In apparent response to a successful Cato Institute administrative appeal under the Freedom of Information Act (FOIA), the Department of Justice Inspector General’s (DoJ IG) office released today additional, highly revelatory data on a Drug Enforcement Administration (DEA) mass electronic surveillance program code-named HEMISPHERE.
In March 2019, the DoJ IG released a report on three separate DEA surveillance programs titled, “A Review of the Drug Enforcement Administration’s Use of Administrative Subpoenas to Collect or Exploit Bulk Data.” The report, though highly redacted, revealed that DEA had been receiving—without court-ordered warrants—an incredibly large amount of data from telecommunications service providers ostensibly in support of drug-related investigations.
As I wrote elsewhere a year ago, even that highly redacted version of the report contained startling revelations:
- Even FBI agents offered access to this kind of data were concerned that it might be deemed illegally obtained by a federal court should the program come to light.
- The IG and/or DEA also withheld from public release in 2019 specific provisions of the DEA Agents Manual that shed critical light on the sweeping power granted line DEA agents to employ administrative subpoenas—a recipe for the abuse at scale that subsequently took place for over 20 years.
- The DoJ IG let the DEA redact and release the IG’s investigative report on the agency, calling into question the entire premise that the DoJ IG is, in fact, capable of carrying out its core mission of independent oversight of DoJ components.
Since that time, Cato has sought the release of the full March 2019 DoJ IG report. On September 26, 2024, DoJ’s Office of Information Policy (OIP) affirmed Cato’s previous administrative appeal of DEA’s withholding of the full report and remanded Cato’s request back to DEA for further processing. Today, that less redacted version of the DoJ IG report was released on the IG’s website, and it provides further disturbing evidence of the symbiotic relationship between federal law enforcement and major telecommunications providers in the employment of warrantlessly obtained commercially collected data for surveillance and investigative purposes.
Initiated in early 2007 under the auspices of the High Intensity Drug Trafficking Area (HIDTA) program, HEMISPHERE is, in the words of the IG report,
“…a contractual service program between law enforcement agencies and a telecommunications service provider (Provider B) under which Provider B maintains and exploits a vast collection of bulk telephone metadata to produce expedited or advanced telephone analytical products in response to target specific administrative subpoenas or other compulsory legal process. Provider B developed this law enforcement sensitive program on its own initiative.… Provider B has promoted HEMISPHERE’s capability to aid narcotics enforcement by serving as an ‘intelligence pointer system’ that could expeditiously identify leads in drug cases from a target’s telephone calling activities.”
The DEA tried to get the IG to delete any reference to HEMISPHERE in its report, arguing that HEMISPHERE was a telecommunications provider program, not a DEA program. The IG disagreed, noting that
The complex legal, policy, and privacy issues implicated in such a use of the DEA’s subpoena authority may change but do not disappear by virtue of the fact that a private company is willing to maintain and mine its own bulk data collection on behalf of law enforcement agencies, such as the DEA, pursuant to contractual arrangements with them.
At the time the IG report was finished, “Provider B” had accumulated “billions of non-content calling records for more than 15 years of international and long-distance calls.” It was a digital gold mine the DEA was eager to exploit.
So how effective was/is HEMISPHERE?
One DEA analyst told the IG that the program “has about an 80 percent accuracy rate in identifying relevant telephone numbers,” a claim that the IG was not able to substantiate based on the available documentation.
Was the program actually legal?
The IG’s review found that despite multiple concerns inside DEA and at the FBI as to the program’s legality under 18 U.S.C. § 2703(c)(2) of ECPA [Electronic Communications Privacy Act], and 21 U.S.C. § 876{a) (which governs Justice Department subpoena authority),
We found no evidence of any written legal analysis of the legal issues described above or of any other expected DEA use of Hemisphere in advance of the program. Indeed, it was not until January 2013, more than 5 years after the program began, that the DEA completed a robust written legal assessment, albeit in a draft memorandum that [name redacted] never memorialized into a final product or distributed to users. We believe that several earlier events should have alerted the DEA to the need for a careful legal review.
It’s worth noting that while the IG and DEA continue to redact the identity of “Provider B,” previous reporting from the New York Times and other media outlets—including responses to FOIA requests—have positively identified AT&T as the originator of HEMISPHERE.
Additionally, while the same IG report noted that two other DEA electronic surveillance and data collection programs were suspended in the summer of 2013 as a result of Edward Snowden’s revelations, there is at present no public data this author is aware of indicating that HEMISPHERE’s use by DEA or other federal, state, or local law enforcement organizations has been terminated. That fact provides further ammunition for those advocating for enactment of the Fourth Amendment in the Not For Sale Act, which passed the House last session but was not taken up by the Senate.