The IRS wants to purchase an internet monitoring tool from a company that has sold products to sections of the U.S. military and the FBI, according to public procurement records. The company, called Team Cymru, provides access to “netflow” data, which can show activity on the wider internet, such as which server communicated with another. This is information that may ordinarily only be available to the company hosting the server or the internet service provider carrying the traffic.
The news shows federal agencies’ continued interest in Team Cymru’s data and products. The procurement records show the IRS also wants to buy subscriptions from a variety of cybersecurity companies, suggesting the intended use case may be defensive in nature. In essence, Team Cymru’s products let cybersecurity professionals monitor activity outside of their own networks and observe what is happening on the wider internet. This may benefit defenders in identifying hackers’ infrastructure, but multiple cybersecurity professionals have previously expressed concern to Motherboard about the sale of netflow data.
“65 days traffic history,” one of the procurement documents reads. Jack Poulson, who runs transparency organization Tech Inquiry, first flagged the procurement records to Motherboard. The documents show the IRS is seeing if a contractor is able to provide the Team Cymru and other subscriptions at once.