Implementation of the Communications Assistance for Law Enforcement Act by the Federal Bureau of Investigation*
Report No. 04-19
Office of the Inspector General
Criminal organizations and individuals frequently use the telecommunications systems of the United States in the furtherance of serious violent crimes, including terrorism, kidnapping, extortion, organized crime, drug trafficking, and corruption. One of the most effective tools law enforcement uses to investigate these crimes is court-authorized electronic surveillance. According to Federal Bureau of Investigation (FBI) personnel, however, continuing advances in telecommunications technology have impaired and in some instances prevented telecommunication carriers (carriers) from assisting law enforcement to conduct authorized electronic surveillance.
Electronic surveillance is provided for in Title III of the Omnibus Crime Control and Safe Streets Act of 1968 and the Electronic Communications Privacy Act of 1986, which extended authorized lawful electronic surveillance to communications transmitted via wireless technology. In October 1994, Congress enacted the Communications Assistance for Law Enforcement Act (CALEA) because of concerns that advances in telecommunications technology, such as cellular telephones and features such as call forwarding and multiparty calls, could limit the effectiveness of lawful electronic surveillance, especially at the state and local level. Law enforcement agencies at the state and local level often do not have the same level of resources or technical ability to conduct electronic surveillance as do federal law enforcement agencies. Because of this, CALEA required that carriers deploy electronic surveillance standards to ensure that technological advances in the telecommunications industry (industry) would not compromise the ability of law enforcement agencies to engage in lawful electronic surveillance.
CALEA provides that the Attorney General can reimburse telecommunications carriers for modifications to equipment, facilities, or services installed or deployed on or before January 1, 1995, to meet CALEA capability requirements.1 Essentially, the capability requirements of CALEA require carriers to be able to isolate, intercept, and deliver communication content and call identifying information to law enforcement pursuant to lawful government order. The carriers are responsible for such modifications to equipment, facilities, and services installed or deployed after January 1, 1995.2 To date, funding for CALEA implementation has totaled $499.5 million.
CALEA requires biannual audit reporting on the equipment, facilities, and services that have been modified to comply with CALEA requirements; whether FBI payments to the carriers were reasonable and cost effective; and projections of future costs for such modifications.3 Consistent with these congressionally mandated audit objectives, we assessed CALEA's implementation to date. Our audit found the following:
We found a variety of factors that have seriously complicated CALEA implementation, including: (1) delays in establishing electronic surveillance standards together with Federal Communications Commission (FCC) extensions, (2) contested cost recovery regulations, (3) carrier cost estimates that were viewed as exorbitant by the FBI, and (4) negotiating RTU licenses with equipment manufacturers. We describe each of these factors in turn.
Factors Complicating CALEA Implementation
Electronic Surveillance Standards
Electronic surveillance standards provide the basis for the development and deployment of technology to permit carriers to assist law enforcement in conducting lawful electronic surveillance. Development of the initial electronic surveillance standards and obtaining agreement by all parties on their content has been a lengthy process. It was not until April 2002, nearly 8 years after CALEA was passed, that the FCC finally mandated electronic surveillance technical standards for wireline local exchange service, cellular, and broadband personal communications services. However, technical standards for other services such as packet-mode are still in the development stage.5
In June 1996, approximately two years after the enactment of CALEA, the Department of Justice (DOJ) issued the Electronic Surveillance Interface Document (ESI). The ESI set forth law enforcement surveillance capabilities, which were developed in consultation with law enforcement agency and industry representatives. In December 1997, the industry published Interim Standard J-STD-025 (known as the J-Standard) to meet the electronic surveillance capability requirements of CALEA. The J-Standard incorporated many of the standards set forth in the ESI but excluded several electronic surveillance capabilities deemed necessary to law enforcement. As a result DOJ filed a deficiency petition with the FCC in March 1998 because the J-Standard did not meet all the capabilities that law enforcement was seeking.
In September 1998, the FCC granted an extension to carriers of CALEA deadline for complying with CALEA capability requirements for equipment installed or deployed after January 1, 1995, from October 28, 1998, to June 30, 2000. This extension was granted on the basis that there was no technology currently available to permit carriers to deploy the minimum industry developed J-Standard capability standards.
In August 1999, the FCC ruled that carriers must comply with additional requirements (punchlist) sought by the government and not included in the J-Standard. The FCC gave carriers until September 2001 to comply. The FCC also mandated that carriers provide the capability to intercept packet-mode communications by September 30, 2001. The industry appealed the FCC decision to United States Court of Appeals, District of Columbia Circuit. On August 21, 2000, the Court of Appeals ruled that each capability standard is required by CALEA, but remanded four of the challenged capabilities to the FCC for further proceedings (99-1442). In an April 11, 2002, Order on Remand, the FCC found that all of the punchlist requirements are required under CALEA and must be provided by wireline, cellular, and broadband telecommunications carriers by June 30, 2002. The FCC has continued to provide extensions of time for carriers with respect to post January 1, 1995 equipment. Also the FBI has not yet agreed to any carrier cost proposal to deploy the CALEA capability requirements on pre- January 1, 1995 equipment because the FBI considered the carriers cost estimates to be exorbitant as we describe below.
Cost Recovery Regulations
In March 1997, the FBI published the final cost recovery regulations (28 CFR Part 100), which set forth the procedures for carriers to follow in order to receive reimbursement for costs incurred in deploying their CALEA solution on their pre-1995 equipment. A CALEA solution is the standards that carriers adopt to be able to comply with law enforcement requests to conduct lawful electronic surveillance. Carriers will incur costs to deploy their CALEA solutions through activation of the software provided by manufacturers under the RTU agreements. The Cost Recovery Regulations became effective on April 21, 1997. Industry representatives filed a lawsuit in April 1998 in U.S. District Court for the District of Columbia (Court) challenging the definition of "installed or deployed" as the term applied to the January 1, 1995, cutoff for reimbursements to carriers. DOJ filed a motion to dismiss, and in August 2000 the Court ruled in favor of DOJ (98-2010).
Carrier Cost Proposals
According to the FBI, a primary reason for the delay in implementing CALEA have been exorbitant cost estimates by carriers. The FBI provided us with examples of several carrier proposals for deployment of their electronic surveillance capabilities. These included proposals from General Telephone and Electric (GTE), SBC Communications (SBC), and Verizon. As detailed below, the cost proposals for these three carriers alone exceeded the $500 million authorized by Congress for CALEA implementation.
The FBI recently received a proposal from a major telecommunications carrier to deploy its electronic surveillance solution on specified carrier priority equipment. FBI personnel were optimistic that an agreement could be negotiated with this carrier, and that this will lead to the deployment of a CALEA solution throughout a significant portion of this carrier's network. The FBI is hopeful that if agreement is achieved with this carrier, the possibility of negotiating reasonably priced agreements with other carriers will be increased.
Right to Use Licenses
A RTU software license allows a carrier to activate the software once the manufacturer is reimbursed for its development costs. The FBI entered into several RTU licensing agreements with manufacturers and carriers and has paid or obligated to manufacturers, primarily Nortel and Lucent, approximately $450 million to permit carriers to obtain RTU software licenses at no charge.6
These agreements were negotiated between February 1998 and April 2003. According to the FBI, it believed that negotiating RTU licenses with manufacturers for the use of their software would be a major advantage for the carriers and that nationwide software buyouts (FBI purchase of RTU licenses for all carriers that use a given manufacturers equipment) would be more cost effective than reimbursing individual carriers for the cost of this software. Under the RTU agreements, the manufacturers developed and made available the software with the necessary features for electronic surveillance needed in order for carriers to deploy their CALEA solutions.
In negotiating RTU agreements, the FBI General Counsel opined in February 1999 that "the proposed [RTU licensing] arrangement is a reasonable attempt to minimize the costs to the federal government because it reduces the potential for manufacturers to collect substantial profit from carriers who will in turn seek reimbursement from the federal government."7
Current and Future Issues
In addition to the past delays described above, we found several current and future issues that will likely have a direct impact on whether CALEA can be fully implemented. These are: (1) the sufficiency of current funding, (2) emerging technologies for which electronic surveillance standards are inadequate or not yet developed, and (3) legislative changes that are necessary to fully implement CALEA.
Future Funding Needs
As of the end of our audit fieldwork approximately $50 million in unobligated funds remained for deployment of carrier electronic surveillance solutions and other FBI funding priorities such as wireless geo-location and trunk surveillance, which are described below.
According to the FBI, cost estimates for obtaining CALEA compliance have varied widely. Prior to enactment of CALEA, industry estimated that CALEA compliance would cost from $3 to $5 billion. The FBI estimated the cost to be between $500 million and $1 billion. From 1998 to 1999, the industry estimates were reduced to $1.3 billion. According to the FBI, manufacturers initially requested $734 million for RTU software licenses in the early stages of negotiation with the FBI. Negotiations between the FBI and industry representatives reduced the final price to $450 million.
In December 2003, the FBI estimated that an additional $204 million would be necessary to complete deployment of CALEA solutions on carrier equipment in high priority areas and to conduct other current FBI priorities such as wireless geo-location and trunk surveillance which are described below. For a variety of reasons, we are skeptical as to whether CALEA's implementation cost can be determined with any degree of specificity. These reasons include wide variances in past budget estimates, the continued slow pace of CALEA implementation, and rapid technological changes in the telecommunications field. We agree, however, that it is unlikely that CALEA can be implemented with the $49.5 million that remains unobligated from current funding.
The FBI is concerned that the emergence of new technologies without the development of concomitant CALEA standards will lessen law enforcement's ability to conduct authorized electronic surveillance. The new technologies include:
In addition, the slow pace of CALEA's implementation increases the likelihood that additional technologies will continue to emerge that could impact law enforcement's ability to conduct authorized electronic surveillance.
DOJ is currently considering whether to propose to Congress changes to CALEA. Currently, CALEA does not apply to "information services," which include Internet Service Providers. However, vendors are now offering phone service over the internet. Some modification of the information services exemption may be necessary in order to ensure that Voice-over-Internet-Protocol services are subject to CALEA requests.
Other CALEA amendments DOJ is considering include: modifying the Attorney General's role with regard to electronic surveillance standard setting, limiting the FCC's authority to grant extensions to carriers for implementing CALEA, granting the FCC enforcement power to compel carriers to comply with CALEA, and amending the mechanism by which carriers may be reimbursed for deploying electronic surveillance standards.
Although we discuss these legislative issues in greater detail in this report, it is not our intent to endorse any specific legislative change. The FBI, in consultation with DOJ and the administration, must fully evaluate each issue before recommending any legislative changes.
In addition to assessing the status of CALEA implementation and assessing its cost effectiveness, our report contains three recommendations to the FBI to improve CALEA implementation:
* BECAUSE THIS REPORT CONTAINED PROPRIETARY/COMMERCIAL INFORMATION, WE REDACTED (WHITED OUT) THAT INFORMATION FROM THE VERSION OF THE REPORT THAT IS BEING PUBLICLY RELEASED. WHERE SUCH INFORMATION WAS REDACTED IS NOTED IN THE REPORT.
Proprietary/Commercial Information Redacted