The DHS subcomponent tracked cell calls during the San Bernardino attack last December.
A federal agency dedicated to monitoring cellular network traffic was watching last December as calls flooded San Bernardino 911 dispatchers.
Nope, not the National Security Agency or the Federal Communications Commission.
It was the National Coordinating Center for Communications, an obscure part of the Homeland Security Department.
NCC “had a picture of the volume of 911 calls” stirred up as a result of activity occurring in a small geographic area near the San Bernardino Inland Regional Center, says John Felker, director of NCC’s parent, the 24-7 National Cybersecurity and Communications Integration Center.
“We didn't know it was a shooting,” he said, adding, for all the agency knew the phones could have been ringing off the hook about a fire.
NCC’s job is to organize the restoration -- or shutdown -- of U.S. cellular networks during national crises and high-profile events.
“We had a picture of the cellphone towers in that area to make sure that there was nobody trying to jam them and they weren't,” Felker said. He spoke April 19 at a cybersecurity symposium held by AFCEA.
NCC was created in 1984 out of the need for a central mechanism to organize national security communications operations at the dawn of the breakup of the AT&T monopoly and the waning years of the Cold War.
Then, a Defense Department component, NCC now sits inside the NCCIC facility in Ballston, Virginia.
As landlines give way to cellular networks, the agency continues to grow and now includes a cybersecurity information-sharing unit. Federal workers along with more than 50 telecommunications and IT company personnel either staff the center around-the-clock or support operations remotely and in the field.
NCC and regional partners, for instance, kept a close eye on communications infrastructure in Washington, Philadelphia and New York, when Pope Francis visited the United States last September.
"We had someone from NCC who was coordinating with the local communications companies to make sure that if something bad happened they'd come in” with equipment for backup, Felker said.
Nothing bad happened with Francis, but the technicians have had more than their fair share of emergency response sessions.
NCC helped re-establish communications following the Sept. 11, 2001, terrorist attacks and Hurricane Katrina, according to a January 2006 report by the President’s National Security Telecommunications Advisory Committee
According to a report released the next year by the same committee, the government in March 2006 deputized NCC to serve as lead organizer for any actions "leading up to and following the termination of private wireless network connections, both within a localized area, such as a tunnel or bridge, and within an entire metropolitan area."
The government has never revealed the secret policy for such cellphone shutdowns, the so-called Standard Operating Procedure 303.
After cellular service at a San Francisco Bay Area Rapid Transit station was disabled in 2011 to stop a protest over police shootings, a civil liberties group sought a copy of the procedures.
The Electronic Privacy Information Center (unsuccessfully) sued for the records all the way up to the Supreme Court earlier this year.
To this day, it is not known if the wireless kill-switch has ever been flipped.
NEXT STORY Ex-Hacker: If You Get Hacked, Sue Somebody