How One IP Address Change Cost HSI Months of Wiretap Downtime

In April 2025, what ICE describes as an inadvertent change to the internet service provider behind Homeland Security Investigations produced a new IP address. HSI is the criminal investigative arm of U.S. Immigration and Customs Enforcement, and the consequences ran far past a brief outage. In the agency's own words, the change caused "months of downtime for wiretaps" (ICE sole-source justification, reported by Biometric Update).

The disclosure surfaced on October 3, 2026, not through an inspector general or a congressional hearing but through a contract filing: a sole-source award made on September 25 to Cox Virginia Telcom LLC, reported as now part of Charter Communications and operating under the Spectrum brand, worth about $702,885 over a base year and two option years to keep dedicated internet circuits running for HSI's Title III and Linguistics Unit (Biometric Update). Title III is the 1968 federal wiretap statute, and this unit runs ICE's court-ordered interception program.

The justification attached to that award is an unusually detailed public account of how intercepted communications travel from American phone networks into federal hands. It shows that the delivery path for HSI wiretaps rests on static IP addresses supplied by a single commercial carrier, that roughly 50 telecommunications providers are configured to send intercepted data toward those addresses over secure tunnels, and that when the address changed in April 2025, those connections collapsed and had to be rebuilt one by one (Biometric Update).

It also shows what ICE decided to do about it. The remedy was not a second carrier or a more resilient addressing design. It was a deeper commitment to the incumbent, on the reasoning that leaving would require new addresses and a repeat of the painstaking rebuild across roughly 50 providers.

The stakes appear in the agency's own paperwork. DHS describes ICE's Title III Digital Collection System as supporting ICE investigations, interagency task force cases, and investigations conducted by other federal agencies, which means a delivery failure at ICE's edge can reach cases that belong to several agencies. ICE's justification warns that losing interception capability for weeks or months could disrupt criminal investigations and potentially endanger undercover agents, officers, and the public (Biometric Update).

What ICE's contract record actually says

The architecture, in the record's own terms, is mundane. HSI's main site in Lorton, Virginia, and its regional core sites act as routing hubs for the Title III program and for a second capability that ICE redacted from the document. Intercept data arrives from carriers over connections tied to static IP addresses supplied by Cox. Those addresses are handed to telecommunications companies so they can build secure tunnels into HSI's Technical Operations network, and from there the data flows to the interception equipment itself (Biometric Update).

Then came April 2025. The inadvertent ISP change produced a new address, and the pre-built paths aimed at the old one stopped delivering. ICE says the new address caused months of wiretap downtime, plus the loss of the redacted second capability, while the connections were painstakingly rebuilt (Biometric Update).

The lock-in rationale is explicit. ICE says its current addresses are tied into connections with roughly 50 providers, and that changing carriers would again require new addresses and the re-establishment of every one of those connections, since many providers will not pre-negotiate or pre-configure replacement connections in advance. Spectrum currently connects seven HSI sites, two regional cores are being relocated without changing the site count, and contracting records call the circuits "vital to the resilience and effectiveness" of the program (Biometric Update).

What the record leaves out matters as much as what it contains. It names no investigations and gives no count of affected intercepts, and no restoration timeline appears in the public reporting, so the public record cannot establish whether every affected tap was dark for the whole period or restored in stages. And it is a sole-source justification, a document written to persuade a contracting officer that competition is unnecessary. The outage story serves that purpose. That does not make it false; agencies have little incentive to advertise their own failures. But it is a document with a job to do, and its drama is doing that job.

How a court order becomes an IP tunnel

Under Title III, a judge authorizes interception of a target's communications for a period capped at thirty days, extendable on further showings to the court (18 U.S.C. § 2518). Executing an order used to mean physical access at the phone company: alligator clips, or their equivalent, at the local exchange (Susan Landau, Lawfare).

Digital switches with features like call forwarding, ISDN, and cellular service ended that. The FBI's 1992 "Digital Telephony" proposal was killed by telephone providers and civil liberties groups, and the Communications Assistance for Law Enforcement Act passed in 1994 with a $500 million sweetener for retrofitting switches, money that fell well short of actual costs and produced years of court fights. The law was written for a country where about nine in a hundred Americans used mobile phones and the internet had not yet been opened to commercial traffic (Lawfare).

What CALEA built was interception capacity inside carrier networks, in place before any order exists. Nearly a thousand pages of FBI documents released through FOIA in 2007, reported by WIRED, described the result: DCSNet, a point-and-click system linking FBI wiretapping rooms to the switches of landline, internet-telephony, and cellular providers. Steven Bellovin called it a "comprehensive wiretap system that intercepts wire-line phones, cellular phones, SMS and push-to-talk systems." Its components included DCS-3000, known as Red Hook, for pen-register and trap-and-trace surveillance of dialed numbers, DCS-6000, Digital Storm, for call and message content, and a classified DCS-5000 for espionage and terrorism cases. FBI endpoints grew from 20 monitoring plants at the program's inception to 57 by 2005, connecting to more than 350 switches by 2002 (WIRED).

The delivery pattern is the part that matters here. Carriers concentrate their intercept feeds at internal hubs known as mediation switches, and the FBI's DCS software linked to those hubs over the internet, in WIRED's words "likely using an encrypted VPN." The private backbone connecting FBI field offices was "separated from the internet," with Sprint running it "on the government's behalf," according to WIRED's account of the 2007 documents. Whether the Bureau's transport arrangements have since been diversified is not apparent from the public record.

International standards settle the same shape. ETSI's lawful-interception specifications define handover interfaces for delivering intercepted content and intercept-related data over IP networks from operator to agency (ETSI TS 102 232-3). Across systems and decades, the model is consistent: the tap happens inside the carrier, the evidence travels over a network to a government endpoint, and that endpoint must be reachable at a fixed, known address.

Why one changed address broke roughly fifty carrier links

That last requirement is the fragile one. A carrier configured to deliver intercepts does not send them to "HSI"; it sends them to a number. Secure tunnels are built in advance and aimed at that number. When an ISP change hands an organization a new address, every external system pointed at the old one stops reaching it. For HSI, that meant roughly 50 carrier relationships, each keyed to the old address, all going stale at once (Biometric Update).

The rebuild explains the duration. ICE says many of the roughly 50 providers will not pre-negotiate or pre-configure replacement connections in advance, so the connections had to be rebuilt painstakingly, provider by provider (Biometric Update).

The dependency is not unique to Virginia. A separate HSI procurement in Puerto Rico, an August solicitation for internet service at HSI facilities in San Juan, requires a static IP address at the agency's Miramar office specifically to maintain connectivity for a telephone intercept server (Biometric Update). Persistent addressing is a standing requirement of the interception estate, not a one-time design choice.

For services that cannot tolerate renumbering, the standard remedies are well established: obtain provider-independent address space and announce it via BGP so the addresses belong to the organization rather than the ISP, or run parallel circuits from two providers with paths pre-built to both. The handover standards do not require an agency to rent its intercept endpoints' addresses from a single ISP; they specify a secured, reachable destination and leave the surrounding network design to implementers. The public record shows HSI's addresses supplied by Cox, and ICE's own reasoning treats any change of supplier as a repeat trigger of the outage. The public record does not show whether portable addressing or dual-carrier delivery was weighed and rejected (Biometric Update; ETSI).

The statutory clock compounds the cost. Title III orders run thirty days at most unless extended (18 U.S.C. § 2518), and an outage eats into a finite authorization window regardless of whether the evidence is arriving.

The vendor stack behind one wiretap program

Read together, the recent contracting records describe a single operational stack. Spectrum carries the intercepts on dedicated circuits. JSI Telecom, awarded a sole-source contract in March 2025, operates and maintains the Title III Digital Collection System itself. Procentrix, awarded a contract the same day as the Spectrum award, handles operations, maintenance, and enhancements for the agency's Title III applications, at a potential value of about $35.4 million, on a competed order that drew two bids. KACE holds a five-year order now valued at up to $126.9 million for monitoring, transcription, and translation work. And High Prairie Services held the incumbent contract for CALEA network and intercept operation support, worth a potential $13.7 million, from September 2020 through September 2025 (Biometric Update; HigherGov).

The JSI relationship shows how deep the incumbency runs. Federal spending data record the initial March 2025 transaction at $7,250,950, a March 2026 option exercise bringing obligations to $14,081,130, and a potential value of $23,403,390 running to March 2030 (USAspending).

The vendor is not new: a 2011 ICE procurement already sought JSI support for its VoiceBox collection management system inside the Title III Digital Collection System, meaning the same firm has been embedded in the program for well over a decade (Biometric Update).

The network-support layer was slated for recompete as well. ICE's forecast, published in February 2025, planned a follow-on competition valued between $10 million and $20 million, set aside for service-disabled veteran-owned small businesses, for services including CALEA architecture support and continuity-of-operations site support (HigherGov).

The pattern across the stack is continuity: long incumbencies, sole-source awards, and now, at the transport layer, an outage deployed as the argument for staying put. There is a logic to it. Each layer's switching cost becomes the justification for the next layer's stability. What the 2025 event added was evidence, in the government's own handwriting, that the cost of change is real and has already been paid once.

The Chinese breach that hit the same architecture

Six months before the HSI outage, the Wall Street Journal reported that a cyberattack tied to the Chinese government had penetrated the networks of a swath of U.S. broadband providers, potentially accessing information from the systems the federal government uses for court-authorized network wiretapping requests. The intrusion campaign was later tracked publicly as Salt Typhoon. The Journal's sources said the hackers might have held access "for months or longer" to network infrastructure used to cooperate with lawful U.S. requests for communications data (Wall Street Journal, as quoted in Lawfare).

Susan Landau argued that the breach "almost certainly" resulted from CALEA. The reported access was to wiretapping requests rather than, as far as reporting indicated, the communications themselves. But that distinction offers limited comfort in counterintelligence terms: wiretap orders reveal exactly which Chinese, Russian, and Iranian agents the U.S. government has identified, and which ones it has not. If Chinese hackers had indeed accessed the court-ordered wiretapping requests, Landau wrote, the result would be "an intelligence failure roughly on par with putting Kim Philby in charge of the FBI's Russia counterintelligence office" (Lawfare).

The security community had spent decades warning about the design. Landau told Congress in 2011 that when a communications or switch provider fails to adequately secure its systems, "that cost occurs over the millions of communications that utilize that switch or application." David Farber told a House subcommittee in 1994 that re-engineering the telephone network for interception could cause "major dangers to the health and economy of the country" and create "opportunities for chaos" (Lawfare).

The two events, 2024 and 2025, are failures of the same architecture in opposite directions. The features that make modern lawful interception instant and universal, dedicated, addressable, always-on plumbing running between carriers and government, also concentrate risk. In 2024 the risk was confidentiality: adversaries inside the carriers reaching the interception machinery. In 2025 it was availability: an administrative change at the government's end severing the delivery chain. The second failure required no adversary at all.

Is the single point of failure overstated?

There are reasons for caution about the direst readings. The document is advocacy for sole-sourcing, and its dramatic framing does argumentative work. It quantifies nothing that the public reporting surfaced: no case count, no number of lost intercepts, no restoration timeline, so "months of downtime" could describe rolling, partial recovery rather than uniform blackout. The public record says nothing about mitigations investigators may have used, whether expedited rebuilds, extensions, or alternative collection methods, so real-world impact cannot be measured from public facts. And the failure was an accident, not an attack; accidents get fixed. Continuity even has genuine security value for a system whose endpoints must be known to dozens of carriers, since constant readdressing would create its own operational risk. The continuity-of-operations work written into the scope of the planned follow-on contract suggests the failure mode is at least formally acknowledged (HigherGov).

But the caution cuts both ways. The strongest evidence for the fragility reading is not critics' framing; it is ICE's own account, disclosed in the agency's paperwork, describing months of lost wiretap capacity from a single administrative change. The chosen remedy confirms the dependency: the agency, by its own reasoning, cannot leave its carrier without re-triggering the failure, which is a working definition of lock-in. And the public record shows no architectural diversity in the delivery layer, while the redactions leave room for capabilities the public cannot see, which means hidden redundancy can be neither confirmed nor ruled out.

The honest verdict is that the record documents a real single-carrier dependency on static addressing and a real multi-month degradation of federal interception. It does not document, and does not permit, claims that every tap went dark everywhere. Both the fragility and the uncertainty are findings.

What the outage actually reveals

The fragility is administrative, not exotic. A modern interception capability, with point-and-click collection, dedicated linguistics units, and contracts running to nine figures across the stack, ends in ordinary enterprise networking, and it broke at the least glamorous layer: an address.

The lock-in compounds. Each layer's switching cost became the argument for the next layer's continuity, and the 2025 outage became Exhibit A for keeping everything the same. ICE is paying roughly $702,885 to guarantee that nothing changes, which is a rational response to the architecture the agency has, and a strange endpoint for a resilience strategy.

The CALEA bargain, three decades on, has aged into both of the failures its early critics forecast. The reliability warnings Farber raised in 1994 and the security warnings Landau raised for decades afterward both turned into evidence. Salt Typhoon showed the interception estate can be attacked; the HSI outage showed it can simply break.

The last lesson is about visibility. A months-long degradation of federal wiretap delivery surfaced publicly through acquisition paperwork rather than an inspector general's report or a congressional hearing: to spend without competition, the agency had to write down what happened the last time its connectivity changed. The second affected capability remains redacted. The number of intercepts lost, the cases touched, the workarounds used, and whether the FBI, DEA, and other agencies run their interception transport on the same one-carrier design all remain unknown, though the Bureau's Sprint-run backbone, documented in 2007, suggests the model is not unique to ICE (WIRED). Until those answers surface, the best available summary of how federal interception infrastructure stays resilient is the one embedded in ICE's own award logic: it works as long as nothing changes.

Sources / References

• Anthony Kimery, "ICE contract reveals network infrastructure behind HSI surveillance operations," Biometric Update, October 3, 2026. https://www.biometricupdate.com/202610/ice-contract-reveals-network-infrastructure-behind-hsi-surveillance-operations
• USAspending.gov, federal contract record for JSI Telecom Inc., PIID 70CMSD25P00000018, U.S. Department of Homeland Security, accessed October 3, 2026. https://www.usaspending.gov/award/CONT_AWD_70CMSD25P00000018_7012_-NONE-_-NONE-
• HigherGov, "Title III Intercepts and Linguists Unit (T3ILU) Communications Assistance for Law Enforcement Act (CALEA) Network and Intercept Operation Support Services (CNIOSS)," contract forecast, published February 21, 2025. https://www.highergov.com/contract-forecast/title-iii-intercepts-and-linguists-unit-t3ilu-co-1095721/
• Susan Landau, "CALEA Was a National Security Disaster Waiting to Happen," Lawfare, November 13, 2024. https://www.lawfaremedia.org/article/calea-was-a-national-security-disaster-waiting-to-happen
• Ryan Singel, "Point, Click ... Eavesdrop: How the FBI Wiretap Net Operates," WIRED, August 29, 2007. https://www.wired.com/2007/08/wiretap/
• ETSI, TS 102 232-3, "Lawful Interception (LI); Handover Interface and Service-Specific Details (SSD) for IP delivery; Part 3: Service-specific details for internet access services," standards listing, GlobalSpec. https://standards.globalspec.com/std/14655176/ts-102-232-3
• 18 U.S.C. § 2518, Wiretap Act authorization provisions, Cornell Legal Information Institute. https://www.law.cornell.edu/uscode/text/18/2518