Updated: ImageStream's CALEA Solution

ISP-Planet Exclusive: ImageStream is putting together a free update for its routers that will enable ISPs and other providers to become CALEA compliant.

by Alex Goldman ISP-Planet Managing Editor [April 6, 2007]

Many ISPs still believe that the CALEA definition of "facilities-based" is the same as the 1996 act definition, but they're wrong. For the purposes of CALEA, an ISP must comply if it owns equipment.

With the deadline for CALEA compliance, May 14, 2007, coming fast, equipment makers are rushing to deliver the right solution.

One favorite of small ISPs, Plymouth, Ind.-based router maker ImageStream says it has nearly completed a fully functional, cheaper solution. The company began working with WISPA some time ago, and a member of the committee referred the company to Merit Network's open source solution, OpenCALEA.

OpenCALEA incorporates an ATIS standard, explains J.C. Utter, ImageStream CEO. This standard is already certified by the FBI, and therefore provides safe harbor under CALEA.

Therefore, ImageStream is incorporating OpenCALEA into its router software. ImageStream provides free firmware upgrades for the life of the router, so the new software will be available to all customers.

Are you committed to the open source nature of OpenCALEA? "We are committed to open source," says Utter. "Not everything that we do is open source, but with any open source project, we would contribute. If we add features, they will be available to Merit, but we have no formal contact with Merit at this time."

CALEA requires that ISPs have a device (a tap) that can receive intercept requests and pass on the required data to another device that stores the data (a probe). The Law Enforcement Authority (LEA) accesses the probe directly to download the data it is allowed to collect through lawful warranted wiretap. The probe and tap must be undetectable to the suspect.

With the new software, ImageStream routers can act as a tap or as a probe. Utter says that competitors such as SS8 and Verint make probe/tap combinations that are proprietary, so that, for example, an SS8 tap will only work with an SS8 probe. In contrast, Utter says, ImageStream products are built on open standards.

There's more work to do
ImageStream continues to work with WISPA, as it examines various ways of complying with CALEA requirements. Utter says WISPA wants to allow its members who are Linux-savvy to use core Linux features instead of OpenCALEA to comply with CALEA. But since the deadline is approaching fast, ImageStream had to embrace one method of compliance instead of many, and therefore chose OpenCALEA.

Utter says the WISPA effort is particularly valuable because the standards developed to date are aimed at equipment makers. "ATIS standards are not especially designed for service providers," says Utter. He believes that WISPA's work will highlight some of the difficulties that service providers will face that others may not have been considered.

A new line of business
Utter says, "we bring LAES-capable functionality, with zero upgrade cost. We are the only manufacturer in the business doing this that we know of. Others are charging as much as $3,000 for the CALEA component alone. That's per-chassis. As a result, we expect people to switch to ImageStream."

He adds that although some ISPs want to deliver wiretap data directly to the LEA, others will work with a Trusted Third Party (TTP), in part because of the legal expertise the TTP will have. ImageStream is working with Intelleq, a TTP that will be using ImageStream routers for CALEA compliance (see Intelleq's CALEA FAQ for more about the company).

Everyone has their own area of expertise. WISPA is supporting wireless ISPs. Intelleq is working with CALEA every day. And ImageStream, Utter says, knows routers and customer service. "We always believed that if we provided value, the money would come. Ours are traditional values and good products."

Update April 10, 2007
Steve Polilli, PR for SS8, writes that SS8 products support open standards, contradicting our article above:

This is a clear misrepresentation. SS8 doesn’t manufacture taps. SS8 typically recommends customers use off the shelf NetOptics taps, though it makes absolutely no difference to SS8’s solution what tap is used. In fact, the SS8 Xcipio solution can do the intercept off a SPAN port, or any other methodology that does port monitoring.

SS8 is the leader in lawful intercept solutions largely because it offers open, standards-based technology and has established partnerships with companies including: Cisco, Alcatel, Juniper, Nortel, Motorola, Acme Packet, Lucent, Broadsoft, and other major players.

— End