1997 Congressional Hearings
Intelligence and Security

SUBCOMMITTEE ON CRIME

COMMITTEE ON THE JUDICIARY

U.S. HOUSE OF REPRESENTATIVES

OVERSIGHT HEARING ON

THE IMPLEMENTATION OF THE COMMUNICATIONS ASSISTANCE FOR LAW ENFORCEMENT ACT OF 1994

Wednesday, October 23, 1997

Room 2237 Rayburn Building, 10:00 AM

Flanigan Testimony

Thank you Mr. Chairman for giving me the opportunity to appear before you and the other distinguished members of your committee. No one can dispute that these hearings are timely and necessary. My appearance today is on behalf of the members of the Telecommunications Industry Association ("TIA"). TIA represents more than 600 United States companies that manufacture and supply the equipment that is the backbone of the telecommunications industry -- from switches for landline, cellular, PCS and satellite systems to pagers to two-way radios. Implementation of the Communications Assistance for Law Enforcement Act of 1994 ("CALEA") is at an impasse that industry and government have not been able to break. Congress intended that most of the implementation of the act would have occurred by the act's fourth anniversary, October 25, 1998. Regrettably, for the reasons I will discuss below, that deadline cannot be met.

I am pleased to report, however, that in the past week manufacturers have received a number of promising signals from the FBI. After several months of being excluded from meetings, last week TIA and several manufacturers were contacted by Mike Warren, the new section head for the CALEA Implementation Section at the FBI. He asked for a series of meetings and has offered to enter into good faith negotiations with the manufacturers, with the hope of achieving an agreement on CALEA's capability requirements.

Unfortunately, this is not the first time that such an appeal has been made by the FBI. In many ways, the FBI's current request is reminiscent of those we received when we first began the standards process in early 1995, immediately after the passage of CALEA.

At that time, the FBI approached TIA and asked, understandably, to be involved in the standards process. TIA was glad to welcome the FBI into the process, hoping that with the constructive participation of law enforcement we would be able to arrive at a standard that was acceptable to all parties. Indeed, as reflected in our Engineering Manual, TIA has always encouraged the active participation of government entities in our standards process. Unfortunately, our attempts to avoid confrontation and at good faith negotiation with law enforcement have put us where we are today: a year away from the compliance deadline and still without a standard to which to build.

B. The Standards Process

As the president of TIA, I am in a unique position to comment on the industry standards process and how we arrived at our current situation. TIA, as an institution accredited by the American National Standards Institute (ANSI), was selected by the telecommunications industry to promulgate the industry's CALEA standard.

Upon passage of CALEA, TIA promptly initiated a standards program. TIA set an ambitious schedule -- hoping to complete the standard on an extremely expedited basis. Although there were some substantive disagreements within industry (as there always are in a standards process), these were resolved on a fairly rapid basis. Disagreements with the FBI, however, were not so easily resolved. It gradually became apparent that law enforcement and industry had markedly different interpretations of what was required under CALEA.

In retrospect, we should have done what CALEA provides: passed the features on which industry agreed as the industry "safe harbor" standard and told the FBI that if it considered this standard to be deficient it should challenge the standard at the FCC. Instead, however, we accepted repeated FBI requests for more consultation, more meetings, and more drafts -- all in the hopes of arriving at some acceptable middle ground where the FBI and industry could reach consensus.

In fact, for the past two and a half years, a vast majority of the standards meetings were devoted to addressing law enforcement's concerns and seeking such an agreement.

During these meetings, industry made several concessions to law enforcement, agreeing to include features in the standard that many in industry were convinced were not required under CALEA. For example, law enforcement requested that it be provided with continuous information about the location of an intercept subject's cellular phone, irrespective of whether the phone was being used or not. Industry refused to provide this feature, finding that it greatly exceeded what CALEA permitted. In a compromise, however, industry agreed to provide law enforcement with the location of a cell phone at the beginning and end of each call -- even though many industry participants felt that even this compromise exceeded the scope of CALEA.

As a result of such compromises, the current proposed industry standard (SP-3580) goes well beyond a conservative reading of CALEA and provides several of the additional features and capabilities requested by law enforcement during the arduous negotiations.

In the end, however, a consensus with the FBI could not be reached. The FBI insisted on at least eleven features (the "punchlist") that industry was convinced were not required even by the broadest reading of CALEA. TIA put these additional features to a vote in several standards meetings where they were broadly rejected by industry, for reasons that include lack of legal authority, cost, and privacy concerns.

Until that point, the negotiations (although protracted and often discordant) could at least be characterized as having been conducted in good faith. In early 1997, however, the FBI proceeded to take several unfortunate actions which I believe current FBI management now regrets. First, the FBI took the unprecedented step of seeking to have TIA's accreditation as an ANSI standards body revoked. This action was completely unwarranted. TIA's accreditation has never been challenged. If the FBI had been successful, TIA would have lost not just its ability to issue SP-3580 but its ability to issue any ANSI-related standards. This challenge, which the FBI eventually withdrew, lasted nearly two months and greatly polarized industry and law enforcement.

The FBI also decided to combine forces with state and local police departments to submit sufficient votes to defeat the industry's consensus proposal. Of the 65 ballots received on SP-3580, at least 34 were from state and local entities who previously had never participated in the standards process. Twenty-eight of these "no" votes were identical, using the same 74-page statement of opposition as the FBI submitted. (Only three companies filed negative comments and all three companies were only opposed to the compromise with law enforcement on location, considering the compromise to violate CALEA.) As a result, despite near-unanimous support among industry, adoption of a consensus standard was not possible.

In an effort to salvage something from this process, industry has decided not only to re-ballot the standard (although the vote on the re-ballot is unlikely to change) but also to place the standard on an alternative track that permits industry to privately consider whether the proposed standard should be adopted as a TIA "interim" (and ANSI "trial use") standard. Voting in this process will close on October 28. However, review and resolution of any comments on the ballots will not be completed until, at the earliest, mid-December. As a result, even if this "interim" standard is adopted, previous delays mean that industry will be unable to build to this standard in time to satisfy the October 25, 1998 deadline.

The purpose of retracing this history is not to criticize the FBI and certainly not to suggest that the current FBI leadership would act in a similar manner. It is necessary, however, to explain why we are here today. The FBI's assurances of good faith and offers to work out an accommodation are welcome, but we need to know that our past and future efforts to reach agreement with the FBI will not result in our being punished with lawsuits and fines in October 1998.

The compliance deadline for manufacturers is only a year away. Because of the extensive lead-times (24-36 months) required by manufacturers to design, build and deploy the equipment and software necessary to implement any complex standard, industry is already past the point of being able to comply with that deadline.

As a result, when the FBI asks us to enter into negotiations to resolve this problem we have to ask (and we think that it is fair for you to ask): What happens if, despite everyone's good faith effort, these negotiations fail to result in a compromise? Will the deadline now be four or six months closer while manufacturers still do not have a standard to which to build? Will manufacturers, despite their good faith efforts to negotiate a solution, be threatened with retroactive penalties of $10,000 per day per wiretap order starting on October 25, 1998? Will the threat of such penalties be used to pressure manufacturers into building features that they do not believe are required by law?

These are questions that should be answered now. The industry shouldn't have to wait -- they can't wait -- for yet another round of negotiations with the FBI. Therefore, we ask for assurance, either from the Administration or from Congress, that manufacturers and carriers who participate in such good faith negotiations will be granted an extension sufficient to allow them to field CALEA-compliant equipment -- and that this extension will not be conditioned on accepting the FBI's view of what CALEA requires.

C. Extension of the Capabilities Deadline

The defeat of the safe harbor standard and the lack of any agreement on a uniform guideline for interception capabilities is the gravest issue facing the telecommunications industry. Without such a standard, manufacturers cannot fully commit to the extensive process of designing and deploying the equipment and software necessary to market products with uniform wiretap capabilities. As a result, it is virtually impossible, as of this date, for manufacturers to meet the rapidly approaching capability deadline of October 25, 1998. Although development times vary from manufacturer to manufacturer, almost every manufacturer of telecommunications equipment operates on a research, design and implementation schedule that requires at least 24 months to make available new capabilities. In addition, manufacturers (working with their carriers) require several additional months (up to one year) to roll-out this new equipment. Even if a standard were announced tomorrow, under optimum conditions, manufacturers and carriers would have difficulty deploying the equipment to implement such a standard until, at the earliest, the spring of 2000.

Can manufacturers build CALEA-compliant equipment without a standard? We believe this would be foolhardy. The telecommunications industry is a standards-driven industry. Because of the great emphasis on interoperability, no manufacturer would dare begin designing a set of features as complex as CALEA requires without an industry standard. Not only would it be prohibitively expensive (requiring great engineering resources from each manufacturer), but it could also result in serious incompatibilities in various manufacturers' architectures.

An extension of the capabilities deadline is the only reasonable solution to the impending crisis. With an extension, industry and the FBI (perhaps with Congressional supervision) could undertake the serious negotiations proposed last week.

An extension of the October 1998 deadline would not increase the government's cost of reimbursing carriers. Nor would it severely affect law enforcement's current ability to conduct wiretaps. Because the FBI capacity regulations have not yet been promulgated, law enforcement will not have the capacity to conduct more than the number of cellular wiretaps they are already able to conduct until, at the earliest, November 2000.

For all of these reasons, Mr. Chairman, an extension is absolutely imperative. The October 25, 1998 deadline is not achievable. The window of opportunity has already closed.

D. Capacity Requirement

As you are aware, the FBI has not yet promulgated its final capacity regulations. In part, the delay in announcing this standard was a contributing factor to the delay in the industry standards process. Throughout 1995 and early 1996, industry participants often postponed resolving certain issues pending the release of the capacity regulations and the equally anticipated Electronic Surveillance Interface. We understand from our recent discussions with the FBI, however, that the FBI intends to promulgate its standard this coming January. The industry certainly looks forward to the FBI regulations and appreciates the new leadership's efforts to resolve this matter.

However, even if a final regulation is promulgated in January, that capacity will not become available until January 2001. CALEA was drafted in an expectation that the capability and capacity requirements were to be implemented by the same October 25, 1998 deadline. Since capacity requirements will not be implemented until 2001, we see little point in trying to satisfy the capability on a considerably shorter implementation schedule -- particularly because, without the capacity, law enforcement will be unable to conduct any more wiretaps they can currently conduct. It seems logical that industry should be given until the capacity deadline (whenever it is finalized) to provide CALEA's capability requirements.

E. Cost Reimbursement

Compliance with CALEA's capability and capacity requirements will be an enormous cost to manufacturers and carriers alike. Congress recognized this in CALEA and included provisions to reimburse carriers for the "direct costs" of developing modifications, capabilities and capacities as well as costs incurred in deploying such capacities and in training personnel. Despite this clear intent, the FBI promulgated rules that ignore this mandate. The regulations unnecessarily adopt complex accounting principles and methods applicable to federal procurement contracts that are unworkable for most manufacturers.