The Drug Enforcement Administration (DEA) and the United States Army have almost certainly been buying questionable remote access hacking tools for years from an Italian company called Hacking Team , via an obscure American reseller called Cicom USA.

Hacking Team openly advertises what it calls its "Remote Control System," (RCS) a piece of malware remotely installed on a target’s computer or smartphone. As the company touts: "Evidence collection on monitored devices is stealth and transmission of collected data from the device to the RCS server is encrypted and untraceable."

The security research group, Citizen Lab, has shown that Hacking Team’s smartphone malware has been spotted in the wild in many countries around the world, including Mexico, Morocco, Malaysia, Hungary, and more.

The new revelation comes from two independent investigations released Wednesday by Privacy International and Vice Motherboard. The London-based nonprofit also published documents from Hacking Team that claim it can monitor "hundreds of thousands of targets" per installation.

When Ars called Cicom’s listed number and left a voicemail, we soon got a call back from Alex Velasco, whom Vice Motherboard identified as the company’s general manager.

"It’s all there in the article, I can’t answer any questions," he said, before hanging up.

Neither the Department of Justice, nor the US Army, immediately responded to Ars’ request for comment by phone and e-mail.

"We cannot identify clients because of the sensitive nature of the work that they do in fighting crime," Eric Rabe, Hacking Team's chief American spokesman, e-mailed Ars late Wednesday night. "I also cannot confirm any relationship between the company Cicom and Hacking Team."

He added:

Hacking Team is in compliance with all export laws including the recent Wassenaar protocols implemented at the beginning of this year. Indeed, there is no allegation of any illegal activity whatsoever by any of the companies or agencies named in this story. We are proud of the assistance we offer to law enforcement and intelligence services. Illegal drug sales over the Internet, services for terrorists and other horrific crimes are routinely negotiated and provided using the devices Hacking Team helps law enforcement surveil. Our leading technology helps fight criminals and terrorists who routinely use the Internet, mobile devices and computers to exploit and threaten peaceful and law abiding citizens of every country.

When Ars asked further how he explained the fact that Hacking Team and Cicom share an address in Annapolis, Maryland, he wrote:

The address of the office we have used in Annapolis, Maryland, is a corporate hosting company, Regus, that provides office space to probably 50 different companies who take offices at that same location. (Our office is moving to Reston, Virginia. The Anapolis office has been essentially closed, though we have some furniture stored there for some time.) As I say, I have no comment on our relationships with other companies or clients.

Experts also agree that it’s only a matter of time before these surveillance tools turn up in the hands of local law enforcement, if they haven’t already.

"I would bet money that they’ve sold to local cops, I just don’t have a smoking gun," Chris Soghoian, a technologist with the American Civil Liberties Union, told Ars.

"They are targeting that market. If their sales people haven’t been able to sell to local law enforcement, then they’re not doing their job. I’m sure someone has bought the software, but like the stingray, they’re hiding what they’re doing."

Annapolis Exchange Parkway… a dead giveaway

The evidence that those two American government agencies purchased from Hacking Team stems from public records. Those filings show that a company called Cicom USA was hired by the US Army in 2011 to do two jobs worth $365,225 and seven more with the DEA worth $927,000 between 2012 and 2014.

A March 2012 Request for Information from the DEA showed that it was interested in acquiring a "fully functional and operational product proven to be capable of providing a Remote Control Host Based Interception System for device or target specific collection pursuant to authorized law enforcement use." Less than two months later, the DEA found that Cicom USA was the only such company available to provide this product and service.

There is little information as to who or what Cicom USA is, other than that it is headquartered at 1997 Annapolis Exchange Parkway, Annapolis, Maryland—the exact same listed address of Hacking Team in the United States.

Other filings show that as of Fiscal Year 2012—the same year as Cicom’s largest single contract ($575,000)—it reported just three employees and annual revenue of $3 million.

"I knew the Hacking Team address was in Annapolis, and recognized it," Soghoian told Ars, when Privacy International showed him the Cicom contracts.

Wheels of justice grind ahead

Many legal experts find this expansion of judicial and police power troubling, particularly given that the United States Department of Justice wants the legal authority to broaden its ability to hack criminal suspects’ computers. (In February 2015, Google published its formal opposition to the proposed revision.)

Federal agents have been known to use such tactics in past and ongoing cases: a Colorado federal magistrate judge approved sending malware to a suspect’s known e-mail address in 2012. But similar techniques have been rejected by other judges on Fourth Amendment grounds. If this rule revision were to be approved, it would standardize and expand federal agents’ ability to surveil a suspect and to exfiltrate data from a target computer regardless of where it is.

In April 2013, a federal judge famously denied the FBI when it asked for permission in its warrant request to target an overseas suspect via his webcam.

"It is not surprising that the DEA has had early access to these and other surveillance capabilities," Ahmed Ghappour, a law professor at the University of California, Hastings, told Ars by e-mail.

"The ‘war on drugs’ has been used as a petri dish for all sorts of surveillance capabilities, and questionable tactics like parallel construction . This is just the latest example. Perhaps most frightening will be use of these capabilities by state police forces, who lack any meaningful training or oversight on the use of hacking tools, and who typically exercise more discretion than their federal counterparts."

The San Francisco-based professor added that because federal prosecutors are especially aggressive in drug-related cases, they often push intensely for plea bargains.

"Less trials means less opportunity to file suppression motions that uncover surveillance technologies or questionable tactics such as parallel construction," he noted.

Brian Owsley, a former federal magistrate judge who is now a law professor at Indiana Tech, coincidentally is about to come out with a law journal article on this exact issue.

He shared with Ars a copy of that article, "Beware of Government Agents Bearing Trojan Horses," which is forthcoming in the Akron Law Review.