The FCC recently released a long-anticipated ruling clarifying the obligations of interconnected VoIP providers under the Communications Assistance for Law Enforcement Act (“CALEA”) and establishing applicable compliance deadlines.
The FCC (News - Alert)’s May 12, 2006 decision reaffirms that interconnected VoIP providers must be CALEA compliant by May 14, 2007. The FCC’s order also requires that CALEA system security plans be filed with the FCC by providers within 90 days after the effective date of the order, meaning that providers will most likely be expected to file the plans before late September or early October of this year.
The agency’s ruling extends to facilities based broadband Internet access providers and contains determinations that apply to other carriers already subject to CALEA.
Section 103 of CALEA imposes specific obligations on “telecommunications carriers” (which already covers wireline, wireless and other carriers) to assist law enforcement, including with respect to 1) call intercept; 2) accessing call identifying information; 3) delivering intercepted communications and call identifying information to the government; and 4) doing so with a minimum of interference to subscriber service and privacy.
In a prior, September 2005 ruling, the FCC determined that CALEA extends to “interconnected VoIP providers.” “Interconnected VoIP services” are those VoIP services that: 1) enable real-time, two-way voice communications; 2) require a broadband connection; 3) require IP-compatible customer equipment; and 4) permit subscribers to receive calls from and initiate calls over the public switched telephone network.
For carriers already subject to CALEA, implementing the accepted industry standard minimizes legal exposure. Although carriers are not legally required to adopt the standard, compliance with the standard is a “safe harbor” under which a carrier will be deemed to have complied with CALEA requirements. The FCC’s latest ruling extends this “safe harbor” to interconnected VoIP providers and concludes that technical standards and requirements will be left to industry standards-setting bodies.
Under the recent ruling, interconnected VoIP providers (and other carriers) may also use the services of a “trusted third party” (TTP) to comply with CALEA. The TTP would “operate as a service bureau with a system that has access to a carrier’s network equipment and remotely manage the intercept process for the carrier.” The TTP process is permitted but not required, and the VoIP provider remains responsible for all CALEA compliance requirements.
All telecommunications carriers subject to CALEA are required to develop and file with the FCC a CALEA system security plan. Under the recent decision, interconnected VoIP providers will be required to file such a plan within 90 days of the effective date of the May 12, 2006 order. The effective date will be 30 days after publication of the order in the Federal Register. Based on our projections, CALEA system security plan submissions should be due before late September or early October 2006.
The system security plan includes company policies and procedures for providing call interception and access to call-identifying information only pursuant to lawful request; maintaining adequate records; and meeting the reporting requirements.
The system security plan also identifies a senior officer responsible for such company policies and procedures, recordkeeping and reporting. The FCC can assess a monetary penalty against any provider that fails to file a system security plan.
The FCC’s decision concludes that all interconnected VoIP providers must also file a monitoring report with the FCC demonstrating the actions the company has taken towards CALEA compliance as well as identifying a date by which full compliance is anticipated. Once the federal Office of Management and Budget approves the paperwork collection requirement, the FCC will issue a public notice setting a specific deadline for filing monitoring reports.
The FCC declined to adopt a national surcharge to recover CALEA cost recovery. However, interconnected VoIP providers (as well as other carriers not subject to rate regulation) may recover CALEA-related costs from their customers through any lawful manner. For example, VoIP providers may recover these costs through a surcharge comparable to the Universal Service Fund assessment.
In its ruling, the FCC established its independent enforcement authority (including its right to issue monetary penalties and cease-and-desist orders) over interconnected VoIP providers (as well as other carriers). The agency determined that it may enforce its existing rules to ensure CALEA compliance.
Finally, the FCC determined that it should consolidate its CALEA rules into Part 1 of the Code of Federal Regulations. Currently, the rules are scattered across three different sections (or “Parts”) of the FCC’s rules. The new, consolidated CALEA rules should take effect before the end of June 2006.
The FCC’s previous September 2005 ruling which initially extended CALEA requirements to interconnected VoIP providers is, as of press time, on appeal before a federal appellate court. That ruling and the recently established compliance deadlines could be affected by the outcome of this appeal. Although the case is ongoing, FCC positions during oral argument on May 1, 2006 were met with questioning which suggests that the court may have serious concerns with the FCC’s position.
----
Thomas K. Crowe, Esq., a practicing attorney in Washington, D.C., is a contributing writer to TMCnet. For more information, please see http://www.tkcrowe.com.
Internet Telephony Magazine
Click here to read latest issue
CUSTOMER 
Cloud Computing Magazine
Click here to read latest issue
IoT EVOLUTION MAGAZINE
