CALEA compliance, answered.

The Communications Assistance for Law Enforcement Act (CALEA) is a 1994 statute requiring telecommunications carriers to give law enforcement certain technical capabilities when they conduct a lawful electronic surveillance — a lawful intercept — on a network. A 2005 FCC order extended CALEA to two-way interconnected VoIP and facilities-based broadband Internet access. Its goal is to preserve lawful-intercept capability as networks evolve, while protecting subscriber privacy.

CALEA applies to “telecommunications carriers” — any entity engaged in transmitting or switching electronic communications to the public for hire. That includes wireline and wireless providers, facilities-based broadband Internet access, and two-way interconnected VoIP.

Generally yes. Facilities-based providers of broadband Internet access to the public are covered by CALEA and need a compliant lawful-intercept capability like any other carrier. (Private networks — and entities acting purely as information services — are carved out, but a facilities-based ISP serving paying subscribers on the public Internet is subject to the statute.)

When served with a court order for lawful surveillance, a carrier’s network must be able to isolate the communications of the suspect named in the order and deliver those communications to the law-enforcement agency named in the order — without touching anyone else’s traffic.

Install a technical solution that delivers the capabilities in CALEA Section 103 — the suspect’s call content and call-identifying information. If the solution conforms to a published industry “safe harbor” standard, the carrier is deemed presumptively compliant. Most carriers meet this obligation by outsourcing to a trusted third party.

A CALEA trusted third party — such as Subsentio, Inc. — provides CALEA compliance on an outsourced basis. The FCC has formally recognized complying through TTPs, and carriers of all sizes use them nationwide. A TTP bundles the technical solution with the compliance program and spreads cost across a national client base, making compliance cost-effective and letting carriers focus on their core business.

CALEA requires carriers to establish privacy and security protocols so lawful intercepts aren’t compromised. The FCC requires these to be filed as a “system security and integrity report.”

Yes. If a carrier can’t meet a lawful-intercept court order because it lacks the required CALEA capabilities, a court may order the network brought into compliance by a set deadline and — for each day of violation after that enforcement order — impose a civil penalty of up to $10,000 per day (CALEA §108).

Generally no — carriers bear the cost of CALEA equipment installed after January 1, 1995. The narrow exception: a carrier may petition and the government may pay if the FCC determines that compliance is “not reasonably achievable” (CALEA §109).

Most switch manufacturers build lawful-intercept software into their equipment — but that software alone does not make a network compliant. The carrier typically also needs a mediation device to direct that software to capture and re-route a named suspect’s traffic, and should test the solution periodically as the network changes.

A lawful intercept is a court-authorized investigative technique that monitors a suspect’s real-time communications — the numbers dialed and their times/dates/durations, or, under a full-content (wiretap) order, the content of calls and, for IP communications, broadband Internet sessions.

First the carrier or its trusted third party reviews the order for validity and returns it for correction if it contains an error. Once validated: arrange connectivity to the authorized agency, activate the CALEA solution, deliver the required capabilities, and deactivate at the court-ordered termination date — plus the privacy, security and FCC recordkeeping tasks around it.

At every stage. Standards limit solutions to only the data Section 103 requires; carriers must confirm a court order is properly authorized before implementing it; the solution can be activated only by the carrier’s appointed officer; the carrier controls what data is sent; and it deactivates at the ordered end date absent a timely renewal.

An intercept order (a “wiretap” or Title III order) authorizes real-time monitoring of communications and generally requires probable cause from a judge; it typically lasts 30–60 days and needs a technical CALEA solution. A subpoena is a weaker instrument that collects historic records (like past billing), meets a “relevance” standard, and can often be fulfilled without a technical intercept.