CALEA update
EDUCAUSE has recently published a CALEA update
.
CALEA ("Communications Assistance for Law Enforcement Act") was enacted by Congress in 1994. It spells out the circumstances and conditions under which wiretapping related to criminal investigations may be conducted by law enforcement agencies. Until last August, the law and regulations applied only to telephone companies. But then the FCC, realizing that much communication formerly conducted by telephone was increasingly being carried over data networks, broadened the Federal regulations implementing CALEA. The revised regulations would require "facilities-based broadband access providers, including higher education institutions, to facilitate lawful requests for surveillance of specific communications on their data networks…."
Within the higher education community, there was great concern about this broadening on three grounds: 1) there had been no process of hearings or consultation prior to the rule-making; 2) the FCC's reinterpretation seemed to go against the plain meaning of the statute; and 3) it would apparently take a very substantial financial investment in network equipment to comply.
In January, the American Council on Education and EDUCAUSE joined in a lawsuit challenging the FCC's reinterpretation. On June 9, 2006, the Court of Appeals of the District of Columbia announced its decision in the suit, which essentially upheld the FCC's action. The court noted, however, that under terms of CALEA itself and in the view of the FCC, "private networks" are exempt from compliance -- a promising development.
Subsequently, the ACE commissioned a legal opinion regarding the extent to which networks operated by colleges and universities may be subject to CALEA. The conclusions of that opinion were also reviewed by different counsel and resulted in a second opinion. Both opinions concur in the following points (quoted from the EDUCAUSE website):
Generally speaking, a higher education or research institution should be fully exempt from CALEA if it satisfies two criteria: (1) its network qualifies as a "private network," and (2) it does not "support" the connection of the private network to the Internet.In practical terms, this means that an institution should be exempt where it restricts the use of its network to particular classes of users (e.g., students, faculty, and administrators), and where the institution relies on a third party (such as a commercial ISP or a regional network) to provide the transmission and switching facilities used to route traffic to the Internet, rather than self-supplying such facilities.
Meanwhile, the American Library Association sought a legal opinion about the applicability of CALEA to libraries. In part the ALA's concern was that the providing of Internet access to the public by libraries might jeopardize colleges' "private network" exemption. The ALA's counsel found unequivocally that "Libraries, whether in an academic institution or not, are exempt from CALEA."
In the case of Lawrence, both conditions cited in the ACE opinion appear to me to be met. 1) We are not in the business of providing network access to the public, even though we have occasional and very limited network use by campus guests, both in the library and elsewhere. 2) We do not provide our own connection to the Internet, but pay a third party for that service.
Just to be sure, we need to get an opinion from counsel based in a review of our particular facts and circumstances. At this point, however, it appears that we will not be expected to comply.