Implementation of the Communications Assistance for Law Enforcement Act by the Federal Bureau of Investigation*
Report No. 04-19
Office of the Inspector General
Deployment of CALEA Solutions Has Been Significantly Delayed
Implementation of CALEA solutions remains delayed after more than nine years since CALEA's enactment.12 Despite payments and obligations of approximately $450 million for manufacturers to assist carriers in implementing the requirements of CALEA, the FBI has not entered into any agreements with carriers to deploy electronic surveillance solutions at priority locations as defined in footnote 17. The main reasons for the delay in implementation are that carriers: (1) have stalled the implementation of CALEA by challenging or failing to develop electronic surveillance standards that address all law enforcement needs; (2) challenged the FBI's carrier cost recovery regulations; and (3) did not provide the FBI with reasonable deployment cost estimates. In addition, the first negotiation with a manufacturer to develop a software solution that will provide carriers with RTU licenses to use manufacturer-developed electronic surveillance features, began in 1998, and the FBI reports that only now are negotiations with manufacturers being completed.
In addition, the FCC has granted the carriers extensions for compliance with CALEA that have delayed implementation by nearly four years which has adversely impacted the FBI's ability to implement CALEA for the benefit of law enforcement. As a result, the FBI estimated that electronic surveillance standards have been deployed on only 10 to 20 percent of carrier wireline equipment, and 50 percent of pre-1995 and 90 percent of post-1995 wireless equipment. However, the FBI was unable to provide us with data showing the extent to which state and local law enforcement has been unable to conduct electronic surveillance as a result of these delays.
We discuss the causes of these delays in detail below. Also we discuss below the two major efforts undertaken by the FBI to implement CALEA: the RTU agreements, and the flexible deployment program. Finally, we discuss issues that CALEA implementation is still facing: emerging technologies, legal issues, and future funding needs.
Causes for Delay in Deployment
Electronic Surveillance Standard Setting and FCC Actions
In June 1996, DOJ issued the Electronic Surveillance Interface (ESI) Document. The ESI sets forth the law enforcement surveillance capabilities, which were developed in consultation with law enforcement and industry representatives. In December 1997, the industry published Interim Standard J-STD-025 (J-Standard) to meet the electronic surveillance capability requirements of CALEA. The J-Standard incorporated many of the standards set forth in the ESI but excluded several electronic surveillance capabilities deemed necessary to law enforcement. As a result, DOJ filed a deficiency petition with the FCC in March 1998 because the J-Standard did not meet an additional nine capabilities (punch-list) that law enforcement was seeking.13 The punchlist included the following capability requirements for carriers:
In September 1998, the FCC granted an extension to carriers of CALEA deadline for complying with CALEA capability requirements. For equipment installed or deployed after January 1, 1995, the FCC extended the deadline from October 28, 1998, to June 30, 2000. The FCC granted this extension on the basis that there was no technology currently available to permit carriers to deploy the minimum industry-developed J-Standard capability standards. In its order, the FCC noted that, pursuant to CALEA, carriers are deemed to be CALEA-compliant with respect to equipment installed or deployed on or before January 1, 1995, unless the Attorney General agrees to reimburse carriers for all reasonable costs necessary to bring such equipment into compliance.
In August 1999, the FCC ruled that carriers must comply with six of the additional punch-list requirements sought by the government and not included in J-Standard (items 1 through 6 on page 7). The FCC gave carriers until September 2001 to comply with these additional capability standards. The FCC also mandated that carriers provide the capability to intercept packet-mode communications by September 30, 2001.14 The industry appealed the FCC decision to the United States Court of Appeals, District of Columbia Circuit. On August 21, 2000, the Court of Appeals ruled that each capability standard is required by CALEA, but remanded four of the challenged capabilities (items 2, 3, 4 and 6) to the FCC for further proceedings (99-1442). In an April 11, 2002, Order on Remand, the FCC found that all of the punchlist requirements are required under CALEA and must be provided by wireline, cellular, and broadband telecommunications carriers by June 30, 2002.
Cost Recovery Regulations
In March 1997, the FBI published the final cost recovery regulations (28 CFR Part 100), which set forth the procedures for carriers to follow to receive reimbursement for costs incurred in deploying their CALEA solutions on their pre-1995 equipment. A CALEA solution is the methodologies that carriers adopt to be able to comply with law enforcement requests to conduct lawful electronic surveillance. Carriers will incur costs to deploy their CALEA solutions through activation of the software provided by manufacturers under the RTU agreements. The Cost Recovery Regulations became effective on April 21, 1997. Industry representatives filed a lawsuit in April 1998 in U.S. District Court of the District of Columbia (Court) challenging the definition of "installed or deployed" as the term applied to the January 1, 1995, cutoff for reimbursements to carriers. DOJ filed a motion to dismiss, and in August 2000 the Court ruled in favor of DOJ (98-2010).
On October 5, 2001, the FBI published a Supplemental Notice of Proposed Rulemaking, 66 Fed. Reg. 50931 (2001). The notice addressed the implementation of CALEA Section 109 regarding the definitions of "replaced" and "significantly upgraded or otherwise undergoes major modification." The FBI published on July 2, 2003, an information collection request 68 Fed. Reg. 39597 (2003) to the Office of Management and Budget for review and approval of the Cost Recovery Regulations in accordance with the Paperwork Reduction Act of 1995. The proposed information collection was published to obtain comments from the public and affected agencies. On October 16, 2003, the FBI published 68 Fed. Reg. 59638 (2003), a 30-day notice of information collection reply comment period regarding the Cost Recovery Regulations.
Carrier Cost Proposals
The FBI implemented an approach to reimbursement that allowed carriers to receive at no charge CALEA electronic surveillance software. The FBI determined that RTU licenses for the use of the manufacturers' software would be a major cost for the carriers and that nationwide software buyouts would be more cost effective than reimbursing individual carriers for the cost of this software (FBI purchase of RTU licenses for all carriers that use a given manufacturer's equipment). Under these RTU agreements, the manufacturers developed and made available to carriers the software with the necessary features for electronic surveillance that carriers require in order to deploy their CALEA solutions. The FBI reasoned that if carriers did not have to pay manufacturers individually for the software licenses, volume discounts could be achieved, thereby reducing deployment costs.
In the past, carriers have submitted cost estimates to the FBI for deployment of CALEA solutions. Deployment involves activation by the carriers of the software solutions previously developed by manufacturers. The FBI has not yet entered into any agreements with carriers because FBI personnel believed that carrier cost estimates for activation were unreasonable. The only exception to this was an agreement with Qwest, dated February 28, 2002, to implement its electronic surveillance solution in the Salt Lake City area before the Winter Olympics held in February 2002.15
FBI personnel provided us with several carrier proposals for deployment of their electronic surveillance solutions as examples of what FBI personnel considered to be exorbitant cost estimates to deploy CALEA solutions. These included submissions by GTE, SBC, and Verizon. The three examples provided by the FBI contained cost estimates that together exceeded the total funds authorized by Congress for CALEA implementation. GTE submitted its proposal in February 1999 before the RTU agreements and before merging with Verizon. GTE estimated that the cost of deploying a CALEA solution throughout its entire network could exceed [Proprietary Information Redacted]. SBC and Verizon submitted cost estimates after the RTU agreements had been consummated and reflected the cost savings resulting from these agreements. The SBC cost proposal, submitted in September 2000, showed an estimate of [Proprietary Information Redacted] for deployment of a CALEA solution. The FBI provided us with two cost proposals submitted by Verizon. The first, submitted in June 2001, showed a cost estimate of [Proprietary Information Redacted] to deploy a CALEA solution throughout its network. The revised proposal submitted by Verizon in July 2002 showed the total cost estimate to be [Proprietary Information Redacted].
The FBI recently received a proposal from a major telecommunications carrier to deploy its electronic surveillance solution on specified carrier priority equipment. FBI personnel were optimistic that an agreement could be negotiated with this carrier, and that this will lead to the deployment of a CALEA solution throughout a significant portion of this carrier's network. The FBI is hopeful that if agreement is achieved with this carrier, the possibility of negotiating reasonably priced agreements with other carriers will be increased.
FBI Efforts to Implement CALEA
Results of Right-To-Use Software License Agreements
As previously reported in an OIG audit of CALEA, the FBI implemented an approach to reimbursement that allowed carriers to receive CALEA electronic surveillance software at no charge through RTU agreements (see OIG audit report numbers 00-10 and 02-14). Under RTU agreements, the manufacturers developed and made available the software with the necessary features for electronic surveillance in order for carriers to deploy their CALEA solutions. As of November 2003, the FBI had paid or obligated approximately $450 million, primarily for the purchase of the RTU software licenses from various manufacturers. The following major manufacturers have participated in RTUs: Nortel, Lucent, Motorola, Siemens, and AG Communications. In addition, the first negotiation with a manufacturer to develop a software solution, which provides the carriers with RTU licenses to use manufacturer developed electronic surveillance features, began in 1998 and the FBI reports that only now are negotiations with manufacturers essentially complete.
The FBI initiated the first agreement with Nortel in 1998. In our previous reports, we stated that the FBI was unable to determine the reasonableness of these agreements because the manufacturers refused to provide adequate cost and pricing data. Nevertheless, the FBI determined that the costs were reasonable through a Determination and Finding (D&F). We were unable to offer an opinion on the reasonableness of these costs without the supporting data. In defense of this approach, the FBI's general counsel opined that: "the . . . [RTU licensing] arrangement is a reasonable attempt to minimize the costs to the federal government because it reduces the potential for manufacturers to collect substantial profit from carriers who will in turn seek reimbursement from the federal government."
In this audit, to determine the result of the RTU agreements, we requested FBI personnel to provide us with data showing the extent to which CALEA compliant software was resident on carrier equipment. The FBI obtained the requested information from two sources. According to the data provided to us by the FBI, as reported in the industry's "Local Exchange Routing Guide" and by carriers under the FBI's Flexible Deployment Initiative described below, CALEA compliant software is now resident on carrier equipment switches as set forth in the two tables below, and that these results were because of the RTU agreements that the FBI had negotiated.16
However, CALEA compliant software features must be activated by the carrier to effect compliance with CALEA requirements. The FBI did not have specific data from the carriers to determine the number of carrier equipment switches on which CALEA features have been activated, but the FBI has requested this information from the carriers. FBI personnel advised us that Verizon has recently agreed to begin providing such information to the FBI. FBI officials provided us with their best estimate of activated carrier switches based on ongoing interaction with industry representatives. They estimated that only 10 to 20 percent of the wireline resident software had been activated and approximately 50 and 90 percent of the pre- and post-1995 wireless resident software, respectively, had been activated. We were told by the FBI that law enforcement agencies may not be able to conduct electronic surveillance on equipment that lacks activated software. We requested that the FBI demonstrate the extent to which law enforcement agencies have been unable to conduct adequate electronic surveillance as a result. However, the FBI was unable to provide us with such information. In our judgment, collection and maintenance of this data is critical for the FBI to determine the degree to which CALEA has been implemented and the extent to which lawful electronic surveillance has been adversely impacted due to delay in carrier deployment.
In order to determine if lawful electronic surveillance had been adversely affected due to the lack of activation of CALEA compliant software, we reviewed reported nationwide domestic intercept activity from passage of CALEA to the present. In this review, we examined intercept activity trends at the federal, state, and local levels since CALEA was enacted. The following table shows the extent and cost of reported intercept activity for federal, state, and local law enforcement agencies. This data was taken from the "Report of the Director of the Administrative Office of the United States Courts (AOUSC) on Applications for Orders Authorizing or Approving the Interception of Wire, Oral, or Electronic Communications" (Wiretap Report) dated April 2003.19 The Wiretap Report did not include counterterrorism investigation intercepts regulated by the Foreign Intelligence Surveillance Act of 1978. In addition, the Wiretap Report only showed so-called "full content" intercept activity, which does not include "pen register" or "trap and trace" intercepts that only collect call-identifying data such as dialed phone numbers.20
As shown above, there has been a minimal but steady growth in the number of intercepts authorized and installed since 1995, with some drop off in 2000 and 2002. The Wiretap Report stated that more than 75 percent of 2002 electronic intercept locations were portable devices with no fixed location (e.g., cellular phones). As noted above, FBI officials believe that 50 to 90 percent of wireless equipment was CALEA compliant. Unfortunately, according to FBI personnel, law enforcement agencies are not required to report on electronic intercepts that are not conducted because costs are prohibitive or because the carrier equipment is not CALEA compliant. Therefore, we are unable to determine the full impact on law enforcement of the delay in implementing CALEA.
The FBI also entered into several additional RTU license agreements subsequent to the issuance of our March 2002 report. These agreements were made to reimburse the carriers for the purchase of RTU Enhanced Dial-Out software licenses from Siemens, Lucent, and Nortel (manufacturers) for $19.8 million, $19.6 million, and $10.7 million, respectively. The FBI determined that RTU license agreements were the most cost effective vehicles to reimburse the carriers for the use of the manufacturers' software. The FBI prepared D&Fs to support this approach because it was unable to obtain adequate cost or price data. However, the information given to us by the FBI did not provide a basis to determine the reasonableness of the cost incurred for the RTU software licenses. Accordingly, we offer no opinion on the reasonableness of these costs.
In the Attorney General's Ninth Annual Report to Congress on CALEA (October 29, 2003), the FBI reported that these manufacturers were making available to carriers dial-out software.21 According to the report, dial-out is an efficient and effective way for law enforcement agencies to conduct authorized electronic surveillance because it uses existing telephone lines and does not require a time delay for carriers to establish additional lines and facilities. As a result, the cost to both carriers and law enforcement agencies should be significantly reduced according to the Report. The effects of these agreements are not reflected in the tables above, which show the extent to which RTU software is resident on carrier equipment.
The FBI offered carriers three flexible deployment initiatives that the FBI said were designed to provide cost savings and operational flexibility to carriers to ensure that deployment of CALEA electronic surveillance solution would occur. The carriers have the option under CALEA to petition the FCC to permit deployment of their capability solutions after the FCC-mandated deadlines. The FBI stated that it would support such petitions before the FCC for those carriers who have approved flexible deployment plans. After the FBI and a carrier agreed on a CALEA deployment schedule, the FBI acknowledged the agreed-upon deployment timeline in a letter of support of the carrier's FCC petition.
The first flexible deployment initiative was offered in January 2000. Carriers were invited to voluntarily provide the FBI certain information regarding their telecommunications systems and a timeline for activating CALEA software provided under the RTU licensing agreements or otherwise deploy a CALEA solution. The flexible deployment initiative also provided carriers with the opportunity to petition the FCC for an extension of time from the June 30, 2000, compliance date established by the FCC. The major carriers petitioned the FCC and were granted an extension to June 2002, which the FBI supported.
The FBI offered a second flexible deployment initiative in August 2001, for carriers with packet-mode communications equipment switches. This initiative was similar in scope and intent to the first flexible deployment initiative. However, the FBI discontinued this initiative because of the scarcity of technical standards for packet-mode systems.
The FBI initiated a third flexible deployment initiative to permit carriers to complete deployment of their electronic surveillance solutions within normal business cycles in order to minimize carrier costs. In the Attorney General's Ninth Annual Report to Congress on CALEA (October 29, 2003), the FBI stated that the FCC had provided extensions to the industry for compliance with CALEA capability requirements to June 2000, and again to June 2002. Pursuant to the third flexible deployment initiative, the major carriers submitted petitions to the FCC in response to the FCC Public Notice (Public Notice), dated September 28, 2001, to extend the June 30, 2002, FCC-mandated CALEA compliance date. On April 28, 2003, the FBI advised Verizon, BellSouth Telecommunications, and SBC that the FBI would not support their petitions to the FCC because of the refusal by these carriers to accommodate law enforcement's high priority electronic surveillance needs.
In this review, we requested from the FBI evidence of these carriers' refusals to accommodate law enforcement's high priority electronic surveillance needs. FBI personnel advised us that a group of federal, state, and local law enforcement officials called the Law Enforcement Technical Forum (LETF) meets regularly to discuss technical matters relating to the implementation of CALEA. FBI personnel stated that the minutes of meetings of the LETF contained comments from state and local law enforcement representatives indicating that law enforcement faced significant problems because carriers had not yet completed deployment of their electronic surveillance solutions. However, our review of these minutes revealed no significant references to such problems. We asked FBI personnel about this, and we were told that such comments had been made at the forum meetings but evidently had not been recorded to the official minutes.
At the time of our audit, FBI representatives stated that the FCC had not ruled on the carriers' petitions. However, on page 6 of an FCC Public Notice dated September 28, 2001, the FCC stated: "Upon the filing with the Commission of a petition or supplement in accordance with the requirements set forth in this Public Notice, the carrier will be deemed to have received a preliminary extension for the period requested in its filing, but not to exceed the two-year limit provided by Section 107(c)(3)(B) . . . ". Therefore, this suggests that the FCC endorsed the major carriers' petitions to extend the June 30, 2002, compliance date. The FBI stated that FCC's granting of repeated extensions to carriers of CALEA compliance date is adversely affecting law enforcement's ability to carry out authorized electronic surveillance. Yet, CALEA provides that the FCC should consider the extensions in consultation with the Attorney General. Until recently, as noted above, the FBI did not object to the extensions.
Current Issues Affecting the Implementation of CALEA
Current issues affecting the implementation of CALEA include future funding needs, emerging technologies for which electronic surveillance standards are inadequate or not yet developed, and legislative changes to facilitate CALEA implementation.
Future Funding Needs
Approximately $50 million in unobligated CALEA funds remain for implementation of carrier technical solutions and other FBI funding priorities as described below. Following is the total CALEA funding received and paid, and the remaining obligated and unobligated funds.
According to Congress' July 1995 Office of Technology Assessment report, entitled "Electronic Surveillance in a Digital Age," the costs of CALEA legislation and who should bear those costs were highly controversial issues. The $500 million authorized for CALEA implementation was a compromise among widely ranging cost estimates from industry and law enforcement. Both industry's and law enforcement's cost estimates for modifying carrier equipment and deploying electronic surveillance technology were based on assumptions that were generally not backed by formal engineering cost analysis.
Cost estimates for obtaining CALEA compliance have varied widely. Prior to the enactment of CALEA, industry estimated that CALEA compliance would cost from $3 to $5 billion, while the FBI Director estimated the cost to be between $500 million and $1 billion. In 1998 and 1999, industry estimates totaled $1.3 billion. Manufacturers initially requested $734 million for the RTU software licenses, and negotiations between the FBI and industry representatives reduced the final price to about $447 million. In December 2003, the FBI estimated that an additional $204 million would be necessary to complete deployment of CALEA solutions on carrier equipment in high priority areas and to conduct other essential activities described below.
Regarding deployment of the carriers' capability and capacity technical solutions, the FBI's Office of General Counsel issued a legal opinion, dated September 1, 2000, which stated in part:
[E]ntering into these [RTU software license] agreements does not guarantee that CALEA-compliant solutions will be operable and available for use by law enforcement. These agreements only ensure that right-to-use licenses for CALEA software will be made available to carriers at no additional charge . . . Additional monies will need to be authorized and appropriated by Congress to deploy the solutions fully. Although how much it will cost to install or deploy the solutions by carriers remains uncertain . . .
The FBI estimated that approximately $254 million will be needed to develop geo-location and trunk surveillance, implement capability requirements on the highest priority switches, and obtain one additional RTU dial-out agreement. The funds will also be used for potential CALEA section 109(b) petitions, the Nextel upstream solution, and other exigent circumstances.23 However, the FBI can use approximately $50 million of unobligated funds, resulting in about $204 million in new funds needed, according to its estimates.
For a variety of reasons, we are skeptical as to whether CALEA's implementation cost can be determined with any degree of specificity. These reasons include wide variances in past budget estimates, the continued slow pace of CALEA implementation, and rapid technological changes in the telecommunications field. We agree, however, that it is highly unlikely that CALEA can be implemented with the $49.5 million that remains unobligated from current funding.
The FBI had not estimated the costs to meet CALEA capacity requirements. Capacity refers to the ability of a carrier to conduct more than one intercept simultaneously. In this regard, according to the FBI report entitled, Status of Reimbursement for Capability and Capacity:
The precise delineation of the modifications needed and the costs, which must be incurred to attain capacity for simultaneous intercepts, has not been established because the variety of technical solutions inhibits a single interpretation.
The FBI hopes that evolving technologies will significantly reduce capacity costs. For example, the dial-out technology described above should permit the reduction of carrier capacity costs because electronic surveillance will be conducted over existing phone lines rather than carriers having to charge law enforcement for additional dedicated lines for such purposes.
Emerging Telecommunications Technologies
New technologies will continue to evolve that will require development of additional electronic surveillance standards. Some of these technologies are:
At the time CALEA legislation was introduced, the FBI Director characterized the proposed legislation as necessary "to maintain technological capabilities commensurate with the existing statutory authority, that is, to prevent advanced telecommunications technology from repealing de facto . . . authority already conferred by Congress."
The FBI is working with various industry standard-setting bodies to develop electronic surveillance standards for new technologies. However, carriers may be reluctant to adopt such standards because of the cost or technological complexity. Therefore, we believe that the legal changes addressed below will, if recommended by DOJ and adopted by Congress, also assist the FBI in meeting the challenges of rapid technological change in the telecommunications field.
In addition to future funding needs and emerging telecommunications technologies, there are also a number of legislative issues to consider in fully implementing CALEA. Although we discuss the legislative issues in this section, it is not our intent to endorse any specific legislative change. The FBI, in consultation with DOJ and the administration, must fully evaluate each issue before recommending any legislative changes.
Information Services Exemption
Currently, CALEA does not apply to "information services". However, vendors are currently offering phone service over the internet. Some modification of the information services exemption may be necessary in order to ensure that Voice-over-Internet-Protocol (VoIP) services are subject to law enforcement requests for lawful electronic surveillance.
The FBI provided one example of the controversy surrounding VoIP carriers. In 2003, the Minnesota Public Utility Commission (MPUC) ruled that Vonage Holdings, Inc. (Vonage), a VoIP carrier, was a telephone service provider under Minnesota state law. As a result, Vonage was subject to certain state regulations, such as those governing 911 emergency calling services. Vonage petitioned both the Minnesota District Court for injunctive relief and the FCC for preemption of all state regulation on the grounds that Vonage is an information service provider.
The Minnesota District Court ruled in favor of Vonage. The Minnesota Attorney General filed a petition on behalf of the MPUC, which was pending at the time of our review. The FCC sought comment on Vonage's petition and the FBI filed comments stating that Vonage did not qualify for relief because its VoIP service is a telecommunications service, not an information service.
FBI personnel stated that the regulatory counsel for Vonage advised the FBI that CALEA definition of "telecommunications carrier" is flexible enough to permit the imposition of CALEA responsibilities on vendors that are not telecommunications carriers under Title II of the Communications Act of 1934.
The FCC issued a notice of proposed rule making, dated February 14, 2002, that would classify wireline broadband internet access and cable modem internet access services as information services. The DOJ filed comments opposing such classifications that it believes will thwart the purpose of CALEA. The FCC had yet to rule on these issues at the time of our review.
Potentially, VoIP services could be a dominant method of telephonic communication in a few years. As the technology evolves, people will be able to make phone calls over the internet using their PDAs. Carriers may be forced to offer such services quickly because their costs should be significantly reduced through the use of packet-mode technology versus conventional communications technology.
Technical Standards Setting
CALEA provides that the Attorney General consult with organizations setting industry standards and others to ensure the efficient and industry-wide implementation of CALEA capability requirements. Modifying the Attorney General's role with regard to electronic surveillance standard setting could make CALEA standard setting more accountable, efficient, and controllable and alleviate the current litigious atmosphere.
Currently, CALEA states that the Attorney General may reimburse the carriers for modifications to equipment, facilities, or services installed or deployed on or before January 1, 1995, to meet the capability requirements. If the Attorney General does not make such reimbursement, the carriers are deemed in compliance with CALEA for such equipment. The carriers are responsible for such modifications to equipment, facilities, and services installed or deployed after January 1, 1995. However, the carriers may request reimbursement for these modifications provided that the FCC has ruled that such modifications are not otherwise reasonably achievable because of being too costly, technically complex, or both. Amending the mechanism by which carriers are reimbursed for deploying electronic surveillance standards may also alleviate the non-cooperative atmosphere.
As noted above, Section 107 of CALEA provides authority to the FCC, after consultation with the FBI, to grant extensions of time to carriers to comply with CALEA capability standards with respect to their post-1995 equipment, facilities, and services. An extension may be granted for a maximum of two years if the FCC determines that compliance with CALEA capability requirements is not reasonably achievable using current technology or technology is deficient or nonexistent. The FCC has granted several extensions of time to carriers in the past that we reported on previously. However, CALEA is silent on the number of extensions the FCC may grant carriers under section 107.
Section 108 provides for court issuance of enforcement orders under section 2522 of title 18, United States Code. Enforcement orders may be issued by a court (1) that approved an electronic surveillance order with which a carrier failed to comply, or (2) upon application by the Attorney General in a civil action to obtain an order to direct a carrier, manufacturer, or provider of telecommunications support services to comply with CALEA. Enforcement orders may only be issued if a court finds that (1) another carrier's facilities are not reasonably available to conduct the authorized electronic surveillance, and (2) the electronic surveillance is reasonably achievable with available technology. A court issuing such an enforcement order must allow a reasonable time period for compliance and may impose a civil penalty not to exceed $10,000 per day for each day of violation of such enforcement order
However, CALEA imposes strict limitations on enforcement orders having to do with capacity, reasonable achievability, and modifications to pre-January 1, 1995, equipment. First, a carrier may not be compelled to comply with court ordered electronic surveillance if the carrier lacks sufficient capacity and the government has not agreed to pay for such capacity. Second, a carrier may not be forced to modify post-January 1, 1995, equipment if the FCC has ruled under section 109(b) of CALEA that such modifications will be too costly or technically complex. Finally, a carrier may not be compelled to modify pre-January 1, 1995, equipment unless the government agrees to pay for such modifications provided that such equipment has not been replaced or significantly upgraded.
In our judgment, CALEA does not give additional powers to the FCC. However, FBI personnel advised us that the Communication Act of 1934 provides the FCC with enforcement powers sufficient to compel carriers to comply with CALEA requirements but, for whatever reason, the FCC has not used such powers. According to FBI personnel, the FCC has very strong enforcement powers over carriers in other areas such as local number portability and enhanced 911.
DOJ petitioned the FCC in March 2004, to attempt to resolve some outstanding issues with regard to some of the legal considerations and technology changes impacting CALEA implementation identified above. These included but were not limited to: identification of services considered to be packet-mode, establishment of a timeline and criteria for carrier compliance with packet-mode standards and standards covering future technology, a ruling that would assist in identification of future services and entities that are subject to CALEA, establishment of procedures for enforcement action against carriers that do not comply with CALEA, and permission for carriers to recover CALEA implementation costs from their customers. If the FCC does what is requested in the DOJ petition, we believe that it would facilitate the implementation of CALEA.
More than nine years since enactment, CALEA has not been fully implemented. Among the causes for this delay are deficient and contested electronic surveillance standards, contested cost recovery regulations, lengthy negotiations with industry representatives regarding the price for the RTU licenses, and carrier cost proposals deemed unreasonable by the FBI. The FBI has made available to carriers electronic surveillance software developed by manufacturers, but the FBI does not know the extent to which carriers have implemented the electronic surveillance solutions utilizing this software. However, FBI personnel estimate that only 10 to 20 percent of the wireline equipment switches are CALEA compliant. Additionally, FBI personnel estimate that only one-half of the pre-January 1, 1995, carrier wireless switches are CALEA compliant.
Our review of nationwide electronic surveillance intercepts indicates that intercept activity at the federal, state, and local level appears to be increasing. But no statistics are kept on intercepts that were not conducted because they were deemed too costly or because carrier equipment was not compliant with CALEA requirements. The FBI was unable to state what effect the delay in CALEA implementation has had on law enforcement's ability to conduct electronic surveillance.
The FBI is concerned that the continual and rapid change in telecommunications technology without concomitant electronic surveillance solutions will adversely impact the ability of law enforcement to conduct electronic surveillance. There are a number of legislative issues that the FBI and DOJ need to evaluate that may assist the FBI in implementing CALEA in the face of rapid technological change.
The FBI has paid or obligated about $50 million during the current reporting period for carrier purchases of the RTU enhanced dial-out software licenses. The FBI determined that RTU license agreements were the most cost effective vehicles to reimburse the carriers for the use of the manufacturers' software. The FBI prepared D&Fs to support this approach because it was unable to obtain adequate cost or price data. However, the information given to us by the FBI did not provide a basis to determine the reasonableness of the cost incurred for the RTU software licenses. Accordingly, we offer no opinion on the reasonableness of these costs.
We recommend that the FBI:
* BECAUSE THIS REPORT CONTAINED PROPRIETARY/COMMERCIAL INFORMATION, WE REDACTED (WHITED OUT) THAT INFORMATION FROM THE VERSION OF THE REPORT THAT IS BEING PUBLICLY RELEASED. WHERE SUCH INFORMATION WAS REDACTED IS NOTED IN THE REPORT.
Proprietary/Commercial Information Redacted