CALEA and VoIP

I'm probably going to be unpopular for saying this (the blogger community tends to be rather anti-establishment, I find), but: I feel the FCC did the right thing in extending CALEA obligations to "interconnected VoIP service providers."

CALEA came about largely because of, believe it or not, ISDN. Unlike a traditional phone line, you can't wiretap an ISDN line. At one time, it was actually believed that ISDN would be widely adopted in the US (please, hold your laughter), and this would have a detrimental effect on the ability of law enforcement to administer authorized wiretaps.

Fast forward a few years, and there's a new problem for wiretaps; namely, cellular phones. Can't tap one of them, either. In my opinion, cellphones became the major impetus for CALEA continuing to move forward once it was apparent that ISDN was pretty much a non-starter in the US.

The intent (I feel like a Constitutional scholar, talking of "original intent") was to provide capabilities to law enforcement that would enable them to execute lawfully authorized wiretaps (and pen register trap and traces, but let's just stick with the term "wiretap" for now -- it's so semantically loaded) substantially equivalent to what they could execute on a traditional phone line, on "non-traditional" telephones or the equivalent. No more, no less.

So, along comes VoIP. Can't tap VoIP, either. Just as I dislike asymmetrical regulation, I dislike asymmetrical statutes - and requiring landline and wireless carriers to implement CALEA capabilities while not requiring VoIP service providers to implement equivalent capabilities is asymmetrical. Does it serve the public interest if a law enforcement agency gets a lawfully-authorized intercept order against a person, but is only able to execute that intercept if the person's phone is landline or wireless, not VoIP? I don't see it.

That said, I do have some problems with the way the FCC is going about it. For one thing, the FCC established a deadline of 18 months from issuance of the order. The original CALEA statute (passed in October, 1994) had a deadline of four years; the FCC eventually established a deadline of June, 2000 (five years and 8 months), and granted extensions to June, 2002 (over seven and a half years) to any carrier that asked. Seven and a half years for the industry to figure out how to make three-way calls and pen register traps transparent to the calling parties and easier to manage, versus one and a half years to establish entirely new technology for intercepting packetized voice transported over a broadband connection that may be owned and operated by a third party, strikes me as a bit (here we go again) asymmetrical.

It will be interesting to see how this plays out. The telephone companies enlisted the support of the telephone equipment manufacturers, defined a standard, played for time, and got the government to pay a significant amount of money to get compliance ($450M paid or owed as of 9/30/03). I don't know if the VoIP service provider community is as adept at the regulatory dance.