What a CALEA Trusted Third Party actually does.
CALEA does not say how a carrier has to meet its obligation, only that it must. Since 2006 the FCC has been explicit that one valid way is to authorize a Trusted Third Party to carry it. Here is what that means, what it does not mean, and how to decide.
A CALEA Trusted Third Party carries the obligation. You keep it.
A Trusted Third Party (TTP) is a company a carrier authorizes to carry out its CALEA obligations on its behalf: receiving and validating surveillance orders, provisioning the intercept on the carrier's network, mediating the traffic into the standard the agency requires, delivering it securely, and keeping the record. The FCC's 2006 Second Report and Order (FCC 06-56) permits carriers to use a TTP to meet their obligations — and says, in the same breath, that the carrier remains responsible for its own compliance.
That second sentence is the one to design around. Outsourcing the work does not outsource the obligation. It moves the expertise, the watch and the execution risk to people who do nothing else — which is exactly why the choice of TTP matters.
The decision, department by department.
Compliance is not a technology purchase. It touches five parts of a carrier at once, and each one has to be ready on the day an order arrives.
| Department | What in-house compliance requires | What a Trusted Third Party carries |
|---|---|---|
| Legal | Someone reads every order for authority, scope, target and dates — and knows the difference between a Title III, a pen-trap, a § 2703(d) order and a state order issued under a statute that permits only one of them. Defective orders are returned in writing with the defects noted. | Order validation is the first step of every engagement, run by people who do it every day. A defective order is returned to the requesting agency in writing with the defects noted. |
| Network planning | Which network element the intercept attaches to, for each technology in the estate — and what happens when the next acquisition adds another one. | The solution is engineered to the topology you actually run, and re-engineered when it changes. |
| Engineering and operations | Provisioning, mediation to the ATIS standard, a secured connection to each agency's monitoring facility, and the testing that proves the agency can read what arrives. | Provisioning, mediation, delivery and testing are operated for you; delivery is validated against the collection systems agencies actually deploy. |
| Security | The system security and integrity policies 47 CFR Part 1 Subpart Z requires, a senior officer reachable by law enforcement 24 hours a day, personnel with security experience, and the records of every interception. | The SSI plan, the 24-hour desk and the record are part of the service. The designated senior officer remains yours; the watch does not have to be. |
| Staffing | People available 24 hours a day, seven days a week, for an event that may not happen this year — and must be handled correctly the night it does. | A watch that is already staffed, across every client, for exactly that night. |
Five questions to ask any TTP — including us.
Who validates the order, and what happens when it is defective? An order with an error is not valid; the evidence it produces may be inadmissible; the carrier that implemented it carries the risk. The answer should be a person, a process, and a written return to the agency with the defects noted — what is missing, not legal advice on how to fix it.
Which standard is the intercept delivered to, and how is delivery tested? The safe harbor is the standard. Testing should be against the collection systems agencies actually use, not a simulator.
Who answers at three in the morning? Not a voicemail. A watch that is already staffed.
What record exists a year later? Which order, what it named, what was done, by whom, when it ended.
What else does the company do? Lawful compliance is the whole of Subsentio's business. It is the differentiator we would put first.
Trusted Third Parties, answered.
What is a CALEA Trusted Third Party?
A company a carrier authorizes to carry out its CALEA obligations on its behalf: receiving and validating orders, provisioning the intercept, mediating and delivering to the agency, and keeping the record. The FCC's 2006 Second Report and Order (FCC 06-56) expressly permits carriers to use a Trusted Third Party to meet their obligations. Subsentio is the largest CALEA Trusted Third Party in the United States.
Does using a TTP transfer the legal obligation?
No. The FCC was explicit that the carrier remains responsible for its own compliance. A TTP carries the work, the expertise, the watch and the record — and reduces the risk of an order being implemented wrongly — but the obligation stays with the carrier. Pick your Trusted Third Party accordingly.
What does self-compliance actually cost?
An equipment solution you buy, install, maintain and operate; a secured connection to every agency that may serve you; a system security and integrity policy; people with legal training to validate orders and people with security experience to manage them; records for every intercept; and staff available 24 hours a day for the receipt and management of an order. Most carriers do not have that expertise in-house and cannot economically build it for an obligation that arrives without warning.
How should a carrier choose a TTP?
Ask who validates the order and what happens when it is defective. Ask which standards the intercept is delivered to, how delivery is tested, and against what. Ask who answers at three in the morning, and what record exists a year later. Ask what else the company does — lawful compliance is the whole of Subsentio's business. And decide with counsel: the FCC permits the arrangement, and your obligation remains your own.
Can a TTP handle records production as well as intercepts?
Subsentio does. Subpoenas, court orders, warrants, preservation and exigent requests are validated and produced by the same compliance team that operates intercepts, on the same watch.
What is a trusted third party in telecom?
In telecom the term almost always means a CALEA Trusted Third Party: a company a carrier authorizes to carry its lawful-intercept and legal-process obligations on its behalf. The FCC recognized the arrangement in its 2006 order. A trusted third party for telecom compliance validates orders, provisions and delivers intercepts, produces records, and keeps the record — while the carrier remains responsible.
Pick your Trusted Third Party accordingly.
Bring us your network and your obligations. We will show you what the obligation requires of you, what we carry, and what stays yours — before you decide anything.