CALEA Act of 1994
The statute everything else on this site refers back to. Ten operative sections, written for the telephone network of 1994 and stretched over every network since. Here is what each one does, and the full text at the bottom.
The Communications Assistance for Law Enforcement Act of 1994 (CALEA)
CALEA is an act of Congress that requires telecommunications carriers to install technical capabilities in their networks so they can implement court orders for lawful electronic surveillance. It also requires that the public-safety goal of the statute be achieved in a manner that protects the privacy of telecommunications customers and leaves carriers free to launch commercial technologies and services.
Its reach was set in 1994 and extended in 2005, when the FCC found that facilities-based broadband Internet access providers and interconnected VoIP providers fall within the statute's own definition of "telecommunications carrier" — a definition deliberately broader than the one in the Communications Act, because it contains a "substantial replacement" provision.
The parts that matter to a provider.
§ 102 · Definitions
Defines the terms that guide the implementation of the statute — "telecommunications carrier," "call-identifying information" and "information services" among them. The carrier definition includes any entity the FCC finds is providing a replacement for a substantial portion of local exchange service.
§ 103 · Assistance capability requirements
The technical capabilities a covered carrier must be able to deliver to law enforcement when served with a court order: isolating and delivering a named subscriber's communications and call-identifying information, expeditiously and unobtrusively, in a format the agency can use, without touching anyone else's traffic.
§ 104 · Notice of capacity requirements
The Attorney General's notice to the industry of the number of intercepts law enforcement may need to run simultaneously on different network types in different markets.
§ 105 · System security and integrity
The privacy backstop: an interception may be activated only under a court order or other lawful authorization, and only with the affirmative intervention of an individual officer or employee of the carrier. The FCC's Part 1 Subpart Z rules on policies, records and the SSI plan implement this section.
§ 106 · Cooperation of equipment manufacturers
Manufacturers and providers of telecommunications support services must make the features and modifications a carrier needs available on a reasonably timely basis and at a reasonable charge.
§ 107 · Technical requirements and standards; safe harbor
A carrier may build its own solution or conform to the publicly available standards of an industry association or standard-setting body. A carrier in compliance with such a standard "shall be found to be in compliance" with § 103 — the safe harbor. The absence of a standard does not relieve the obligation.
§ 108 · Enforcement orders
A court may direct a carrier to comply and, under 18 U.S.C. § 2522, impose civil penalties of up to $10,000 a day for non-compliance — unless compliance is "not reasonably achievable" or alternative technologies are reasonably available to law enforcement.
§ 109 · Payment of costs
If a carrier shows the FCC that compliance is not reasonably achievable, the Attorney General may pay the reasonable costs of the upgrade — or the carrier is deemed in compliance without it.
§ 110 · Authorization of appropriations
Congress authorized $500,000,000 (fiscal years 1995–1998) to reimburse the industry for bringing equipment installed or deployed on or before January 1, 1995 into compliance.
Does this apply to you?
Telecommunications carriers as CALEA defines them: common carriers, commercial mobile service providers, and any entity the FCC finds provides a replacement for a substantial portion of local exchange service — which, since 2005, includes facilities-based broadband Internet access providers and interconnected VoIP providers. Information services and private networks are outside it.
CALEA Act of 1994, answered.
Who does CALEA apply to?
Telecommunications carriers as CALEA itself defines them — common carriers, commercial mobile service providers, and any entity the FCC finds provides a replacement for a substantial portion of local exchange service. The FCC applied that last category to facilities-based broadband Internet access and interconnected VoIP providers in 2005.
What does "safe harbor" mean in CALEA?
Section 107(a)(2): a carrier that is in compliance with publicly available technical requirements or standards adopted by an industry association or standard-setting organization "shall be found to be in compliance" with the § 103 capability requirements. Building to the applicable standard is the safe harbor.
Does CALEA require a carrier to decrypt communications?
No. A carrier is not responsible for decrypting, or ensuring the government's ability to decrypt, a communication encrypted by a subscriber unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt it (§ 103(b)(3)).
CALEA, full text
Hosted in full by Subsentio. Opens in a new tab.
Other primary documents.
CALEA Broadband Coverage Order (2005)
The 2005 FCC order that extended CALEA to facilities-based broadband and interconnected VoIP providers — what it decided, why, and what it left open.
CALEA Capability Order (2006)
The 2006 FCC order that set the May 14, 2007 deadline, permitted Trusted Third Parties, required SSI filings and monitoring reports, and settled who pays.
ECPA (1986)
What ECPA did: extended the Wiretap Act to electronic communications and created the Pen Register Act and the Stored Communications Act — the tiers of process.
The Wiretap Act (1968)
The 1968 statute behind every Title III order: a general prohibition on intercepting communications, with a court-supervised exception on probable cause.
FISA (1978)
What FISA authorizes — foreign-intelligence surveillance of foreign powers and their agents under the FISA court — and what a FISA order means for a carrier.
USA PATRIOT Act (2001)
What the USA PATRIOT Act changed for communications providers: FISA, the pen-register statute, the Stored Communications Act and emergency disclosure.