Uncategorized —

The FCC’s battle with universities and libraries over VoIP and data wiretapping continues

The FCC recently rebuffed calls from universities and libraries for relief …

On Wednesday, the FCC rebuffed calls from universities and libraries for both exemptions from the federal wiretapping rules that are now being applied to the Internet and for extensions to the May 14, 2007 deadline that ISPs have for compliance with those rules. As far as can we can tell from the two-page summary that has been released, the FCC's new order on the application of the Communications Assistance for Law Enforcement Act (CALEA) to facilities-based broadband service providers contains the following three provisions, among others:

First, the new order contains a re-affirmation of the May 14, 2007 deadline for bringing every ISP's network—including the networks of universities and public libraries—into compliance with CALEA. The specifics of what the FCC means by "compliance" are still being debated, but in general the feds want the capability to perform "wiretaps" on VoIP and other broadband traffic that moves through an ISP and onto the "public Internet." Note that there's an exemption made for calls between two endpoints on a private network, where none of the call traffic leaves that network.

The order also includes a provision for ISPs to use so-called Trusted Third Parties (TTP) for the purposes of compliance. While the commissioners themselves in their public statements have emphasized TTPs as the answer to most of the cost-based objections raised by universities, the summary's TTP language doesn't seem very clear and I haven't seen it discussed in the other reporting on this ruling. The TTP provision appears to a way for universities to route all of their non-local VoIP traffic through a third-party network that's already fitted out with the appropriate, fed-friendly snooping hardware. This would allegedly keep ISPs from having to foot the bill for installing such hardware themselves.

Finally, the order seems to affirm that it will indeed fall to the universities and other ISPs themselves to foot the bill for bringing their data networks up to spec with federal wiretapping standards.

Cost is key to objections

As I noted in my previous post, "CALEA creep, and the networked costs of federal snooping," the costs of installing new snooping technology (both hardware and software) into old networks are a key part of universities' objections to the extension of CALEA to their broadband traffic.

It's still not clear how much CALEA compliance will cost universities, and the estimates vary wildly depending on who you listen to: from a few hundred dollars per student (per some university estimates) to around US$0.01 per student when a TTP is used (per would-be TTP estimates submitted to the government and reproduced in Commissioner Tate's statement).

Part of the uncertainty arises from the lack of technical clarity in the mandates; it's still not clear exactly how schools will have to modify their networks to comply with the order. As part of an the ongoing legal battle over CALEA's fundamental (in)applicability to broadband data services, the FCC has filed a brief in D.C. Circuit court claiming that necessary modifications will be minimal, since only the pipe(s) connecting the private network to the outside world will have to be tapped. For their part, the universities argue that this isn't necessarily the case, and that once law enforcement has its jack-booted foot in the door it will not be content to stay on the edge of the network, but will want to move further on campus with the traffic monitoring.

The FCC has a long court battle ahead of it

Wednesday's order is by no means the last word on this issue, because if the FCC's ruling is going to hold, it'll have to stand up to a ton of scrutiny from the courts. So far, things don't look good for the commission.

In the CNET coverage of Wednesday's ruling, McCullagh and Broache cite Congress's explicit guidance from 1994 to the effect that CALEA does not apply to ISPs. The FCC, for its part, disagrees and wants to argue that CALEA is "technology-neutral."

How the FCC can possibly maintain this "technology-neutral" assertion is beyond me, because the whole point of CALEA's initial passage was to bring existing wiretapping legislation up-to-date with what were then new technologies like conference calling. Instead of pressuring the FCC to do creative allegorical exegesis of the CALEA statute, perhaps law enforcement should focus on getting a new round of technologically current wiretap legislation passed. Y'know, the good old democratic process and all that. Then maybe we could have a real debate on the value, or lack thereof, of extending wiretapping rules to the Internet. (See the addendum below for more on this point.)

Apparently, I'm not the only one who finds the FCC's "technology-neutral" argument laughably illogical. Today the D.C. Circuit Court of Appeals heard oral arguments against the FCC's rulings by the EFF and its allies in American Council on Education v. FCC. This case represents another, potentially successful front in the battle against what I've elsewhere called "CALEA creep" , and so far the fight appears to be going well. According to a hot-off-the-wires report, the judge is laughing at and ridiculing the arguments made by the FCC's lawyers.

As long as the courts stick to the plain language of the statute and with the additional guidance given by Congress, the FCC's orders won't stand and law enforcement will be forced to try the aforementioned legislative route for getting what they want.

Addendum: Is the extension of CALEA to VoIP and data services really necessary?

Probably not. As the EFF has pointed out, the feds already have the authority to snoop VoIP calls and other broadband communications, with a proper warrant. Right now, the feds can go into a university where there's suspected terrorist and/or criminal use of computer facilities and set up all sorts of snooping devices—keystroke loggers, traffic monitoring hardware, hidden cameras, and the whole nine yards. What they cannot yet do is set up a VoIP tap from the comfort of D.C. or Langley with the click of a mouse. So what law enforcement really wants, and what the FCC apparently wants to grant, is the ability to easily tap communications from a remote location.

Law enforcement likes the remote tapping capabilities that CALEA already affords for regular phone calls for a number of reasons, only a few of which have to do with convenience. Specifically, if you want to use technologies of mass surveillance (TMS) to set up a massive information vacuum, then you've got to be certain that you're getting all the traffic. Expanding CALEA to ISP data traffic will make it much easier for the feds to incorporate VoIP calls into the NSA's existing domestic spying program, and it will also improve the reach and efficiency of the various Big Data Mining and Monitoring Operation in the Sky-type programs, like Carnivore and the sundry iterations of Total Information Awareness (TIA).

You must to comment.

Channel Ars Technica