The US government has dramatically lifted the stakes in its crackdown on journalism, subpoenaing a US company in an effort to obtain information about the research and writing of articles that exposed its links with the cybersecurity industry.

In a remarkable fishing expedition, the US Department of Justice has used its prosecution of author and activist Barrett Brown to issue a subpoena to web-hosting company Cloudflare for information relating to the Echelon wiki site.

That site was used by Project PM, an international collaborative research project dedicated to piecing together a clearer picture of the US cybersecurity industry, its extensive links with the US government and secret activities such as the HBGaryFederal-Palantir-Berico plot to destroy WikiLeaks. The subpoena demands, inter alia, “account access history including any and all authentication, file transfer, web server logs or other transaction logs containing source IP addresses relating to the subscriber’s use of Cloudflare services”.

Crikey published a piece by Brown on one of the major Project PM discoveries, a US mass surveillance program targeting Arab social media users called Romas/COIN, in 2011.

Another of Project PM’s targets was a US company called Endgame, a provider of cybersecurity services to many US government agencies, including the Pentagon. Endgame’s services should be enough to make even the most Luddite citizen paranoid. As Business Week — the only mainstream media outlet to investigate the company — revealed in a 2011 article:

“… Endgame executives will bring up maps of airports, parliament buildings, and corporate offices. The executives then create a list of the computers running inside the facilities, including what software the computers run, and a menu of attacks that could work against those particular systems. Endgame weaponry comes customized by region — the Middle East, Russia, Latin America, and China — with manuals, testing software, and ‘demo instructions’. There are even target packs for democratic countries in Europe and other US. allies. Maui (product names tend toward alluring warm-weather locales) is a package of 25 zero-day exploits that runs clients $2.5 million a year. The Cayman botnet-analytics package gets you access to a database of internet addresses, organization names, and worm types for hundreds of millions of infected computers, and costs $1.5 million. A government or other entity could launch sophisticated attacks against just about any adversary anywhere in the world for a grand total of $6 million …”

“Zero-day exploits” attack previously unrevealed flaws in software before developers can patch them.

“Project PM set about revealing the sordid truth about this shadowy industry. Those who participated are now being targeted …”

Some of the information compiled by Project PM was obtained from the famous HB Gary Federal hack, in which would-be US cybersecurity player Aaron Barr and his company had their emails leaked. The emails provided an insight into the rarely-glimpsed world of high-level US cybersecurity, espionage and surveillance. The emails were also used by outlets such as the New York Times to explore links between cybersecurity firms and the US government.

Now, the US government is using its prosecution of Brown, including for the heinous crime of sharing a link, to go after those involved with Project PM, which may have been up to 20 people around the world who used leaked materials and other publicly available information to generate a clearer picture of a secretive industry. The tenuous connection between the charges levelled at Brown and his Project PM activities relates to the hack of emails of self-promoting “alternative CIA” Stratfor, which forms a limited basis for some Project PM materials.

Many of the Project PM contributors are outside the US, including the current webmaster of the site. Among those who contributed research was Melbourne information and transparency activist Asher Wolf. This is the second time Wolf has been dragged into US prosecutions, after Massachusetts prosecutors tried to subpoena a Twitter hashtag relating to the Occupy movement last year.

“The U.S. Department of Justice is out of control,” Wolf told Crikey. “It is deeply troubling that people who engage in journalism, academic research, or who have an interest in following emerging political movements via social media platforms are finding themselves potentially included in U.S. legal dragnets.  These sort of subpoenas are not only vindictive, but also aim to scare people away from poking around in the guts of allegations of nation-wide corruption and malfeasance amongst infosec contractors.

“The fact that a bit of Saturday night online research into infosec contractors – or simply following an issue on Twitter – has now meant I’ve twice faced potential dragnet inclusion in U.S. subpoenas is bloody outrageous. The U.S. should be ashamed of themselves. They’re acting like thugs.”

The fishing expedition continues the disturbing record of both the Obama administration and state-level US prosecutors in persecuting whistleblowers, undermining the First Amendment by arguing releasing information to the media is “aiding the enemy” and aggressively pursuing online activists in an attempt to make an example of them.

But Project PM, and particularly information about Endgame, was important because it demonstrated that, contrary to the narrative pushed by Western governments (including our own) that they are hapless victims of Chinese espionage, cyberterrorists and online activists, Western governments devote considerable resources to their own espionage and cyberattack efforts, frequently via unaccountable, secretive private firms.

Moreover, cybersecurity remains an issue the mainstream media, with rare exceptions, not merely fails to cover accurately but sends out its journalists to serve as enthusiastic spruikers. Journalists hype threats and impacts to strengthen the case for more government and corporate spending to be directed toward the companies that operate in this space, which are increasingly controlled by big US and European defence contractors.

Unlike professional journalists engaged in hysterics, Project PM set about revealing the sordid truth about this shadowy industry. Those who participated are now being targeted by the most powerful government on earth.