FCC Adopts NPRM and Declaratory Ruling Regarding CALEA Obligations

August 4, 2004. The Federal Communications Commission (FCC) adopted, but did not release, a Notice of Proposed Rulemaking and Declaratory Ruling (NPRM & DR) regarding imposing CALEA obligations upon broadband internet access services, including voice over internet protocol (VOIP), and other information services. The FCC gave the Department of Justice (DOJ) much of what it had requested. The FCC tentatively concluded that broadband internet access services are subject to CALEA requirements, and that managed or mediated VOIP services are also subject to CALEA requirements.

The FCC issued a short press release [PDF] describing this item, and four Commissioners wrote brief separate statements, which they read, in whole or in part, at the FCC's meeting on August 4, 2004.

After the meeting, FCC Chairman Michael Powell spoke to reporters, and the FCC's Ed Thomas and Julius Knapp spoke at a press conference. However, neither the FCC's press releases, the written statements of its Commissioners, nor the oral comments, constitute federal law. Nor are they binding upon the FCC. Nevertheless, this is the information that the FCC has provided.

No one from the FCC stated when the FCC would release to the public the text of this NPRM & DR. Nor did anyone state when the FCC might ultimately issue its report and order.

On March 10, 2004, the Department of Justice (DOJ) and two of its components, submitted a petition for rulemaking [83 pages in PDF] to the FCC regarding requiring broadband service providers, voice over internet protocol (VOIP) service and application providers, and others, to design and modify their networks, hardware, software, and equipment in a manner that enables the DOJ to more easily intercept VOIP and other internet based communications. See, story titled "Summary of DOJ Petition for Rulemaking to Expand the CALEA to Cover Information Services" in TLJ Daily E-Mail Alert No. 873, April 9, 2004.

The DOJ asserted that the FCC has authority to issue a declaratory ruling and promulgate rules under the 1994 Communications Assistance for Law Enforcement Act (CALEA). The FCC tentatively concluded that it has such authority. However, it did not provide the DOJ everything that it requested in its petition.

The DOJ prevailed on many key items. The FCC "tentative concluded" in its NPRM that broadband internet access services are subject to CALEA obligations. The FCC also tentatively concluded that VOIP services are subject to CALEA obligations, provided that they are managed or mediated. The DOJ petition was not precise, but it contained no "managed or mediated" qualification.

The DOJ also prevailed in convincing the FCC that it should create an enforcement mechanism to be administered by the FCC. (The CALEA only gives enforcement authority to the courts.)

The DOJ appears to have lost on its request that the FCC set up a procedure under which new technologies must be submitted to, and approved by, the FCC.

Nothing in this NPRM & DR, or the CALEA, expands the authority of law enforcements agencies to conduct surveillance. Wiretap authority, and pen register and trap and trace authority (including internet addressing and routing information), are addressed in Title 18 (criminal code) and Title 50 (foreign intelligence surveillance). The CALEA, which is codified in Title 47 (communications), imposes requirements upon telecommunications carriers to design and modify their networks to facilitate lawfully obtained surveillance orders.

Section 103(a) of the CALEA, which is codified at 47 U.S.C. § 1002(a), provides, in part, that "a telecommunications carrier shall ensure that its equipment, facilities, or services that provide a customer or subscriber with the ability to originate, terminate, or direct communications are capable of expeditiously isolating and enabling the government ... intercept, to the exclusion of any other communications, all wire and electronic communications carried by the carrier within a service area to or from equipment, facilities, or services of a subscriber of such carrier concurrently with their transmission to or from the subscriber's equipment, facility, or service, or at such later time as may be acceptable to the government".

Tentative Conclusions Extending CALEA Obligations to Broadband and VOIP. While the FCC states that it is only issuing a DR on one issue -- push to talk -- and the rest of this item is a NPRM, much of the NPRM actually consists of "tentative conclusions" that resolve some of the most fundamental issues raised by the DOJ petition. In effect, much of the important content of the NPRM is not in the nature of a NPRM. It resembles a DR.

The DOJ requested in its petition that the FCC issue a declaratory ruling that broadband internet access services and broadband telephony services are subject to CALEA.

The FCC release states that the FCC "tentatively concludes that CALEA applies to facilities-based providers of any type of broadband Internet access service -- including wireline, cable modem, satellite, wireless, and powerline -- and to managed or mediated Voice over Internet Protocol (``VoIP´´) services. These tentative conclusions are based on a Commission proposal that these services fall under CALEA as ``a replacement for a substantial portion of the local telephone exchange service.´´" This is a major victory for the DOJ.

The FCC has also tentatively concluded that VOIP services are subject to CALEA, provided that they are "managed or mediated". The DOJ did not request this "managed or mediated" qualification. Also, the FCC release does not explain what it means by "managed or mediated"

Ed Thomas, Chief of the FCC's Office of Engineering and Technology (OET), stated in a press conference on August 4 that "non-managed is basically peer to peer; it could be Skype". He also said that Vonage is an example of a managed service. See also, comment [PDF] submitted by Skype.

The DOJ's petition does reference the notions of managed VOIP services, and mediated VOIP services, in a footnote. (See, DOJ petition, footnote 39, at pages 16-17.)

Basically, the DOJ wrote that a mediated VOIP service is one that is provided by "an entity that both provides the broadband access service that enables the telecommunications ... and acts as a mediator that provides any connection management". This might include a VOIP service offered as part of a cable company's broadband internet access package.

The DOJ also wrote that "A stand-alone broadband telephony service provider includes entities that do not offer broadband access but do provide fully- or partially-managed broadband telephony service. Stand-alone broadband telephony service providers own or lease transmission facilities in order to manage quality of service and are thereby responsible to the customer for the transport of packets." The DOJ argued that both of these types of services, as well as others, should be subjected to CALEA obligations.

Statutory Basis for Tentative Conclusions. The FCC release provides that information services can be subjected to CALEA requirements as "telecommunications services", as the DOJ argued in its petition. Although, the FCC has not adopted the primary basis advanced by the DOJ. The FCC release states that the tentative conclusions are based on the clause in the CALEA regarding "a replacement for a substantial portion of the local telephone exchange service." This clause is found in Subsection 102(8)(B)(ii) of the CALEA, which clarifies the definition of the term "telecommunications carrier".

The DOJ petition contains a long and tortured argument that the FCC should, in effect, simply declare providers of information services are really telecommunications carriers, notwithstanding the plain definitions of the terms found in the CALEA, and elsewhere in the Communications Act.

Tentative Conclusion Regarding Creation of FCC Enforcement Authority. The DOJ requested that the FCC adopt rules that provide that "the Commission is the appropriate agency to enforce any CALEA compliance benchmarks and/or deadlines, as well as CALEA compliance generally." (See, DOJ Petition at pages 58-63.)

The FCC release states that, in the NPRM, "the Commission considers whether, in addition to the enforcement remedies through the courts available to LEAs under CALEA section 108, it may take separate enforcement action against carriers that fail to comply with CALEA and tentatively finds that it has general authority under the Communications Act to promulgate and enforce CALEA rules against carriers and non-common carriers."

If the FCC actually promulgates rules that create such enforcement authority, this will be a major victory for the DOJ, because the FCC is far more likely to grant the DOJ the remedies that it seeks than is the federal judiciary. The FCC, as demonstrated by its previous CALEA related R&Os, and by this NPRM, is willing to grant DOJ requests not provided for by statute. In contrast, the courts would likely apply the statute.

Tentative Conclusion Regarding Request for FCC Licensing of Information Technologies. The DOJ petition requested that the FCC "require any carrier that believes that any of its current or planned equipment, facilities, or services are not subject to CALEA to immediately file a petition for clarification with the Commission to determine its CALEA obligations." (See, DOJ petition, at page 34. It should also be noted that the DOJ used the term "carrier" here not to refer to "telecommunications carrier" or "common carrier", but rather to entities that it argues are subject to CALEA obligations.)

A review of the comments submitted to the FCC in response to the DOJ's petition reveals that this DOJ proposal was one of the most opposed, and vehemently opposed, items in the DOJ petition.

The FCC appears not to be prepared to grant to the DOJ its request. The FCC release states that the FCC "tentatively concludes that it is unnecessary to identify future services and entities subject to CALEA. The Commission recognizes Law Enforcement’s need for certainty regarding the applicability of CALEA to new services and technologies, but anticipates that the Report and Order in this proceeding will provide substantial clarity sufficient to resolve Law Enforcement’s and industry’s uncertainty about future compliance obligations."

Declaratory Ruling Extending CALEA Obligations to Push to Talk. The FCC release states that in the declaratory ruling (DR) portion of this item "the Commission grants in part a Law Enforcement request in the Petition and clarifies that commercial wireless ``push-to-talk´´ services are subject to CALEA, regardless of the technologies that Commercial Mobile Radio Service providers choose to apply in offering them."

At a press conference after the meeting, Ed Thomas (Chief of FCC's OET) and Julius Knapp (Deputy Chief of the OET) stated that the DR only addresses the push to talk issue.

This DR, however, is not a controversial item. A review of the comments submitted to the FCC, ex parte communications, and relevant public speeches of interested parties reflects that of all of the significant proposals in the DOJ petition, this was the only one without significant opposition. See also, TLJ web page titled "Summary of Comments Submitted to the FCC in Response to the DOJ's CALEA Petition"

Steve Largent, P/CEO of the Cellular Telecommunications & Internet Association (CTIA) stated in a release that "The mobile wireless industry has always worked closely with law enforcement. Wireless carriers and their vendors are committed to working with the law enforcement agencies and the FCC to ensure that push-to-talk wireless services are CALEA compliant and to find the most effective way to meet law enforcements' needs". He added that " Consistent with the CALEA statute, we expect that the FCC will provide a reasonable timeframe for push-to-talk services to become CALEA compliant."

Other Items in the NPRM. The FCC release states that the NPRM "seeks comment on the feasibility of carriers relying on a trusted third party to manage their CALEA obligations". This would involve the use of technologies that allow private sector intercept providers, such as VeriSign, to conduct surveillance. Currently, wiretaps are conducted by law enforcement agencies.

The NPRM also seeks comments on "whether standards for packet-mode technologies are deficient and thus preclude carriers from relying on them as safe harbors for complying with CALEA."

The NPRM also tentatively concludes that "that carriers are responsible for CALEA development and implementation costs". That is, the carriers and service providers will not be able to receive reimbursement from the federal government for their costs of modifying their networks, equipment, and software to facilitate surveillance. This is consistent with the DOJ petition.

Are Competitors of Entities Covered by CALEA Also Covered CALEA? The DOJ petition argued that the FCC should issue a rule that a service that directly competes against a service already deemed to be covered by CALEA is presumptively covered by CALEA. (See, DOJ Petition, at page 33.)

There is nothing in the FCC release on this question. The Commissioners said nothing about this.

Items Not Mentioned in the FCC Release. Neither the FCC release, nor the Commissioners' statements, state that the NPRM seeks comments on whether the internet and other information technologies are hindering law enforcement. There exists the argument that, contrary to the assertions of the DOJ, new technologies now enable law enforcement to obtain more stored communications and data, to intercept communications that were previously transmitted on paper, and to electronically store, analyze and access the data that it obtains.

Also, Neither the FCC release, nor the Commissioners' statements state that the FCC seeks comments on the extent to which carriers and service providers are complying with their existing wiretap and CALEA obligations, or whether they are, and if so, to what extent, providing law enforcement access to communications over broadband internet access services, VOIP, and other information services.

Statements by Commissioners. FCC Chairman Michael Powell wrote in a separate statement [PDF] that "We are entering a dynamic space in the evolution of Internet voice services and applications. As technologies re-shape communications, this Commission must continually assess the needs of the law enforcement community under the" CALEA."

FCC Commissioner Kathleen Abernathy voted for this item, and praised it in her oral statement at the August 4 meeting. She wrote in a separate statement [PDF] that she partially read at the meeting. However, in the portions of the statement that she did not read at the meeting, she questioned the authority of the FCC to do many of the things that are proposed or tentatively concluded in the NPRM.

She wrote that "at the end of the day, the federal courts -- rather than this Commission -- will be the arbiter of whether we are authorized to take the actions proposed in this rulemaking, and we must remain mindful of that fact as we consider final rules."

FCC Commissioner Jonathan Adelstein wrote in a separate statement [PDF] that "This Notice facially accedes to law enforcement's request, but stops short of developing fully the most defensible basis for these proposed outcomes, which are at the heart of the federal law enforcement agencies’ petition."

Adelstein (at right) continued that "Rather than seeking comment on the most stable footing for law enforcement’s request, the item seizes upon notable but thin distinctions between definitions in CALEA and the Communications Act. Moreover, the item does not acknowledge fully and seek comment on existing precedent that is in tension with the tentative conclusions here. For example, whether or not the Commission ultimately appeals the decision in the Ninth Circuit’s Brand X case, which concluded that broadband access via cable modem includes a “telecommunications service,” this Notice’s failure to seek comment on a legal analysis that would comport with the Circuit’s holding is an unnecessary failing. For these reasons, I concur in the result, if not the full legal analysis behind the Commission’s tentative conclusions.

FCC Commissioner Michael Copps also wrote in a separate statement [PDF] that the FCC should not ignore the BrandX case.

FCC Commissioner Kevin Martin did not write a separate statement.

Michael Gallagher, the head of the National Telecommunications and Information Administration (NTIA), issued a statement. "I commend the Commission for acting quickly on the Petition for Rulemaking filed by the DoJ, DEA and FBI.  By issuing this notice, the Commission takes an important first step to ensure that law enforcement has access to the advanced tools needed to pursue those who would threaten us using advanced technologies." The head of the NTIA generally represents the position of the administration on communications issues.

More Information. See, related stories: "FBI Now Seeks a Rulemaking to Expand CALEA to Cover VOIP Services" in TLJ Daily E-Mail Alert No. 834, February 11, 2004; "FBI Publishes CALEA Final Notice of Capacity" in TLJ Daily E-Mail Alert No. 797, December 11, 2004; and "FBI Wants Broadband Internet Access Classified As A Telecommunications Service So That CALEA Will Apply" in TLJ Daily E-Mail Alert No. 707, July 30, 2003.

The CALEA is codified in Title 47, along with the Communications Act of 1934, and amendments thereto. However, the original bill, HR 4922 in the 103rd Congress (which became Public Law No. (103-414), stated in its preamble that the bill amends Title 18, which is the Criminal Code.

This item is FCC 04-187 in ET Docket No. 04-295 and RM-10865. Geraldine Matise presented this item at the Commission meeting. She can be contacted at 202 418-2322 or gmatise@fcc.gov.