The Implementation of the Communications Assistance for Law Enforcement Act
Audit Report 06-13
Office of the Inspector General
Criminal organizations and individuals frequently use the telecommunications systems of the United States to further serious violent crimes, including terrorism, kidnapping, extortion, organized crime, drug trafficking, and public corruption. One of the most effective tools law enforcement uses to investigate these crimes is court-authorized electronic surveillance. However, continuing advances in telecommunications technology have impaired and in some instances prevented telecommunications carriers from assisting law enforcement in conducting court-authorized electronic surveillance.
In the early 1990s, the Federal Bureau of Investigation (FBI) asked Congress for legislation to assist law enforcement agencies to conduct electronic surveillance. The FBI argued that advances in the telecommunications industry such as cellular telephones, call forwarding, and speed dialing challenged the ability of law enforcement agencies to fully perform electronic surveillance. In response, Congress passed the Communications Assistance for Law Enforcement Act (CALEA) in 1994 to enable law enforcement to conduct electronic surveillance despite the deployment of new technologies and wireless services that have altered the character of electronic surveillance. In short, CALEA requires telecommunications carriers (carriers) to modify the design of their equipment, facilities, and services to ensure that law enforcement can perform electronic surveillance (for purposes of this report, the term electronic surveillance is used only in the sense of the real-time interception of information). To facilitate CALEA implementation, Congress appropriated $500 million to reimburse carriers for the direct costs of modifying systems installed or deployed on or before January 1, 1995.
Effective implementation of CALEA relies heavily on the shared responsibilities of the FBI, the Federal Communications Commission (FCC), telecommunications carriers, and telecommunications equipment manufacturers. CALEA also required the Department of Justice (DOJ) Office of the Inspector General (OIG) to conduct biennial audits of the progress of CALEA implementation.1
The OIG initiated this audit to: (1) review CALEA implementation costs and progress; (2) review the impediments to CALEA implementation, including the effects of emerging technologies; and (3) determine how the implementation of CALEA, or lack thereof, impacts federal, state, and local law enforcement in its ability to conduct electronic surveillance.
As part of our audit, we interviewed officials within the FBI and the DOJ who have CALEA implementation responsibilities, as well as representatives from telecommunications service providers, the FCC, advocacy groups, and federal, state, and local law enforcement. We reviewed the FBI's 2004 Threat Assessment Report, the FBI Investigative Technology Division CALEA Law Enforcement Case Examples, and other documents to gain an understanding of issues encountered by law enforcement while conducting electronic surveillance. We also mailed a survey to a statistical sample of 1,396 federal, state, and local law enforcement officials to identify issues that affect law enforcement’s ability to conduct electronic surveillance. Appendix I contains more information about the objectives, scope, and methodology of this audit.
CALEA Implementation Costs and Progress
After 10 years and over $450 million, t he FBI estimates that only 10 to 20 percent of the wireline switches, and approximately 50 percent of the pre-1995 and 90 percent of the post-1995 wireless switches, respectively, have CALEA software activated and thus are considered CALEA-compliant.2 Although we acknowledge that the FBI bases its estimates on the best available data, we could not provide assurance on the accuracy of these estimates. Neither the FBI nor the FCC know the actual rate of CALEA compliance because there is no requirement for carriers to report the number of switches that are compliant. During the past 10 years, the FBI has spent about $400 million to reimburse manufacturers for their purchase of CALEA-compliant software licenses (Right-to-Use or RTU licenses). These software licensing agreements allowed the carriers to meet CALEA intercept requirements by collecting and delivering to law enforcement pertinent call-identifying information, call content, or both.
Through extensive negotiations, the FBI negotiated substantially reduced costs for the RTU licenses compared to the initial cost proposals as shown in the following chart.
The FBI also entered into additional RTU license agreements totaling $50 million to reimburse carriers for the purchase of RTU Enhanced Dial-Out software licenses. The “dial-out” software takes advantage of the Public Switched Telephone Network (PSTN) already in place between carrier equipment performing an intercept and a law enforcement collection site.3
Although the FBI was able to negotiate substantially reduced costs for the RTU license agreements compared to the carriers’ initial cost proposals, as reported in previous OIG audits, the cost information given to us by the FBI did not provide a basis to determine the reasonableness of the RTU licenses’ costs. Accordingly, our prior reports offered no opinion.
Benefits of CALEA
For the switches with activated CALEA software, we found that CALEA has provided federal, state, and local law enforcement with beneficial features to conduct electronic surveillance.4 The law enforcement officials we interviewed said that electronic surveillance is a vital investigative tool and that the CALEA features are extremely beneficial. In addition, of the 82 agencies that responded to our survey stating that they performed electronic surveillance, the following chart shows a breakdown of law enforcement’s use of the CALEA features:
Law enforcement officials also stated that CALEA has greatly reduced the amount of time it takes carriers to initiate a wiretap. Prior to CALEA, both the carrier and law enforcement had to be physically present at the switch location during the electronic surveillance. With CALEA, provisioning, or the providing of electronic surveillance service by the carrier,is completed remotely from a central location for all electronic surveillance in a carrier’s network. According to carrier and law enforcement officials, this process has significantly reduced carrier and law enforcement travel costs and time.
Impediments to Implementing CALEA
Despite these successes, the FBI has encountered significant impediments in implementing CALEA. These impediments included the contentious standard-development process, carrier requests for extensions and enforcement orders for non-compliance, and the extended negotiations with carriers over software activation agreements.
Developing Technical Standards
Electronic surveillance standards provide the basis for the development and deployment of technology to permit carriers to assist law enforcement in conducting electronic surveillance. In accordance with CALEA, the FBI consults with telecommunication carriers and manufacturers to determine what capabilities will be included in the CALEA standards. Developing electronic surveillance standards is a lengthy process. For example, the initial CALEA standards took 10 years to develop and implement because of protracted litigation over law enforcement wiretapping requirements. These delays are the primary reason CALEA implementation continues on wireline systems.
CALEA gives the lead role in setting electronic surveillance standards to the telecommunications industry and this delegation has created considerable tension between the FBI and the telecommunications industry throughout the standards development process. According to the FBI, CALEA allows the telecommunications industry to decide what law enforcement needs to accomplish effective electronic surveillance. If the FBI believes a standard is deficient, it must challenge the standard by filing a deficiency petition with the FCC. Instead of having to explain why law enforcement needs a particular feature or service, the FBI’s preference would be to place the onus on the telecommunications industry to explain why a feature or service law enforcement wants is not technically feasible.
Carrier Extensions and Enforcement Orders for Non-Compliance
Under CALEA, the FCC has the power to grant carriers time extensions for complying with the statute. The FCC granted hundreds of extensions in conjunction with the FBI’s flexible deployment initiatives.5 These extensions are now a source of contention between the FBI and the telecommunications industry because carriers have delayed the implementation process by continuing to seek extensions from the FCC. For example, the FCC issued extensions to many wireline and wireless carriers for complying with CALEA until June 30, 2002, and then to June 30, 2004. Furthermore, in 2004 carriers filed for time extensions for complying with CALEA until June 30, 2006.
Carrier officials we interviewed have argued that the extensions are warranted. A telecommunications industry representative noted that while the FBI blames the FCC for granting carriers repeated extensions, the extensions were approved in conjunction with the FBI’s flexible deployment initiatives.
Until this point, the FBI’s pursuit of legal remedies for carrier non‑compliance with CALEA has not included filing enforcement actions.6 The FBI explained that it has not sought enforcement orders for two reasons: (1) pre-1995 equipment is deemed CALEA‑compliant until the FBI agrees to reimburse carriers for their deployment costs, and (2) post-1995 equipment has been covered under FCC time extensions. FBI officials summarized the current status of this issue by saying that it cannot file suit to enforce CALEA because the carriers currently do not have to comply with the statute.
Telecommunications industry representatives cited law enforcement’s failure to file enforcement actions as evidence that carrier non-compliance is not a real concern. A representative indicated that carriers were not protected from enforcement actions because the FCC has not ruled on the latest extension requests. However, several state and local law enforcement agencies we interviewed said their failure to file CALEA enforcement actions was a matter of practicality. If they already know a carrier does not have the ability to conduct the electronic surveillance, they will not bother going through the trouble and expense of obtaining an enforcement order. In addition, one local law enforcement official noted that although a local judge might be willing to issue an Order to Show Cause against a carrier, the agency would have to wait three months for a hearing. Given that the wiretap is needed immediately, the official said the law enforcement agency instead will pursue a traditional wiretap, which does not provide the CALEA features.7
Activation Negotiations on Pre-1995 Equipment
Although the FBI has spent over $450 million on RTU licenses since 1994, entering into these agreements did not guarantee that CALEA-compliant software solutions were operable. The agreements provided the carriers with the CALEA-compliant software solutions. However, the agreements did not include the activation costs. Software must be activated; engineering and provisioning practices developed; security policies implemented; and in a handful of cases, external hardware deployed, prior to a carrier facilitating surveillance that utilizes the software.
At the time of this audit, the FBI was negotiating reimbursement agreements with four wireline carriers regarding deploying CALEA solutions on pre-1995 wireline equipment.8 According to the FBI, it concluded negotiations with two carriers in September 2005 for a total cost of $4.5 million. FBI officials said substantial personnel turnover at the third carrier made negotiations difficult, and the FBI said it is postponing further discussions with this carrier until the agreements with the first two carriers are finalized. The FBI also temporarily discontinued negotiations with the fourth carrier because the carrier’s initial proposal of $170 million far exceeded the amount of remaining funds.
Effects of Delayed Implementation on Wireline Systems
We found that the beneficial features CALEA provided generally have not been realized on wireline systems. However, we believe the following factors mitigate the effects of the delayed implementation: (1) the growing popularity of Internet telephony, (2) the limited number of wireline wiretaps, (3) the apparent limited effect on criminal investigations, and (4) emerging technologies.
Growing Popularity of Internet Telephony
Internet telephony and Internet telephony service providers represent a growing portion of the telecommunications industry.9 An April 2005 report from research firm International Data Corporation (IDC) predicts that U.S. residential Internet telephony customers will grow from 3 million in 2005 to 27 million by the end of 2009. In addition, a carrier representative we interviewed reiterated a widely held belief that the Internet will swallow up the conventional telephone network, essentially replacing traditional telephone services in the near future.
Limited Number of Wireline Intercepts
According to the April 2005 Report of the Director of the Administrative Office of the United States Courts on Applications for Orders Authorizing or Approving the Interception of Wire, Oral, or Electronic Communications, the most common location specified in wiretap applications authorized in 2004 was “portable device, carried by/on individual.”10 According to the report, 88 percent of all wiretaps authorized involved portable devices such as portable digital pagers and cellular telephones. The report noted that since 2000 – the first year that the “portable device, carried by/on individual” category was used – “the proportion of wiretaps involving fixed locations has declined as the use of mobile communications devices has become more prevalent.” According to the report, only 5 percent of all intercept devices were authorized for personal residences, and 2 percent were authorized for business establishments such as offices, restaurants, and hotels.
Furthermore, our discussions with four wireline carriers in areas of the country with high electronic surveillance activity revealed a limited number of court orders for intercepts requiring CALEA features. For example, a wireline carrier reported that from 2002 to 2004, less than one percent of the court orders it received for intercepts required CALEA features. According to the federal, state, and local law enforcement officials we interviewed and surveyed, their agencies do not request intercepts requiring CALEA features for several reasons (e.g., the high cost charged by carriers, carrier noncompliance, or the investigation only required a traditional wiretap).
The Apparent Limited Effect on Criminal Investigations
The FBI measures the impact of CALEA and identifies federal, state, and local law enforcement concerns through distribution of Threat Assessment Surveys and by maintaining a help desk that law enforcement officials can contact when they have difficulty conducting electronic surveillance or if they have questions.11 Our review of the FBI’s Threat Assessment Surveys revealed that the law enforcement community is less concerned over the ability to perform electronic surveillance on wireline equipment, and more concerned over new and emerging technologies. As shown in the following chart, 49 percent of those surveyed believed that criminals evaded surveillance using wireless phones, and 42 percent believed the use of the Internet allowed criminal evasion of electronic surveillance.
As shown in the following chart, law enforcement officers who completed the survey expected that pre-paid cell phones, telephony over broadband, and voice or text over the Internet would have the greatest impact on their agency’s electronic surveillance activities within the next two years.
In our interviews with FBI officials, we requested specific examples that illustrate existing intercept problems. The FBI provided a document entitled FBI Investigative Technology Division CALEA Law Enforcement Case Examples dated October 29, 2004. The document contained 23 examples of unsuccessful intercepts, none of which involved electronic surveillance problems for wireline intercepts. The 23 examples involved either wireless or Voice over Internet Protocol (VoIP), which seems to be law enforcement’s primary concern since a low percentage of wireline intercepts are conducted.12 In addition, we believe these examples are not necessarily indicative of technology that is negatively impacting law enforcement’s ability to conduct electronic surveillance because the carriers identified in these examples have either implemented CALEA solutions or contracted with a trusted third party to administer its CALEA responsibilities.
According to law enforcement officials, [LAW ENFORCEMENT SENSITIVE INFORMATION REDACTED].
Similarly, officials surveyed by the OIG identified pre-paid calling cards and pre-paid cell phones as the top two threats affecting their ability to conduct electronic surveillance. Of the 82 affirmative responses to our survey, law enforcement officials indicated that the following emerging technologies negatively affect their agencies' ability to conduct electronic surveillance:
FBI Plans for Remaining CALEA Funding
As of November 2005, about $45 million in CALEA funds remain for the implementation of carrier technical solutions. As previously discussed, the FBI is in various stages of negotiating reimbursements to four carriers for the cost of deploying CALEA solutions on their pre-1995 wireline equipment. The FBI said that it plans to use any remaining funds to reimburse second‑tier carriers for their implementation of CALEA solutions on pre-1995 wireline equipment.
We are concerned about how the FBI plans to use the remaining $45 million in CALEA funding. We recognize that CALEA allows the FBI to reimburse carriers for all reasonable costs associated with bringing pre-1995 wireline equipment, facilities, and services into compliance. Nevertheless, because telecommunications technology has significantly advanced from the time of CALEA’s enactment, and because of the increasing use of these new technologies by subjects of electronic surveillance, we believe the FBI should reexamine the future benefits of implementing CALEA on wireline systems.
Issues Requiring Resolution
The development, deployment, and maintenance costs associated with implementing CALEA and the related question of who should bear those costs continue to be controversial issues. In addition to cost issues, we found that carrier’s limited customer service for law enforcement officials attempting to conduct electronic surveillance and the FBI’s limited support provided to state and local law enforcement will also affect the future implementation of CALEA.
Costs Incurred by Carriers
Officials from the 10 carriers we interviewed indicated that they were committed to complying with CALEA and that they had, or were actively engaged in deploying CALEA solutions on their networks. However, these same officials advised us that the significant costs associated with making their networks CALEA compliant will hinder full CALEA implementation. Carrier representatives stated that the cost to develop, deploy, and maintain electronic surveillance capabilities has been significant, and that these costs are expected to increase as technology accelerates. For example, one carrier said that it spent about $40 million to make its network CALEA-compliant.13
Costs Incurred by Law Enforcement
From a law enforcement perspective, carrier wiretap fees, equipment costs, and delivery costs contribute to the high cost of conducting electronic surveillance.
Wiretap Fees. A traditional wiretap costs law enforcement about $250. However, while we found that fees vary widely, a wiretap with CALEA features costs law enforcement approximately $2,200, according to law enforcement officials and carrier representatives we interviewed. A law enforcement official noted that, “[w]ith CALEA, the carriers do less work but it costs approximately 10 times as much to do a CALEA-compliant tap versus a traditional tap. ” While many law enforcement officials we interviewed agreed that the features provided by CALEA are valuable, we found that some law enforcement agencies said they cannot afford to conduct the number of CALEA wiretaps they would like to support their investigations. Instead, we found these agencies often conduct traditional wiretaps to avoid the high carrier fees associated with a CALEA wiretap.
Equipment Costs. In order to conduct CALEA intercepts, law enforcement must maintain or have access to a wireroom. A wireroom consists of a computerized system that intercepts, decodes, records, and plays back telephone communications. Law enforcement agencies across the country have spent between hundreds of thousands to several million dollars to equip their wirerooms. The equipment costs depend upon the desired capacity of simultaneous wiretaps and the need to accommodate carriers’ various delivery methods. In addition to the initial purchase of wireroom equipment, some law enforcement agencies pay about $30,000 per year to equipment vendors to maintain their equipment. Further, law enforcement agencies said they spend additional funds to acquire hardware and software upgrades just to keep current with emerging technological improvements.
Delivery Methods. Many law enforcement officials noted that CALEA addresses what carriers need to provide law enforcement agencies without addressing how the data is to be delivered. Due to the potential delivery methods, law enforcement agencies must purchase additional equipment to receive the intercepted data from a carrier.
The four delivery methods are dial-out, virtual private network (VPN), frame relay, and T-1 lines. While dial-out and VPN are increasingly popular and favored among law enforcement agencies, some carriers only deliver data via a T-1 line which we found to be the most expensive delivery method. Using a T-1 line costs law enforcement agencies approximately $1,300 for each switch, and can take up to two months to install. One law enforcement official told us that his agency pays approximately $20,000 per month to carriers to maintain T-1 line connections.
However, for some law enforcement agencies delivery of wireline CALEA intercept data by T-1 line is impractical because of the number of T-1 lines required. Law enforcement officials in California and Florida, for example, stated that carriers required T-1 lines to each switch in order to deliver CALEA features. These law enforcement officials explained that this concept is cost prohibitive considering the number of switches. Therefore the California and Florida law enforcement officials we interviewed said they conduct traditional intercepts on wireline switches rather than intercepts with CALEA features.
Limited Carrier Customer Service
Several law enforcement officials stated that they received poor customer service from the carriers when dealing with electronic surveillance issues, and believed some carrier employees lack CALEA training. In particular, carriers were criticized for interrupting wiretaps by upgrading switches without notifying law enforcement. In addition, law enforcement officials on the west coast stated that carriers on the east coast do not provide customer service after 5:00 p.m. EST. Another law enforcement official cited an example of when a carrier’s switches were able to conduct the wiretaps but the carrier’s technician did not know how to activate the switches. However, one carrier representative told us that his company investigated such law enforcement complaints and found that about half of the problems stem from law enforcement’s lack of technical expertise in operating the collection equipment and not the carrier’s lack of customer service.
FBI Support of State and Local Law Enforcement
State and local law enforcement officials stated that they feel unsupported by the FBI on electronic surveillance issues. These officials said a lack of FBI-provided CALEA training has negatively affected the quality of CALEA implementation. The law enforcement officials stated that the FBI should provide basic “hands-on” training for law enforcement agents and technical personnel on CALEA wiretaps.
In addition, law enforcement officials who attend FBI-sponsored Law Enforcement Technical Forums noted that the number of forums has declined over the last few years. Additionally, we were told that forums have become one-sided with the FBI simply presenting information, instead of an exchange of ideas between the FBI and law enforcement officials. Law enforcement officials also noted that the FBI should provide an opportunity and venue for vendors to showcase their equipment and analytical programs, and for meetings with carriers to voice their concerns.
Controversy over Technologies Covered by CALEA
In March 2004, the DOJ attempted to resolve many of the electronic surveillance problems faced by law enforcement officials with new technologies by filing a Joint Petition for Expedited Rulemaking with the FCC. The Joint Petition also sought to address longstanding implementation issues such as carrier extensions of time for complying with CALEA, enforcement for noncompliance, and fees charged by carriers. In response to the Joint Petition, on August 5, 2005, the FCC ruled that providers of facilities-based broadband Internet access service and interconnected (managed) VoIP services must be prepared to accommodate electronic surveillance within the scope of CALEA.14 According to the FCC, these services essentially replace conventional telecommunications services currently subject to CALEA.15 The FCC also found that the definition of “telecommunications carrier” encompasses providers of services that are not classified as telecommunications services under the Communications Act of 1934. The FCC stated that it is taking a two-step approach to focus debate on the implementation rather than the applicability of CALEA to providers of broadband Internet access services and VoIP services.
Ten years after its enactment, the FBI continues to encounter significant challenges in implementing CALEA. According to law enforcement officials we interviewed and surveyed, law enforcement has been significantly handicapped in its efforts to conduct electronic surveillance by a variety of technological innovations that have taken place in the telecommunications field, including the emergence and widespread availability of broadband Internet access services and VoIP services. Other impediments have included a contentious process of developing technical standards, continuous carrier requests for extensions, and extended negotiations with carriers over software activation agreements. In light of the FCC’s August 2005 ruling, absent some change in existing CALEA requirements and corresponding changes in how the FBI exercises its responsibilities in overseeing CALEA implementation, the goals envisioned when CALEA was enacted will not be realized fully.
As a result of our review, we offer six recommendations for the FBI to consider in fulfilling its CALEA implementation responsibilities. The recommendations include improving liaison between law enforcement officials and carrier and manufacturer representatives; improving the methodology for gathering examples of criminal investigations that have been adversely impacted because of a carrier’s inability to provide CALEA-compliant wiretaps; and revisiting the FBI’s plans to spend the remaining $45 million in CALEA funds. In addition, we will continue to monitor recommendations made in prior OIG reports on CALEA, specifically that the FBI should collect and maintain data on the number of carrier switches that are CALEA-compliant, and submit to Congress legislative changes necessary to ensure that electronic surveillance is achieved in the face of rapid technological change.
|« Previous||Table of Contents||Next »|