Professionals
Related Practices

FBI's 'Super-CALEA' Proposal: More Devices Covered, More Burdens on Industry

co-authored by Daniel Mah and Michael Vatis
BNA's Electronic Commerce & Law Report
August 9, 2006

BNA Document  

Reproduced with permission from BNA's Electronic Commerce & Law Report, Vol. 11, No. 31, pp. 845-847 (Aug. 9, 2006). Copyright 2006 by The Bureau of National Affairs, Inc. (800-372-1033) http://www.bna.com

CALEA

The FBI is circulating proposed changes to the Communications Assistance to Law Enforcement Act that would, among other things, establish the United States as gatekeeper for foreign law enforcement wiretap orders and impose new implementation costs on a broad spectrum of communications providers.

FBI's 'Super-CALEA' Proposal: More Devices Covered, More Burdens on Industry

By Michael Vatis and Daniel Mah

By Michael Vatis, Partner, and Daniel Mah, Associate, with Steptoe & Johnson LLP, New York and Washington D.C., respectively. The authors may be contacted at mvatis@steptoe.com and dmah@steptoe.com.


At a July meeting with industry representatives, the FBI circulated a draft11 of a supercharged version of the Communications Assistance for Law Enforcement Act (CALEA), the law that requires telecommunications carriers to build wiretap capabilities into their networks to facilitate electronic surveillance by law enforcement. CALEA has recently been the subject of regulatory action at the Federal Communications Commission and the D.C. Circuit Court of Appeals, resulting in an expansive reading of the existing law to cover broadband Internet access providers and interconnected Voice over Internet Protocol (VoIP) providers.

Not content with its victories in these fora, the FBI apparently is requesting expansive changes to CALEA. One look at the Bureau’s “Super-CALEA” reveals that it is a pure law enforcement “wish list,” with little or no attempt to balance competing interests as the current statute does. Indeed, the section-by-section analysis that accompanies the draft bill specifically explains that the purpose of one of the amendments is to demote privacy interests in favor of the carrier’s “primary duty to facilitate access to all of the communications or communication-identifying information that a law enforcement agency has been authorized to obtain.

What is more, the draft bill, if passed, would constitute a radical expansion of the FBI’s access to (and control of foreign agencies’ access to) purely foreign communications.

Definitions Reach New Technologies

The FBI’s Super-CALEA draft attempts to rationalize the scope of CALEA by removing any overlap with the Communications Act resulting from both statutes’ use of the term “information service,” and by defining more explicitly the services that are covered and the scope of the FCC’s authority to bring more services within CALEA. This is not necessarily a bad thing. The existing law is plagued with definitional difficulties that have resulted in the FCC going to extraordinary lengths in an effort to have the same words mean different things under CALEA and under the Communications Act. A more rational framework for CALEA could facilitate a better policy debate as to what services should have wiretap capabilities mandated by law.

The FBI’s draft legislation, of course, would include much more within the scope of CALEA than does existing law. Notably, Super-CALEA would cover “network access services,” which are supposed to include not only broadband Internet access but potentially other kinds of services too. It also covers “replacement telephone service,” a concept that is not limited to interconnected VoIP services, but that includes the provision of any service on a commercial basis available to the public for the transmission of any communications involving the human voice in real or near-real time.

This definition could include free services like Skype and “Xbox”-style voice communications, if such capabilities are being provided as an adjunct to some other commercial activity. In addition, the FBI’s proposed bill would expand the FCC’s discretion to bring other services within its scope, if it is in the public interest, by removing the requirement that such service be a “replacement for a substantial portion of the local telephone exchange service.”

Some definitional battles are likely to remain. The new definition of “exempt service” (which would replace the “information service” exception under existing law) continues to exempt remote computing services and electronic messaging services. The definition would also exempt from CALEA certain “true” peer-to-peer applications (where addressing information is not provided by the peer-to-peer software provider), as well as certain wireless “hot spot” providers.

U.S. Point-of-Presence Requirement

Even more radically, Super-CALEA attempts to require covered carriers to have a point-of-presence within the United States, staffed by persons located in the United States, to facilitate electronic surveillance by U.S. law enforcement. The U.S. point-of-presence requirement can be waived by the Attorney General on such conditions as are mutually agreed upon by the Attorney General and the carrier. While a U.S. point-of-presence has often been a matter of negotiation with U.S. law enforcement when a foreign carrier seeks to acquire a U.S. carrier or provide service in the United States, the new requirement by its terms would seem to apply to all covered carriers, whether foreign or domestic, whether providing service in the United States or not, and regardless of whether the communication involves a U.S. end point.

Not only that, Super-CALEA would require covered carriers to ensure that interceptions and access to communication-identifying information can be activated only “with the affirmative intervention of an individual officer or employee of the carrier acting within the United States.” This is a subtle change with significant consequences. Read literally, a foreign carrier would have to have someone in the United States involved in wiretaps even if the interception is in relation to a communication between foreign points pursuant to a foreign law enforcement order. This could create conflicts with foreign laws regarding assistance to law enforcement agencies.

It could also create a conflict with U.S. wiretap statutes, which generally prohibit interceptions in the United States without a U.S. court order. That conflict might be resolved only by having foreign law enforcement agencies obtain Justice Department assistance in every case in which they want to conduct electronic surveillance. Thus, this provision could conceivably set up the U.S. government with the ability to easily intercept purely foreign communications through access points in the United States and make it the gatekeeper for all foreign law enforcement intercept orders.

Additional Substantive Duties

The draft bill would also expand CALEA’s substantive requirements. Super-CALEA clarifies that communication-identifying information (previously “call-identifying information”) (“CII” for short) includes any information the carrier uses to route the communication, as well as other information that is “reasonably available.” This is intended to ensure that the FBI will to continue to have access to “dialed digit extraction” capabilities. Less clear is what this means for packet communications carriers, which are covered under the proposed bill as providers of “network access services.” In the section-by-section analysis, the FBI does acknowledge that:

[i]t is not feasible to require network access carriers to maintain full extraction capabilities for services they do not control in a manner that is sufficiently accurate, reliable and up-to-date to properly meet the needs of law enforcement agencies.


 

ARTICLE SUBMISSIONS

The Electronic Commerce & Law Report publishes articles by attorneys addressing legal issues arising from regulation of online commerce, information privacy, network security, Internet governance, software development and licensing, trademarks and copyrights, computer crimes, and the application of constitutional principles to electronic communications media.

Inquiries should be directed to the Managing Editor, Electronic Commerce & Law Report, 1231 25th St., N.W., Washington, D.C. 20037; telephone (202) 785-6883, fax (202) 728-5203, or e-mail to totoole@bna.com.


In addition, post-cut-through dialed digits are specifically excluded from the definition of CII for network access service providers (e.g., broadband Internet access providers), but not for replacement telephone providers (such as VoIP providers). Super-CALEA would still require such carriers to extract CII from within a packetized stream, if that information is “reasonably available.” Packet carriers will, moreover, have to provide temporary storage of intercepted information to facilitate law enforcement’s interception of the communications. Super-CALEA also introduces a default minimum capacity requirement that applies unless the Attorney General publishes a notice requiring more. Covered carriers must

ensure that each of its switching, addressing, routing, or transmission facilities are capable of accommodating simultaneously a minimum of two each of interceptions, pen registers and trap and trace devices.

This appears to be a per-switch or per-router requirement. What this means is that covered carriers cannot get reimbursement from the government for building this minimum intercept capacity. Finally, the revised CALEA would require carriers to deliver information to law enforcement in a standardized format.

Increased Government Leverage Over Industry

In addition, Super-CALEA would give law enforcement overwhelming leverage in standard setting and in the event of disputes over CALEA. First, it guts the “safe harbor” and industry’s role in setting wiretap standards under existing law. Currently, a carrier that implements a CALEA solution in accordance with industry standards is deemed to be in compliance until such time as the FCC sets aside or modifies that standard in response to a deficiency petition filed by law enforcement. In other words, under existing law, carriers are protected from violating CALEA during disputes with the government over the applicable standards.

Under Super-CALEA, the “safe harbor” ends as soon as the deficiency petition is filed, leaving carriers potentially liable for $10,000 a day in civil penalties for each day of non-compliance. Moreover, the proposed bill gives the Attorney General the power to adopt standards that would qualify for “safe harbor” treatment. Faced with a choice between the risk of incurring daily liability fighting the FBI on the applicable standards or complying with the government’s issued standard, most carriers would likely choose the latter. At that point, both the industry’s and the FCC’s ability to prescribe standards become largely irrelevant.

Super-CALEA would also reverse the burden of proof in enforcement proceedings and require the carrier to establish that there are alternatives reasonably available to law enforcement. In addition, carriers will no longer be able to plead that compliance with CALEA is not reasonably achievable in defense to an enforcement proceeding, but must bring a separate petition to prove that compliance is not reasonably achievable pursuant to an 11-factor test. Even if the carrier were to succeed in meeting the high burden associated with such a petition, the FCC can only grant relief for up to two years and the Attorney General can seek reconsideration at any time.

And in case this were not enough to persuade the carrier to accede to law enforcement’s demands, the draft bill amends the Communications Act to make a carrier’s non-compliance with CALEA a negative factor whenever the FCC must consider the public interest in relation to that carrier, e.g., when that carrier is applying for an FCC authorization or is seeking consent for transfer of control.

Finally, the FBI’s draft cements the FCC’s recent finding that carriers are responsible for post-1995 CALEA implementation costs, and specifically amends the federal wiretap and pen register/trap-and-trace statutes to preclude recovery of such costs through intercept provisioning charges. The ability of carriers to recover such costs through intercept provisioning charges was crucial to the FCC’s previous finding that certain intercept capabilities requested by law enforcement were cost-effective. It will be interesting to see whether those findings will change with the elimination of virtually all methods of cost recovery.

Limited Anti-Liability Provision

Super-CALEA does throw one bone to industry. It proposes an anti-liability provision that would immunize carriers, their officers, employees and agents against any cause of action in any court for “providing any information, facilities or assistance or making any modifications to equipment, facilities or services, or ensuring any capability in accordance with this Act.”

One wonders whether this is an attempt to “save” the industry from civil suits for cooperating with the National Security Agency’s warrantless wiretapping program in return for broader wiretap capabilities. If it is, then industry would be foolish to accept such a bargain. Not only would industry be taking on significantly greater burdens, but the anti-liability provision would not appear to be broad enough to save carriers from NSA-related suits because the information provided to the NSA does not appear to be “in accordance with this Act.” And even if this were not the case, the government already has ample incentive to leap to industry’s defense and assert the state secrets privilege whenever a carrier is sued for assisting the NSA. If this is a bone, it has no marrow.

The FBI’s proposals are so radical that it is hard to imagine the draft bill making much headway in Congress any time soon. But the Bureau has essentially framed the debate with this draft, and simultaneously thrown down the gauntlet to industry. It is now up to industry to explain to members of Congress and staff just how radical these proposals are, and how they would not only impose significant burdens on communications providers, but could also cause serious rifts with foreign allies.

1 Available at <http://pub.bna.com/eclr/caleadraft.pdf>


Copyright 2006, The Bureau of National Affairs, Inc., Washington, D.C.