The Communications Assistance for Law Enforcement Act
Released: 2009-03-30T00:00:00

Background

In the early 1990s the Federal Bureau of Investigation (FBI) asked Congress for legislation to assist law enforcement agencies to continue conducting electronic surveillance. The FBI argued that the deployment of digital technologies in public telephone systems was making it increasingly difficult for law enforcement agencies to conduct electronic surveillance of communications over public telephone networks. As a result of these arguments and concerns from the telecommunications industry, as well as issues raised by groups advocating protection of privacy rights, the Communications Assistance for Law Enforcement Act (CALEA) was enacted on October 25, 1994 (47 U.S.C. 1001-1021), in the final days of the 103 rd Congress.

CALEA is intended to preserve the ability of law enforcement officials to conduct electronic surveillance effectively and efficiently, despite the deployment of new digital technologies and wireless services by the telecommunications industry. CALEA requires telecommunications carriers to modify their equipment, facilities, and services to ensure that they are able to comply with authorized electronic surveillance. These modifications were originally planned to be completed by October 25, 1998. Since that time, the Federal Communications Commission (FCC) issued two additional orders establishing June 30, 2002, as the date by which telecommunications carries must have upgraded all their systems. Equipment manufacturers have fulfilled their obligation to provide CALEA solutions and carriers are implementing them. The FBI and FCC continue to monitor and review the implementation of this program.

Some Technical Terms

As a result of the revolution in digital technology in telecommunications, the process of wiretapping and other electronic surveillance has become more complex, and legal ambiguities have been introduced. As a background to understanding the problems associated with CALEA implementation, the definitions of several terms are necessary. Electronic surveillance refers to either the interception of communications content (as in a conversation) also known as wiretapping, or the acquisition of call-identifying information (the number dialed). The latter activity is accomplished through the use of pen register devices, which capture call-identifying information for numbers of outgoing calls from the location of lawful interception, and traps and traces, which capture information for numbers received at the location of lawful interception, much like consumer caller ID systems. Under current federal law, law enforcement (i.e., police or the FBI) must obtain a court order before conducting any of these activities. However, a wiretap requires a higher "evidentiary burden" than a pen register or trap and trace, including showing that there is probable cause for believing that a person is committing one of a list of specific crimes.

Under traditional analog technology, it was easy to separate the above categories of electronic surveillance. However, the advent of digital signal transmission technologies has made that distinction less clear. Information signals (voice or data) can be transmitted over telephone networks in one of two ways: circuit-switched and packet-switched modes. In circuit-switched systems, a communications path is established between the parties and dedicated exclusively to one conversation for the duration of the call. In packet-switched systems, the information is broken down into smaller pieces called "packets" using a digital process. Each packet contains a small part of the message content along with call-identifying information called a "header" that indicates the origination and destination points of the information. Each packet is transmitted separately and is reassembled into the complete message at the destination point.

The packet-switched mode is the signal transmission technology used in all Internet communications. Packet switching is considered a more efficient use of a network than circuit switching because the same line can be used for multiple communications simultaneously. Although the circuit-switched mode was historically used in all voice telephone calls, the packet-switched mode is increasingly being used for voice and data transmissions over telephone networks.

CALEA's Main Provisions

CALEA requires telecommunications carriers to assist law enforcement in performing electronic surveillance on their digital networks pursuant to court order or other lawful authorization. The telecommunications industry, privacy rights groups, and law enforcement agencies agree that CALEA was not intended to expand law enforcement's authority to conduct electronic surveillance. On the contrary, CALEA was intended only to ensure that after law enforcement obtains the appropriate legal authority, carriers will have the necessary capabilities and sufficient capacity to assist law enforcement in conducting digital electronic surveillance regardless of the specific telecommunications systems or services deployed.

CALEA (47 U.S.C. 1002) directs the telecommunications industry to design, develop, and deploy solutions that meet certain assistance capability requirements for telecommunications carriers to support law enforcement in the conduct of lawfully-authorized electronic surveillance. Pursuant to a court order or other lawful authorization, carriers must be able, within certain limitations, to: (1) expeditiously isolate all wire and electronic communications of a target transmitted by the carrier within its service area; (2) expeditiously isolate call-identifying information that is reasonably available on a target; (3) provide intercepted communications and call-identifying information to law enforcement; and (4) carry out intercepts unobtrusively, so targets are not made aware of the electronic surveillance, and in a manner that does not compromise the privacy and security of other communications.

To allow carriers to give law enforcement the means to conduct its wiretaps, CALEA (47 U.S.C. 1003) requires the Attorney General to determine the number of simultaneous interceptions (law enforcement agencies' estimate of their maximum capacity requirements) that telecommunications carriers must be able to support.

To maintain privacy rights of individuals, CALEA (47 U.S.C. 1004) requires telecommunications carriers to ensure that any interception of communications or access to call-identifying information that is conducted within their premises can only be done with a court order. It also requires the specific intervention of an officer or employee of the carrier acting in accordance with regulations prescribed by the Federal Communications Commission (FCC).

CALEA (47 U.S.C. 1005) directs telecommunications carriers to consult with telecommunications equipment manufacturers to develop equipment necessary to comply with the capability and capacity requirements identified by the FBI. For efficient industry-wide implementation of the above requirements, CALEA (47 U.S.C. 1006) directs the law enforcement community to coordinate with the telecommunications industry and state utility commissions to develop suitable technical standards and establish compliance dates for equipment. In its Eighth Annual Report , the FBI stated that, "to date, most manufacturers have either complete, or nearly complete, CALEA solutions available for their carrier customers."

CALEA (47 U.S.C. 1008) gives the Attorney General, subject to the availability of appropriations, authority to pay telecommunications carriers for all reasonable costs directly associated with the modifications performed by carriers in connection with equipment, facilities, and services installed or deployed on or before January 1, 1995 (known as the "grandfather" date).

Major Events Following Enactment of CALEA

Initial Delays

CALEA gave implementation responsibility to the Attorney General, who, in turn, delegated the responsibility to the FBI. The FBI leads that nationwide effort on behalf of federal, state, and local law enforcement agencies. FBI officials initially anticipated that it would take a year for a standard to be developed and agreed upon by law enforcement, the telecommunications carriers, and the equipment manufacturers. Telecommunications consultants estimated that it would take the industry another three years to design, build and deploy new systems to comply with CALEA. Instead, industry and law enforcement became involved in a protracted dispute over what should be required for law enforcement's wiretapping capabilities.

By March 1997, the completion of the capability standard was overdue by 16 months. The FBI attempted to expedite the industry's implementation of CALEA by releasing regulations that included a cost recovery plan for the federal government's payment of costs associated with CALEA, as well as capability and capacity requirements for the industry to meet. The plan required more extensive upgrades to networks than the telecommunications industry believed were necessary for law enforcement to preserve its wiretapping capabilities. Industry groups and privacy advocates disputed the FBI's plan. They argued that the FBI was attempting to expand its surveillance capabilities beyond the congressional intention of CALEA, and was attempting to unfairly shift costs and accountability away from the federal government onto private industry. Furthermore, the industry argued that, without an adopted capability standard, it could not begin designing, manufacturing, and purchasing the equipment to achieve CALEA compliance.

In December 1997, the Telecommunications Industry Association (TIA, representing telecommunications equipment manufacturers) adopted, over the objections of the law enforcement community, a technical standard, J-STD-025, also known as the "J-standard." This standard prescribes upgrades to network devices to meet CALEA's assistance capability requirements for local exchange, cellular, and broadband personal communications services (PCS). Although the FBI claimed that the J-standard did not provide all of the capabilities needed, the industry asserted that CALEA's language stated that telecommunications carriers would be compliant if they met publicly available standards adopted by the industry.

Privacy rights groups, on the other hand, protested two aspects of the J-standard that they asserted would make information beyond what is legally required available to law enforcement. One was a feature enabling the telecommunications network to provide location information for users of mobile wireless telecommunications services. The location information protocols in J-STD-025 allow law enforcement agencies to obtain information on the physical location of the nearest cell site (i.e., the receiver/transmitter antenna and base station) of mobile phone handsets at the beginning and end of each call. Wireless carriers are now deploying another technology (called triangulation) that will enable the carriers, and law enforcement, to track wireless telephone users more precisely, potentially within a few meters. The other was a feature enabling the network to access packet-mode data from telephone calls using more advanced systems. Privacy rights groups argued that these capabilities would violate the Fourth Amendment rights of individuals against unreasonable searches and seizures. Despite these objections, telecommunications manufacturers began designing new switches and upgrades to existing switches according to the J-standard.

Currently, equipment manufacturers have successfully incorporated the J-standard into their new equipment and carriers are now well underway with their efforts to upgrade their systems.

The FBI's "Punch List"

In the negotiations to develop the J-standard, TIA had refused to include some of the capabilities that law enforcement officials claimed they needed to facilitate digital wiretapping. As a result, in March 1998, the FBI petitioned the FCC to require the telecommunications industry to adopt eleven additional capabilities. Industry and privacy rights groups protested that the FBI's plan would unlawfully expand enforcement capabilities. Eventually, the "punch-list" included the following six items:

Content of subject-initiated conference calls—Would enable law enforcement to access the content of conference calls supported by the subject's service (including the call content of parties on hold). Party hold, join, drop—Messages would be sent to law enforcement that identify the active parties of a call. Specifically, on a conference call, these messages would indicate whether a party is on hold, has joined or has been dropped from the conference call. Subject-initiated dialing and signaling information—Access to all dialing and signaling information available from the subject would inform law enforcement of a subject's use of features (such as the use of flash-hook and other feature keys). In-band and out-of-band signaling (notification message)—A message would be sent to law enforcement whenever a subject's service sends a tone or other network message to the subject or associate (e.g., notification that a line is ringing or busy). Timing information—Information necessary to correlate call-identifying information with the call content of a communications interception. Dialed digit extraction—Information would include those digits dialed by a subject after the initial call setup is completed.

Capacity Requirements

The FBI's subsequent implementation actions were also opposed by the telecommunications industry. In March 1998, the FBI announced its estimated capacity requirements for local exchange, cellular, and broadband PCS. The industry protested the FBI's estimates, arguing that it would require telephone carriers to accommodate thousands of wiretaps simultaneously, an impractical and unnecessary burden. In July 1998, the FBI developed guidelines and procedures to facilitate small carrier compliance with its capacity requirements, and asked carriers to identify any systems or services that did not have the capacity to accommodate those requirements. In December 1998, the FBI began a proceeding to develop capacity requirements for services other than local exchange, cellular, and broadband PCS, asked additional questions of interested parties in June 2000. These technologies and services included paging, mobile satellite services, specialized mobile radio, and enhanced specialized mobile radio. To date, the proceeding is still pending.

Previous FCC Actions

As a result of petitions from the industry and the FBI, the FCC became involved in the implementation of CALEA. In October 1997, the FCC released its first Notice of Proposed Rule Making (NPRM) on CALEA implementation. The NPRM sought comments from interested parties regarding a set of policies and procedures proposed by the FCC for telecommunications carriers to follow. The proposed procedures would (1) preclude the unlawful interception of communications, (2) ensure that authorized interceptions are performed, (3) maintain secure and adequate records of any interceptions, and (4) determine what entities should be subject to these requirements, whether the requirements are reasonable, and whether to grant extensions of time for compliance with the requirements.

In response to the NPRM, telecommunications carriers, privacy rights groups, and the FBI submitted comments to the FCC to attempt to influence the final decision. Then, in April 1998, the FCC released a Public Notice requesting comments on issues raised in those petitions concerning the dates that carriers were required to comply with CALEA and the dispute over the J-standard. Based on comments it received, the FCC extended the implementation deadline until June 30, 2000, stating that without a standard, the necessary equipment would not be available in time.

In October 1998, the FCC initiated a proceeding to review the technical capabilities prescribed by the J-standard. The goal of that proceeding was to determine whether telecommunications carriers should be required under CALEA to meet the FBI's "punch list" items. The FCC addressed these issues in several documents released over the following year. In March 1999, the FCC's First Report and Order established the minimum capability requirements for telecommunications carriers to comply with CALEA. Telecommunications carriers were required to ensure that only lawful wiretaps occur on their premises and that the occurrence of wiretaps is not divulged to anyone other than authorized law enforcement personnel. On August 2, 1999, the FCC decided to allow carriers to decide how long they would maintain their records of law enforcement's wiretap, pen register, and trap and trace interceptions. On August 31, 1999, the Second Report and Order established a definition for "telecommunications carrier" to include all common carriers, cable operators, electric and other utilities that offer telecommunications services to the public, commercial mobile radio services, and service resellers. The definition did not include Internet service providers (ISPs), which were explicitly excluded under the CALEA statute.

The FCC's Third Report and Order, released August 31, 1999, adopted technical requirements for wireline, cellular, and broadband PCS carriers to comply with CALEA requirements. The ruling adopted the J-standard, including the two capabilities that were opposed by the privacy rights groups (i.e., the ability to provide location information and packet-mode data to law enforcement). As described above, the FCC also adopted six of the punch list capabilities requested by the FBI to be implemented by telecommunications carriers. The Order required all aspects of the J-standard except for the packet-mode data collection capability to be implemented by June 30, 2000. The Order required carriers to comply with the packet-mode data capability and the six punch list capabilities by September 30, 2001. (The FCC ultimately extended the date by which all telecommunications carriers must have upgraded their systems to June 30, 2002. )

On April 9, 2001, the FCC adopted its Second Order on Reconsideration, which clarified the arrangements telecommunications carriers must make to ensure that law enforcement agencies can contact them when necessary, and the interception activity that triggers a record-keeping requirement.

In September 2001, FCC released a tandem Order and Public Notice on CALEA implementation. In the Order, the Commission extended until November 19, 2001, the deadline by which wireline, cellular, and broadband personal communications services (PCS) carriers must implement a packet-mode communications electronic surveillance capability, or to seek individual relief under section 107(c) of CALEA. The notice explained the petitioning process for telecommunications carriers seeking relief under section 107(c) for an extension of the new compliance deadline with respect to packet-mode communications, as well as other safe harbor standards.

Finally, on April 11, 2002, the FCC released an Order on Remand, which responded to a decision issued by the United States Court of Appeals for the District of Columbia Circuit vacating four of the punch list electronic surveillance capabilities mandated by the Third Report and Order in this proceeding. The FCC found that all of the capabilities were necessary and authorized by CALEA and had to be provided by wireline, cellular, and broadband PCS telecommunications carriers by June 30, 2002. The FCC also required that two additional punch list capabilities that were mandated by the Third Report and Order, but not reviewed by the Court of Appeals be provided by that same date.

The FCC granted preliminary extensions to requesting carriers with respect to punch list implementation that will expire on June 30, 2004. It granted preliminary extensions in connection with "packet" services that had been scheduled to expire on November 19, 2003, but that date was further extended to January 30, 2004. No further action with respect to that extension has been taken.

Government Activity: 2004 - Present

The FBI and other law enforcement agencies, the FCC, and Congress are all concerned with CALEA-related issues, particularly with respect to packet-based services (i.e., voice over Internet Protocol [VoIP]) and "push-to-talk" services offered by wireless providers.

FBI Activity

The FBI has remained active in promoting its positions related to its CALEA powers.

Comments to the FCC's Wireless Broadband Task Force Report

On April 22, 2005, the Department of Justice (DOJ) filed comments on the FCC's Wireless Broadband Task Force Report, requesting that the FCC "continue to preserve the vital national security and criminal law enforcement capabilities of CALEA as it develops a deregulatory framework for wireless broadband Internet access services." Reply comments in the proceeding were due May 23, 2005.

Notice of Information Collection Under Review

On April 13, 2005, the FBI published a 60-day Notice of Information Collection Under Review. The notice announced a CALEA Readiness Survey program, which seeks to evaluate the effectiveness of CIU programs for implementing CALEA solutions in the Public Switched Telephone Network. Comments in this proceeding were accepted until June 13, 2005.

Petition for Declaratory Ruling

On March 10, 2004, the FBI, the DOJ, and the Drug Enforcement Administration petitioned the FCC to identify additional telecommunications services not identified specifically within CALEA that should be subject to it. The services named in the FBI petition include some now considered beyond the scope of CALEA by many observers, including services that fall under the FCC's definition of "information services" under the Communications Act of 1934. However, CALEA provides the FCC a broader framework to determine that a service is a "telecommunications service." Comments and replies to the petition were due April 12 and April 27, 2004, respectively. The FCC ruled on this Petition on August 5, 2005, discussed below (See "FCC Action," page 10).

Inspector General Report

The FBI's Inspector General issued a report in April 2004 on CALEA implementation. In its report, the IG expressed concern over the cost estimates for obtaining CALEA compliance, which have varied widely. Industry has stated it believes estimates full compliance will cost approximately $1.3 billion; the FBI has estimated costs in the range of $500 million to $1 billion. Further, in December 2003, the FBI estimated that an additional $204 million would be necessary to complete deployment of CALEA. The IG stated in its report that it did not believe implementation costs could be determined with any degree of specificity, but that it was unlikely CALEA could be implemented with the $49.5 million that remains unobligated from current funding.

FCC Activity

In response to law enforcement's petition and after considering the comments and replies from interested parties, the FCC released an NPRM and Declaratory Ruling on August 4, 2004. Additionally, the FCC has issued two Orders in this matter.

Declaratory Ruling

In the Declaratory Ruling accompanying the NPRM, the FCC clarified that commercial wireless "push-to-talk" services are subject to CALEA, regardless of the technologies that wireless providers choose to apply in offering them.

First Report and Order

On August 5, 2005, the FCC ruled that providers of certain broadband and interconnected VoIP services must accommodate law enforcement wiretaps. The FCC found that these services can be considered replacements for conventional telecommunications services currently subject to wiretap rules, including circuit-switched voice service and dial-up Internet access. As such, the new services are covered by CALEA, which requires the FCC to preserve the ability of law enforcement to conduct wiretaps as technology evolves. The rules are limited to facilities-based broadband Internet access service providers and VoIP providers that offer services permitting users to receive calls from, and place calls to, the public switched telephone network—these providers are called interconnected VoIP providers.

In making its ruling, the FCC found that the definition of "telecommunications carrier" in CALEA is broader than the definition of that term in the Communications Act and can, therefore, include providers of services that are not classified as telecommunications services under the Communications Act. CALEA contains a broader definition of telecommunications provider that authorizes the FCC to classify an entity a telecommunications carrier if it finds that such service is a replacement for a substantial portion of the local telephone exchange.

The FCC established a deadline of 18 months from the effective date of the Order for providers to achieve full compliance and adopted a Further Notice of Proposed Rulemaking to seek more information about whether specific classes of facilities-based broadband Internet access providers should be exempt from CALEA (i.e., small and rural providers and providers of broadband networks for educational and research institutions).

A coalition of organizations filed a Petition for Review with the United States Court of Appeals for the District of Columbia Circuit on October 25, 2005. Specifically, the "petitioners seek relief from the Order on the grounds that it exceeds the Commission's statutory authority and is arbitrary, capricious, unsupported by substantial evidence, and contrary to law. Petitioners request that this Court vacate the Order and the Final Rules adopted therein and grant such other relief as may be appropriate."

Second Report and Order

On May 3, 2006, the FCC addressed several issues regarding CALEA implementation, specifically, the Order:

Affirms the May 14, 2007, CALEA compliance deadline for facilities-based broadband Internet access and interconnected VoIP services (as established by the First Report and Order) and clarifies that the date will apply to all such providers. Explains that the FCC does not plan, at this time, to intervene in the standards-setting process in this matter. Permits telecommunications carriers the option of using Trusted Third Parties (TTPs) to assist in meeting their CALEA obligations. Restricts the availability of compliance extensions to equipment, facilities, and services deployed prior to October 25, 1998. Finds that the commission may, in addition to law enforcement remedies available through the courts, take separate enforcement action under section 229(a) of the Communications Act against carriers that fail to comply with CALEA. Concludes that carriers are responsible for CALEA development and implementation costs for post-January 1, 1995, equipment and facilities, and declines to adopt a national surcharge to recover CALEA costs. Requires all carriers providing facilities-based broadband Internet access and interconnected VoIP service to submit interim reports to the FCC to ensure that they will be CALEA-compliant by May 14, 2007, and also requires all such providers to which CALEA obligations were applied in the First Report and Order to come into compliance with the system security requirements in the commission's rules within 90 days of the effective date of this Second Report and Order.

Court Challenge

In June 2006, the United States Court of Appeals for the District of Columbia Circuit affirmed the FCC's decision concluding that VoIP and facilities-based broadband Internet access providers have CALEA obligations similar to those of telephone companies.

Congressional Activity: 111th and 110th Congresses

No bills were introduced in the 110 th Congress that would have amended the CALEA statute and no bills have been introduced in the 111 th Congress.