Subject: [Raven] CALEA Applicability

From: "Richard Payne" <[email-masked]>
Date: Thu, 4 Nov 1999 21:20:36 -0500

In this post I focus purely on the U.S., specifically on CALEA and what it
does and does not mandate. I'm going to summarize information from a lot of
people's posts, so, if your name is not mentioned, please don't feel
slighted: I'm just trying to keep the length of this thing manageable.

A couple of days ago I asked if anyone who had anything approaching a proof
that CALEA applied to the Internet could send it along. My theory was that
it didn't, based on my reading of the definitions of Section 102.

No-one sent such a proof, but a number of people (you know who you are) sent
me and the rest of the list some very useful background information on how
this controversy got started, how people who do this for a living are
construing the law, and on how the FCC, which oversees U.S. telecoms, is
interpreting the law.

I will attempt to summarize four key elements of this material and my
understanding of their implications.

(A) Megaco's initial issue was, apparently, whether connecting voice over IP
(VoIP) to a public switched telephone network (PSTN) made the VoIP provider
subject to CALEA-type requirements. This seems to me to be a considerably
narrower issue than whether Internet protocols, in general, require
tappability, because the PSTN is already presumably CALEA-compliant. Why
would you need to spy on the IP side?

(B) The FCC's take on the issue of information service providers, as
expressed in their publication 99-229 (Second Report and Order), is as
follows. Page 8, quoting the legislative history of CALEA:

"Also excluded from coverage are all information services, such as Internet
service providers or services such as Prodigy or America-On-Line. All of
these private network systems or information services can be wiretapped
pursuant to court order, and their owners must cooperate when presented with
a wiretap order, but these services and systems do not need to be designed
so as to comply with the capability requirements."

And on page 15, in the Commission's own words:

"Commenters unanimously agree with our tentative conclusion that providers
that exclusively offer information services (IS) (i.e. that do not also
offer telecommunication services), such as electronic mail providers and
on-line service providers, are exempt from CALEA's requirements."

So far so good...

(C) The FCC's take on the issue of telecoms providing information services
(which a logical person might suppose would be exempted from CALEA
compliance by the actual words of the statute):

"Where facilities are used to provide both telecommunications and
information services, however, such joint-use facilities are subject to
CALEA in order to ensure the ability to surveil the telecommunications
services. For example, digital subscriber line (DSL) services are generally
offered as tariffed telecommunication services, and therefore subject to
CALEA, even though the DSL offering often would be used in the provision of
information services."

This reasoning makes no sense to me, given that the voice stream for DSL
could be tapped without tapping the data stream, and that the statute
explicitly exempts information services. Also, what _would_ people use DSL
for besides data services? Slow TV, perhaps? Bat squeaks? Also, nice use of
the verb "surveil".

(D) Chris Savage helpfully noted a day or two ago that the FCC had pushed
back requirements for CALEA compliance for packet-mode communications to
September 2001.

****************************************************************************

So what can we conclude from these facts, and what does all this have to do
with the IETF? I offer these tentative conclusions:

First, if the issue is whether VoIP requires tappability merely because it's
connected to a PSTN, then it seems to me to make little sense for the IETF
to start messing with the IP side until it's clear that the PSTN side isn't
providing good enough CALEA compliance. This conclusion is independent of
whether or not CALEA is a "good thing" by somebody's lights: it follows from
not solving non-problems.

Second, the claim that CALEA applies to the Internet as a whole is pretty
clearly false. It doesn't apply to ISP's, for example, and certainly not to
end-users. Therefore, any argument along the lines of "the IETF has to
develop a tap standard because CALEA is the law of the Internet already, and
you wouldn't want to be civilly disobedient" is wrong.

Third, the claim that VoIP _has to be_ tappable in order to comply with
CALEA may or may not be true, depending on who's offering the service and
how, but certainly won't be true until September 2001 at the earliest.
Therefore, any argument along the lines of "the Internet has to be
CALEA-tappable because VoIP is legally required to be" is, unless there's a
few other provisos attached, wrong.

Fourth, as noted above, it seems extremely unlikely that CALEA could ever be
argued to apply to ISP's or end-users' computers, even if the end-users were
using their microphones to talk. Presumably that's what CESA's for.
Therefore, use of end-to-end encryption for security, either end-user to
end-user or ISP-to-ISP (preferably both), is not inconsistent with CALEA,
and any argument along the lines of "we've got to weaken existing protocols
in order to comply with CALEA" is wrong.

Fifth, and most obviously, if you really want to achieve secure
communications, you must encrypt your information before it hits a telecom
and decrypt it only after it has left the telecom. Even data services
provided by telecoms, which a plain reading of CALEA would suppose to be
exempt as information services, are captured by CALEA in the FCC's view. The
FCC's reasoning about DSL (quoted above) seems both incorrect and
disturbing: they appear to be ignoring the plain wording of the statute and
handing cable companies a marketing opportunity on a silver platter.

I think these implications make it fairly clear what position the IETF
should take on facilitating tapping. The only halfway-good argument we've
seen on this list for building tapping into standards ("we have to do it
because it's the law") is wrong. Therefore the IETF should not facilitate
tapping.

****************************************************************************

If anybody believes that I've made a mistake in either the facts or
conclusions, please let me know. People on this list tend not to be too shy
about that anyway.

Richard Payne

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: Chris Savage <[email-masked]>
Date: Fri, 5 Nov 1999 11:52:13 -0500

Richard Payne said:

>(C) The FCC's take on the issue of telecoms providing 
>information services which a logical person might
>suppose would be exempted from CALEA
>information services, however, such joint-use facilities are 
>subject to CALEA in order to ensure the ability to surveil the
>telecommunications services. For example, digital subscriber line
>(DSL) services are generally offered as tariffed telecommunication
>services, and therefore subject to CALEA, even though the DSL
>offering often would be used in the provision of information services."
> 
>This reasoning makes no sense to me, given that the voice 
>stream for DSL could be tapped without tapping the data stream,
>and that the statute explicitly exempts information services. Also,
>what _would_ people use DSL for besides data services? Slow TV,
>perhaps? Bat squeaks? Also, nice use of the verb "surveil".

IMHO the FCC got this right.  The FCC views US law (correctly, I think) as
drawing a bright line between "telecommunications carriers" and providers of
"information services."  This obviously can get murky in particular cases,
but it provides a clean basis for the FCC to say, for example, that it can't
and won't regulate those on the "information services" side of the line.

But information services of the sort we care about are delivered, one way or
another, via telecommunications.  So the ISP is an information service
provider, but the telco that provides a high-speed line (DSL, T1, whatever)
between the end user and the ISP is acting as a carrier.  As such, it is
subject to CALEA with regard to its activities as such.

This just means, ISTM, that just as a LEA with a proper warrant can tap a
plain old voice-grade phone line and record the modem signaling going from
the end user's computer to the ISP and back, a LEA with a proper warrant can
tap a souped-up phone line and record the DSL-modem signaling going from the
end user's computer and back.  The rules for packet-mode are messier, as the
FCC found, but the idea that a telco is acting as a carrier (not an
information services provider) when it sells DSL to customers is, ISTM,
clearly right.  And being a "carrier" is what subjects you to CALEA.

Christopher W. Savage
Cole, Raywid & Braverman, L.L.P.
1919 Penn. Ave. N.W., Suite 200, Washington, D.C. 20006
voice: 202-828-9811	fax: 202-452-0067	

*************************************************************************** 
This electronic mail transmission may contain confidential or 
privileged information.  If you believe that you have received the 
message in error, please notify the sender by reply transmission 
and delete the message without copying or disclosing it. 
***************************************************************************