep pace and stay ahead of evolving criminal activity that poses a threat to public safety and/or national security," ICE spokesperson Dani Bennett told Motherboard in an email.

Although Flashpoint's website doesn't go into any specifics, it claims the company has "caught bad guys for the government."

Indeed, Flashpoint's leadership has a close relationship with law enforcement, and in particular the FBI. According to to The Intercept, the US government has paid Flashpoint's Chief Innovation Officer Evan Kohlmann and his company at least $1.4 million for testifying in trials as an expert witness, and assisting with FBI investigations and consulting with other agencies.

According to public records, other US agencies that have ordered services from Flashpoint include Citizenship and Immigration Services for a total of $70,000 in 2015, the Secret Service for $331,500 in 2014, and most recently the Internal Revenue Service for $65,000 this August. Those records do not indicate whether the orders were specifically for dark web monitoring, but do suggest they related to subscriptions to Flashpoint services.

A representative for Flashpoint told Motherboard in an email that while the company "has many clients in the public and private sectors who contract for both short-term and long-term engagements, it does not disclose client details."