Cracking Down on Federal Aid for Reproductive Health Surveillance: The National Domestic Communications Assistance Center

This series of blog posts examines how the federal government and the White House — which has pledged to fight against the criminalization of abortion — can prevent federal surveillance assistance to state and local law enforcement from being used to investigate and prosecute reproductive health care choices.

In our first post, we examined how FBI assistance through Regional Computer Forensic Laboratories aids local law enforcement in accessing and analyzing electronic devices. In this edition, Part 2 in the series, we’ll examine how the National Domestic Communications Assistance Center (NDCAC) supports state and local law enforcement in monitoring Americans’ communications.

***

Government acquisition of communications is a complex process, and has become even more so given the diffuse array of apps and services individuals use to communicate: Texting, emails, voice and video calls, and messaging on social media platforms are all part of the current electronic communications ecosystem. Companies in all these spaces can provide an array of information about users’ messages, as well as other data such as location information and communications metadata.

To help state and local law enforcement obtain and analyze electronic communications and related data, the National Domestic Communications Assistance Center (NDCAC) was formed in 2012 — just as a new round of the “Going Dark” encryption debate was heating up. The FBI entity has since grown into a broad system of communications surveillance support for state and local law enforcement, and today offers a range of aid that spans logistical support (how to find companies that hold communications data and what data to seek from them), legal support (how to efficiently make successful applications for court orders to compel the disclosure of data), and technical support (how to extract, analyze, and use certain data). The help the NDCAC provides encompasses both acquisition and investigative use of sensitive digital data.

In total, the NDCAC hosts 150,000 portal visits from law enforcement portal each year, serving over 24,000 law enforcement clients. NDCAC tools are downloaded over 8,000 times annually. Its Technical Resource Group — which provides aid in obtaining and analyzing data — responded to over 7,600 assistance requests in the six months preceding its most recent public report.

Logistical Support

The NDCAC offers law enforcement a database cataloging the providers of communications applications and services, with information on how to effectively acquire data from them. The database includes industry points of contact for over 4,000 providers. The NDCAC’s apps and databases also provide law enforcement with details on the types of data various apps maintain – such as audio messages, chats, files, images, video calls, and video messages, as well as whether records available from the app are historic or can be obtained prospectively, or both. These databases also break down what types of information apps will automatically collect during user sign-up, compared to information that may be available through use.

Legal Support

NDCAC provides “Go-bys of legal process that have been successfully used by agencies,” (meaning models of the best types of legal requests to make for certain types of records and services), and seeks to “leverage the FBI’s CALEA expertise” to make legal demands easier for state and local law enforcement. As an example of how useful these legal templates can be, according to an NDCAC briefing, in Fiscal Year 2019 its template for a reverse location search warrant was downloaded by law enforcement officials an astounding 1,187 times. As of 2019, NDCAC was also considering a “Legal Demand Service” project that would provide automated delivery of criminal legal process, and work to reduce overall time for obtaining data from service providers, although the current status of this effort is unknown.

Technical Support

NDCAC aid to state and local law enforcement also includes technical assistance, helping police extract revealing information from digital data they acquire. It offers real-time assistance to help understand and analyze phone data, such as interpreting call detail records, cell-site records, and other geolocation data for local law enforcement. NDCAC services also help identify IP addresses included in data retrieved by law enforcement, and provide tools and advice for sorting and analyzing large batches of data retrieved from apps and service providers.

These services can be valuable for mining seized data for sensitive information, which can be used for prosecutions or to further drill down into the private life of a suspect. For example, NDCAC online services instruct law enforcement on how they can data mine the header of an email to determine its originating IP address, then use that data to determine the Internet Service Provider the sender was using, and subsequently use this information to demand records on their browsing activities.

What Steps Should the Administration Take to Limit NDCAC Aid For Abortion Investigations?

NDCAC is fully managed by the FBI, which has authority to set terms and standards for how its resources are used and what type of investigations its staff will assist. The Bureau should create a new set of rules that conditions access to most NDCAC resources and tools on agreement not to use them for abortion investigations. (The NDCAC also conducts training for law enforcement, but it would not be feasible to control or limit how individual law enforcement officials use the skills they acquire from such training.)

From a practical standpoint, a significant portion of how state and local law enforcement harness the NDCAC is by accessing a secure law enforcement portal. The FBI could add a new rule for portal access, requiring law enforcement agencies to certify that no information accessed, apps used, or tools and forms downloaded will be used for abortion investigations. It could also require law enforcement to make a similar certification before receiving any assistance from NDCAC staff, such as those who staff the Technical Resource Group. The FBI could enforce these rules by providing that any violation of a certification would result in full loss of NDCAC services for that law enforcement entity, including access to NCDAC training.

Coming Soon: Part 3, Fusion Centers