1997 Congressional Hearings
Intelligence and Security
SUBCOMMITTEE ON CRIME
COMMITTEE ON THE JUDICIARY
U.S. HOUSE OF REPRESENTATIVES
OVERSIGHT HEARING ON
THE IMPLEMENTATION OF THE COMMUNICATIONS ASSISTANCE FOR LAW ENFORCEMENT ACT OF 1994
Wednesday, October 23, 1997
Room 2237 Rayburn Building, 10:00 AM
MATTHEW J. FLANIGAN
PRESIDENT,TELECOMMUNICATIONS INDUSTRY ASSOCIATION
BEFORE THE CRIME SUBCOMMITTEE OFTHE HOUSE COMMITTEE ON THE JUDICIARY
October 23, 1997
Thank you Mr. Chairman for giving me the opportunity to appear before you and the other distinguished members of your committee. No one can dispute that these hearings are timely and necessary. My appearance today is on behalf of the members of the Telecommunications Industry Association ("TIA"). TIA represents more than 600 United States companies that manufacture and supply the equipment that is the backbone of the telecommunications industry -- from switches for landline, cellular, PCS and satellite systems to pagers to two-way radios. Implementation of the Communications Assistance for Law Enforcement Act of 1994 ("CALEA") is at an impasse that industry and government have not been able to break. Congress intended that most of the implementation of the act would have occurred by the act's fourth anniversary, October 25, 1998. Regrettably, for the reasons I will discuss below, that deadline cannot be met.
I am pleased to report, however, that in the past week manufacturers have received a number of promising signals from the FBI. After several months of being excluded from meetings, last week TIA and several manufacturers were contacted by Mike Warren, the new section head for the CALEA Implementation Section at the FBI. He asked for a series of meetings and has offered to enter into good faith negotiations with the manufacturers, with the hope of achieving an agreement on CALEA's capability requirements.
Unfortunately, this is not the first time that such an appeal has been made by the FBI. In many ways, the FBI's current request is reminiscent of those we received when we first began the standards process in early 1995, immediately after the passage of CALEA.
At that time, the FBI approached TIA and asked, understandably, to be involved in the standards process. TIA was glad to welcome the FBI into the process, hoping that with the constructive participation of law enforcement we would be able to arrive at a standard that was acceptable to all parties. Indeed, as reflected in our Engineering Manual, TIA has always encouraged the active participation of government entities in our standards process. Unfortunately, our attempts to avoid confrontation and at good faith negotiation with law enforcement have put us where we are today: a year away from the compliance deadline and still without a standard to which to build.
B. The Standards Process
As the president of TIA, I am in a unique position to comment on the industry standards process and how we arrived at our current situation. TIA, as an institution accredited by the American National Standards Institute (ANSI), was selected by the telecommunications industry to promulgate the industry's CALEA standard.
Upon passage of CALEA, TIA promptly initiated a standards program. TIA set an ambitious schedule -- hoping to complete the standard on an extremely expedited basis. Although there were some substantive disagreements within industry (as there always are in a standards process), these were resolved on a fairly rapid basis. Disagreements with the FBI, however, were not so easily resolved. It gradually became apparent that law enforcement and industry had markedly different interpretations of what was required under CALEA.
In retrospect, we should have done what CALEA provides: passed the features on which industry agreed as the industry "safe harbor" standard and told the FBI that if it considered this standard to be deficient it should challenge the standard at the FCC. Instead, however, we accepted repeated FBI requests for more consultation, more meetings, and more drafts -- all in the hopes of arriving at some acceptable middle ground where the FBI and industry could reach consensus.
In fact, for the past two and a half years, a vast majority of the standards meetings were devoted to addressing law enforcement's concerns and seeking such an agreement.
During these meetings, industry made several concessions to law enforcement, agreeing to include features in the standard that many in industry were convinced were not required under CALEA. For example, law enforcement requested that it be provided with continuous information about the location of an intercept subject's cellular phone, irrespective of whether the phone was being used or not. Industry refused to provide this feature, finding that it greatly exceeded what CALEA permitted. In a compromise, however, industry agreed to provide law enforcement with the location of a cell phone at the beginning and end of each call -- even though many industry participants felt that even this compromise exceeded the scope of CALEA.
As a result of such compromises, the current proposed industry standard (SP-3580) goes well beyond a conservative reading of CALEA and provides several of the additional features and capabilities requested by law enforcement during the arduous negotiations.
In the end, however, a consensus with the FBI could not be reached. The FBI insisted on at least eleven features (the "punchlist") that industry was convinced were not required even by the broadest reading of CALEA. TIA put these additional features to a vote in several standards meetings where they were broadly rejected by industry, for reasons that include lack of legal authority, cost, and privacy concerns.
Until that point, the negotiations (although protracted and often discordant) could at least be characterized as having been conducted in good faith. In early 1997, however, the FBI proceeded to take several unfortunate actions which I believe current FBI management now regrets. First, the FBI took the unprecedented step of seeking to have TIA's accreditation as an ANSI standards body revoked. This action was completely unwarranted. TIA's accreditation has never been challenged. If the FBI had been successful, TIA would have lost not just its ability to issue SP-3580 but its ability to issue any ANSI-related standards. This challenge, which the FBI eventually withdrew, lasted nearly two months and greatly polarized industry and law enforcement.
The FBI also decided to combine forces with state and local police departments to submit sufficient votes to defeat the industry's consensus proposal. Of the 65 ballots received on SP-3580, at least 34 were from state and local entities who previously had never participated in the standards process. Twenty-eight of these "no" votes were identical, using the same 74-page statement of opposition as the FBI submitted. (Only three companies filed negative comments and all three companies were only opposed to the compromise with law enforcement on location, considering the compromise to violate CALEA.) As a result, despite near-unanimous support among industry, adoption of a consensus standard was not possible.
In an effort to salvage something from this process, industry has decided not only to re-ballot the standard (although the vote on the re-ballot is unlikely to change) but also to place the standard on an alternative track that permits industry to privately consider whether the proposed standard should be adopted as a TIA "interim" (and ANSI "trial use") standard. Voting in this process will close on October 28. However, review and resolution of any comments on the ballots will not be completed until, at the earliest, mid-December. As a result, even if this "interim" standard is adopted, previous delays mean that industry will be unable to build to this standard in time to satisfy the October 25, 1998 deadline.
The purpose of retracing this history is not to criticize the FBI and certainly not to suggest that the current FBI leadership would act in a similar manner. It is necessary, however, to explain why we are here today. The FBI's assurances of good faith and offers to work out an accommodation are welcome, but we need to know that our past and future efforts to reach agreement with the FBI will not result in our being punished with lawsuits and fines in October 1998.
The compliance deadline for manufacturers is only a year away. Because of the extensive lead-times (24-36 months) required by manufacturers to design, build and deploy the equipment and software necessary to implement any complex standard, industry is already past the point of being able to comply with that deadline.
As a result, when the FBI asks us to enter into negotiations to resolve this problem we have to ask (and we think that it is fair for you to ask): What happens if, despite everyone's good faith effort, these negotiations fail to result in a compromise? Will the deadline now be four or six months closer while manufacturers still do not have a standard to which to build? Will manufacturers, despite their good faith efforts to negotiate a solution, be threatened with retroactive penalties of $10,000 per day per wiretap order starting on October 25, 1998? Will the threat of such penalties be used to pressure manufacturers into building features that they do not believe are required by law?
These are questions that should be answered now. The industry shouldn't have to wait -- they can't wait -- for yet another round of negotiations with the FBI. Therefore, we ask for assurance, either from the Administration or from Congress, that manufacturers and carriers who participate in such good faith negotiations will be granted an extension sufficient to allow them to field CALEA-compliant equipment -- and that this extension will not be conditioned on accepting the FBI's view of what CALEA requires.
C. Extension of the Capabilities Deadline
The defeat of the safe harbor standard and the lack of any agreement on a uniform guideline for interception capabilities is the gravest issue facing the telecommunications industry. Without such a standard, manufacturers cannot fully commit to the extensive process of designing and deploying the equipment and software necessary to market products with uniform wiretap capabilities. As a result, it is virtually impossible, as of this date, for manufacturers to meet the rapidly approaching capability deadline of October 25, 1998. Although development times vary from manufacturer to manufacturer, almost every manufacturer of telecommunications equipment operates on a research, design and implementation schedule that requires at least 24 months to make available new capabilities. In addition, manufacturers (working with their carriers) require several additional months (up to one year) to roll-out this new equipment. Even if a standard were announced tomorrow, under optimum conditions, manufacturers and carriers would have difficulty deploying the equipment to implement such a standard until, at the earliest, the spring of 2000.
Can manufacturers build CALEA-compliant equipment without a standard? We believe this would be foolhardy. The telecommunications industry is a standards-driven industry. Because of the great emphasis on interoperability, no manufacturer would dare begin designing a set of features as complex as CALEA requires without an industry standard. Not only would it be prohibitively expensive (requiring great engineering resources from each manufacturer), but it could also result in serious incompatibilities in various manufacturers' architectures.
An extension of the capabilities deadline is the only reasonable solution to the impending crisis. With an extension, industry and the FBI (perhaps with Congressional supervision) could undertake the serious negotiations proposed last week.
An extension of the October 1998 deadline would not increase the government's cost of reimbursing carriers. Nor would it severely affect law enforcement's current ability to conduct wiretaps. Because the FBI capacity regulations have not yet been promulgated, law enforcement will not have the capacity to conduct more than the number of cellular wiretaps they are already able to conduct until, at the earliest, November 2000.
For all of these reasons, Mr. Chairman, an extension is absolutely imperative. The October 25, 1998 deadline is not achievable. The window of opportunity has already closed.
D. Capacity Requirement
As you are aware, the FBI has not yet promulgated its final capacity regulations. In part, the delay in announcing this standard was a contributing factor to the delay in the industry standards process. Throughout 1995 and early 1996, industry participants often postponed resolving certain issues pending the release of the capacity regulations and the equally anticipated Electronic Surveillance Interface. We understand from our recent discussions with the FBI, however, that the FBI intends to promulgate its standard this coming January. The industry certainly looks forward to the FBI regulations and appreciates the new leadership's efforts to resolve this matter.
However, even if a final regulation is promulgated in January, that capacity will not become available until January 2001. CALEA was drafted in an expectation that the capability and capacity requirements were to be implemented by the same October 25, 1998 deadline. Since capacity requirements will not be implemented until 2001, we see little point in trying to satisfy the capability on a considerably shorter implementation schedule -- particularly because, without the capacity, law enforcement will be unable to conduct any more wiretaps they can currently conduct. It seems logical that industry should be given until the capacity deadline (whenever it is finalized) to provide CALEA's capability requirements.
E. Cost Reimbursement
Compliance with CALEA's capability and capacity requirements will be an enormous cost to manufacturers and carriers alike. Congress recognized this in CALEA and included provisions to reimburse carriers for the "direct costs" of developing modifications, capabilities and capacities as well as costs incurred in deploying such capacities and in training personnel. Despite this clear intent, the FBI promulgated rules that ignore this mandate. The regulations unnecessarily adopt complex accounting principles and methods applicable to federal procurement contracts that are unworkable for most manufacturers.
- *The requirement to "flow down" cost accounting to manufacturers is
beyond the FBI's statutory authority. The statute and its legislative
history clearly indicate that telecommunications equipment manufacturers
are to be paid by their carrier customers in the normal course of business
based on commercial prices set by the marketplace.
- *It is widely recognized that government contract-style cost accounting
methods are costly and unnecessary when the government can obtain
equivalent assurances that the costs being reimbursed by the government are
reasonable. Alternatives such as a benchmark or reference pricing system
would meet the government's needs.
- *The FBI's argument that it must be granted unlimited rights in the
design of the CALEA equipment and the data (software) provided with it are
overreaching and unworkable. A simple agreement between the lead carrier,
the manufacturer and the government that the software development effort
will be charged only once is all that is necessary.
- *The regulations, without explanation or justification deny reimbursement to many categories of costs that Congress indicated should be reimbursed such as "general and administrative" ("G&A") costs.
Congress directed that the cost reimbursement regulations effectuate "cost efficient" payment for CALEA capabilities and capacity. These regulations are so regressive and complicated that they utterly fail to meet this requirement.
The Bureau has recently begun to explore new ways of pricing CALEA equipment. We are pleased that the FBI is now open to more commercially reasonable approaches. The FBI deserves encouragement from Congress for this effort. While many questions remain unanswered, we look forward to exploring this new approach in detail as the FBI develops its thinking further.
F. Cellular Related Technologies
Before concluding, Mr. Chairman, I would briefly like to talk about some technologies that have been largely ignored in the negotiations process. At the beginning of my comments, I mentioned the broad range of telecommunications equipment manufactured by TIA's member companies. Although the wireline, cellular and PCS industries are well represented here today and are the technologies most directly affected by CALEA, I should point out that TIA's member companies build equipment for several other related technologies, such as satellite telecommunications and paging, that also may fall within the scope of CALEA.
Individual companies have attempted to open dialogues with law enforcement about the status of these related technologies and how CALEA compliance should be managed. Unfortunately, law enforcement, in particular the FBI, has been so overwhelmed with the various issues related to cellular and PCS that they have been unable to talk about these other technologies.
Although we certainly appreciate their need to set priorities (as well as their informal statements that enforcement actions are unlikely for these technologies), as the October 25, 1998 deadline approaches for these technologies we need to receive some formal guidance from law enforcement (at a minimum, a formal assurance that the deadline will be extended).
In conclusion, Mr. Chairman, manufacturers are pleased with the new signals we are receiving from the FBI. We have had more meetings with FBI management in the past week than we had in the past four months. We believe that this is in substantial part because you were willing to hold this hearing and because the staff of the Committee and Subcommittee were willing to spend a substantial amount of time exploring the concerns of manufacturers before the hearing was held. For that, we thank you.
We are particularly pleased by the FBI's statement that it wishes to resolve the current impasse amicably through good faith negotiations. As I mentioned, however, we are in our current predicament because we have already devoted many months to efforts to reach a good faith understanding with the FBI, and all we have to show for it so far is a much-delayed standard. That's why we continue to ask for assurances that the FBI and Justice Department will not impose sanctions on carriers and manufacturers who have entered into such good faith negotiations and that they will give manufacturers sufficient time to comply with CALEA's capability requirements, whatever the outcome of those talks.
The FBI has presented several proposals aimed at putting CALEA implementation back on track, particularly regarding cost reimbursement and capability. Manufacturers, however, must judge the FBI by the flexibility it shows on the October 25, 1998 deadline.
All that manufacturers have ever wanted is a clear lawful standard to which to build and the assurance that we will have sufficient time to design and develop the necessary equipment and software to implement that standard. The proposals suggested by the FBI offer one of the most promising opportunities to resolving CALEA's implementation problems. But they do not solve the crisis that manufacturers have faced for the last eighteen months. I sincerely hope that the FBI can give us an assurance that this crisis can be defused. If not, then I believe only this Committee can provide the assurance that is needed.
Thank you, Mr. Chairman. I am would be willing to entertain any questions that you might have.
|Join the GlobalSecurity.org mailing list|