Law enforcement agencies use electronic surveillance techniques to acquire evidence for criminal and terrorism investigations. Traditionally, electronic surveillance involved using various techniques to intercept and obtain communication information and content. Title III of the Omnibus Crime Control and Safe Streets Act of 1968 (Title III) and portions of the Electronic Communications Privacy Act (ECPA) are the primary laws governing the use of electronic surveillance in criminal investigations.10 Similar rules governing electronic surveillance conducted during foreign intelligence, counterintelligence, and terrorism investigations are found in the Foreign Intelligence Surveillance Act (FISA).11
The rapid pace of technological changes in the way people communicate has presented challenges to law enforcement agencies conducting electronic surveillance for criminal investigations. In 1994, Congress passed the Communications Assistance for Law Enforcement Act (CALEA) to ensure that the telecommunication industry would build surveillance solutions into the technologies they deploy that allow law enforcement agencies to continue to obtain electronic surveillance information. According to CALEA’s assistance capability requirements, telecommunication carriers are to isolate, intercept, and deliver communication content and call identifying information to law enforcement pursuant to lawful authorization.12
CALEA Provisions and Responsibilities
CALEA assigned certain responsibilities to the Attorney General, the Federal Communications Commission (FCC), telecommunication carriers, equipment manufacturers (manufacturers), and the Department of Justice (DOJ) Office of the Inspector General (OIG). In February 1995, the Attorney General delegated CALEA management to the Federal Bureau of Investigation (FBI). Table 1 outlines each entity with CALEA responsibilities.
TABLE 1: SUMMARY OF CALEA STATUTORY RESPONSIBILITIES
| Entity | Responsibility |
|---|---|
| FBI | Ensures industry-wide implementation of the assistance capability requirements. |
| Consults with state and local law enforcement agencies. | |
| Provides estimates to the telecommunication industry on the number of interceptions that government agencies may need to conduct. | |
| Establishes rules to facilitate carrier reimbursements. | |
| Allocates appropriated funds to carriers in a manner consistent with law enforcement priorities. | |
| Annually reports to Congress the amount of carrier payments during the preceding year and the projected payments for the current year. | |
| FCC | Determines which entities are telecommunication carriers and may exempt any entity or category as a carrier by rulemaking and consulting with the FBI. |
| Establishes technical standards for compliance with assistance capability requirements if industry associations fail to issue technical standards, or if a government agency or any other person believes that industry-adopted standards are deficient.13 | |
| Reviews and grants or denies petitions for extensions. | |
| Telecommunication Carriers and Other Service Providers14 |
Ensure that equipment, facilities, or services that provide customers the ability to originate, terminate, or direct communications meet the CALEA assistance capability requirements. |
| Equipment Manufacturers |
Make available all features or modifications necessary to meet assistance capability requirements, including consulting with carriers over current and planned equipment. |
| OIG15 | Report to Congress biennially on the type of equipment, facilities, and services brought into compliance with CALEA and whether costs paid to each carrier for CALEA-required modifications were reasonable and cost effective. |
Effective implementation of CALEA’s provisions is dependant on the joint efforts of government agencies, service providers, and telecommunications equipment manufacturers subject to the law’s requirements.
The Telecommunications Carrier Compliance Fund
CALEA authorized the Attorney General to reimburse telecommunication carriers for modifications made to meet CALEA assistance capability requirements on their equipment, facilities, or services installed or deployed on or before January 1, 1995.16 In 1996, Congress established the Telecommunications Carrier Compliance Fund (TCCF) and, over subsequent years, appropriated nearly $500 million for such reimbursements, as shown in Table 2 below.
TABLE 2: DEPOSITS TO THE TELECOMMUNICATIONS CARRIER COMPLIANCE FUND
| Funding Activity | Amount ($) |
|---|---|
| FY 1997 Direct Appropriations | 60,000,000 |
| FY 1997 Department of Justice Working Capital Fund | 40,000,000 |
| FY 1997 U.S. Postal Inspection Service Transfer | 1,000,000 |
| FY 1997 U.S. Customs Service Transfer | 1,580,270 |
| FY 2000 Direct Appropriations | 15,000,000 |
| FY 2000 Supplemental Appropriations | 181,000,000 |
| FY 2001 Direct Appropriations | 200,976,876 |
| Total TCCF Deposits | $499,557,146 |
The Attorney General delegated the responsibilities of overseeing the TCCF and compensating carriers for CALEA compliance modifications to the FBI. To carry out these responsibilities, the FBI established a CALEA Implementation Unit (CIU) in its Operational Technology Division and an Offsite Contract Unit (OSCU) in its Finance Division.17 The CIU worked with carriers, manufacturers, and other telecommunication industry representatives to develop and deploy CALEA-mandated solutions while the OSCU awarded and administered CALEA implementation agreements and audited proposed implementation costs.
In prior OIG audits, we reported on FBI agreements that applied TCCF funds to pay manufacturers for software feature updates and associated licensing fees, referred to as Right-To-Use (RTU) agreements. These payments allowed carriers to obtain CALEA software solutions once the FBI reimbursed development costs to the manufacturer.18 As shown in the Table 3, the FBI has spent about $451.7 million on these RTU licenses since 1997.
TABLE 3: TCCF COST SUMMARY
(1997-2007)
| Type of Cost | Amount ($) * |
 |
|---|---|---|
| RTU Agreements19 | 451.7 | |
| Carrier CALEA Solution Deployment, Activation, and Testing |
7.5 | |
| 2007 TCCF Rescissions | 40.3 | |
| TOTAL | $ 499.5 |
* Figures in millions, rounded to nearest $100,000
In addition to the RTU agreements, the FBI spent approximately $7.5 million to reimburse wire line carriers for deployment, activation, and testing costs of solutions that allow carriers to comply with CALEA requirements, or CALEA solutions. In 2007, Congress rescinded over $40 million from the TCCF.20 According to a DOJ finance official, the FBI is working with DOJ to transfer the $5,037 remaining in the TCCF to the DOJ’s Working Capital Fund and subsequently close the TCCF account.
The objectives of the audit were to determine: (1) the type of equipment, facilities, and services brought into compliance with CALEA, and (2) whether payments during the most recent 2-year review period for CALEA-required modifications were reasonable and cost effective. In light of the TCCF rescissions that occurred in 2007, our audit also reviewed how the FBI has continued to work with telecommunication providers to help ensure that emerging communication technologies are CALEA compliant.
Our review focused on TCCF-financed activity occurring between January 1, 2006, and December 31, 2007. During the audit, we interviewed officials at FBI Headquarters, the CIU, various FBI Finance Division units, and selected telecommunication providers. We reviewed CALEA annual reports, assessments, associated files, contracts, obligations, and payments for CALEA-implementation.
Title III, as amended, contains the procedures law enforcement agencies must follow to obtain the necessary judicial authorization to conduct electronic surveillance, while ECPA, as amended, extends Title III coverage to the contents of electronic messages such as e-mail and to data transmissions from facsimiles and pagers.
FISA, as amended, requires carriers to furnish “…all information, facilities, or technical assistance necessary to accomplish the electronic surveillance in such a manner as will protect its secrecy and produce a minimum of interference…” with the services of the target of electronic surveillance.
Call-identifying information is defined as dialed number information that identifies the origin, direction, destination, or termination of any communication generated or received by a subject of surveillance. Content is defined as the substance or meaning of a communication.
-
Electronic surveillance standards provide a basis for the development and deployment of technology to permit carriers to assist law enforcement in conducting electronic surveillance.
To meet their responsibilities under CALEA, some carriers have chosen to contract with “trusted third parties.” A trusted third party is a private company whose services include providing reviews of a carrier’s CALEA-compliance, managing the intercept function, and serving as the custodian of record for the intercept information.
The FBI’s Operational Technology Division was formerly called the Investigative Technology Division, while the OSCU was formerly called the Telecommunications Contract and Audit Unit.
Our March 2006 report found that the FBI was not provided the cost information necessary to determine the reasonableness of costs associated with RTU agreements. Therefore, the audit offered no opinion on the reasonableness or cost effectiveness of these expenses. See 2006 OIG CALEA Implementation Report, 16.
Included in the $451.7 million figure is a late payment penalty of about $5,000, for which the FBI could provide no explanation.