Not every Internet provider can handle the demands of a Foreign Intelligence Surveillance Act warrant or law enforcement subpoena for data. For those companies, Zack Whittaker reports on ZDNet, the answer is to turn to a shadowy class of companies known as “trusted third parties” to do the black bag work of complying with the demands of the feds.

Under the Communications Assistance for Law Enforcement Act (CALEA), phone companies and Internet providers can charge back the government for their efforts in responding to warrants. AT&T charges the CIA more than $10 million per year for access to its phone call metadata. But smaller ISPs who aren’t frequently hit with warrants can’t afford to keep the infrastructure or manpower on-hand to respond to requests—so they sign up with a “trusted third party” capable of doing the work as an insurance policy against such requests.

Companies such as Neustar, Yaana Technologies, and Subsentio contract with smaller providers and reap the profits from charging federal law enforcement and intelligence agencies for the data. Neustar and Yaana are also essentially private intelligence companies, providing large-scale data capture and analytics (though probably not on the scale of NSA’s Xkeyscore.) Neustar is also in the phone number portability business, and owns a number of the new top level domains approved by ICANN.

As Whittaker reports, the Atlanta-based ISP Cbeyond works with Neustar to handle CALEA requests, and Neustar contacts the ISP’s counsel for permission whenever one is made. But as a Cbeyond staffer familiar with the arrangement told Whittaker, “Of what worth is our permission when we don't even know what we're being asked to give access to?"

Neustar chief privacy officer Becky Burr told Whittaker that her company also handles civil subpoenas, including data subpoenas from divorce cases. She said it will often push back on subpoenas if they are improper.

But the partnership ends between trusted third parties and ISPs when the ISPs choose to fight a subpoena or a FISA order. When it goes to court, the ISP’s lawyers are on their own.