A Reinterpretation of CALEA

© 2005 Wendy Wigen

EDUCAUSE Review, vol. 40, no. 2 (March/April 2005): 60–71.

As the telecommunications community braces itself for what may be the most significant change in telecommunications law since the breakup of Ma Bell, the decisions that will set the precedent for a new Telecommunications Act are already being made at the Federal Communications Commission (FCC). Although many of the changes will take years, one decision appears to be on the fast track (at least by FCC standards). In a pro–law enforcement environment, a reinterpretation of CALEA to include the Internet seems certain to make progress.

CALEA is the Computer Assistance for Law Enforcement Act. Initially passed in 1994, it requires providers of commercial voice services to engineer their networks in such a way as to assist law enforcement agencies in executing wiretap orders. The act was the result of law enforcement’s appeal to Congress for help in carrying out wiretaps in the face of ever-more-challenging telecommunications technology, in particular the switch from analog to digital services. At the time the act was passed, law enforcement agreed to exempt the Internet and private phone networks as part of a long compromise process with Congress. Higher education was excluded as a "private network"—that is, whenever a campus phone network connects to the PSTN (Public Switched Telephone Network), it uses a CALEA-compliant commercial carrier, and therefore the communication is covered.

Ten years have passed, and law enforcement once again finds itself in a challenging communications environment. The recent popularity of VoIP (Voice-over Internet Protocol) has opened the door for law enforcement to argue that as communications converge to the Internet, the Internet must be made more accessible to legal intercepts (wiretaps). In anticipation of a favorable ruling for law enforcement, new technologies are rapidly evolving to make this practicable. In the spring of 2004, the U.S. Department of Justice (DOJ), the Federal Bureau of Investigation (FBI), and the Drug Enforcement Agency (DEA) filed a joint petition to the FCC (http://www.askcalea.com/docs/20040310.calea.jper.pdf) for expedited rulemaking on CALEA. The petition asked the FCC to rule that the Internet was now subject to CALEA under the "substantial replacement" clause written into the original statute. That clause states that any technology that becomes a substantial replacement for commercial voice services will be subject to compliance. The FCC received over fifty comments on the petition. Predictably, law enforcement agencies and legal intercept vendors supported the petition. Telecommunications carriers, Internet service providers, VoIP vendors, and privacy groups (who fought hard in 1994 to obtain the balance in the law) filed against it. EDUCAUSE and Internet2, as part of a coalition of thirteen higher education and library associations, filed comments (http://www.internet2.edu/pubs/20040413-Comments-CALEA.pdf) that outlined the negative impact that CALEA compliance would have on costs, innovation, and personal privacy for their member institutions.

The FCC responded by issuing a Notice of Proposed Rulemaking, or NPRM (http://www.techlawjournal.com/agencies/calea/20040809nprm.pdf), on August 4, 2004.¹ In this proposed rulemaking, the FCC stated that schools "do not appear to be covered by CALEA" and cited the coalition’s comments. On September 20, 2004, EDUCAUSE and Internet2 representatives met with the FCC CALEA working group to help clarify this statement. As a result of the meeting, the following points became clear:

• The ruling is still very much in flux, and its progress will largely depend on how law enforcement responds to the NPRM.
• Some form of assistance for legal intercepts will be extended to the Internet; however, there are several major questions still to be resolved: Is CALEA the proper legal vehicle to achieve this? Does this require new legislation? (There is concern among the FCC commissioners that any final ruling on the NPRM will not hold up in court.) Who will be required to comply? Who will pay? What standards will constitute compliance?
• The education and library communities must stay active in the process.

EDUCAUSE decided to once again organize the community and submit comments. Fifteen education and library organizations joined EDUCAUSE (the "EDUCAUSE Coalition") to file comments (http://www.educause.edu/ir/library/pdf/EPO0420.pdf) with the FCC on November 8, 2004. The document made clear that whereas the members of the coalition support the need for law enforcement to have access to communications under proper legal conditions, they reject the FCC attempt to extend CALEA to include broadband Internet access and VoIP.

The coalition’s comments argued two basic points: (1) the CALEA statute, as currently written, does not apply to broadband Internet access, and only Congress has the power to rewrite CALEA; and (2) if CALEA is extended to include broadband Internet access and VoIP, coalition members need to be clearly and specifically exempted from this obligation.

Despite the broadly held opinion that any ruling resulting from this NPRM will be quickly challenged in court, EDUCAUSE feels that higher education must continue to build its argument for an exemption. Significant progress was made following a meeting with law enforcement in December 2004. On December 21, the DOJ, the DEA, and the FBI filed reply comments to the FCC that clarified an exemption for campus intranets and educational and research networks such as Internet2. They also agreed to continue negotiations on a full exemption for facility-based educational and library facilities.

Much work remains, but by uniting with other education and library associations, EDUCAUSE has sent a strong and consistent message: any rule changes concerning the Internet must take into account the impact on our communities. CALEA is only the beginning; eventual changes in the Telecommunications Act will result from these early decisions. Most important, these proceedings provide a means for our community to remain an active participant in shaping the future of the Internet.

1. Formally published in the September 23, 2004, Federal Register at 69 Fed. Reg. 56976, http://a257.g.akamaitech.net/7/257/2422/06jun20041800/edocket.access.gpo.gov/2004/04-20705.htm.