The higher education community and others submitted comments in November 2004 to the Federal Communications Commission (FCC) that outlined their major concerns. The full text of that document is available at http://www.educause.edu/ir/library/pdf/EPO0420.pdf.

Briefly stated, the main points the community is currently presenting to the FCC and the Department of Justice (DoJ) are:

1. Congress should decide, not the FCC or the DoJ, whether to extend CALEA to ISPs. The community feels the FCC overstepped its purview and "stretched" CALEA to fit its needs instead of properly turning to Congress to reconsider the law.
2. Law enforcement has sufficient access to our networks under current law, without CALEA compliance. Colleges and universities have and will continue to support and assist law enforcement. Campuses have the technical personnel that can help law enforcement acquire the information they need using traditional methods at a much reduced cost.
3. The cost of compliance far outweighs the benefit to law enforcement. Historically, there have been so few wiretap requests on campuses that the cost per incident would be extraordinary if CALEA compliance were required.
4. CALEA compliance would impact innovation. University and college campuses have traditionally been an important source of networking innovation. Having to design network improvements within the constraints of CALEA compliance would be detrimental to innovation.

The full report and order that explains the FCC's legal reasoning is available at http://www.educause.edu/ir/library/pdf/EPO0528.pdf.

Briefly, and perhaps oversimplified, their main argument follows:

1. CALEA, as passed in 1994, contained the "Substantial Replacement Provision" clause. This provision states that the term "telecommunications carrier" could include any person or entity engaged in providing wire or electronic communication switching or transmission service to the extent that the FCC finds that such service is a replacement for a substantial portion of the local telephone exchange service and that it is in the public interest (Section 102. (8)(B)(ii) CALEA).
2. Broadband Internet access substantially replaces dial-up service (a portion of the local exchange service).
3. Interconnected VoIP substantially replaces plain old telephone service (POTS).
4. Therefore, broadband and interconnected VoIP providers are "telecommunications providers" for the purposes of CALEA.

The Second Report and Order made the following determinations that pertain to educational networks:

1. Affirms the 18-month implementation deadline, which mandates full compliance by May 14, 2007.
2. Clarifies that this deadline applies to all providers of broadband Internet access and interconnected VoIP services -- i.e., there will not be earlier deadlines for LECs that are already subject to CALEA or later deadlines for small entities.
3. Confirms that the FCC will not establish any assistance-capability requirements, but rather will defer to ongoing industry standards-setting bodies working in conjunction with law enforcement.
4. Makes clear that covered service providers may rely on "trusted third parties" ("TTPs") (such as VeriSign) to handle CALEA compliance. The FCC views this as a cost-saving measure for smaller entities.
5. Limits the availability of extensions under section 107(c) of the Act, apparently making clear that section 107(c) applies only to equipment installed before October 1998. The Order also will provide guidance regarding petitions for relief pursuant to section 109(b), which applies to equipment deployed after January 1, 1995 and authorizes the FCC to determine that particular capability requirements are not "reasonably achievable" with respect to a petitioning carrier's equipment, facilities, or services.
6. Addresses the enforcement of CALEA.
7. Clarifies that carriers may not recover capital costs through charges imposed on law enforcement agencies for installing wiretaps.

To read the released summary of the order go to: http://www.educause.edu/ir/library/pdf/EPO0632.pdf

1. Review the "Immediate Security Requirements" outlined in the Second Report and Order (and available at http://www.educause.edu/ir/library/pdf/EPO0642.pdf) and be prepared to file a report on how you are/or will comply with these requirements. The report date has not been established but is expected to be early Spring 2007.
2. Investigate the equipment vendor and third party provider solutions becoming available.
3. Attend the CALEA discussion session at the EDUCAUSE regional conference in your area in Spring 2007.