The law, without the alarmism.
Lawful surveillance sits at the three-way intersection of communications law, law enforcement and subscriber privacy. This is where we explain it, in plain English, without the hype, from the TTP (trusted third party) that lives it every day.
Does CALEA apply to you?
Almost certainly. Since the FCC's 2005 First Report and Order, CALEA reaches the vast majority of communications service providers, including broadband, VoIP, wireless and hosted IP providers whose services interconnect with the public switched network. "Our hardware came CALEA-compliant from the factory" is where most providers get it wrong: compliance is a capability you operate, not a checkbox you buy.
Capability
Your network must be able to implement a lawful intercept, to the industry safe-harbor standard for your network type.
Court-order handling
Orders must be authenticated and reviewed: an invalid order risks inadmissible evidence and real liability.
Delivery
Collected communications must reach the agency's monitoring center in the required format and standard, on time.
Privacy
Everything above must happen without touching the traffic of subscribers who aren't named in the order.
Who's in, and who's out.
CALEA Section 102 covers any entity "engaged in the transmission or switching of wire or electronic communications as a common carrier for hire." The statute was written in 1994, so applying it to modern networks takes some translation. The short version:
Covered
Wireline, wireless, satellite, facilities-based broadband and two-way interconnected VoIP. Resellers and MVNOs too, the reseller's duty is ensuring its facilities-based wholesaler has a CALEA solution in place, written into the wholesale agreement.
Exempt
Private networks (a university research network, a bank's ATM system, a corporate PBX), as long as they aren't "to the public." Interexchange and pure backbone carriers ("a carrier's carrier") are generally treated as exempt interconnecting carriers, a point neither the statute nor the FCC's rules expressly address, since law enforcement intercepts through the last-mile provider instead. But every operator, exempt or not, still owes "reasonable assistance" when lawful surveillance is implemented.
CALEA in nine sections, plain English.
The full text is in the library below. Here's what each operative section actually does:
§102 · Definitions
Defines the terms that decide everything else, "telecommunications carrier," "call-identifying information," "information services."
§103 · Capability
The core duty: the technical capabilities a covered carrier must deliver to law enforcement when served with a surveillance order.
§104 · Capacity
The Attorney General's notice of how many simultaneous intercepts law enforcement may need, by network type and market.
§105 · Security
The privacy backstop: an interception can be activated only under a court order or other lawful authorization, and only with the affirmative intervention of the carrier's own personnel.
§106 · Manufacturers
Equipment vendors must make CALEA solutions available to their carrier customers in reasonable time, at reasonable cost.
§107 · Safe Harbor
The provision this company is built on: conform to an industry standard and you "shall be found to be in compliance." No existing standard is not an excuse.
§108 · Enforcement
Courts can order compliance and impose civil penalties of up to $10,000 a day, unless compliance is "not reasonably achievable" or law enforcement has reasonable alternatives.
§109 · Cost Recovery
If compliance is "not reasonably achievable," the Attorney General pays for the upgrade, or the carrier is deemed compliant without it.
§110 · Appropriations
Congress authorized $500,000,000 (fiscal years 1995–98) to fund the §109 retrofit of network equipment deployed on or before January 1, 1995.
Statutes, standards and source documents.
The primary documents, the statute, the FCC orders that extended it, and the privacy law that constrains it, hosted here in full.
A decade of plain-English analysis.
From Apple v. the FBI to the CLOUD Act, from going-dark to state surveillance statutes, our government-affairs commentaries cover the controversies where law enforcement access meets subscriber privacy. Sixty-plus essays, all in the blog.
Read the commentary →Still have questions?
Ask the experts, real answers to specific compliance questions, from the TTP (trusted third party) that operates this discipline every day.