The Legal Line
Dear Ed:It is my understanding that this past May 15th the FCC required all common carriers and VoIP providers to comply with all CALEA requirements. I have read the order twice on the FCC’s website but I don’t really understand what this may mean for my company in terms of what we may have to do to comply. We use both TDM switches and VoIP systems on our international resale traffic network. We even have one switch still in use that is a dinosaur from 1999. Does all our equipment really need to be compliant?It could get pricey to be fully compliant and, quite frankly, I not sure if we currently have the budget to do it. I also understand from following the history of CALEA that there are several FCC regulatory filings on top of the equipment aspect. I have not seen these requirements in the May 2006 FCC order but am concerned that they may still apply. Where do I go to find out about CALEA compliance?Mich-CTODear MCTO:First of all, if you have any question about CALEA you must ask CALEA – or at least, www.AskCALEA.com, the foremost authority on CALEA. It’s a website that coordinates and disseminates information about compliance with CALEA. It also has several forums for law enforcement and carriers alike. I highly recommend that you visit the site, and better yet, join the Telecommunication Carriers Forum on the site to receive weekly updates on CALEA issues.As for your question, CALEA equipment compliance is straightforward, but the pivotal date to remember is January 1, 1995. Most switching equipment that was placed in service prior to January 1, 1995, is already deemed temporarily compliant with CALEA’s capability requirements pursuant to Section 109(d) of CALEA, also at 47 USC §1008(d). If you replace or upgrade this equipment then the replacement or upgrade must be fully CALEA compliant. Switching equipment - TDM, VoIP or otherwise, placed into service after January 1, 1995, must be fully CALEA-compliant by May 14, 2006, with the only the exception being if the carrier has a CALEA Section 109 extension granted by the FCC. This means your dinosaur must be compliant too.In a nutshell, being “CALEA compliant” means that, as a carrier, you meet the CALEA Section 103’s capability requirements, or alternatively, are compliant with the Telecommunications Industry Association’s (“TIA”) J-STD-025 Revision A document. The Section 103 requirements are available on the CALEA website. The TIA Revision is available at www.tiaonline.org. In addition, CALEA compliance requires that a carrier’s CALEA facilities include all CALEA elements prescribed to date so you will need to monitor this, as they will be developing. The CALEA website and the FCC’s website, www.fcc.gov/calea/ are the best sources for information on these requirements.Unlike other aspects of telecommunications, the FCC has somewhat of a limited authority and role in the CALEA compliance process, The FCC authority includes: •The authority to establish findings that identify telecommunications services that are subject to the requirements of CALEA which are not specifically detailed in the law.•The authority to require a telecommunications carrier to ensure that its equipment, facilities, or services that provide a customer or subscriber with the ability to originate terminate or direct communications, are capable of meeting the assistance capability requirements.•The authority to establish systems security and integrity regulations for carriers to follow.•The authority to establish by Rules, all technical requirements for CALEA, in the event a carrier petitions the Commission believing that the industry standard is deficient.•The authority, upon petition from a telecommunications carrier, to make determinations of reasonable achievability regarding the assistance capability requirements of Section 103 with respect to any equipment, facility, or service installed or deployed after January 1, 1995.In terms of “ FCC administrative requirements”, I think that you may be referring to the reporting requirements of SSI Plans and CALEA policies and procedures. These include rules requiring the following to be reported to the FCC:1. All common carriers must comply with CALEA’s capacity and capability requirements and must also comply with 47 C.F.R. §§64.2100 to 64.2106 of the Commission’s rules by filing with the Commission a Telecommunications Carrier Systems Security and Integrity Plan (“SSI Plan”).2. Resellers of local exchange services, both facilities-based and switchless, must also comply with these rules by filing an SSI Plan for the same reason.3. Providers of facilities-based broadband Internet access service and interconnected VoIP service must also file an initial Systems Security and Integrity Plan with the FCC.4. Telecommunications carriers must furthermore file with the Commission, information regarding the policies and procedures used for employee supervision and control, and to maintain secure and accurate records of each communications interception or access to call-identifying information.5. All entities providing facilities-based broadband Internet access or interconnected VoIP services (per the E-911 Order definition) must file monitoring reports with the Commission that briefly describe steps that they are taking to come into compliance with CALEA section 103 related to equipment and their networks.These are the requirements, and carriers in the prepaid industry must be prepared by May 14th 2007. I suggest if you think there is going to be a compliance issue due to technology, you should consult your legal counsel now to fire-up a CALEA Section 109 Petition, and get it before the FCC. By January and February of 2007, the FCC may be overwhelmed by such petitions. Likewise, be familiar with the actual requirements of CALEA; it is more than merely a technical standard for switches and networks. Speak with your regulatory counsel regarding your CALEA policies and procedures and have them in place by early 2007 to ensure no surprises at the last minute. Remember that the fine associated with being non-compliant is up to $5,000.00 per day, and that is a steep budget expense. Once your company’s upper management knows the consequence of non-compliance, it may outweigh your current budget constraints.Good Luck and Success in the Industry.Send your questions firstname.lastname@example.org.