As warranted wiretap of VoIP becomes the law, every network in the U.S. must comply. Some equipment makers see an opportunity.

by Alex Goldman ISP-Planet Managing Editor [April 6, 2007]

On May 14, 2007 the Communications Assistance for Law Enforcement Act (CALEA) comes into effect and all ISPs that own equipment must enable law enforcement agencies (LEAs) to access their networks lawfully (i.e., with a warrant, keeping only the data the warrant allows them to have) in order to intercept VoIP traffic.

Because this date is arriving fast, we've been talking to many companies about what it means. The largest telcos and cablecos can spend millions of dollars to comply and are not worried. Regional and local ISPs, whose subscribers number in the thousands instead of the millions, cannot afford to buy a $100,000 box that generates no revenue but is required to comply with the law.

Of course, there are alternatives. ISPs can explain to the FCC why they are unable to comply at this time. ISPs can also hire a Trusted Third Party (TTP) to collect the data and hand it over securely to the LEAs.

Collecting the voice
Eric Hernaez, CEO of Solegy, a VoIP platform provider, says that his company expects to use a TTP. Asked whether the relationship between service provider and TTP will be as dysfunctional as that between and ISP and an upstream telco, Hernaez is optimistic. He says relatively low barriers to entry will ensure competition.

"You do not have to be a large telco monopoly to be a TTP. We expect there to be competition in the TTP space just like there's competition now in the E911 service bureau business. Initially, ISPs thought that only telcos and Level 3 could provide E911 but there are dozens of providers out there now. We have spoken to E911 companies that plan to also be TTPs."

Of course, service providers are already working with law enforcement, responding to subpoenas. "We get requests all the time," says Hernaez. "We get a request for records at least once per month."

CALEA distinguishes between two types of warrant. An ISP can be required to provide the header information (date of call, ID of caller, ID of number called, etc.) which is known as the Call Identifying Information (CII), or an ISP can be required to provide the actual voice call data, known as the content. CALEA anticipates the latter type of warrant to be rarer, easing the data storage requirement for ISPs.

An expert in packet analysis
"We've given CALEA a great deal of thought," says Jay Botelho, product manager at Walnut Creek, Calif.-based WildPackets. "I want to make sure this is clear: we're experts in data analysis. Long before anyone gave a thought to CALEA, we were thinking about it, over a year ago, in part because we've always been a supplier of software and technology to U.S. government agencies (international agencies too). Our technology has delivered evidence sets that agencies have gone to court with successfully."

Manufacturers have some flexibility in complying with CALEA. The FCC recognized that it could not choose technology, so in its ruling, it left the details of compliance vague, simply requiring companies to comply with "industry standards" and guaranteeing them "safe harbor" if they did so.

Therefore, if you can get a standard accepted, it becomes legal. The only certified standard that we are aware of at this time is from ATIS (see the ATIS press release: ATIS and TIA'S Joint CALEA Standard Published as an American National Standard). ATIS copyrights its standards and sells them for a fee, so we do not have access to it.

Procera envisions a variety of setups for its PacketLogic-based CALEA compliance solution: The ISP can do it all usng Procera or other equipment, the ISP can work with a TTP that uses Procera or other equipment, or the ISP can do the data interception but use a TTP to deliver the data to the LEA using Procera or other equipment. Of course the company recommends using its own product, but the point here is that ISPs do have options.

WildPackets is not getting certified and is not part of any standard. "We know the agencies, the end users of this data. They have been coming to us for years and continue to do so in order to obtain this data," says Botelho.

So the company is working with TTPs, which are using a variety of different solutions. WildPackets' modular software architecture makes it easy to adapt to different networks, Botelho claims.

It's important to deliver the data that the LEA needs and has a right to access to. If a LEA obtains data it has no right to have, it must discard that data or jeopardize the legality of its investigation. "If they can prove that some of the data was collected outside the warrant, then all the data collected under the warrant gets thrown out," says Botelho.

Does CALEA require a specific data format? "I read through the law. The law is not specific. Part of the law says it will rely on industry standards. It's our opinion that if you can deliver the data in a format that the LEA can analyze, you've met the CALEA requirements."

Conclusion
This concludes our CALEA introduction. In two other articles running today and linked in Related articles, below, we show how one company will deliver a CALEA compliance solution and we show how one ISP association is working on a CALEA standard that will be more friendly to WISPs and smaller companies.

We will be talking to more equipment makers, and to TTPs, in the coming weeks.

— End