The System Security and Integrity (SSI) report is due on March 12, 2007.

February 19, 2007
Contact: communications@ihets.org

For those institutions that are subject to the FCC’s Communications Assistance for Law Enforcement Act (CALEA) the System Security and Integrity (SSI) report is due on March 12, 2007.

Public notices regarding the act are posted on the CALEA section of EDUCAUSE’s Web site, which also provides links to frequently asked questions, a tech expert group, discussion group, report instructions, samples, forms, and much more.

According to EDUCAUSE, the FCC released a public notice establishing filing deadlines and stating "facilities-based broadband Internet access and interconnected VoIP service providers subject to CALEA must file," which means that exempt institutions are not required to submit these reports.

To gauge how IHETS consortium member institutions responsible for complying with CALEA reporting requirements have approached the issue, two questions were recently asked, "How have you determined whether or not your institution must comply?" and "What steps are you taking if your institution must comply?" Review some of the responses IHETS received.

Indiana University

The university is taking the position that a reasonable interpretation of the pertinent language puts the obligation for CALEA compliance on the organizations that put network traffic directly on the public Internet. We do not do that; network communications from Indiana University are passed to one of two Internet Service Providers, and those companies put our traffic on the public Internet. If at some point some additional guidance is provided by the FCC or the DoJ that indicates that Indiana University has some local obligation under the law, we will then do whatever is necessary to satisfy those obligations.

We reviewed all of the material and cases, and discussed this at length with Counsel, and this is the conclusion we have reached. Counsel is working right now on a summary of our deliberations, in the form of a position paper we can produce if asked.

—Mark S. Bruhn, associate vice President for telecommunications, executive director, REN-ISAC

Indiana Wesleyan University

The position we are taking on CALEA is that we are exempt. While there remains much to be clarified by the FCC and courts in language and intent of the ruling, we feel Indiana Wesleyan University can make an exempt claim based on our understanding of the ruling and multiple opinions from a variety of well respected authorities in the educational community on CALEA. We will continue to monitor any developments that may provide further clarification on the subject. Regardless of the outcome of CALEA and interpretation, it has been and will be our intent to work with law enforcement in whatever way we can legally to assist them with any issue that may require cooperation.

—John Jones, vice president for information technology

Ball State University

Ball State University has relied upon the available guidance regarding the issue of compliance exemption, consisting primarily of ACE and EDUCAUSE resources. These resources rely primarily upon the decision in American Council on Education, et al. v. FCC and USA, U.S. Court of Appeals for the District of Columbia, App. Ct. Nos. 05-1404, 1408, 1438, 1451 and 1453 issued in June of last year. Although the subsequently released ACE and EDUCAUSE guidance lacks the strength of judicial precedent, these sources seem to have become de facto standards for CALEA exemption decision making in higher education. It appears likely this existing guidance will continue to take center stage until further judicial rulings resolve the lingering questions regarding what constitutes a "private" network and what "support" of that network means.

The now critical questions of a "pubic vs. private network" and the second question asking who maintains the Internet connection (the "support" test) are difficult to answer in unequivocal terms, as the questions themselves remain open to debate from several angles. We note that several sources including the opinion by Albert Gidari of Perkins Coie "Communications Assistance For Law Enforcement Act (CALEA) And Private Networks In Academia" as well as the published guidance of at least two large Internet consortium groups including The Merit Network (serving Michigan education) and MOREnet (serving Missouri education) downplay the public/private test somewhat and suggest the more critical question is test of who "supports" the networks.

Even though much ambiguity continues to surround these important questions, Ball State University has completed an internal review of the public/private test as well as the support test and believes that under all but the most stringent interpretation possible (and perhaps not even then) BSU would remain in a position to claim full exemption.

As Ball State University has determined it has full exemption, there is no need to take further action at this time beyond documenting the rationale and decision making process.

—H. O'Neal Smitherman, vice president for information technology & CIO

Bethel College

We have followed the same advice as others…we are trusting that our ISP relationship negates our need to comply. We are going to draft documentation regarding our perceived lack of need to comply, check it institutionally with our VP’s, have them run it past the lawyer and then retain that documentation.

—Lorne Oke, AVP for institutional technology (CIO)

Manchester College

We have determined that we are exempt as the college receives the commodity Internet from a trusted third party (IHETS) who also controls our router. We have also made arrangements to limit public access to our network through 802.1x.

—Michael Case, director of information technology services

Follow these links to see how other agencies and state networks have approached the CALEA reporting issue.

National Higher Education Coalition
Merit Network
OARnet
WiscNet
American Library Association

To determine whether or not your institution must comply, explore EDUCAUSE’s resource material and clearinghouse on CALEA legal opinions and analyses, which includes opinions, issue briefs, and court rulings related to compliance exemptions.