US gov't wiretapping laws and your network

23.01.2007
CALEA. What is it, and what does it mean for your network? If the acronym for the Communications Assistance for Law Enforcement Act is familiar, chances are your organization has already done much decision-making regarding CALEA. If not, with the deadlines for reporting and compliance fast approaching, it's time to become familiar with CALEA and what implications it may have for the network you administer.

First, some background. Congress enacted CALEA in 1994. CALEA's purpose was to provide a way of intercepting voice communications from digital telephone networks to aid in Law Enforcement Agencies (LEA) in investigations.

In 2005, the Federal Communications Commission (FCC) issued a First Report and Order on CALEA in response to a joint petition from the Department of Justice, FBI and Drug Enforcement Agency to expand CALEA intercept coverage to include providers of interconnected voice-over-IP (VoIP) services. The First Report and Order required facilities-based Internet services and VoIP broadband providers to be compliant by May 14, 2007.

The FCC describes an intercept process whereby Call Identifying Information (CII) is extracted from the communications stream. However, the FCC is leaving the creation of CII standards to the communications industry. Once the requested information is obtained, it's sent to the requesting LEA.

On May 12, 2006, the FCC issued a CALEA Second Report and Order, which confirmed the feasibility of the compliance deadline and provided additional information, including reporting plans for networks covered by CALEA. According to an FCC Public Notice issued Dec. 14, 2006, networks that are not CALEA exempt must file a Monitoring Report (FCC Form 445) by Feb. 12, 2007. A second FCC Public Notice requires System Security and Integrity plans to be filed by March 12, 2007.