Facebk/WhatsAp
© Logos/AP/FacebookAcademics/hexux.net/KJN
The U.S. doesn't need to know whom they're targeting or show probable cause when ordering Facebook, WhatsApp or any tech company to help agencies spy on users in secret, newly unsealed court documents show.

U.S. federal agencies have been using a 35-year-old American surveillance law to secretly track WhatsApp users with no explanation as to why and without knowing whom they are targeting.

In Ohio, a just-unsealed government surveillance application reveals that in November 2021, DEA investigators demanded the Facebook-owned messaging company track seven users based in China and Macau. The application reveals the DEA didn't know the identities of any of the targets, but told WhatsApp to monitor the IP addresses and numbers with which the targeted users were communicating, as well as when and how they were using the app. Such surveillance is done using a technology known as a pen register and under the 1986 Pen Register Act, and doesn't seek any message content, which WhatsApp couldn't provide anyway, as it is end-to-end encrypted.

As Forbes previously reported, over at least the last two years, law enforcement in the U.S. has repeatedly ordered WhatsApp and other tech companies to install these pen registers without showing any probable cause. As in those previous cases, the government order to trace Chinese users came with the statement that the Justice Department only needed to provide three "elements" to justify tracking of WhatsApp users. They include:

1) the identity of the attorney or the law enforcement officer making the application;
2) the identity of the agency making the application; and
3) a certification from the applicant that "the information likely to be obtained is relevant to an ongoing criminal investigation being conducted by that agency."
"Other than the three elements described above, federal law does not require that an application for an order authorizing the installation and use of a pen register and a trap and trace device specify any facts."
Attachment A
© FORBESA screenshot from a government order on WhatsApp shows U.S. investigators didn't know the identities of the seven individuals on which they wanted data.
The latest case shows that America's unexplained snooping has a global reach, far beyond domestic WhatsApp users and those in neighboring countries, affecting foreign targets whose identities the government does not know. According to another court document unearthed by Forbes, one previous case in Ohio saw another seven WhatsApp users targeted, three in the U.S., four in Mexico. For each, the U.S. either knew the alias or the real name of the user.

Chinese opioid sales

As the Chinese WhatsApp numbers were published unredacted in the government filing, Forbes was able to find indications that the DEA was seeking to carry out surveillance on Chinese individuals and entities shipping opioids on the Web and over encrypted apps. One number was included as a contact in a comment from 2020 on a blogpost, offering shipment of pharmaceutical products, providing an email containing the domain of what appears to be a Chinese company. (As no charges have been filed in the case, Forbes is not revealing the numbers of the names of the entities being targeted by the DEA probe. The Justice Department in Ohio hadn't commented at the time of publication.)

Another was listed on a Facebook page, where chemicals were being sold by a company promising "research" chemicals. Pictures on the page showed cellophane bags containing various powders and pointing to Telegram and Wickr numbers, as well as the WhatsApp contact, promising high-purity substances, including psychoactive drugs benzodiazepines, which include diazepam (better known by its brand name, Valium) and alprazolam (also better known as its brand name, Xanax.) One of the numbers was also posted to a Facebook group called "dark research chemicals forum," where users have been discussing how to get hold of various substances, many looking for benzodiazepines.

Though the DEA may be legitimately using the Pen Register Act to track the Chinese chemical suppliers fueling America's opioid crisis, there remain concerns about the lack of an explanation of "probable cause." Yet, despite complaints from the likes of the ACLU about the law going back decades, there's little sign of any movement on Capitol Hill to address any of the more contentious aspects of the Act. American agencies can, therefore, continue to carry out surveillance on users of one of the world's most popular messaging apps without having to provide any reason, either to a judge or the public.
About the Author:
Thomas Brewster is an associate editor for Forbes, covering security, surveillance and privacy. I'm also the editor of The Wiretap newsletter, which has exclusive stories on real-world surveillance.