2 million is a very small contract in this context. More than likely this is for a targeted operation, like accessing the phones of known drug or human traffickers. They should absolutely disclose the nature of the contract to the public, but I have a hard time believing this is for some sort of mass surveillance or violation of privacy. The cost for that would be significantly higher from what I know.