The U.S. military and FBI have previously bought access to netflow data from a company called Team Cymru. Now the IRS wants to buy products from the company too.
The IRS wants to purchase an internet monitoring tool from a company that has sold products to sections of the U.S. military and the FBI, according to public procurement records. The company, called Team Cymru, provides access to “netflow” data, which can show activity on the wider internet, such as which server communicated with another. This is information that may ordinarily only be available to the company hosting the server or the internet service provider carrying the traffic.
The news shows federal agencies’ continued interest in Team Cymru’s data and products. The procurement records show the IRS also wants to buy subscriptions from a variety of cybersecurity companies, suggesting the intended use case may be defensive in nature.
In essence, Team Cymru’s products let cybersecurity professionals monitor activity outside of their own networks and observe what is happening on the wider internet. This may benefit defenders in identifying hackers’ infrastructure, but multiple cybersecurity professionals have previously expressed concern to Motherboard about the sale of netflow data.
“65 days traffic history,” one of the procurement documents reads. Jack Poulson, who runs transparency organization Tech Inquiry, first flagged the procurement records to Motherboard. The documents show the IRS is seeing if a contractor is able to provide the Team Cymru and other subscriptions at once.
The IRS is seeking a purchase of Team Cymru’s “Recon—Advanced” product, the procurement records show. Recon provides access to “internet traffic telemetry” according to Team Cymru’s website. On its site the company describes this data as “the world’s largest Threat Intelligence data ocean.” Team Cymru says its product can be used to “trace malicious activity through a dozen or more proxies and VPNs to identify the origin of a cyber threat.”
