Criminal organizations and individuals frequently use the telecommunications systems of the United States in the furtherance of serious violent crimes, including terrorism, kidnapping, extortion, organized crime, drug trafficking, and corruption. One of the most effective tools law enforcement uses to investigate these crimes is court-authorized electronic surveillance. According to Federal Bureau of Investigation (FBI) personnel, however, continuing advances in telecommunications technology have impaired and in some instances prevented telecommunication carriers (carriers) from assisting law enforcement to conduct authorized electronic surveillance.

Electronic surveillance is provided for in Title III of the Omnibus Crime Control and Safe Streets Act of 1968 and the Electronic Communications Privacy Act of 1986, which extended authorized lawful electronic surveillance to communications transmitted via wireless technology. In October 1994, Congress enacted the Communications Assistance for Law Enforcement Act (CALEA) because of concerns that advances in telecommunications technology, such as cellular telephones and features such as call forwarding and multiparty calls, could limit the effectiveness of lawful electronic surveillance, especially at the state and local level. Law enforcement agencies at the state and local level often do not have the same level of resources or technical ability to conduct electronic surveillance as do federal law enforcement agencies. Because of this, CALEA required that carriers deploy electronic surveillance standards to ensure that technological advances in the telecommunications industry (industry) would not compromise the ability of law enforcement agencies to engage in lawful electronic surveillance.

CALEA provides that the Attorney General can reimburse telecommunications carriers for modifications to equipment, facilities, or services installed or deployed on or before January 1, 1995, to meet CALEA capability requirements.¹ Essentially, the capability requirements of CALEA require carriers to be able to isolate, intercept, and deliver communication content and call identifying information to law enforcement pursuant to lawful government order. The carriers are responsible for such modifications to equipment, facilities, and services installed or deployed after January 1, 1995.² To date, funding for CALEA implementation has totaled $499.5 million.

Audit Results

CALEA requires biannual audit reporting on the equipment, facilities, and services that have been modified to comply with CALEA requirements; whether FBI payments to the carriers were reasonable and cost effective; and projections of future costs for such modifications.³ Consistent with these congressionally mandated audit objectives, we assessed CALEA's implementation to date. Our audit found the following:

• After more than nine years and nearly $450 million in payments or obligations, deployment of CALEA technical solutions for electronic surveillance remains significantly delayed. The FBI does not collect and maintain data on carrier equipment that is CALEA compliant. Nevertheless, FBI personnel estimate that CALEA compliant software has been activated on approximately 50 percent of pre-January 1, 1995, and 90 percent of post-January 1, 1995, wireless equipment. Most troubling, according to FBI estimates, CALEA compliant software has been activated on only 10 to 20 percent of wireline equipment. FBI personnel advised that law enforcement agencies were unable to properly conduct electronic surveillance on equipment for which the CALEA-compliant software has not been activated. However, the FBI was unable to demonstrate the extent to which lawful electronic surveillance has been adversely impacted by the lack of CALEA implementation. We concluded that it was critical that the FBI collect data on carrier compliance and the impact of non-compliance on state and local law enforcement to determine the extent to which lawful electronic surveillance is being compromised.

• The FBI has made approximately $450 million in payments and obligations to equipment manufacturers for Right-To-Use (RTU) licenses. A RTU software license allows a carrier to activate the software once the manufacturer has been reimbursed for its development costs. Except for a one-time payment of $2.2 million, the FBI has not yet made any payments from CALEA funds to telecommunications carriers for activation of CALEA-compliant software discussed below.⁴ The FBI believed that first negotiating RTU licenses with manufacturers would ultimately lessen the cost for telecommunications carriers. Whether or not this is true will be determined as the FBI negotiates agreements with carriers to activate the software obtained under the RTU agreements.

• Cost estimates from the FBI suggest that the current funding level of $500 million for CALEA is insufficient. In December 2003, the FBI estimated that about $204 million in additional funds might be required. Estimates on the cost of CALEA implementation have varied widely, however, and technological change continues to occur at a rapid pace. For these reasons, we are skeptical of the accuracy of the FBI's estimates or whether CALEA's implementation cost can be determined with any specificity.

We found a variety of factors that have seriously complicated CALEA implementation, including: (1) delays in establishing electronic surveillance standards together with Federal Communications Commission (FCC) extensions, (2) contested cost recovery regulations, (3) carrier cost estimates that were viewed as exorbitant by the FBI, and (4) negotiating RTU licenses with equipment manufacturers. We describe each of these factors in turn.

Factors Complicating CALEA Implementation

Electronic Surveillance Standards

Electronic surveillance standards provide the basis for the development and deployment of technology to permit carriers to assist law enforcement in conducting lawful electronic surveillance. Development of the initial electronic surveillance standards and obtaining agreement by all parties on their content has been a lengthy process. It was not until April 2002, nearly 8 years after CALEA was passed, that the FCC finally mandated electronic surveillance technical standards for wireline local exchange service, cellular, and broadband personal communications services. However, technical standards for other services such as packet-mode are still in the development stage.⁵

In June 1996, approximately two years after the enactment of CALEA, the Department of Justice (DOJ) issued the Electronic Surveillance Interface Document (ESI). The ESI set forth law enforcement surveillance capabilities, which were developed in consultation with law enforcement agency and industry representatives. In December 1997, the industry published Interim Standard J-STD-025 (known as the J-Standard) to meet the electronic surveillance capability requirements of CALEA. The J-Standard incorporated many of the standards set forth in the ESI but excluded several electronic surveillance capabilities deemed necessary to law enforcement. As a result DOJ filed a deficiency petition with the FCC in March 1998 because the J-Standard did not meet all the capabilities that law enforcement was seeking.

In September 1998, the FCC granted an extension to carriers of CALEA deadline for complying with CALEA capability requirements for equipment installed or deployed after January 1, 1995, from October 28, 1998, to June 30, 2000. This extension was granted on the basis that there was no technology currently available to permit carriers to deploy the minimum industry developed J-Standard capability standards.

In August 1999, the FCC ruled that carriers must comply with additional requirements (punchlist) sought by the government and not included in the J-Standard. The FCC gave carriers until September 2001 to comply. The FCC also mandated that carriers provide the capability to intercept packet-mode communications by September 30, 2001. The industry appealed the FCC decision to United States Court of Appeals, District of Columbia Circuit. On August 21, 2000, the Court of Appeals ruled that each capability standard is required by CALEA, but remanded four of the challenged capabilities to the FCC for further proceedings (99-1442). In an April 11, 2002, Order on Remand, the FCC found that all of the punchlist requirements are required under CALEA and must be provided by wireline, cellular, and broadband telecommunications carriers by June 30, 2002. The FCC has continued to provide extensions of time for carriers with respect to post January 1, 1995 equipment. Also the FBI has not yet agreed to any carrier cost proposal to deploy the CALEA capability requirements on pre- January 1, 1995 equipment because the FBI considered the carriers cost estimates to be exorbitant as we describe below.

Cost Recovery Regulations

In March 1997, the FBI published the final cost recovery regulations (28 CFR Part 100), which set forth the procedures for carriers to follow in order to receive reimbursement for costs incurred in deploying their CALEA solution on their pre-1995 equipment. A CALEA solution is the standards that carriers adopt to be able to comply with law enforcement requests to conduct lawful electronic surveillance. Carriers will incur costs to deploy their CALEA solutions through activation of the software provided by manufacturers under the RTU agreements. The Cost Recovery Regulations became effective on April 21, 1997. Industry representatives filed a lawsuit in April 1998 in U.S. District Court for the District of Columbia (Court) challenging the definition of "installed or deployed" as the term applied to the January 1, 1995, cutoff for reimbursements to carriers. DOJ filed a motion to dismiss, and in August 2000 the Court ruled in favor of DOJ (98-2010).

Carrier Cost Proposals

According to the FBI, a primary reason for the delay in implementing CALEA have been exorbitant cost estimates by carriers. The FBI provided us with examples of several carrier proposals for deployment of their electronic surveillance capabilities. These included proposals from General Telephone and Electric (GTE), SBC Communications (SBC), and Verizon. As detailed below, the cost proposals for these three carriers alone exceeded the $500 million authorized by Congress for CALEA implementation.

• GTE submitted its proposal in February 1999 prior to the RTU agreements and prior to its becoming part of Verizon. GTE estimated that the cost of deploying their CALEA solution throughout its entire network could exceed [Proprietary Information Redacted].

• SBC and Verizon cost estimates were submitted after the RTU agreements had been consummated and reflected the cost savings resulting from these agreements. The SBC cost proposal submitted in September 2000 showed an estimate of [Proprietary Information Redacted] for deployment of their CALEA solution.

• The FBI provided us with two examples of cost proposals submitted by Verizon. The first, submitted in June 2001, showed a cost estimate of [Proprietary Information Redacted] to deploy their CALEA solution throughout its network. The second proposal submitted by Verizon in July 2002 showed the total cost estimate to be [Proprietary Information Redacted].

The FBI recently received a proposal from a major telecommunications carrier to deploy its electronic surveillance solution on specified carrier priority equipment. FBI personnel were optimistic that an agreement could be negotiated with this carrier, and that this will lead to the deployment of a CALEA solution throughout a significant portion of this carrier's network. The FBI is hopeful that if agreement is achieved with this carrier, the possibility of negotiating reasonably priced agreements with other carriers will be increased.

Right to Use Licenses

A RTU software license allows a carrier to activate the software once the manufacturer is reimbursed for its development costs. The FBI entered into several RTU licensing agreements with manufacturers and carriers and has paid or obligated to manufacturers, primarily Nortel and Lucent, approximately $450 million to permit carriers to obtain RTU software licenses at no charge.⁶

These agreements were negotiated between February 1998 and April 2003. According to the FBI, it believed that negotiating RTU licenses with manufacturers for the use of their software would be a major advantage for the carriers and that nationwide software buyouts (FBI purchase of RTU licenses for all carriers that use a given manufacturers equipment) would be more cost effective than reimbursing individual carriers for the cost of this software. Under the RTU agreements, the manufacturers developed and made available the software with the necessary features for electronic surveillance needed in order for carriers to deploy their CALEA solutions.

In negotiating RTU agreements, the FBI General Counsel opined in February 1999 that "the proposed [RTU licensing] arrangement is a reasonable attempt to minimize the costs to the federal government because it reduces the potential for manufacturers to collect substantial profit from carriers who will in turn seek reimbursement from the federal government."⁷

Current and Future Issues

In addition to the past delays described above, we found several current and future issues that will likely have a direct impact on whether CALEA can be fully implemented. These are: (1) the sufficiency of current funding, (2) emerging technologies for which electronic surveillance standards are inadequate or not yet developed, and (3) legislative changes that are necessary to fully implement CALEA.

Future Funding Needs

As of the end of our audit fieldwork approximately $50 million in unobligated funds remained for deployment of carrier electronic surveillance solutions and other FBI funding priorities such as wireless geo-location and trunk surveillance, which are described below.

According to the FBI, cost estimates for obtaining CALEA compliance have varied widely. Prior to enactment of CALEA, industry estimated that CALEA compliance would cost from $3 to $5 billion. The FBI estimated the cost to be between $500 million and $1 billion. From 1998 to 1999, the industry estimates were reduced to $1.3 billion. According to the FBI, manufacturers initially requested $734 million for RTU software licenses in the early stages of negotiation with the FBI. Negotiations between the FBI and industry representatives reduced the final price to $450 million.

In December 2003, the FBI estimated that an additional $204 million would be necessary to complete deployment of CALEA solutions on carrier equipment in high priority areas and to conduct other current FBI priorities such as wireless geo-location and trunk surveillance which are described below. For a variety of reasons, we are skeptical as to whether CALEA's implementation cost can be determined with any degree of specificity. These reasons include wide variances in past budget estimates, the continued slow pace of CALEA implementation, and rapid technological changes in the telecommunications field. We agree, however, that it is unlikely that CALEA can be implemented with the $49.5 million that remains unobligated from current funding.

Emerging Technologies

The FBI is concerned that the emergence of new technologies without the development of concomitant CALEA standards will lessen law enforcement's ability to conduct authorized electronic surveillance. The new technologies include:

• Packet-mode (digitalized transmissions) communications that can be used via conventional telecommunications systems or the internet.

• Internet-based telecommunications services, which use packet-mode communication.

• Nontraditional wireless services, such as personal digital assistants.

• Internet hotspots, such as cyber cafes, that provide anonymity with multiple access points.

• Walkie-talkie networks, such as Verizon's push-to-talk.

• Third party calls using calling cards and toll free numbers.

In addition, the slow pace of CALEA's implementation increases the likelihood that additional technologies will continue to emerge that could impact law enforcement's ability to conduct authorized electronic surveillance.

Legislative Issues

DOJ is currently considering whether to propose to Congress changes to CALEA. Currently, CALEA does not apply to "information services," which include Internet Service Providers. However, vendors are now offering phone service over the internet. Some modification of the information services exemption may be necessary in order to ensure that Voice-over-Internet-Protocol services are subject to CALEA requests.

Other CALEA amendments DOJ is considering include: modifying the Attorney General's role with regard to electronic surveillance standard setting, limiting the FCC's authority to grant extensions to carriers for implementing CALEA, granting the FCC enforcement power to compel carriers to comply with CALEA, and amending the mechanism by which carriers may be reimbursed for deploying electronic surveillance standards.

Although we discuss these legislative issues in greater detail in this report, it is not our intent to endorse any specific legislative change. The FBI, in consultation with DOJ and the administration, must fully evaluate each issue before recommending any legislative changes.

OIG Recommendations

In addition to assessing the status of CALEA implementation and assessing its cost effectiveness, our report contains three recommendations to the FBI to improve CALEA implementation:

• Collect and maintain data on the carrier equipment that is and is not CALEA compliant.

• Periodically survey state and local law enforcement to determine the extent to which delay in the implementation of CALEA is adversely impacting law enforcement's ability to conduct lawful electronic surveillance.

• Submit to Congress CALEA legislative changes necessary to ensure that lawful electronic surveillance is achieved expeditiously in the face of rapid technological change.

1. CALEA vests authority for its implementation with the Attorney General. The Attorney General delegated this authority to the FBI pursuant to 28 CFR section 0.85(o).
2. The carriers may request reimbursement for these modifications provided that the FCC has ruled that such modifications are not reasonably achievable.
3. The General Accounting Office performed the first biannual audit in 1996. The DOJ Office of the Inspector General (OIG) performed the audits in 1998, 2000, and 2002.
4. The FBI entered into a $6.2 million agreement with Qwest to ensure that its network in Salt Lake City was CALEA compliant for the 2002 Winter Olympics. Of this amount, $4 million came from FBI Counterterrorism funds and $2.2 million came from CALEA funding.
5. Packet-mode is the digitalization of telecommunication transmissions so that a carrier can use its entire system to transmit a communication instead of dedicating a specific portion of the system for the transmission duration as with a conventional transmission. Packet-mode is more efficient and less costly because each digitized communication packet can travel the most direct system path.
6. The manufacturers and the approximate amounts paid or obligated under RTU agreements were: Lucent ($189 million), Nortel ($113 million), Siemens ($60 million) Motorola ($55 million), and AG Communications ($30 million).
7. In June 1999, the FBI prepared a Determination and Findings Regarding the Implementation of CALEA prior to entering into any RTU software license agreements. The FBI prepared this document because it was unable to determine the reasonableness of the cost of the RTU software licenses through traditional means, such as cost or price analysis. This was because the manufacturers were unwilling to furnish adequate cost or price information to the FBI in spite of repeated attempts by the FBI to obtain such information. As a result, the information given to us by the FBI was insufficient for use to determine the reasonableness of these costs. Accordingly, we were not able to offer an opinion on the reasonableness of the cost paid for the RTU software licenses.
8. The sources of these other funds were the DOJ working capital fund - $40 million; U.S. Customs Service - $1,580,270; and U.S. Postal Inspection Service - $1 million.

* BECAUSE THIS REPORT CONTAINED PROPRIETARY/COMMERCIAL INFORMATION, WE REDACTED (WHITED OUT) THAT INFORMATION FROM THE VERSION OF THE REPORT THAT IS BEING PUBLICLY RELEASED. WHERE SUCH INFORMATION WAS REDACTED IS NOTED IN THE REPORT.

Proprietary/Commercial Information Redacted