POLICY ALERT: College and University CALEA Exemption Rests on Private Network Status

[Rodney Petersen <rpetersen () EDUCAUSE EDU>]

Please excuse any cross-posting of this information.  However, I thought
that many of you might be interested in the announcement below that
includes an interpretation of the application of CALEA to institutions
of higher education after the ruling of the D.C. Court of Appeals.  The
key document introduced below is available at
http://www.educause.edu/ir/library/pdf/EPO0654.pdf  
 
Please let me know if you have any questions.
 
Regards,
 
-Rodney

--------------------------------------------------
Rodney J. Petersen
Policy Analyst & Security Task Force Coordinator

EDUCAUSE
1150 18th Street, N.W., Suite 1010
Washington, D.C.  20036
(202) 331-5368 / (202) 872-4200
(202) 872-4318 (FAX) 
EDUCAUSE/Internet2 Security Task Force
www.educause.edu/security <http://www.educause.edu/> 
-------------------------------------------------- 

 

________________________________

From: educause [mailto:educause () EDUCAUSE EDU] 
Sent: Thursday, July 13, 2006 4:55 PM
To: EMARKETING () LISTSERV EDUCAUSE EDU
Subject: [EDUCAUSECOPY] POLICY ALERT: College and University CALEA
Exemption Rests on Private Network Status



Dear Colleague,

 

As you may know, last month, the U.S. Court of Appeals for the District

of Columbia Circuit issued a decision denying the American Council on

Education (ACE) appeal of the Federal Communications Commission's rules

extending provisions of the Communications Assistance for Law

Enforcement Act (CALEA) to include the Internet.

 

ACE, EDUCAUSE, and legal counsel have reviewed the complex implications

of the decision and are issuing the following statement to our joint

memberships:

 

***********************************************************************

A higher education institution seeking to clarify whether it is bound

by the Federal Communication Commission (FCC) order extending the

Communications Assistance for Law Enforcement Act (CALEA) to the

Internet must determine if its campus network can be classified as a

"private network," according to a legal analysis by the American

Council on Education

<http://www.educause.edu/ir/library/pdf/EPO0654.pdf>. The way the

campus network connects to the Internet is another key factor.

 

CALEA, enacted in 1994, requires telephone companies to ensure that

their networks do not impede law enforcement agencies from setting up

wiretaps. On Aug. 5, 2005, in response to a petition filed by the U.S.

Department of Justice and the Federal Bureau of Investigation, the

FCC adopted a rule extending the scope of CALEA to include all

"facilities-based" Internet service providers and certain Voice-over-IP

providers. The U.S. Court of Appeals for the District of Columbia

Circuit upheld that rule on appeal in a decision issued June 9, 2006.

At the same time, the court reaffirmed provisions within CALEA

that specifically exempt private networks, such as those operated by

many colleges and universities, from such regulation by the FCC.

 

The legal analysis commissioned by ACE is based on a detailed

examination of the FCC order, the government's court briefs, and the

court's opinion.

 

"An institution should be exempt where it restricts the use of its

network to particular classes of users (e.g., students, faculty, and

administrators), and where the institution relies on a third party

(such as a commercial ISP or a regional network) to provide the

transmission and switching facilities used to route traffic to the

Internet, rather than self-supplying such facilities," the analysis

concludes.

 

The FCC order explicitly states that colleges and universities

operating private broadband networks will be subject to the new

obligations if they support a connection to the Internet. The FCC

explained during the court proceedings that "support" refers to

"private network operators that provide their own connection to the

Internet," as opposed to "those that contract with an ISP for that

connection."

 

"This analysis confirms our initial impression that the circuit 

court's recent decision on CALEA is good news for colleges, " said ACE

President David Ward. "We believe that many institutions will not be

subject to CALEA using the FCC's criteria. But the distinction between

private and non-private networks is very fine, so we're encouraging

campuses to consult carefully with their own IT departments and

in-house counsel to determine where they stand. It could come down to

something as basic as who owns the cable that connects a campus's

network to the Internet."

 

The status remains unclear for institutions that allow the general

public limited access to their network--for example, through library

computer terminals--but it is possible that limited public use might

not call a network's classification as "private" into question.

 

The FCC published implementation details regarding the application of

CALEA to broadband networks in the July 5, 2006, Federal Register.

Institutions with networks that are not deemed private or that provide

their own connection to the Internet will be required to submit a

security plan 120 days after publication of a forthcoming Federal

Register notice, expected soon; these plans must explain how the

institution will handle employee supervision and control, as well as

related matters. Updates of network equipment covered by CALEA must be

completed by May 14, 2007.

 

Further information on CALEA and interpretation of the recent ruling

will be posted at <http://www.educause.edu/calea> as it is developed.

Campus counsel may wish to contact Sheldon E. Steinbach, ACE vice

president and general counsel, at <sheldon_steinbach () ace nche edu> for

more information on the FCC mandate or the ACE legal analysis.

 

**********************************************************************

 

In addition to the above announcement, ACE has prepared a document

titled THE APPLICATION OF CALEA TO HIGHER EDUCATION NETWORKS, which can

be found at

http://www.educause.edu/ir/library/pdf/EPO0654.pdf

 

EDUCAUSE will continue its efforts to educate the community about the

CALEA decision through conference presentations, special interest

working groups, and appropriate Constituent Group listservs. A central

resource will continue to be the CALEA resource Web page

http://www.educause.edu/calea

 

Best wishes,

 

Mark Luker

Vice President

EDUCAUSE

 

**************************************************

You are receiving this message because you are the primary

representative at an EDUCAUSE member institution. For questions,

contact EDUCAUSE at <info () educause edu> or 4772 Walnut St., Suite 206,

Boulder, CO, 80301.

 

**************************************************

EDUCAUSE is a nonprofit association whose mission is to advance higher

education by promoting the intelligent use of information technology.

The current membership comprises more than 2,000 colleges,

universities, and educational organizations, including 200

corporations, with 15,000 active members. EDUCAUSE has offices in

Boulder, Colorado, and Washington, D.C. Learn more at

http://www.educause.edu