1. CALEA Discussion Institute for Computer Policy and Law June 28, 2006 Doug Carlson Executive Director, Communications & Computing Services New York University doug.carlson@nyu.edu

2. 2 Caveats I’m not a Communications Lawyer! Opinions, opinions, opinions – not undisputed facts

3. 3 The Basics – Title 18 USC Title 18 provides the framework which requires universities to assist law enforcement with communications intercepts: “An order authorizing the interception of a wire, oral, or electronic communication under this chapter shall, upon request of the applicant, direct that a provider of wire or electronic communication service, landlord, custodian or other person shall furnish the applicant forthwith all information, facilities, and technical assistance necessary to accomplish the interception unobtrusively and with a minimum of interference with the services that such service provider, landlord, custodian, or person is according the person whose communications are to be intercepted.”

4. 4 The Basics (continued) CALEA Communications Assistance for Law Enforcement Act Imposes specific obligations on “telecommunications carriers” to build certain "assistance capabilities" into their networks

5. 5 The Controversy Government would like in-place mechanisms to quickly initiate comprehensive intercepts of Internet communications (e.g., CALEA compliant equipment) One interpretation of this requirement suggested the potential cost to higher education could be high vs. alternatives Replace all network equipment vs. less expensive solutions

6. 6 Court case results (Current thinking on broadband – subject to change) Still not clear!!! Opinions Most colleges and universities are likely, at most, to need to make the “gateway” between the campus and the Internet CALEA compliant Two tests Private network Institution doesn’t provide its own facilities to the Internet (Service Provider)

7. 7 FCC First Report and Order - Footnote 100 “To the extent [that] private networks are interconnected with a public network, either the [public voice network] or the Internet, providers of the facilities that support the connection of the private network to a public network are subject to CALEA under the [Substantial Replacement Provision].”

8. 8 Private Network Offer network access to a well-defined set of users Incidental other usage might be OK? Open (non-authenticated) wireless? The D.C. Circuit Court read the FCC Order as upholding the exempt status of private networks!!!

9. 9 Providing access to the Internet Does the institution provide access to the Internet What does “provide” mean? One thought: Does the campus or the ISP own/provide connections between the campus network and the ISP’s Point of Presence (PoP)?

10. 10 Other Issues Further appeals? Status of state/regional Research & Education networks? Same as universities? Congress may consider new regulations

11. 11 What ACE and EDUCAUSE are doing (as of 6/25) Analyzing the Court’s decision Will create a document on the impact of the Court’s decision Will continue dialog with Law Enforcement on guidelines for Title 18 compliance – to be published

12. 12 What should universities do? Wait until ACE/EDUCAUSE position paper comes out (within the next few weeks) Watch for guidelines being developed by EDUCAUSE If appropriate given the above, evaluate if the university appears to have a “private network” and is not responsible for providing the connection to the Internet If don’t have a private network, CALEA obligations could be daunting If do have responsibility for connection to your ISP, it could increase chances that gateway would need to be CALEA- compliant

13. 13 Related Issues Network authentication of terminals on campus (e.g., 802.1x) Data retention of logs and other records

14. 14 VeriSign Filing to the FCC What’s your opinion? “Arguments that certain classes or categories of facilities-based broadband Internet access providers notably small and rural providers and providers of broadband networks for educational and research institutions should be exempt from digital forensic requirements under either CALEA or Title I should be rejected. To allow such exemptions would defeat the essential purpose of CALEA to provide ubiquitous digital forensic capabilities, and provide the equivalent of safe zones for criminals, hackers, and terrorists to engage in unlawful activities and attack the national infrastructures. The Commission should not adopt any CALEA exemptions.” November 14, 2005

15. 15 Good information source http://www.educause.edu/calea