Hemisphere: Law Enforcement's Secret Call Records Deal With AT&T

For almost 10 years, federal and local law enforcement agencies across the country have engaged in a massive and secretive telephone surveillance program known as “Hemisphere.” Publicly disclosed for the first time in September 2013 by the New York Times, the Hemisphere program provides police access to a database containing call records going back decades, combined with a sophisticated analytical system. The program involves a private-public partnership with AT&T.

“Hemisphere” came to light amidst the public uproar over revelations that the NSA had been collecting phone records on millions of innocent people. However, Hemisphere wasn’t a program revealed by Edward Snowden’s leaks, but rather its exposure was pure serendipity: a citizen activist in Seattle discovered the program when shocking presentations outlining the program were provided to him in response to regular old public records requests.

But these documents only painted a partial portrait of the program, and since the New York Times’ initial reporting in 2013, EFF has filed its own Freedom of Information Act and state-level public records requests to learn more. The results have been frustrating, with various agencies providing highly and inconsistently redacted documents in what seems to be an attempt to further hide information from the public.

In July 2015, EFF had enough with the secrecy. We filed two separate lawsuits to force law enforcement agencies to release important information that would contribute to the public debate about the efficacy and legitimacy of the program. One lawsuit was against the Drug Enforcement Administration (DEA), while the other was against the California State Attorney General.

In late 2018, we closed the case having freed up hundreds of pages of documents and unmasked redactions across dozens of emails and presentations. The California lawsuit is ongoing.

What is Hemisphere?

Through the Hemisphere program, AT&T assists federal and local law enforcement in accessing and analyzing its massive database of call detail records (CDRs)—information on phone numbers dialed and received, as well as the time, date, and length of call and in some instances location information. More specifically, Hemisphere has access to telecommunication “switches” operated by AT&T that guide telephone calls. Because other providers use AT&T “switches” for their calls, the database contains call detail records regardless of carrier. The database has records concerning local, long distance, cellular, and international calls.

Official government presentations estimate 4 billion call detail records populate the Hemisphere database on a daily basis. That includes records dating as far back as 1987, which is much further back than the records most telcos store.

The AT&T employees who help run the Hemisphere program are housed within law enforcement agencies in Los Angeles, Houston, and Atlanta and have their salaries paid by the White House’s Office of National Drug Control Policy (ONDCP) through its High Intensity Drug Traffic Areas (HIDTA) program.

What is Hemisphere Used For?

The Hemisphere program boasts of several “unique” features:

Dropped and additional phones: Using sophisticated computer algorithms, analysts can run an abandoned phone number through the database to determine a person’s new phone number. Similarly, armed with a currently used phone number, investigators can determine whether there are other phone numbers used by that person or an associate with similar calling patterns.
Location Information: Hemisphere allows law enforcement access to temporary roaming location data on individuals when they make and receive calls.
International phones: The program contains call detail records on international phone numbers that place calls through an AT&T switch or roam on the AT&T network. Law enforcement has access to this information without having to go to law enforcement officials abroad, known as legal attachés or Legats.
Speed: Records can be returned to law enforcement from Hemisphere in as little as one hour for emergency requests, and 1-5 days for non-emergency requests. That is significantly faster than requests made directly to the telephone provider.

How Does It Work?

Federal and state law enforcement investigators submit an administrative subpoena to an HIDTA point of contact, seeking call detail records linked to a specific phone number or multiple numbers. Administrative subpoenas are orders issued directly by law enforcement officials so, unlike a warrant, they don’t require any court oversight. The HIDTA point of contact in turn submits the request to one of the Hemisphere Regional Centers located in Los Angeles, Houston or Atlanta. Once the request is received, the regional center then sends the request to a Hemisphere analyst who processes it and delivers the results electronically directly to the law enforcement agency that made the initial request.

Why Wasn’t It Disclosed Until 2013?

Law enforcement has taken pains to ensure that Hemisphere evades public scrutiny. In fact, as government presentations on the program have made clear, investigators regularly take steps—in the name of “protecting the program”—to “keep the program under the radar.” Most critically, program officials instruct law enforcement to “never refer to Hemisphere in any official document.” Instead, law enforcement hides Hemisphere through a practice called “parallel subpoenaing.” What that means is once police get results back from Hemisphere, they send another subpoena, this time directly to the suspect’s phone provider, to obtain the records for the new phone numbers identified by Hemisphere. The police are then careful to only reference this second request for records in their investigative reports, search warrant affidavits, and court testimony. Through this process, the original results returned by Hemisphere—and the process for obtaining them—are “walled off” from judges, criminal defendants and the public.

Only when the New York Times reported on Hemisphere in 2013 did the program come to light.

EFF’s Public Records Requests and Lawsuits

Since 2013, we’ve submitted several separate public record requests seeking information about the program. First, we submitted two requests under the federal Freedom of Information Act (“FOIA”) to the DEA seeking records about the program. Then we sent a request under California’s Public Records Act (CPRA) to the Los Angeles Regional Criminal Information Clearinghouse, (LACLEAR), the division of the California Attorney General’s Office that administers Hemisphere for law enforcement in California and the West Coast. Both DEA and LACLEAR produced heavily redacted records and withheld other records in full.

We took both to court—suing the DEA in federal court, and requesting a writ of mandate against LACLEAR in state court—arguing that they improperly withheld the records under public records law.

All the Records

Below is the complete list of public records EFF has obtained about Hemisphere. They include the records at issue in the lawsuits we’ve filed against the DEA and LACLEAR. It also includes records we obtained from Harris County, Texas, the ONDCP, and the Northern California Regional Intelligence Center (NCRIC). Finally, records about Hemisphere obtained by outside organizations, including the Electronic Privacy Information Center (EPIC), the New York Times and Muckrock’s Dustin Slaughter are below as well.

Records obtained by EFF from the DEA through a FOIA request:

Complete DEA responsive documents

Of note:

Records obtained by EFF from LACLEAR/California Department of Justice through a CPRA request:

Complete LA CLEAR/CADOJ responsive documents (100 pages)

Of note:

Training Presentations #1, #2, #3

Records Obtained from the City of Atlanta through an Open Records Act Request

Full City of Atlanta Document set (ZIP)

Records obtained by EFF from Harris County, Texas, through the Texas Public Information Act:

These documents show how Harris County serves as a passthrough for federal funds to AT&T for the Hemisphere program, which at one time was codenamed "Hudson Hawk."

Full Harris County document set (ZIP)

Of note: