A shadowy company set up last September linked to a DARPA / FBI contractor who peddled a ‘lawful intercept’ internet spy device to government agencies and law enforcement a decade ago, took over a massive portion of the Pentagon’s idle internet addresses on the day of President Biden’s inauguration, according to an in-depth investigation by the Associated Press.

The valuable internet real estate has since quadrupled to 175 million IP addresses which were previously owned by the US Department of Defense – about 1/25th the size of the current internet, and over twice the size of the internet space actually used by the Pentagon.

“It is massive. That is the biggest thing in the history of the internet,” said Doug Madory, director of internet analysis at network operating company Kenntic.

The company, Global Resource Systems, was established by a Beverly Hills attorney, and now resides in a shared workspace above a Florida bank.

The company did not return phone calls or emails from The Associated Press. It has no web presence, though it has the domain grscorp.com. Its name doesn’t appear on the directory of its Plantation, Florida, domicile, and a receptionist drew a blank when an AP reporter asked for a company representative at the office earlier this month. She found its name on a tenant list and suggested trying email. Records show the company has not obtained a business license in Plantation.

Incorporated in Delaware and registered by a Beverly Hills lawyer, Global Resource Systems LLC now manages more internet space than China Telecom, AT&T or Comcast. –Associated Press

One name is linked to Global Resource Systems in the Florida business registry – that of Raymond Saulino – who as recently as 2018 was listed in Nevada corporate records as a managing director of a cybersecurity/internet surveillance company called Packet Forensics. According to the report, “The company had nearly $40 million in publicly disclosed federal contracts over the past decade, with the FBI and the Pentagon’s Defense Advanced Research Projects Agency among its customers.”

In 2011, Packet Forensics and Saulino, its spokesman, were featured in a Wired story because the company was selling an appliance to government agencies and law enforcement that let them spy on people’s web browsing using forged security certificates.

The company continues to sell “lawful intercept” equipment, according to its website. One of its current contracts with the Defense Advanced Research Projects Agency is for “harnessing autonomy for countering cyber-adversary systems.” A contract description says it is investigating “technologies for conducting safe, nondisruptive, and effective active defense operations in cyberspace.” Contract language from 2019 says the program would “investigate the feasibility of creating safe and reliable autonomous software agencies that can effectively counter malicious botnet implants and similar large-scale malware.”

Saulino is also listed as a principal with a company called Tidewater Laskin Associates. Incorporated in 2018 (and sharing the same Virginia Beach, VA address as Packet Forensics – a UPS store – with different mailbox numbers), Tidewater obtained an FCC license in April 2020 for unknown reasons.

Calls to the number listed on the Tidewater Laskin FCC filing are answered by an automated service that offers four different options but doesn’t connect callers with a single one, recycling all calls to the initial voice recording.

Saulino did not return phone calls seeking comment, and a longtime colleague at Packet Forensics, Rodney Joffe, said he believed Saulino was retired. Joffe, a cybersecurity luminary, declined further comment. Joffe is chief technical officer at Neustar Inc., which provides internet intelligence and services for major industries, including telecommunications and defense. -AP

And now a company linked to Saulino, which didn’t exist before September, took control of a massive chunk of the Pentagon’s internet space on inauguration day for unknown reasons.

According to a terse and opaque explanation from the Pentagon’s Brett Goldstein – head of the Defense Digital Service which is running the project, the military hopes to “assess, evaluate and prevent unauthorized use of DoD IP address space” and “identify potential vulnerabilities” in order to defend against cyber-intrusions by global adversaries who consistently infiltrate US networks – occasionally from unused internet blocks. What that has to do with Global Resource Systems is anyone’s guess.

Explanations for what the internet space could be used for are purely speculative, and include “honeypots” – machines set up with vulnerabilities laid as bait to draw hackers, “Or it could be looking to set up dedicated infrastructure — software and servers — to scour traffic for suspect activity.”

“This greatly increases the space they could monitor,” said Madory.

Why did the Pentagon choose Global Resource Systems – a company linked to a ‘spooky’ individual – on inauguration day? “As to why the DoD would have done that I’m a little mystified, same as you,” internet pioneer Paul Vixie told AP.

More via AP:

Deepening the mystery is Global Resource Systems’ name. It is identical to that of a firm that independent internet fraud researcher Ron Guilmette says was sending out email spam using the very same internet routing identifier. It shut down more than a decade ago. All that differs is the type of company. This one’s a limited liability corporation. The other was a corporation. Both used the same street address in Plantation, a suburb of Fort Lauderdale.

“It’s deeply suspicious,” said Guilmette, who unsuccessfully sued the previous incarnation of Global Resource Systems in 2006 for unfair business practices. Guilmette considers such masquerading, known as slip-streaming, a ham-handed tactic in this situation. “If they wanted to be more serious about hiding this they could have not used Ray Saulino and this suspicious name.”

Guilmette and Madory were alerted to the mystery when network operators began inquiring about it on an email list in mid-March. But almost everyone involved didn’t want to talk about it. Mike Leber, who owns Hurricane Electric, the internet backbone company handling the address blocks’ traffic, didn’t return emails or phone messages.

Despite an internet address crunch, the Pentagon — which created the internet — has shown no interest in selling any of its address space, and a Defense Department spokesman, Russell Goemaere, told the AP on Saturday that none of the newly announced space has been sold.