CALEA compliance, answered.

The Communications Assistance for Law Enforcement Act (CALEA) is a 1994 statute requiring telecommunications carriers to give law enforcement certain technical capabilities when they conduct a lawful electronic surveillance — a lawful intercept — on a network. A 2005 FCC order extended CALEA to two-way interconnected VoIP and facilities-based broadband Internet access. Its goal is to preserve lawful-intercept capability as networks evolve, while protecting subscriber privacy.

CALEA applies to “telecommunications carriers” — any entity engaged in transmitting or switching electronic communications to the public for hire. That includes wireline and wireless providers, facilities-based broadband Internet access, and two-way interconnected VoIP.

Generally yes. Facilities-based providers of broadband Internet access to the public are covered by CALEA and need a compliant lawful-intercept capability like any other carrier. (Private networks — and entities acting purely as information services — are carved out, but a facilities-based ISP serving paying subscribers on the public Internet is subject to the statute.)

When served with a court order for lawful surveillance, a carrier’s network must be able to isolate the communications of the suspect named in the order and deliver those communications to the law-enforcement agency named in the order — without touching anyone else’s traffic.

Install a technical solution that delivers the capabilities in CALEA Section 103 — the suspect’s call content and call-identifying information. If the solution conforms to a published industry “safe harbor” standard, the carrier is deemed presumptively compliant. Most carriers meet this obligation by outsourcing to a trusted third party.

A CALEA trusted third party — such as Subsentio, Inc. — provides CALEA compliance on an outsourced basis. The FCC has formally recognized complying through TTPs, and carriers of all sizes use them nationwide. A TTP bundles the technical solution with the compliance program and spreads cost across a national client base, making compliance cost-effective and letting carriers focus on their core business.

CALEA requires carriers to establish privacy and security protocols so lawful intercepts aren’t compromised. The FCC requires these to be filed as a “system security and integrity report.”

Yes. If a carrier can’t meet a lawful-intercept court order because it lacks the required CALEA capabilities, a court may order the network brought into compliance by a set deadline and — for each day of violation after that enforcement order — impose a civil penalty of up to $10,000 per day (CALEA §108).

Generally no — carriers bear the cost of CALEA equipment installed after January 1, 1995. The narrow exception: a carrier may petition and the government may pay if the FCC determines that compliance is “not reasonably achievable” (CALEA §109).

Most switch manufacturers build lawful-intercept software into their equipment — but that software alone does not make a network compliant. The carrier typically also needs a mediation device to direct that software to capture and re-route a named suspect’s traffic, and should test the solution periodically as the network changes.

A lawful intercept is a court-authorized investigative technique that monitors a suspect’s real-time communications — the numbers dialed and their times/dates/durations, or, under a full-content (wiretap) order, the content of calls and, for IP communications, broadband Internet sessions.

First the carrier or its trusted third party reviews the order for validity and returns it for correction if it contains an error. Once validated: arrange connectivity to the authorized agency, activate the CALEA solution, deliver the required capabilities, and deactivate at the court-ordered termination date — plus the privacy, security and FCC recordkeeping tasks around it.

At every stage. Standards limit solutions to only the data Section 103 requires; carriers must confirm a court order is properly authorized before implementing it; the solution can be activated only by the carrier’s appointed officer; the carrier controls what data is sent; and it deactivates at the ordered end date absent a timely renewal.

An intercept order (a “wiretap” or Title III order) authorizes real-time monitoring of communications and generally requires probable cause from a judge; it typically lasts 30–60 days and needs a technical CALEA solution. A subpoena is a weaker instrument that collects historic records (like past billing), meets a “relevance” standard, and can often be fulfilled without a technical intercept.

Having, and being able to operate, the capabilities the Communications Assistance for Law Enforcement Act requires: isolating a named subscriber's communications and call-identifying information under a court order, delivering them to the agency in the required standard, keeping the records and policies the FCC's rules require, and doing all of it without touching anyone else's traffic. It is a capability you run, not a product you buy.

Telecommunications carriers as CALEA defines them — common carriers, commercial mobile providers, and, since the FCC's 2005 order, facilities-based broadband Internet access providers and interconnected VoIP providers — plus the resellers and MVNOs whose service rides on them. If you sell communications service to the public and it reaches the PSTN or the Internet, assume you need it and confirm the exception rather than the rule.

Four, in order. Confirm coverage for each service you sell. Stand up the intercept capability, engineered to the safe-harbor standard for your network type (ATIS in the United States). File the system security and integrity plan with the FCC before commencing service and designate the senior officer law enforcement can reach 24 hours a day. Then operate it: validate every order, provision, deliver, record, terminate — or authorize a Trusted Third Party to carry that work.

Section 103 sets the assistance-capability requirements: expeditiously isolate and deliver a subscriber's communications and call-identifying information, in a format the agency can use, unobtrusively, without compromising anyone else's privacy. Section 105 adds the security requirement that an intercept can be activated only under lawful authorization and with the affirmative intervention of the carrier's own personnel. The FCC's rules in 47 CFR Part 1, Subpart Z turn § 105 into the SSI plan, the senior-officer designation and the record-keeping duty.

The statute is 47 U.S.C. §§ 1001–1010. The FCC's implementing regulations are 47 CFR Part 1, Subpart Z (§§ 1.20000–1.20008): definitions, policies and procedures for employee supervision (§ 1.20003), records (§ 1.20004), submission of the SSI plan (§ 1.20005), the assistance-capability rule (§ 1.20006), extensions (§ 1.20007) and enforcement (§ 1.20008). The 2005 and 2006 FCC orders that extended CALEA to broadband and VoIP sit alongside them.

Yes. CALEA is the Communications Assistance for Law Enforcement Act, so "CALEA Act compliance" and "CALEA compliance" name the same obligation. People also search it as lawful intercept compliance, which is the capability the Act requires.

It depends on the network and on how it is done. In-house, the cost is an intercept solution to buy, install and maintain; a secured connection to every agency that may serve you; the SSI policies; people with legal training to validate orders and security experience to manage them; and staff on call 24 hours a day for an event that arrives without warning. A Trusted Third Party turns most of that into a predictable service. Subsentio's free technical analysis produces a specific figure for a specific network; we do not quote a generic one.

Three kinds of company: equipment and software vendors, who sell the intercept technology; consultants, who advise; and Trusted Third Parties, who operate the whole obligation — validation, provisioning, delivery, the record — on the carrier's behalf under an arrangement the FCC expressly permits. Subsentio is a CALEA compliance company of the third kind, and the largest CALEA Trusted Third Party in the United States.

Ask five questions. Who validates the order and what happens when it is defective? Which standard is the intercept delivered to, and how is delivery tested — against a real collection system or a simulator? Who answers at three in the morning? What record exists a year later? And what else does the company do — lawful compliance is the whole of Subsentio's business. Then decide with counsel; the obligation stays yours whoever carries the work.

There is no certifying body and no CALEA certificate. What the statute offers instead is the § 107 safe harbor: a carrier in compliance with the publicly available industry standard for its network "shall be found to be in compliance." The closest thing to certification is a documented compliance analysis showing the capability actually delivers what an agency's collection system can read.

Lawful intercept vs CALEA is capability versus statute. Lawful intercept is the capability — isolating and delivering a named subscriber's communications in real time under a court order. CALEA is the statute that requires U.S. carriers to have that capability ready. Outside the United States the capability goes by the same name under each country's own statute; CALEA itself applies only in the U.S.

The searches "FBI CALEA" and "DOJ CALEA" point at two different roles. Under the statute, the Attorney General issues the capacity notices of § 104, pays the costs § 109 provides for, and may apply to a court for an enforcement order under § 108. The FBI supports law enforcement's use of lawful intercept — today largely through the National Domestic Communications Assistance Center (NDCAC), which publishes technical and standards guidance for agencies and carriers. The FCC administers the rules in 47 CFR Part 1, Subpart Z, including the SSI plan filings.

Subsentio acquired it. In June 2015 Subsentio announced the acquisition of Neustar's lawful intercept business, bringing its customers and operations into Subsentio's compliance operation. Providers who once contracted with Neustar for CALEA are Subsentio customers today.

The same obligation as any other carrier, applied to a facilities-based broadband network: an intercept capability engineered to the ATIS Internet-access standard, the SSI plan and senior-officer designation, and the operating discipline to validate, provision, deliver, record and terminate an order. Subsentio serves ISPs from the smallest WISP to regional fiber networks, and the obligation does not shrink with the subscriber count.