Shifting the cost of surveillance
Remember CALEA? In a brief, pious open meeting on Wednesday, the FCC said that the costs of making wiretapping easy for law enforcement should be shifted to everyone other than law enforcement. There's an argument in the D.C. Circuit about this on Friday, and we'll see whether the FCC had any legal basis to take this step.
Background. Back in August of 2005, the FCC issued an order that said that CALEA required all broadband providers and “interconnected VoIP” providers to make their services easily tappable by law enforcement. Lots of problems:
1. The 1994 CALEA statute expressly, vividly, and intentionally excluded “information services” from its coverage. The FCC has taken the view that broadband provision is an “information service,” and that online applications are “information services.” The August 2005 order's legal argument (charitably described as a “stretch” by Commr. Copps on Wednesday) is that CALEA's facial exclusion of “information services” can be ignored because these new services are “substantial replacements” for phone service. The D.C. Circuit case (see CDT page here) focuses on the weakness of this argument.
2. The August 2005 order said that these new actors had to comply with CALEA (making their services easily tappable by law enforcement) by May 2007. A big catch: the order didn't say what compliance meant. Law enforcement filings made clear that they wanted to deal with compliance via “deficiency” proceedings — in other words, “you go ahead and invest in your new businesses, and if we don't think what you've done is compliant, we'll make you retrofit your application to our desires or just take it down.” The threat to innovators is clear: you should go talk to law enforcement first, before you launch, so that they don't bring you down later. You should ask permission.
3. The August 2005 order also made clear that the Commission planned to extend the reach of CALEA to other services (like all VoIP services, whether or not they're capable of connection to the public telephone network), and to require that all devices running VoIP be “location-aware” — capable of telling law enforcement where they're being used.
What happened on Wednesday. On Wednesday morning, the FCC met in public session. No comments from the floor are allowed, and the FCC doesn't issue the actual order until later. So what you get are Commissioners reading their comments on a yet-to-be-issued order. Each one of the Commissioners said about the same thing (save for the Copps quip about the legal weakness of the FCC's reading of CALEA):
1. FCC's support of law enforcement and Homeland Security goals is primary, and the primary goal of the Order is to ensure that law enforcement agencies have everything they need. Each Commissioner solemnly emphasized the key Homeland Security goals of the FCC (”our highest calling” in the words of Commr. Adelstein). (Prediction: someday FCC will be part of DHS.)
2. We're not going to extend the May 2007 deadline for anyone.
3. We're not going to tell you what compliance means — we'll rely on standard-setting activities to do that. (My understanding is that these standards activities are not well advanced — and there are many hard questions to be answered. What, for example, is “call identifying information” online?)
4. Everyone can use “trusted third parties” (also called TTPs by Commissioners. The FCC loves acronyms) to comply with CALEA. This will reduce costs.
5. Speaking of costs, although the 1994 CALEA statute called for carriers to be paid back for their costs of compliance, we will not be doing any of that. All covered entities (including, potentially, free VoIP services) will be responsible for their own costs of compliance. (Commr. Tate said that these costs are “speculative” and can't outweigh the requirements of national security.)
Then they all voted in favor of the order.
What this means. This is a very big step that won't get as much attention as the Net Neutrality fight. But it's very related to that fight, and very important. What's going on here is that the FCC is independently reading a statute that embodied a particular Congressional undertaking (”we won't design the internet for the needs of law enforcement”) to mean the opposite (”we will design the internet for the needs of law enforcement”). And the costs of making data look familiar to law enforcement, so that they can stay comfortable in their telephony-based understandings, may be enormous.
There are costs to innovation — having to ask permission before launching a new service. There are costs to privacy — having to design everything to have a back door for law enforcement. And there will be powerful intermediaries (the Trusted Third Parties) with whom everyone will have to deal, who will have no constitutional limitations on their actions. There is no principled limit to what the FCC feels it can do in the name of assisting law enforcement.