29 September 2014, NYT: Chertoff Group: A Review of Security Requirements for Local Number Portability Administration (PDF)
SEPT. 28, 2014
Spy Agencies Urge Caution on Phone Deal
By ERIC LICHTBLAU
WASHINGTON -- An obscure federal contract for a company charged with routing millions of phone calls and text messages in the United States has prompted an unusual lobbying battle in which intelligence officials are arguing that the nation's surveillance secrets could be at risk.
The contractor that wins the bid would essentially act as the air traffic controller for the nation's phone system, which is run by private companies but is essentially overseen by the government.
And with a European-based company now favored for the job, some current and former intelligence officials -- who normally stay out of the business of awarding federal contracts -- say they are concerned that the government's ability to trace reams of phone data used in terrorism and law enforcement investigations could be hindered.
A small Virginia company, Neustar, has held the job since the late 1990s, but a private phone-industry panel has recommended to the Federal Communications Commission that an American division of Ericsson, the Swedish-based technology company, get the work instead. No final decision has been made.
In its bid to hold on to the $446 million job, Neustar has hired Michael Chertoff, a well-connected former secretary of homeland security, to examine the implications of the proposed switch.
In a 45-page report  that Neustar plans to send to the F.C.C. this week, Mr. Chertoff, now a private consultant, argues that national security concerns have been slighted in the contracting process. An advance copy of his report was provided to The New York Times.
Without a fuller assessment of the risks posed in switching the contract to a European-based outfit, "security would become obsolete in the face of constantly morphing threats," Mr. Chertoff says in the report.
If a foreign intelligence service were to gain access to the phone-routing system and identify the targets of United States surveillance efforts, Mr. Chertoff said, "that would be a counterintelligence bonanza for adversaries of the nation and a security disaster for the United States."
Neustar declined to say how much it paid Mr. Chertoff for the report, indicating only that it was a "modest sum."
Officials from the F.B.I., the Drug Enforcement Administration, the Secret Service and the Immigration and Customs Enforcement agency have weighed in on the debate, as have senators and House members who supervise American intelligence operations.
The F.B.I. and other law enforcement agencies said that while they had "no position" on who should get the contract, they did want to make sure that their professional needs were adequately addressed and that there would be no disruption in access to call-routing data "in real time or near real time."
"Law enforcement cannot afford to have a lapse in this vital service," the agencies told the F.C.C. in a letter.
The agencies expressed particular concern that a contractor with access to the phone system from outside the United States could mean "unwarranted, and potentially harmful" access to American surveillance methods and targets.
The debate echoes the 2006 controversy over a $6.8 billion deal that would have allowed a Dubai company to manage six American ports. The proposal was met with outrage in Congress over the idea that such vital pieces of American infrastructure would be placed in foreign hands, and the contract was ultimately killed.
Ericsson is a Swedish technology firm, but its supporters in the contract debate point out that the network's operation would be handled by an American-based division, Telcordia Technologies, and that it would be run more cheaply than Neustar without any harm to the system's operations.
Mark Wigfield, a spokesman for the F.C.C., said there was no timetable for deciding whether Telcordia would get the phone-routing contract, as recommended by the industry panel. He said the agency would examine all aspects of the job -- including the national security implications -- before any decisions were made.
The battle over the little-known routing network reflects the central role that the phone companies play in the government's surveillance and phone-tracing capabilities.
The surveillance system has been intensely criticized in the 14 months since Edward J. Snowden, the former National Security Agency analyst, released classified information detailing the wide scope of the government's capabilities. As a result, Apple and Google took steps this month to encrypt smartphone data in ways that would make it much more difficult for government investigators to crack.
The phone-routing system grew out of a 1997 law that allowed cellphone and landline users to keep the same number even when they switched carriers. These so-called portability standards made things easier for consumers but created potential complications for intelligence and law enforcement officials in tracing phone calls and determining which numbers were tied to which carriers.
The routing network that was put in place, with Neustar as its administrator, was designed partly to allow the government nearly instant access to the data on where calls were being routed.
In an interview, Lisa Hook, the chief executive of Neustar, insisted that "irregularities" in the F.C.C. bidding process had weighed against her company in trying to hold onto the lucrative contract, which provides nearly half its revenues. She said that the major phone carriers, who pay for the contract, would clearly rather see an international industry leader like Ericsson end up with the work.
"We're a small company," she said. "We're just looking for a level playing field."
Ms. Hook predicted that if the Ericsson division did win the contract, the changeover to a new administrator to run the system could take years and would leave the nation's phone grid vulnerable in the meantime. "Any claim that this is simple and can be done easily is just wrong," she said.