I haven't said anything good about Symantec in awhile, but Norton DNS provides this free for home AND commercial use.
Two limitations, it only has 3 levels of filtering to choose from and no whitelist options that I'm aware of...
2) Spyware + Porn
3) Spyware + Porn + File Sharing
Just need to use their DNS servers. There are obviously ways to circumvent the filtering, but those individuals will at least be learning other (valuable?) skills if they learn how.
While I agree with the rest of your post....
First off, we can assume that the FBI has more than one surveillance van, in which they can't all have the same SSID. They would include some sort of vehicle ID, etc.
Why can't all the vans have the same SSID? This would allow the FBI agents to switch vans daily and not have to re-connect their laptops each time they use a different van. This assumes they use the same authentication/password as well.
I've setup multiple residential and low-budget commercial networks with low-end access points in this manner and it works relatively well. Not to say this is the best or right way, but when has that ever stopped somebody.