IMPLEMENTATION OF THE
COMMUNICATIONS ASSISTANCE FOR LAW ENFORCEMENT ACT
BY THE FEDERAL BUREAU OF INVESTIGATION
Audit Report 98-13, (3/98)
TABLE OF CONTENTS
CHRONOLOGY OF CALEA IMPLEMENTATION ACTIVITIES SINCE THE 1996 GAO REPORT
SCOPE AND BACKGROUND
The Office of the Inspector General completed an audit of the implementation of the Communications Assistance for Law Enforcement Act (CALEA) by the Federal Bureau of Investigation (FBI). We are required by CALEA to report to Congress by April 1, 1998, on the equipment, facilities, and services (hereinafter referred to as equipment) that have been modified to comply with CALEA; and whether FBI payments to telecommunications carriers (carriers) for equipment modifications are reasonable and cost effective.
Congress enacted CALEA to ensure that law enforcement agencies, when authorized by court order, had the ability to intercept electronic communications. The CALEA provides that carriers may be reimbursed for costs associated with equipment modifications to meet technical capability and current and future capacity requirements. The Department of Justice may reimburse the carriers for the modifications from the $500 million authorized by CALEA, subject to congressional appropriations.
The FBI and the telecommunications industry (industry) currently disagree over
reimbursement eligibility and over what capabilities must be provided to comply with
CALEA. To date, carriers have made no modifications to equipment. As a result, the FBI has
made no payments to carriers. Therefore, our audit was directed at assessing the current
activities of the FBI, but did not address the financial audit objectives in CALEA. This
was similar to the review performed by the General Accounting Office (GAO) in 1996.
Congress enacted CALEA to ensure that technological changes in the industry would not compromise the ability of law enforcement agencies to engage in lawful electronic surveillance. To accomplish this goal, CALEA established a process whereby the: (1) Department of Justice (DOJ) notifies carriers of law enforcement's capability and capacity needs1, (2) carriers respond with statements identifying equipment that does not meet the requirements, and (3) DOJ selects and reimburses carriers to modify their equipment to accommodate law enforcement requirements. The DOJ delegated the responsibility of implementing CALEA to the FBI.
Carriers must comply with CALEA capability requirements by October 25, 1998, which is 4 years after enactment of CALEA. Pursuant to CALEA, the FBI can only reimburse carriers for modifications to equipment in place before January 1, 1995. The carriers must be in compliance with CALEA capacity requirements within 3 years after the final capacity requirement rule has been published in the Federal Register.
The CALEA also provided that manufacturers ". . . shall on a reasonably timely basis and at a reasonable charge, make available to . . . carriers. . . such features or modifications as are necessary to permit such carriers to comply with the capability . . . and the capacity requirements identified by the Attorney General . . ."
The CALEA required the GAO to report to Congress on the implementation of CALEA
biannually beginning April 1, 1996. The CALEA was subsequently amended to give the OIG
this reporting responsibility. On April 1, 1996, the GAO reported that law enforcement
requirements had not been completed and, as a result, carriers had not modified equipment
or requested or received reimbursement from the FBI.
The FBI and the industry currently disagree over what capabilities must be provided to meet CALEA requirements and over reimbursement eligibility. To date, carriers have made no modifications to equipment that resulted in requests to the FBI for reimbursement. As a result, the FBI has made no payments to carriers. FBI officials advised us that the disagreement is over the technical capabilities required by CALEA, Section 103, and the extent of the industry's reimbursement eligibility under CALEA, Section 109.
Technical Capability Requirements
In December 1997, the industry published Interim Standard J-STD-025 (Interim Standard) purportedly to meet the technical capability requirements of CALEA, Section 103. However, FBI officials determined that the Interim Standard is deficient because it does not meet nine key capabilities (punch-list capabilities) that the Department of Justice (DOJ) determined to be required by CALEA and essential to the effective use of lawfully authorized electronic surveillance.2 The CALEA grants the Federal Communications Commission (FCC) the authority to resolve such issues and to establish by rule the necessary technical requirements.
On February 26, 1998, the Attorney General testified on the status of CALEA implementation before the House Appropriations Subcommittee. She stated the DOJ's position on the capability requirements issue and the industry's response to that position. She said that the DOJ would file a deficiency petition against the Interim Standard with the FCC on March 13, 1998. DOJ would seek to have the required punch-list capabilities added to the Interim Standard through FCC rulemaking.
On March 6, 1998, the Attorney General met with industry representatives in an attempt to achieve a compromise with regard to CALEA implementation. Although no agreement was reached, the Attorney General agreed to postpone filing the deficiency petition with the FCC until March 20, 1998, pending the outcome of renewed negotiations. The deficiency petition was filed on March 27, 1998.
CALEA provides that the Attorney General may, subject to the availability of appropriations, agree to pay carriers for certain costs to comply with CALEA, Section 103. The costs eligible for reimbursement are: (1) all reasonable costs directly associated with carrier modifications to equipment installed or deployed on or before January 1, 1995; and (2) additional reasonable costs directly associated with making the assistance capability requirements reasonably achievable with respect to equipment deployed after January 1, 1995.3 Pursuant to CALEA carriers must be in compliance with Section 103 by October 25, 1998.
According to FBI officials, the industry initially wanted full reimbursement of all CALEA implementation costs for all types of equipment commercially available prior to January 1, 1995, whether or not the equipment had been installed. According to the FBI, it sought adherence to the letter of the law in that reimbursement would be made available only for modifications to equipment installed prior to January 1, 1995.
Industry and DOJ officials met the week of February 23, 1998, to attempt to resolve their differences. According to the FBI, they advised carriers that the DOJ would agree to extend the CALEA January 1, 1995 cutoff for installed equipment to the October 25, 1998 capability compliance deadline, pursuant to FCC rulemaking. The FBI was willing to take this position in order to partially reimburse selected carriers for modifications made to equipment installed between January 1, 1995 and October 25, 1998. The FBI acknowledged that funds authorized by CALEA could not be used to reimburse carriers for modifications to equipment installed after January 1, 1995, and that another source of funding would be needed to cover this cost.
Carriers rejected this proposal. According to the FBI, the carriers wanted all equipment installed as of October 25, 1998, grandfathered under and deemed in compliance with CALEA unless DOJ agreed to pay for modifications to such equipment.
On March 6, 1998, the Attorney General and other DOJ officials met with industry leaders. In advance of this meeting, the FBI prepared for the Attorney General a document entitled: Recommendations for Structure of AG-CEO Meeting that stated the following proposal made by DOJ:
(1) The government would pay for the development of solutions for all switching platforms in existence prior to January 1, 1995. Any switching platforms in existence prior to January 1, 1995, for which the Government does not fund solution development, would be deemed in compliance until such time as DOJ does fund development,
(2) The government would pay for all deployment costs for specific switches in place before January 1, 1995,
(3) The government would share deployment costs with industry for specific switches installed or deployed between January 1, 1995 and October 25, 1998, even though the Government is not statutorily obligated to reimburse those costs [subject to FCC determination and availability of funds],
(4) Law enforcement would also forbear seeking enforcement actions for a reasonable period (a period that would coincide with manufacturer development timelines) after the October 25, 1998 compliance date, thereby allowing the industry a reasonable period in which to deploy solutions.
Notwithstanding this proposal, the FBI reported that the carriers will not be able to
meet the October 25, 1998 deadline based on its assessment of the timelines provided by
manufacturers (see references to the FBI implementation report identified hereafter). At
the March 6, 1998 meeting, DOJ and industry officials agreed to explore, for a 60-day
period, the technical feasibility of and potential pricing scenarios for developing
CALEA-compliant solutions for all equipment.
CHRONOLOGY OF CALEA IMPLEMENTATION
ACTIVITIES SINCE THE 1996 GAO REPORT
June 1996 - Capability Requirements Issued
Law enforcement surveillance capabilities were developed in consultation with other law enforcement agencies, manufacturers and carriers. These capabilities were issued in a document entitled, Electronic Surveillance Interface (ESI) Document on June 24, 1996.4
October 1996 - Telecommunications Carrier Compliance Fund Established
The Congress established the Telecommunications Carrier Compliance Trust Fund (TCCF) within the U.S. Treasury and authorized agencies with law enforcement responsibilities to deposit unobligated balances into the TCCF to assist in the funding of CALEA implementation efforts, subject to Congressional reprogramming requirements.
The Congress appropriated $60 million as start-up funds to begin CALEA implementation and deposited these funds in the TCCF. The Attorney General also transferred $40 million of DOJ working capital funds to the TCCF. Additionally, the U.S. Postal and Customs Services made contributions to the TCCF of $1 million and $1.6 million, respectively. This made $102.6 million available for CALEA implementation.
March 1997 - Implementation Plan Submitted
The FBI submitted an implementation plan to Congress on March 3, 1997. The implementation plan included: (1) law enforcement requirements for electronic surveillance, (2) a prioritized list of carrier equipment to be modified to meet law enforcement requirements for electronic surveillance; (3) capacity requirements; and (4) a projected reimbursement plan. The FBI estimated that carrier reimbursements would amount to $100 million a year for 5 years beginning in FY 1997.
March 1997 - Final Cost Recovery Regulations Published
The FBI published final cost recovery regulations (28 CFR Part 100) setting forth the procedures for carriers to follow in order to receive reimbursement under CALEA. The cost recovery regulations state the: (1) criteria for determining allowable and unallowable costs, (2) requirements carriers must meet in their submission of cost estimates and requests for payments for the disbursements of funds, and (3) audit requirements for the CALEA implementation effort. The FBI alsodeveloped requisite audit programs and procedures to audit carrier proposals and agreements.
July 1997 - FCC Petition Filed
The Cellular Telecommunications Industry Association (CTIA) filed a petition with the FCC to establish electronic surveillance technical standards to implement Section 103 of CALEA because " . . . the standards process is deadlocked, due . . . to unreasonable demands by law enforcement for more surveillance features than either CALEA or the wiretap laws allow." In its petition the CTIA characterized the ESI as a de facto standard ". . . even though CALEA expressly prohibits law enforcement from requiring any specific design of systems or features or the adoption of any particular technology to meet CALEA." The FCC did not rule on the CTIA petition.
January 1998 - Implementation Report Submitted
The FBI reported to Congress on January 26, 1998, in response to a Conference Committee Report (H. Rpt. 105-405) that directed the DOJ to submit to the Committees on Appropriations a report that included: (1) cost estimates for development and deployment of the proposed CALEA solution, (2) a timeline for development and deployment of the solution, and (3) two signed cooperative agreements with appropriate carriers.
According to the implementation report, manufacturers reviewed the punch-list requirements, and none stated that these requirements were impossible to meet. However, several of the manufacturers stated that some of the requirements would be very or extremely difficult to meet. The implementation report included no cost estimates for development and deployment of a CALEA solution. Only one manufacturer permitted the FBI to disclose pricing data in the implementation report.
The implementation report provided a timeline that showed manufacturers' best estimates for deployment of solutions to permit carriers to satisfy law enforcement requirements to intercept electronic communications. Only one manufacturer expected to have a CALEA compliant solution by the October 25, 1998, deadline. Based on manufacturer timelines disclosed in the implementation report, the FBI expects that the carriers will not be able to meet the October 25, 1998 deadline.
According to the implementation report, the FBI is currently in negotiation with a carrier to enter into a cooperative agreement. However, the FBI has not entered into any cooperative agreements with carriers at this time.
February 1998 - DOJ Position on the Capability Requirements Established
The DOJ advised that 9 of the 11 punch-list capabilities contained in the ESI were clearly within the scope of CALEA. The DOJ was willing to compromise on one punch-list capability and acknowledged that one other punch-list capability, although it would enhance the effectiveness of electronic surveillance, was not required by CALEA. The DOJ stated that the carriers' interim standard was deficient in that it failed to address the nine punch-list capabilities within the scope of CALEA.
The carrier associations responded and disagreed that CALEA required carriers to provide the punch-list capabilities. The carrier associations urged the DOJ to accept the industry developed interim standard capability standards.
March 1998 - Final Notice of Capacity Requirements Published
The FBI published in the Federal Register the Final Notice of Capacity Requirements, which succeeded notices published on October 16, 1995 and January 14, 1997. The carriers have 180 days to provide the FBI with a statement of equipment that does not meet the capacity requirements. The FBI would consider reimbursing carriers for modifications to equipment to meet the capacity requirements.
March 1998 - Petition Filed
On March 27, 1998, DOJ filed a deficiency petition with the FCC to initiate an expedited rulemaking proceeding under Section 107(b) of CALEA and related provisions. The DOJ filed the petition because it determined that industry adopted a seriously deficient technical standard to implement Section 103.
SCOPE AND BACKGROUND
We performed the audit in accordance with Government Auditing Standards issued by the Comptroller General of the United States, and accordingly, included such procedures as were considered necessary to accomplish our audit. Our audit covered the period April 1996 to March 1998. Our procedures were designed to determine the status of CALEA implementation activities because carriers had made no modifications to equipment that would have resulted in requests to the FBI for reimbursement.
The DOJ assigned the responsibility for the implementation of CALEA to the FBI. The FBI established the CALEA Implementation Section in its Information Resources Division and the Telecommunications Contracts and Audit Unit in its Finance Division to carry out these responsibilities.
The mission of the CALEA Implementation Section is to develop CALEA mandated law enforcement requirements, in concert with other Federal, state and local law enforcement agencies; manufacturers; and carriers. Once the requirements are developed, the CALEA Implementation Section must work with manufacturers and carriers to develop and deploy necessary products to implement law enforcement requirements.
The mission of the Telecommunications Contract and Audit Unit is to develop cost recovery regulations, audit plans and programs, and mechanisms for reimbursing carriers for equipment modifications to meet CALEA requirements. The Telecommunications Contract and Audit Unit will also review carrier proposal costs associated with FBI reimbursements for equipment modifications.
1 Capability refers to the ability of equipment to meet electronic surveillance requirements provided in Section 103 of CALEA. Capacity refers to the ability of carriers to meet estimated electronic surveillance intercepts as set forth in Section 104 of CALEA.
2 The DOJ advised industry representatives, in a letter dated February 3, 1998, that the punch-list capabilities were clearly within the scope of CALEA.
3 For equipment installed or deployed after January 1, 1995, a carrier may petition the FCC for a determination of "reasonable achievability."
4 Prior to issuance of the ESI, the FBI had issued electronic surveillance capabilities in both 1994 (prior to the enactment of CALEA) and 1995. These documents contained the punch-list capabilities.