CALEA Capability Order (2006)
If the 2005 order said who is covered, this one said what covered means: a deadline, a filing, a report, and — for the first time in writing — permission to hand the whole obligation to a Trusted Third Party.
CALEA and Broadband Access and Services — Second Report and Order and Memorandum Opinion and Order
The CALEA Capability Order clarified the obligations of all CALEA-covered entities, including providers of broadband Internet access and VoIP. It permitted covered carriers to meet their compliance obligations either by developing technical solutions with their equipment vendors or by contracting with a "trusted third party" provider of CALEA solutions — the arrangement Subsentio operates for its customers.
It set a compliance deadline of May 14, 2007 for covered broadband and VoIP providers, restricted compliance extensions to equipment, facilities and services deployed before October 25, 1998, and required covered providers to file interim "monitoring reports" declaring their compliance strategies and timeframes. It gave carriers 90 days to file their system security and integrity (SSI) policies with the Commission — the document that summarizes a carrier's CALEA compliance program and gives law enforcement the carrier's point of contact.
On cost, the order concluded that carriers are responsible for CALEA development and implementation costs for post-January 1, 1995 equipment and facilities, declined to adopt a national surcharge, and held that costs not eligible for the Congressionally appropriated compliance fund must be absorbed as a cost of doing business or recovered from subscribers — never shifted to law enforcement through the rates charged for intercept assistance. It also found that the Commission may take separate enforcement action under section 229(a) of the Communications Act, in addition to the remedies available to law enforcement through the courts.
The parts that matter to a provider.
Trusted Third Parties
A carrier may use a TTP to assist in meeting its CALEA obligations. The carrier remains responsible for compliance; the TTP carries the work — validation, provisioning, delivery, the record.
May 14, 2007
The compliance deadline for facilities-based broadband Internet access and interconnected VoIP providers, affirmed against requests for delay.
SSI policies and monitoring reports
Carriers were given 90 days to come into compliance with the system security requirements and to file their SSI policies; broadband and VoIP providers were required to file interim monitoring reports on their path to compliance.
Who pays
Carriers bear CALEA costs for post-1995 equipment. No national surcharge. Costs may be absorbed or recovered from subscribers, not passed to law enforcement.
Extensions narrowed
Compliance extensions under § 107(c) are limited to equipment, facilities and services deployed before October 25, 1998.
Does this apply to you?
Every CALEA-covered carrier, and in particular the broadband and VoIP providers brought inside the statute in 2005 — this is the order that told them when, how and at whose expense.
CALEA Capability Order (2006), answered.
What is a system security and integrity (SSI) plan?
The policies and procedures a carrier files with the FCC under 47 CFR § 1.20005 describing how it supervises and controls interceptions: who may authorize one, what counts as appropriate legal and carrier authorization, how records are kept, and a senior officer law enforcement can reach 24 hours a day. It must be filed before commencing service and updated within 90 days of a merger, divestiture or change of policy — since June 2023, through the CALEA Electronic Filing System.
Did the order let carriers pass CALEA costs to law enforcement?
No. The order held that costs not covered by the compliance fund are a cost of doing business or may be recovered from subscribers, but may not be shifted to law enforcement agencies through the rates charged for lawful intercept assistance.
Second Report and Order, FCC 06-56
Hosted in full by Subsentio. Opens in a new tab.
Other primary documents.
CALEA Act of 1994
What CALEA (1994) requires, section by section — definitions, capability, security, safe harbor, enforcement — with the full text to download.
CALEA Broadband Coverage Order (2005)
The 2005 FCC order that extended CALEA to facilities-based broadband and interconnected VoIP providers — what it decided, why, and what it left open.
ECPA (1986)
What ECPA did: extended the Wiretap Act to electronic communications and created the Pen Register Act and the Stored Communications Act — the tiers of process.
The Wiretap Act (1968)
The 1968 statute behind every Title III order: a general prohibition on intercepting communications, with a court-supervised exception on probable cause.
FISA (1978)
What FISA authorizes — foreign-intelligence surveillance of foreign powers and their agents under the FISA court — and what a FISA order means for a carrier.
USA PATRIOT Act (2001)
What the USA PATRIOT Act changed for communications providers: FISA, the pen-register statute, the Stored Communications Act and emergency disclosure.