Uber is facing a criminal probe from the US Justice Department over a piece of software it used to evade law enforcement and transportation regulators, according to Reuters. The program, known internally at Uber as “Greyball,” was first disclosed by a March report in The New York Times. Uber used the software tool to hide cars from regulators who were attempting to conduct sting operations on drivers in areas the company was not yet licensed to operate, such as Portland, Oregon.

Uber could be in hot water over Greyball

Greyball was a multi-step defense, in Uber’s eyes, from those eager to “violate its terms of service.” The company claims it was developed as a way to cut down on fraud and protect drivers from violent taxi union protestors, and it claimed at the time that it still uses Greyball primarily for this purpose. “This program denies ride requests to users who are violating our terms of service,” Uber said in a statement back in March. “Whether that’s people aiming to physically harm drivers, competitors looking to disrupt our operations, or opponents who collude with officials on secret ‘stings’ meant to entrap drivers.”

The program worked by identifying suspicious users either based on credit card information, location, or the type of device being used to access the Uber app. The company went so far as to check credit card data against popular credit unions used by law enforcement and mining public social media data to determine the suspected person’s employment. Once a user was “Greyballed,” so to speak, Uber would show a different version of the its app with fake cars that would not respond to call requests.

Uber has used fake versions of its app in other instances

The New York Times also reported late last month that Uber used a similar geofencing tactic to prevent Apple employees from discovering that it fingerprinted individual iPhones as part of an anti-fraud mechanism first deployed in China. Upon discovering the scheme, Apple CEO Tim Cook reportedly told Uber chief Travis Kalanick that the ride-hailing app would be kicked put of the App Store if the practice continued.

Letters from Uber to Portland authorities, made available to the public last week, indicate that Greyball was used “exceedingly sparingly” in Portland before the city approved the ride-hailing service in 2015, according to Reuters. Uber also discontinued its use of Greyball as a means of locating and thwarting regulators after The New York Times published its initial March report. It is assumed it is still used for fraud prevention and other purposes.

Still, Uber reportedly received a subpoena from a Northern California grand jury seeking information about Greyball and how and where it was used. Reuters points out that, while a formal request for these types of documents does indicate some type of criminal wrongdoing is being investigated, it does not guarantee that charges will ultimately be brought.