OVERVIEW

In March, the FBI submitted to Congress an "implementation plan" for the Communications Assistance for Law Enforcement Act (CALEA). The plan, as presented, is not responsive to the instructions from the Congress and creates the misleading impression for those exercising oversight at this critical point in the implementation process that implementation is running smoothly and without controversy. In fact, the FBI's approach to CALEA has caused significant delays in the implementation of the Act and risks a collapse of the carefully structured checks and balances that were built into CALEA. Congress intended in CALEA to ensure that the surveillance needs of law enforcement would be maintained without disrupting equally important constitutional guarantees of privacy or the continued advancement, through innovation, of the nation's competitive telecommunications infrastructure.

Substantial differences in interpretation of CALEA have emerged between law enforcement on the one hand and industry and privacy advocates on the other. Indeed, the undersigned organizations believe that law enforcement is using the implementation process to significantly expand surveillance capabilities and capacities beyond those contemplated in CALEA; and to unfairly shift costs and accountability for implementation from government, as provided by CALEA, to private industry and private American citizens.

The implementation plan submitted to Congress by the FBI is part of an attempt to substitute the judgment of the FBI for the collective and open deliberative process established by Congress in CALEA. The Congress should now continue the oversight which it began in requiring that the FBI submit an implementation plan in the first place. In furtherance of that, the undersigned organizations representing telecommunications carriers and privacy interests submit to the Appropriations and Judiciary Committees the attached summary and comments in response to the FBI's CALEA implementation plan.

EXECUTIVE SUMMARY

• Congress clearly specified in CALEA that industry should develop standards to implement the high-level capability requirements of CALEA. The industry standards process is almost complete. Balloting is underway and will be completed in June. When the proposed standard has been fully vetted and adopted, the industry technical and legal experts believe it will meet, in all respects, the law enforcement requirements of CALEA, on a cost-effective basis, while also respecting privacy interests. However, as the FBI's implementation plan implies, the proposed industry standards do not meet, in all respects, the FBI's unrestricted desires.

• The FBI implementation plan suggests that delay in implementing CALEA was caused by industry and its failure to accept unquestioningly all of the FBI's surveillance recommendations. This is not accurate. To the contrary, the FBI's approach to the standards development process has far exceeded the consultative role envisioned for law enforcement by CALEA and has caused significant delays and complications.

• The Bureau's recommended surveillance "needs," which it has set forth in a quasi-restricted document entitled the Electronic Surveillance Interface (ESI), contains numerous technical specifications that have been incorporated into the pending industry-developed CALEA capability standards document (referenced as SP-3580). The ESI also contains numerous specifications that have been rejected by the telecommunications industry standards development organizations because they went beyond the requirements of CALEA. The rejected elements also would have violated customer privacy and would have imposed unreasonable technical burdens.

• In response to industry's rejection of some of its technical specifications, the FBI has presented an implementation plan that will, if approved as submitted, enable the Bureau to circumvent the open process enacted by Congress in CALEA for establishing and incorporating both capability and capacity requirements in the nation's telecommunications infrastructure. This implementation plan continues to promote the controversial, rejected capability specifications, and would institutionalize excessive capacity requirements. The plan also relies on unique, non-public "cooperative agreements," as well as reimbursement procedures that contravene Congressional intent.

• The FBI "explains" its capability requirements in the implementation plan by simply mischaracterizing the industry's efforts and canonizing by reference the FBI's own capability requirements as set forth in the ESI document. This "explanation" does not provide the committees with any meaningful explanation of the continued controversy over capability which has become so pervasive that, left unresolved, will further derail the compliance deadlines set out in CALEA, raising costs and adding delays for the government and industry alike.

• Law enforcement capacity requirements are not yet complete. The FBI's second attempt to establish these capacity requirements contains substantial deficiencies that industry and privacy groups have identified as potentially imposing requirements far in excess of documented needs and leaving key issues unresolved. Until the FBI reconciles these problems, the FBI cannot provide the specific surveillance capacity requirements and justification requested by the Congress.

• CALEA does not grant law enforcement a blank check for ubiquitous surveillance coverage. Rather, it requires law enforcement to select, using its own prioritization, how and where to spend limited resources. The funding and prioritization provisions of CALEA were intended to insert public accountability into the law enforcement electronic surveillance activities. Because neither capability nor capacity requirements are yet final, the implementation plan sets forth an ambiguous and necessarily vague estimate of costs. It also omits, other than in broad generalities, identification of law enforcement priorities, all contrary to what was called for by the oversight committees. Until rectified, this deficiency indicates the need for continued close oversight of the implementation process and continued Congressional control on the expenditure of funds.

The plan demonstrates that compliance is not reasonably achievable within the CALEA deadlines. The FBI itself states that modifications to carrier's imbedded bases will not likely be deployed before 1999. Given the delays and complications caused by the FBI's broad interpretation of CALEA, no telecommunications carriers or manufacturers are yet able to design, engineer, test or install CALEA technology in their equipment or networks. Further, carriers will not likely be able to convert the eventual final standards for either capability or capacity into the necessary hardware and software and deploy it before October, 1998. Consideration should be given by Congress to the impact that CALEA deadlines and reimbursement decisions, as applied in the FBI plan, will have on the entire telecommunications industry and their subscribers.

In sum:

The FBI implementation plan suggests that all is well with CALEA implementation, when in fact substantial controversy persists. Many contentious issues of scope and cost are unresolved.

The committees should hold hearings to examine the FBI's CALEA implementation plan for the purpose of (i) ensuring that CALEA funds are not expended on requiring the ubiquitous installation of surveillance enhancements that are outside the scope of CALEA but are limited to achieving compliance with the features reflected in the industry standard; (ii) to determine whether the compliance dates of January 1, 1995 and October 25, 1998 are still valid, reasonable, and achievable, given the unanticipated delays that have occurred in the implementation process; and (iii) to address the other concerns raised herein.

Back.