Scope of the CALEA Order (II)
Yesterday's post prompted a message saying, “What do you mean, private networks?”
In response to the first CALEA order last summer, the American Council on Education and many other entities and groups argued strenuously that imposing CALEA compliance on internal school networks would cost an enormous amount of money (and clearly was not contemplated by Congress in 1994).
The education groups had very strong statutory arguments on their side. In CALEA, Congress exempted [look at (b)(2)(B)] from the assistance capability requirements all “equipment, facilities, or services that support the transport or switching of communications for private networks.”
In the 2005 order, the Commission noted this exemption, but seemed to take it away at the same time — saying that “[t]o the extent … that these private networks are interconnected with a public network …, providers of the facilities that support the connection of the private network to a public network are subject to CALEA…”
What? Just about all colleges and libraries with internal broadband networks of their own are connected via a commercial ISP to the internet. Did the FCC mean by its use of “support” that everything included in these internal networks had to be easily tappable by law enforcement? The Commission seemed to be willfully ignoring the statute. A sort of “down means up” reading.
In the June 9 D.C. Circuit opinion that upheld the Commission's CALEA trajectory, the court refused to worry along with ACE about the FCC's use of the word “support” – pointing out that the Order expressly excluded “private networks.” End of story from the court's perspective. ACE is reading this as reaffirmation of the exclusion. Right now, the CALEA obligations fall on commercial ISPs, and not on private networks.
It's clear, though, that the Commission is retaining the power to extend CALEA to any private network in the future. In the Second Report and Order that came out in May, the Commission said it would clarify whether gateway routers or other equipment (even if owned privately) providing interconnection to the public internet for private networks was covered by CALEA.
In the meantime, it's still a little unclear how far “private networks” extend — do they include those gateway routers at the border of (let's say) a university network? And what exactly constitutes a “private network”? Does it include every homeowner with an unsecured wifi router at the end of their cable or DSL broadband service? (I don't think so, but if anyone out there has an opinion please comment or email.)
A rehearing of the case by the entire D.C. Circuit might help. Also, it may be that legislation will be introduced that will clarify that only commercial networks (offered to the public for a fee) are covered. There will be news about CALEA's scope for months and years to come.