The Federal Communications Commission is forcing universities to comply with national wiretapping laws by making them alter private networks and the Internet, a move that could cost universities upwards of $7 billion and threaten the privacy of student records, according to reports from the American Council on Education.
The FCC is trying to make universities more compliant with the Communications Assistance for Law Enforcement Act, enacted by Congress in 1994 to ensure that telephone companies operate networks in a manner that allows law-enforcement agencies to install wiretaps with court authorization, the A.C.E. report stated.
At the University of California, the Information Technology Guidance Committee recently convened to address FCC demands and to decide how the university would comply with the CALEA mandates.
According to UCSD student ITGP representative Vincent Pascual, the committee was concerned about CALEA because, through its provisions, the university can be subpoenaed for medical records and other student records.
“Law-enforcement agencies can now monitor usage of the Internet, [Internet Telephone], AOL Instant Messenger and even text messages sent via cell phone,” Pascual said in a recent presentation to the A.S. Council. “Students have not been notified of this usage of CALEA. We need to improve notification to students … and make sure they are clear about this monitoring.”
Though the university normally complies with wiretapping requests, the current CALEA policy is not conducive to student privacy, Pascual said.
“The issue at point here has to do with the fact that CALEA does not serve as a good umbrella policy when it comes to privacy for UC networks,” he said. “The university is attempting to lobby against CALEA’s umbrella application to UC.”
The Higher Education Coalition, made up of various college groups, also opposes the FCC’s extension of CALEA, and members of HEC indicated in a November 2005 presentation to the FCC that there was no reason for universities to alter their current methods of networking.
“Extending CALEA to such institutions is neither necessary to national security nor otherwise in the public interest, in light of the … detrimental impact that significant compliance costs would have on higher educational and research institutions,” the HEC report stated.
Originally, the law extended only to telephone companies, and Congress exempted “information services” such as Internet-access providers and “private networks” found at some universities and corporations.
However, after the 2001 terrorist attacks, the U.S. Department of Justice asked the FCC to expand CALEA coverage to services used as “substantial replacements” for traditional telephone communication, including broadband Internet and online phone services. The FCC also mandated that CALEA provisions be extended by April 2007 to “facilities-based Internet service providers,” such as colleges and universities, who use their own equipment to make their Internet systems. FCC spokesman Mark Wigfield did not respond to requests for comment.
The potential financial impact of altering university Internet services would create a “bottleneck” for UCSD in order to meet the FCC’s requirements, Academic Computing Services Director Tony Wood said last October.
“What we’re concerned about is the expense,” Wood said. “If it requires a lot of money to do something we never have to, we don’t want it.”
Terry W. Hartle, the senior vice president of A.C.E., stated in a report that higher education is in a fix because the FCC’s new legal obligations have been imposed without specifications on how compliance could be achieved. He indicated that the FCC is not clarifying exactly how it wants institutions of higher education to become fully CALEA-compliant, and that it won’t move from its 2007 deadline, creating a problem for universities.
According to Hartle, A.C.E. and a nonprofit group called Educause filed a lawsuit in January to block the FCC from proceeding until it finally explains exactly what it wants from universities. He indicated that a ruling would be likely by August.