Yes they do. From their website:
"The Software Engineering Institute (SEI) is a not-for-profit Federally Funded Research and Development Center (FFRDC) at Carnegie Mellon University, specifically established by the U.S. Department of Defense (DoD) to focus on software and cybersecurity."
On one hand, leading academic institutions are commonly understood to have a responsibility to preserve free speech (especially speech that is critical of military or government action), remain as a neutral education and research body decoupled from any specific political or military agendas, and help lead in social progress towards greater overall ethical standards in education, research, and scholarship.
On the other hand, many universities loan out the credential and status of being affiliated with them as a recruitment tactic to assist the DoD in the task of creating a diversified set of military research organizations, which from a superficial observation point of view (the view taken by many of the younger engineers duped into working for below market pay at such places) look like run-of-the-mill software/science/engineering jobs while having all sorts of ethical gray areas, and the end result is to create rampant ethical conflicts of interest, questionable management practices, and many other problems.
I don't think it's as simple as just pointing out that SEI is an FFRDC and moving on. The fact that universities in general continue to perpetuate this problem -- academia-military pseudo-credible research facility affiliation and status-mongering -- that is the bigger issue.
But it looks like they put themselves in that position. Either by voluntary working with the FBI and allegedly taking a $1M grant, and/or doing unethical research by doing it on the live network.
(I mean, I guess it's possible for an NSL to order you to do anything, because America.)
What's worse - that CMU did this in the first place or that they did it so cheaply?
It can only require you to turn over existing records/information.