Transcript Slide 1

CALEA and Private
Broadband Networks
Presented to Merit Network, January 31, 2007
Matthew A. Brill
Partner, Latham & Watkins, LLP
Latham & Watkins operates as a limited liability partnership worldwide with an affiliate in the United Kingdom and Italy, where
the practice is conducted through an affiliated multinational partnership ©Copyright 2005 Latham & Watkins. All Rights Reserved.
Introduction
•
The FCC’s extension of CALEA to broadband Internet
access and interconnected VoIP services created the
prospect that higher education networks could become
subject to the statute’s requirements, with huge potential
compliance costs.
•
Even after an appeal to the U.S. Court of Appeals for the
D.C. Circuit, the issues remain cloudy in certain respects.
But the court case prompted the FCC and Department of
Justice to provide some guidance on the circumstances in
which colleges and universities will be expected to comply
with CALEA.
2
Statutory Background
•
Congress enacted the Communications Assistance for
Law Enforcement Act (“CALEA”) in 1994 to ensure that
the introduction of digital technology in the public
switched telephone network would not thwart the ability of
law enforcement agencies to effectuate wiretaps.
•
Importantly, law enforcement agencies derive their
surveillance authority from criminal statutes and court
orders. All providers of electronic communications must
comply with wiretap orders, irrespective of CALEA.
•
CALEA concerns only the manner in which service
providers will comply with surveillance requests.
3
CALEA Requirements
•
Telecommunications carriers must implement certain
“assistance-capability requirements” to ensure that their
networks are capable of isolating a subscriber’s
communications and call-identifying information and
enabling interception by the government. 47 U.S.C. §
1002(a).
•
Carriers must comply with assistance capability
requirements in a manner that is unobtrusive, protects the
subscriber’s privacy, and protects information regarding
the government’s surveillance.
4
CALEA Applies to “Telecommunications Carriers”
•
CALEA defines a “telecommunications carrier” as “a
person engaged in the transmission or switching of wire
or electronic communications as a common carrier for
hire.” 47 U.S.C. § 1001(8)(A).
•
The definition specifically includes commercial wireless
carriers. Id. § 1001(8)(B)(i).
•
It also includes “a person or entity engaged in providing
wire or electronic communication switching or
transmission service to the extent that the [FCC] finds that
such service is a replacement for a substantial portion of
the local telephone exchange service and that it is in the
public interest to deem such a person or entity to be a
telecommunications carrier . . . .” Id. §1001(8)(B)(ii).
5
CALEA Does Not Apply to Private Networks
•
The statute exempts private networks from the
assistance-capability requirements.
•
Specifically, the requirements do not apply to “equipment,
facilities, or services that support the transport or
switching of communications for private networks or for
the sole purpose of interconnecting telecommunications
carriers.” 47 U.S.C. § 1002(b)(2)(B).
6
Nor Does CALEA Apply to Information Services
•
CALEA also specifies that the definition of a “telecommunications
carrier” does not include “persons or entities insofar as they are
engaged in providing information services.” 47 U.S.C. §
1001(8)(C)(i). A separate provision reaffirms that information services
are not subject to the assistance-capability requirements. Id. §
1002(b)(2)(A).
•
CALEA defines an “information service” as “the offering of a capability
for generating, acquiring, storing, transforming, processing, retrieving,
utilizing, or making available information via telecommunications. . . .”
Id. § 1001(6)(A). (This definition is virtually identical to that found in
the Telecommunications Act of 1996.)
7
The FCC’s August 2005 Order
•
In response to a petition filed by DOJ and the FBI, the FCC adopted
an order extending the scope of CALEA to include all facilities-based
providers of broadband Internet access and interconnected VoIP
services.
•
The Order defines covered broadband providers as supplying
“transmission or switching over their own facilities between the end
user and the Internet service provider.” (Para. 24 n.74)
•
The FCC relied on the Substantial Replacement Provision to subject
providers of facilities-based broadband and interconnected VoIP
services to the assistance-capability requirements in CALEA.
•
The FCC established a compliance deadline of May 2007.
8
Applicability of CALEA to Private Networks
•
The FCC’s Order recognized that “private broadband networks or
intranets that enable members to communicate with one another
and/or to receive information from shared data libraries not available
to the general public . . . appear to be private networks for purposes
of CALEA,” and thus exempt.
•
At the same time, however, the Order suggested that the exemption
could be lost if such private networks connect to the Internet, as
virtually all higher education networks do. The Order stated: “To the
extent that . . . private networks are interconnected with a public
network, either the PSTN or the Internet, providers of the facilities that
support the connection of the private network to the public network
are subject to CALEA under the SRP.”
•
In subsequent meetings and press statements, the FCC declined to
elaborate on the meaning of this statement.
9
The FCC’s Reading of the Information Service
Exclusions
•
The FCC ruled that CALEA’s “information service” exclusions did not
prevent it from reaching broadband Internet access or VoIP services.
•
It concluded that, even though broadband Internet access is an
information service (and VoIP may be an information service), the
“telecommunications” component of those services can be severed
from the data-processing components, with CALEA applying only to
the former functionality.
•
Under the Communications Act, applying the very same statutory
language, the FCC ruled that these functions cannot be separated.
The FCC argued that it could interpret the term “information service”
in contradictory ways based on the different purposes of CALEA and
the Communications Act.
10
Court Appeal
•
A coalition of parties representing higher education as well as
providers of broadband and VoIP services, privacy groups, and other
public interest organizations appealed the FCC Order.
•
The appeal contended that the FCC’s Order violated CALEA’s
exemption of information services and private networks.
•
In response to our opening brief, the Government briefs
acknowledged a key limitation on the application of CALEA to higher
education networks. In particular, the FCC clarified that its Order
applies to “private network operators that provide their own
connection to the Internet,” which are subject to CALEA with respect
to that connection, but does not apply to “those that contract with an
ISP for that connection.” The Department of Justice agreed that
CALEA applies at most to “Internet gateway” facilities, rather than to
the internal portions of private networks.
11
Court Decision
•
On June 9, 2006, the court of appeals issued an opinion upholding
the FCC Order. (A petition for rehearing filed by certain petitioners
was later denied.)
•
The court ruled that differences in the structures and purposes of
CALEA and the Communications Act made it reasonable for the FCC
to construe the term “information services” differently under the two
statutes.
•
More favorably, the court made clear that CALEA “expressly excludes
‘private networks’ from its reach.” The court also found that the FCC
had not yet attempted to apply CALEA obligations to the internal
portions of private networks. But the court did not address the
circumstances under which Internet gateways are subject to CALEA.
12
What Does This Mean for Higher Education and
Research Networks?
•
There are still unanswered questions, but the Order, the
Government briefs, and the court decision taken together
suggest two factors that will determine whether colleges
and universities have any obligations under CALEA.
•
These factors are: (1) whether the campus network
“supports” the connection to the Internet, and (2) whether
the campus network qualifies as a “private network.”
13
Does the Network “Support” the Connection to
the Internet?
•
While the language in the FCC Order is cryptic, the FCC’s court brief
sets forth a more workable test: Colleges and universities that
“provide their own connection to the Internet” are subject to CALEA
(at least with respect to those Internet connection facilities), while
institutions that rely on a third party for this connection are exempt.
•
This still leaves some gray areas, but the FCC most likely would
conclude that an institution provides its own Internet connection when
it constructs, purchases, leases, or otherwise operates fiber optic or
other transmission facilities and associated switching equipment that
link the campus network to an ISP’s point of presence.
•
In contrast, the FCC most likely would conclude that an institution is
exempt if it obtains access to the Internet by (1) contracting with an
ISP or regional network to pick up Internet traffic from a campus
router, (2) purchasing a private line or other transmission service from
a telecommunications carrier on a contractual or tariffed basis (as
opposed to leasing dark fiber or other facilities), or (3) relying on
some combination of these approaches.
14
Is the Network a “Private” Network?
•
If a campus network is closed (i.e., does not connect to the Internet),
it is clearly exempt from CALEA under the private network exemption.
•
Interconnected networks that support their own Internet connection
appear to enjoy a limited exemption if they otherwise qualify as
“private.” Specifically, only the gateway equipment itself is subject to
CALEA – the Internet portions of a private network remain exempt.
•
The FCC did not expressly define “private network,” but the
touchstone appears to be limited availability to specific members or
constituents of an organization. Thus, a campus network that is
available only to students, faculty, and administrators should be
considered a private network, which means CALEA applies at most to
the Internet gateway equipment.
•
In contrast, networks that provide general public access and support
a connection to the Internet may well be subject to CALEA obligations
throughout the network, rather than only at the gateway.
15
Next Steps for Education and Research Networks
•
Determine status based on network configuration and
public v. private access.
•
For entities that are exempt, no need for further action.
•
The FCC released a Second Report and Order on May
12, 2006 regarding CALEA implementation details.
16
Compliance Obligations Under the
Second Report and Order
•
•
For entities that appear to be covered by CALEA, the next
steps under the Second Report and Order are:
•
Must submit compliance status form to FCC on February 12.
•
Must submit report to FCC on “system security and integrity
requirements” – which concern employee supervision and
recordkeeping – on March 12.
•
Must be in full compliance by May 14, 2007. This will require: (1)
installing new CALEA-compliant gateway equipment,
(2) contracting with a “trusted third party” to provide the requisite
surveillance capabilities, or (3) developing a customized network
solution.
Penalties for noncompliance: separate enforcement
processes involving FCC and law enforcement
17
Continuing Legal Proceedings
•
The FBI has drafted legislation that would codify the
FCC’s Order and allow further expansions, including the
possible override of the private network exemption by the
FCC. This legislation is circulating but has not yet been
introduced. It is expected to face long odds in a
Democratically controlled Congress.
•
The FCC has an open rulemaking regarding discretionary
exemptions for certain entities, including higher education
institutions.
18