CALEA and Higher Education Networks

1. CALEA and Higher Education Networks Presented by Matthew A. Brill Latham & Watkins, LLP

2. Introduction • The FCC’s extension of CALEA to broadband Internet access and interconnected VoIP services created the prospect that higher education networks could become subject to the statute’s requirements, with huge potential compliance costs. • Even after an appeal to the U.S. Court of Appeals for the D.C. Circuit, the issues remain cloudy in certain respects. But the court case prompted the FCC and Department of Justice to provide some guidance on the circumstances in which colleges and universities will be expected to comply with CALEA.

3. Statutory Background • Congress enacted the Communications Assistance for Law Enforcement Act (“CALEA”) in 1994 to ensure that the introduction of digital technology in the public switched telephone network would not thwart the ability of law enforcement agencies to effectuate wiretaps. • Importantly, law enforcement agencies derive their surveillance authority from criminal statutes and court orders, independent of CALEA. • Thus, CALEA concerns the manner in which service providers will comply with surveillance requests, not whether they will do so.

4. CALEA Requirements • Telecommunications carriers must implement certain “assistance-capability requirements” to ensure that their networks are capable of isolating a subscriber’s communications and call-identifying information and enabling interception by the government. 47 U.S.C. § 1002(a). • Carriers must comply with assistance capability requirements in a manner that is unobtrusive, protects the subscriber’s privacy, and protects information regarding the government’s surveillance.

5. CALEA Applies to “Telecommunications Carriers” • CALEA defines a “telecommunications carrier” as “a person engaged in the transmission or switching of wire or electronic communications as a common carrier for hire.” 47 U.S.C. § 1001(8)(A). • The definition specifically includes commercial wireless carriers. Id. § 1001(8)(B)(i). • It also includes “a person or entity engaged in providing wire or electronic communication switching or transmission service to the extent that the [FCC] finds that such service is a replacement for a substantial portion of the local telephone exchange service and that it is in the public interest to deem such a person or entity to be a telecommunications carrier . . . .” Id. §1001(8)(B)(ii).

6. CALEA Does Not Apply to Private Networks • The statute exempts private networks from the assistance-capability requirements. • Specifically, the requirements do not apply to “equipment, facilities, or services that support the transport or switching of communications for private networks or for the sole purpose of interconnecting telecommunications carriers.” 47 U.S.C. § 1002(b)(2)(B).

7. Nor Does CALEA Apply to Information Services • CALEA also specifies that the definition of a “telecommunications carrier” does not include “persons or entities insofar as they are engaged in providing information services.” 47 U.S.C. § 1001(8)(C)(i). A separate provision reaffirms that information services are not subject to the assistance-capability requirements. Id. § 1002(b)(2)(A). • CALEA defines an “information service” as “the offering of a capability for generating, acquiring, storing, transforming, processing, retrieving, utilizing, or making available information via telecommunications. . . .” Id. § 1001(6)(A). (This definition is virtually identical to that found in the Telecommunications Act of 1996.)

8. The FCC’s August 2005 Order • In response to a petition filed by DOJ and the FBI, the FCC adopted an order extending the scope of CALEA to include all facilities-based providers of broadband Internet access and interconnected VoIP services. • The FCC relied on the Substantial Replacement Provision to subject providers of facilities-based broadband and interconnected VoIP services to the assistance-capability requirements in CALEA. • The FCC established a compliance deadline of May 2007, although it acknowledged that it has not yet determined what the statute’s assistance-capability requirements “mean in a broadband environment” and that industry groups have yet to develop compliance standards.

9. Applicability of CALEA to Private Networks • The FCC’s Order recognized that “private broadband networks or intranets that enable members to communicate with one another and/or to receive information from shared data libraries not available to the general public . . . appear to be private networks for purposes of CALEA,” and thus exempt. • At the same time, however, the Order suggested that the exemption could be lost if such private networks connect to the Internet, as virtually all higher education networks do. The Order stated: “To the extent that . . . private networks are interconnected with a public network, either the PSTN or the Internet, providers of the facilities that support the connection of the private network to the public network are subject to CALEA under the SRP.” • In subsequent meetings and press statements, the FCC declined to elaborate on the meaning of this statement.

10. The FCC’s Reading of the Information Service Exclusions • The FCC ruled that CALEA’s “information service” exclusions did not prevent it from reaching broadband Internet access or VoIP services. • It concluded that, even though broadband Internet access is an information service (and VoIP may be an information service), the “telecommunications” component of those services can be severed from the data-processing components, with CALEA applying only to the former functionality. • Under the Communications Act, applying the very same statutory language, the FCC ruled that these functions cannot be separated. The FCC argued that it could interpret the term “information service” in contradictory ways based on the different purposes of CALEA and the Communications Act.

11. Court Appeal • A coalition of parties representing higher education as well as providers of broadband and VoIP services, privacy groups, and other public interest organizations appealed the FCC Order. • The appeal contended that the FCC’s Order violated CALEA’s exemption of information services and private networks. • In response to our opening brief, the Government briefs acknowledged a key limitation on the application of CALEA to higher education networks. In particular, the FCC clarified that its Order applies to “private network operators that provide their own connection to the Internet,” which are subject to CALEA with respect to that connection, but doesnot apply to “those that contract with an ISP for that connection.” The Department of Justice agreed that CALEA applies only to “Internet gateway” facilities, rather than to the internal portions of private networks.

12. Court Decision • On June 9, the court of appeals issued an opinion upholding the FCC Order. • The court ruled that differences in the structures and purposes of CALEA and the Communications Act made it reasonable for the FCC to construe the term “information services” differently under the two statutes. • More favorably, the court made clear that CALEA “expressly excludes ‘private networks’ from its reach.” The court also found that the FCC had not yet attempted to apply CALEA obligations to the internal portions of private networks.

13. What Does This Mean for Higher Education? • There are still unanswered questions, but the Order, the Government briefs, and the court decision taken together suggest two factors that will determine whether colleges and universities have any obligations under CALEA. • These factors are: (1) whether the campus network “supports” the connection to the Internet, and (2) whether the campus network qualifies as a “private network.”

14. Does the Campus Network “Support” the Connection to the Internet? • While the language in the FCC Order is cryptic, the FCC’s court brief sets forth a more workable test: Colleges and universities that “provide their own connection to the Internet” are subject to CALEA (at least with respect to those Internet connection facilities), while institutions that rely on a third party for this connection are exempt. • This still leaves some gray areas, but the FCC most likely would conclude that an institution provides its own Internet connection when it constructs, purchases, leases, or otherwise operates fiber optic or other transmission facilities and associated switching equipment that link the campus network to an ISP’s point of presence. • In contrast, the FCC most likely would conclude that an institution is exempt if it obtains access to the Internet by (1) contracting with an ISP or regional network to pick up Internet traffic from a campus border router, (2) purchasing a private line or other transmission service from a telecommunications carrier on a contractual or tariffed basis (as opposed to leasing dark fiber or other facilities), or (3) relying on some combination of these approaches.

15. Is the Campus Network a “Private” Network? • If a campus network is closed (i.e., does not connect to the Internet), it is clearly exempt from CALEA under the private network exemption. • Interconnected networks that support their own Internet connection appear to enjoy a limited exemption if they otherwise qualify as “private.” Specifically, only the gateway equipment itself is subject to CALEA – the Internet portions of a private network remain exempt. • The FCC did not expressly define “private network,” but the touchstone appears to be limited availability to specific members or constituents of an organization. Thus, a campus network that is available only to students, faculty, and administrators should be considered a private network, which means CALEA applies at most to the Internet gateway equipment. • In contrast, networks that provide general public access and support a connection to the Internet may well be subject to CALEA obligations throughout the network, rather than only at the gateway.

16. Next Steps for Colleges and Universities • Determine status based on network configuration and public v. private access. • For entities that are exempt, no need for further action. • The FCC released a Second Report and Order on May 12 regarding CALEA implementation details.

17. Compliance Obligations Under the Second Report and Order • For entities that appear to be covered by CALEA, the next steps under the Second Report and Order are: • Must submit report to FCC on “system security requirements” – which concern employee supervision and recordkeeping – at a date TBD. • Also must submit compliance status form to FCC at a date TBD. • Must be in full compliance by May 14, 2007. This will require: (1) installing new CALEA-compliant gateway equipment (which is not yet available), (2) contracting with a “trusted third party” to provide the requisite surveillance capabilities, or (3) developing a customized network solution.

18. Continuing Legal Proceedings • On July 21, several parties sought rehearing of the June 9 court of appeals decision. Such petitions usually face long odds. • The FBI has drafted legislation that would codify the FCC’s Order and allow further expansions, including the possible override of the private network exemption by the FCC. This legislation is circulating but has not yet been introduced. • The FCC has an open rulemaking regarding discretionary exemptions for certain entities, including higher education institutions.