Filing for an extension to CALEA is not at all like filing for an extension to your taxes. You will need a lawyer even if you're not in compliance.

by Alex Goldman ISP-Planet Managing Editor [May 7, 2007]

Note: I am not a lawyer and this article does not constitute legal advice.

May 14, 2007 is the deadline for CALEA compliance. I am not writing this article to threaten ISP owners with fines or jail time for failing to comply. The government might be entitled to do this, but I suspect that if the FBI needs access to your network, they will expect to be able to use the threat of fines or jail time to obtain the immediate access they need.

But making your network accessible to Law Enforcement Agencies (LEAs) ahead of time in the manner described by law is no trivial undertaking.

Background
The FCC's rules are listed, mainly, in the May 12, 2006 Second Report and order (.pdf). However, the rules did not specifically say how an ISP would comply. Instead, the FCC left it up to the industry to comply.

So standards bodies went to work, like ATIS, which published its Lawfully Authorized Electronic Surveillance (LAES) For Internet Access and Services in March, 2007. Unfortunately, ATIS sells the documents describing its standards, and retains the copyright, so we can neither read nor cite them (price is $185 for an electronic copy and $164 for an electronic download).

More recently, the OpenCALEA project has been working on a cheaper method for complying, but at press time was still in version 0.5.

Where we are now
ISPs can comply with CALEA in three ways:

1. By building a standards-compliant proprietary system
2. By using an off the shelf proprietary system (we've been covering many recently, and we have not written about all of them)
3. By contracting with a Trusted Third Party (TTP) that will bill the ISP and deliver the required data in the required format to the LEA.

ISPs want to help law enforcement. Many already routinely handle requests for data from law enforcement. More innovative ISPs and WISPs have participated in Amber Alerts or helped wire (or unwire) the local police department. But the final standards for CALEA only were available a few months ago, and the costs of compliance are impossible to forecast (they depend on the number of type of warrants, which should vary widely over time and geographically).

So some ISPs will not be able to comply.

Filing for an extension
You can get an extension at tax time, but you still have to file and pay an estimate of how much you owe (see Form 4868 (.pdf)).

Similarly, you can file for a CALEA extension, but you have to submit a plan for complying. The form you should have already filed (on February 12, 2007) is Form 445 (.pdf). This details how close you are to being complaint. In order to file the form, you need to obtain an FCC Registration Number, which your lawyer can help you do.

As I'm not a lawyer, I cannot provide specific legal advice to you, but I'm telling you to get to know a lawyer who can provide the advice you need, and to be prepared to do the necessary paperwork on (or, preferably, before) Monday, May 14, 2007.

Your lawyer will also advice you where to file. Hint: It's not as simple as one copy to the FCC.

Make sure you've paid all back taxes
Form 477 also warns:

If you owe a past debt to the Federal Government, any information you provide may also be disclosed to the Department of Treasury Financial Management Service, other federal agencies and/or your employer to offset your salary, IRS tax refund or other payments to collect that debt. The FCC may also provide this information to these agencies through the matching of computer records when authorized. In addition, all information provided in this form will be available for public inspection. If information requested on the form is not provided, processing of the application may be delayed or the application may be returned without action.

— End