03-30258. Implementation of Section 104 of the Communications Assistance for Law Enforcement Act

AGENCY:

Federal Bureau of Investigation, (FBI), Justice.

ACTION:

Final notice of capacity; supplement for the purpose of responding to remand.

SUMMARY:

By this notice, the FBI is responding to a court decision to remand for further explanation two issues from the final notice of capacity. The final notice of capacity was published on March 12, 1998, at 63 FR 12218, pursuant to the requirements of the Communications Assistance for Law Enforcement Act (“CALEA”), 47 U.S.C. 1001, et seq. Because the court did not vacate the final notice of capacity, we are providing further explanation as to the two remanded issues and are not republishing the final notice of capacity. Telecommunications carriers should note that the provisions of 47 U.S.C. 1003(d) do not apply to today's notice and should not file a “carrier statement” in response thereto. Comments on this notice may be submitted in accordance with the instructions below.

DATES:

Written comments must be received at CALEA Implementation Unit, 14800 Conference Center Drive, Chantilly, VA 20153 on or before February 3, 2004.

FOR FURTHER INFORMATION CONTACT:

Contact the CALEA Implementation Unit, Federal Bureau of Investigation (FBI) at [phone], or at CALEA Implementation Unit, 14800 Conference Center Drive, Chantilly, VA 20153.

I. Background

Congress enacted CALEA in 1994 to require telecommunications carriers to ensure that their networks have the capability to enable local police, Federal officers and all other law enforcement agencies to conduct lawfully authorized electronic surveillance. Electronic surveillance is an indispensable tool used in investigating serious crimes, including terrorism, drug trafficking, and kidnaping. Congress has long recognized the importance of this investigative technique, and has authorized and governed its use through several laws, including Title III of the Omnibus Crime Control and Safe Streets Act of 1968, 18 U.S.C. 2510 et seq. (“Title III”), the Electronic Communications Privacy Act of 1986, 18 U.S.C. 2701 et seq. (“ECPA”), and the Pen Registers and Trap and Trace Devices provisions, 18 U.S.C. 3121 et seq., as those laws were recently modified by the USA PATRIOT Act, Public Law 107-56, 115 Stat. 272, recently.

Under these laws, the government can obtain authority to intercept various forms of transmitted communications, including but not limited to, telephone conversations, pager messages, electronic mail, and computer data transmissions. Communications interceptions, commonly referred to as “wiretaps,” are strictly regulated by Title III. With few and limited exceptions, wiretaps are prohibited without prior court authorization. The threshold level of proof to obtain such authorization includes a determination that probable cause exists to believe that the communications to be intercepted will constitute evidence of a crime.

The government can also obtain authority from a court to use a “pen register” or “trap and trace device.” This requires a lower amount of proof than that required under Title III. Pen registers and traps and traces may not be used to intercept communications; rather, they are used to acquire “call identifying information.” This information includes the dialing and signaling associated with a communication. See 47 U.S.C. 1001(2) (definition of “call identifying information”). Telephone numbers and the routing information in a packet header are both examples of call identifying information. Pen registers are devices or processes for acquiring outgoing dialing, routing, addressing and signaling information, and traps and traces are used to record such information as it is incoming. 18 U.S.C. 3127(3), (4).

The electronic surveillance laws cited above delineate the government's lawful authority to intercept communications and acquire call-identifying information. CALEA, by contrast, is intended to preserve the government's technical ability to engage in electronic surveillance as allowed by law. It does so by requiring “telecommunications carriers” to design or modify their systems to ensure the government's ability to intercept communications and acquire call-identifying information, pursuant to lawful authorization. See generally 47 U.S.C. 1002.

In addition, CALEA contains “capacity requirements.” See generally id § 1003. The capacity provisions generally require carriers to be capable of supporting a certain number of communications interceptions, pen registers, and traps and traces at the same time. These provisions also require the Attorney General to issue a notice of the maximum and actual capacity requirements setting forth the “maximum” and “actual” number of communications interceptions, pen registers, and traps and traces that all government agencies may, in the future, conduct and use at the same time. The FBI Director is the authorized delegate of the Attorney General with respect to the implementation of CALEA, and therefore has issued such notices of capacity on the Attorney General's behalf.^[1]

A. Notices of Capacity

In 1995, the FBI published an initial notice of capacity which expressed capacity requirements in terms of a “percentage of engineered capacity.” 60 FR 53643 (Oct. 16, 1995). After receiving comments from the public we revised that methodology and published a second notice of capacity. 62 FR 1902 (Jan. 14, 1997). After an additional round of comments, we published the final notice of capacity (referred to herein as the “final notice”) on March 12, 1998. 63 FR at 12218-12310. At all times, we sought and incorporated the comments of the telecommunications industry, which assisted us in understanding the challenges facing the industry and others in applying the capacity requirements. The FBI acted on behalf of all Federal, State and local law enforcement agencies nationwide in establishing these capacity requirements.

The capacity requirements contained in the final notice were based on data obtained through a survey of Federal and State court clerks, law enforcement agencies, and telecommunications carriers. These entities were requested to provide records of any past surveillance activity conducted between January 1, 1993, and March 1, 1995. After gathering and organizing this data, we formed “baseline” numbers of surveillances for each region in the country.^[2] The final notice identified capacity requirements for telecommunications carriers offering local exchange services (referred to as “wireline”) and wireless carriers providing certain commercial mobile radio services, specifically cellular service and personal communications service (PCS).^[3]

Counties ^[4] were used as the geographic region in identifying capacity requirements for wireline carriers. With respect to wireless services, the Federal Communications Commission (FCC) utilizes 306 Metropolitan Statistical Areas (MSA) and 428 Rural Statistical Areas (RSA) for cellular licensing purposes; and 51 Major Trading Areas (MTA) and 493 Basic Trading Areas (BTA) for PCS licensing. Each of these geographic regions was used in identifying capacity requirements for cellular and PCS services respectively. For purposes of this publicaiton, we will collectively refer to all of these types of wireless service areas as “market service areas.”

The baseline numbers were derived from analysis of the number of surveillances that were ongoing on particular days during the survey period.^[5] The final notice describes in detail how the baselines were calculated. See 63 FR 12224-26. As the final notice describes, we chose to count multiple surveillances ongoing on the same day as occurring “simultaneously” for the purpose of determining capacity requirements. For example, if the survey data had indicated that on January 2, 1993, in a particular market service area, Title III surveillance had been established on two cellular telephones, and a pen register had been installed on a third, then these would have been counted as three simultaneous surveillances. Having formed baselines, we thereafter generated the capacity requirements by multiplying the baseline by a growth factor. The FBI chose in the final notice to publish capacity requirements in the form of a single “actual” and “maximum” number for each region, rather than as separate numbers for the different types of surveillance (communications interceptions and pen registers/traps and traces).

B. Court Decision

On January 18, 2002, the District of Columbia Circuit ruled on a number of challenges to the final notice. See USTA v. FBI, 276 F.3d 620 (D.C. 2002). While the Court's decision largely upheld the final notice, it vacated one issue and remanded two others to the FBI. The Court vacated the statement in the final notice (63 FR 12219) that “law enforcement considers 5 business days from a telecommunications carrier's receipt of a court order to be a reasonable time within which to permit an incremental expansion up to the maximum capacity.” USTA, 276 F.3d at 627. The Court also required the FBI to provide further explanation of: (1) our decision to count any two historical surveillances occurring on the same day as simultaneous and, (2) our decision to set forth only one “actual” and one “maximum” capacity requirement number per region, rather than separate requirements for each type of surveillance.

The Court's concern with both of these issues centered on the explanations contained in the final notice. The Court did not vacate these portions of the final notice, but directed the district court to remand them to the FBI for a more adequate explanation.

II. Response to the Remand

This publication responds to the Court's remand by addressing both issues as follows. First, we provide additional explanation, not previously before the Court, for our interpretation of the term “simultaneously.” Second, we are supplying carriers with supplemental guidance with regard to the previously-published numerical capacity requirements by providing a method of breaking those numbers down between communications interceptions and acquisitions of call-identifying information.^[6] This additional guidance should further assist carriers in their efforts to comply with CALEA's capacity requirements, while at the same time it will address the concerns raised by the remand. Following the end of the comment period, the FBI will review any such comments it receives and publish a finalized notice in the Federal Register.

A. Meaning of “Simultaneously”

The first issue we address herein is the interpretation of the term “simultaneously.” The Court of Appeals noted that the final notice “treated interceptions as ‘simultaneous’ if they occurred on same day, even though they may each only take moments and do not overlap in the least.” USTA, 276 F.3d at 626. We understand the Court's concern to be that communications, such as telephone calls for example, could be short in duration, and interceptions of two or more of them on the same day might “not overlap” if they occurred at different times. The Court directed us to provide further explanation for our determination of capacity requirements based not on a number of overlapping communications interceptions, but on a number of surveillances ongoing on the same day.^[7]

In response to the Court's direction, the FBI provides the following further explanation of its capacity methodology. First, the FBI examined the statutory language of CALEA. This examination suggested that 47 U.S.C. 1003 permits using same day data. The statute only requires that the government provide estimates of interceptions, pen registers, and trap and traces that law enforcement “may conduct and use simultaneously.” 47 U.S.C. 1003(a)(1)(A), (B). The word “may” indicates that capacity requirements should represent a number of interceptions that might take place. Second, the FBI examined how other courts have interpreted the word simultaneously. These cases suggested that the word simultaneous can be interpreted more broadly than coterminous, giving the FBI additional latitude to use the data available. Third, the FBI offers an explanation of how technology impacts capacity requirements. This explanation shows how using the number of same day ongoing surveillances provides a technology neutral approach allowing carriers to use their expertise to efficiently design their systems. For example, some technical intercept solutions require dedicated hardware for the duration of a court order regardless of whether the target is actually communicating, while an alternative technical intercept solution requires carriers' resources only when communications occur. Finally, we explain how the capacity requirements are based on data and expressed in terms within the FBI's and other law enforcement agencies' expertise. The FBI's particular expertise includes knowledge of the historical patterns of criminal activity within our jurisdiction, and of the investigative resources historically needed to detect and prevent such activity. Our expertise also includes an understanding of the frequency with which we have had to rely on electronic surveillance as a tool, and of the implications of limitations on its use in the future.

1. Statutory Language

As set forth above, CALEA requires the government to estimate the number of interceptions, pen registers, and trap and trace devices, that law enforcement authorities “may conduct and use simultaneously.” 47 U.S.C. 1003(a)(1)(A), (B) (emphasis added). These terms, including the word “simultaneously,” are not defined in CALEA.

First, we believe that CALEA's language supports the FBI's approach to the capacity requirements, even when viewing the term “simultaneously” as referring only to precisely coterminous actions. This is because Congress directed us to estimate the number of interceptions, pen registers, and traps and traces that law enforcement agencies “may conduct and use simultaneously.” (emphasis added). The term “may” indicates that capacity requirements should represent a number of interceptions that might take place, which is precisely what the FBI approach accomplishes. For example, in our experience, criminal suspects may, like anyone else, make and receive phone calls at any time of the day or night. Thus when two or more telephones are under lawful surveillance on the same day, calls may occur at any time and thus “may” result in communications interceptions at the same exact time. Our establishment of capacity requirements based on a number surveillances on the same day is therefore a reasonable basis on which to predict the number of precisely coterminous interceptions that law enforcement agencies “may” conduct.

Second, in common usage, the word “simultaneously” could encompass events that are not precisely coterminous but happen on the same day or around the same time. This understanding has been applied in court opinions as well. See, e.g., Mendes-Silva v. United States, 980 F.2d 1482, 1486 (D.C. Cir. 1993) (“simultaneous administration” of drug defined by party as administration on “the same day”), cert. denied, 479 U.S. 923 (1986); San Luis Obispo Mothers for Peace v. NRC, 789 F.2d 26, 40 n.11 (D.C. Cir. 1986) (“simultaneous occurrence” of earthquake and nuclear accident defined as occurrence of the two events within “48 hours”). Courts also refer to actions, such as the filing of motions, as “simultaneous” if they occur on the same day. See generally, Spenkelink v. Wainwright, 442 U.S. 1301, 1303 (1979) (per Rehnquist, J., in chambers) (“[t]he District Court simultaneously entered a second order”); Dillard v. Industrial Comm'n of Virginia, 416 U.S. 783, 792 (1974) (insurance company “[s]imultaneously” applied for a regulatory hearing and discontinued payments to insured); City of Orrville v. FERC, 147 F.3d 979, 984 (D.C. Cir. 1998) (on “same day” that one party requested a rehearing another party “simultaneously moved to intervene”). The FBI's treatment of interceptions occurring on the same day as simultaneous, is therefore, a permissible interpretation of this statutory term.

We further note that the statute directs us to give notice of a number of simultaneous surveillances of all types, not just interceptions. In pertinent part, it states that the Attorney General should “provide * * * notice of the * * * number of communications interceptions, pen registers, and trap and trace devices * * * that the Attorney General estimates that government agencies authorized to conduct electronic surveillance may conduct and use simultaneously.” 47 U.S.C. 1003(a)(1)(A) (emphasis added). This provision plainly contemplates, among other things, the “use” of a pen register or trap and trace device, simultaneously with the “conduct” of one or more interceptions. Although, as the Court observed, two communications interceptions might not overlap if they occur at different times of the day, the same cannot be said for either the simultaneous “use” of two or more pen registers or trap and devices, or the simultaneous use of such device(s) with the conduct of an interception. Since a pen register or trap and trace device may be said to be in “use” for so long as it is installed on a line, and not just when it is actually obtaining information, then its “use” would continue throughout each day over the time period that it is installed. The device's use would then occur “simultaneously” with the conduct of any communication interceptions on the same day, irrespective of the time. It would also be simultaneous with the use of any other pen register or trap and trace devices on the same day. Our approach to the capacity requirements is consistent with this reading of the statutory language, since we counted the numbers of ongoing surveillances of all types on a single day in determining the baselines. For all of the reasons discussed above, we opine that it is appropriate to determine and express the capacity requirements in terms of a number of surveillances ongoing on the same day.

2. Law Enforcement Needs and Capacity Requirements

The FBI's approach to the capacity requirements is based on the premises: (A) that carriers will need to use certain resources to assist with each lawful surveillance, and (B) that more resources might be needed for each additional surveillance initiated while others are ongoing. As the Court is aware, we sought, to determine a number of surveillances that might be ongoing on the same day within particular geographic regions. Having notice of this number, we believed, carriers (as well as law enforcement agencies) would be able to anticipate and plan for the amount of resources they might need to use in order to facilitate the specified number of surveillances. Ultimately, therefore, our approach was intended to ensure the important goals that carriers will have the appropriate notice and will make the appropriate level of resources available in order to meet law enforcement's surveillance needs.

We now seek to provide the Court with further explanation of our approach. First, determining the capacity requirements as a number of ongoing surveillances is an approach that is “neutral” as to the system design chosen by the carrier to meet the requirements. By contrast, determining and expressing the requirements in terms of a number of overlapping communications interceptions would assume the carrier's system only utilizes additional resources when the communications interceptions overlap. In fact, some carriers' systems require additional dedicated resources for each additional ongoing surveillance, notwithstanding whether communications interceptions overlap.

Second, our approach allows the industry the flexibility to use its expertise to design different systems and allows law enforcement agencies to benefit from such expertise. Under the FBI's approach, a carrier is not precluded from designing and implementing different systems for meeting the requirements, including systems that do not require dedicated resources for each additional surveillance. If the number of overlapping communications were relevant to a carrier's chosen design, the telecommunications industry may rely on its special, if not unique, expertise in determining the extent to which that might occur.

(a) The Final Notice Determined Capacity Requirements in a System-Neutral Manner

Determining capacity requirements in a system-neutral manner is necessary because CALEA did not authorize the FBI to require any specific system design. See 47 U.S.C. 1002(b)(1). In addition, we know that carriers in fact use designs that differ in their capabilities to accommodate multiple surveillances at the same time. To accommodate these realities, we sought to give carriers notice of a number of surveillances that may be conducted at the same time, because they may need to use more resources to support each additional surveillance while others are ongoing. This is in fact the case in systems that are designed to use specific resources for the entire time that a surveillance is ongoing, even when no communication is actually being intercepted.

For example, some telecommunications switches are designed to send lawfully intercepted communications and call-identifying information to a law enforcement agency over a high-capacity connection referred to as a “T1.” These systems are designed such that a T1 connection must be dedicated to the surveillance for the entire time that the surveillance is in effect. The number of T1 connections that can be supported at one time by a telecommunications switch is limited. Hence, such a carrier would likely need to be able to support multiple T1 connections in order to facilitate multiple surveillances on the same switch on the same day.

CALEA's legislative history indicates that Congress may have contemplated a similar example when enacting CALEA's capacity provisions in the first instance. At the time of CALEA's enactment, Congress was made aware by the FBI of a number of cases where lawfully authorized surveillance had been impeded due to insufficient “cellular port capacity.” See H.R. Rep. No. 103-827, 103rd Cong., 2nd Sess., at 15 (1994). At this time, cellular telephone surveillance was conducted by accessing a subject's communications at the telecommunications switch through one of a limited number of access ports used for maintenance. Hence, each interception required the use of another access port, and the number of interceptions that could be active at the same time was limited by the number of available ports.

In both of the above examples, the ability of the carrier's system to accommodate multiple surveillances at the same time is limited. Importantly, this ability is limited by the number of surveillances ongoing at the same time, not by the number of overlapping communications actually being intercepted at the same time. If we were to adopt an alternative approach by determining capacity requirements based on a number of overlapping communications interceptions, then the capacity requirements based thereon would not provide carriers with systems similar to the examples above with notice of the number of surveillances they could be required to accommodate at the same time. Such carriers might then underestimate the resources necessary to support those surveillances. In order to ensure that all carriers will have the information they need in order to meet law enforcement's needs, the capacity requirements should therefore be based on a number of ongoing surveillances.

We are aware, however, that some carriers' systems function differently. For example, some telecommunications switches are capable of sending intercepted communications and call-identifying information over an ordinary phone line, by “dialing-out” such information each time a communication occurs. In these systems, the switch resources are released after the intercepted communications are transmitted and become available for other uses. The carriers' ability to facilitate multiple surveillances in these cases might to some degree be affected by the number of overlapping communications interceptions. Nevertheless, we cannot base the capacity requirements on an assumption that all carriers' systems have this or similar abilities, because, in fact, many do not.

Nothing in our approach to the capacity requirements would preclude a carrier from meeting them by using a “dialing-out” capability or any other system design. Having notice of the number of surveillances that law enforcement agencies may conduct at any given time, carriers and their manufacturers and suppliers could engineer methods of facilitating that number of surveillances without reliance on additional resources being dedicated for each additional surveillance maintained. If it were relevant to the system design, members of the telecommunications industry, as discussed below, have special expertise in determining the frequency with which communications (and the interceptions thereof) might overlap.

Applying our preceding explanation, we believe that determining capacity requirements based on a number of same-day surveillances is the most appropriate method for ensuring that carriers will be able to meet law enforcement's surveillance needs.

(b) The Final Notice Allows for Different System Designs and Allows Law Enforcement To Benefit From Industry Expertise

Another benefit not previously presented to the Court is that the capacity requirements stated in the final notice allow carriers to design a system that can meet the requirements through different methods. Stating capacity requirements in terms of a number of simultaneous surveillances thus allows law enforcement agencies to benefit from the special expertise of the telecommunications industry. With notice of the number of simultaneous surveillances that they should be able to facilitate, carriers can use their own expertise to decide how to design a system to facilitate that number of surveillances.

CALEA recognizes that carriers, manufacturers and suppliers are naturally in a position to assess the capabilities of their own systems, and to design and implement technical changes to their systems to meet different demands. The structure of CALEA reflects a recognition that members of the telecommunications industry possess expertise in engineering technical requirements necessary to facilitate lawful surveillance. For example, CALEA allows carriers to design systems that follow an industry-adopted set of technical standards that meet CALEA's requirements. See 47 U.S.C. 1006(c); see also USTA v. FCC, 227 F.3d 450, 460 (referencing CALEA's “unique structure” in delegating the establishment of technical standards to both the telecommunications industry and the FCC).

In order for law enforcement agencies to obtain the benefit of industry expertise, it is most appropriate that the capacity requirements be determined and expressed in terms of a certain number of ongoing surveillances. The industry is then left free to design an appropriate system to meet these requirements. As discussed below, such designs might involve the dedication of certain resources for the duration of each surveillance, or might rely on shared resources that are invoked only when a communication is actually being intercepted and then released when the communication is over, or some combination of both. The capacity requirements set forth in the Final Notice, as discussed above, are “system neutral” in that they do not assume any particular system design.

Carriers, along with their manufacturers and suppliers, possess special expertise in assessing their subscribers's potential use of their telecommunications systems. Carriers routinely in the ordinary course of their business engage in “traffic engineering” to determine the “busy hour,” when the frequency and/or duration of their subscribers” telecommunications activity is highest. In order to guarantee a certain level of service to their subscribers, carriers are necessarily well informed of the level of burden that subscribers are likely to place on the telecommunications system at any given time. Without such knowledge they would not be able to provide the level of service that their subscribers expect. For example, wireline telephone carriers routinely estimate the number of their subscribers who are likely to pick up their telephones at the same time in order to place a call. The same types of assessments are routinely made by carriers with regard to the design and implementation of new “features” that the carrier offers to subscribers, such as call-waiting or conference calling. The carrier's telecommunications system is designed in such a way as to be able to satisfy the subscribers' demands as closely as possible. Such assessments are particularly within the scope of the industry's particular expertise.

Carriers and other industry members are therefore specially, if not uniquely, qualified to assess the burdens that a certain number of surveillances could place on their telecommunications systems. In one sense, the carrier's design of a system to meet CALEA's requirements is analogous to the design of any other “feature” that may be associated with a subscriber's service. Carriers and other members of the telecommunications industry are specially qualified to assess the frequency and duration of the communications made by a subscriber under surveillance, and the extent to which a given number of surveillances might involve communications that overlap, in the event that such an assessment is relevant to the particular system design chosen by the carrier. Indeed, a carrier's routine assessment of its subscribers' use of the telecommunications system will necessarily include an assessment of such use by those subscribers who happen to be under lawful surveillance. For example, in a wireline carrier's system, if an assessment of the frequency and duration of the phone calls made or received by subscribers under surveillance is relevant to the carrier's design of a system to meet the capacity requirements, then the carrier can use its expertise to make that determination. Law enforcement agencies, in turn, will benefit from the industry's expertise in this regard.

3. The Capacity Requirements Are Based on Data and Expressed in Terms Within the FBI's and Other Law Enforcement Agencies's Expertise

The FBI chose the aforementioned approach towards determining capacity requirements because the data and the terms in which we stated the capacity requirements were within our expertise, the area of law enforcement. The data we acquired through our survey, as discussed above, included information regarding the number of surveillances ongoing at certain times within a given geographic area. Our particular expertise allowed us to analyze and derive conclusions from this data regarding the number of surveillances likely to be sought by law enforcement agencies in particular geographic regions at the same time. These data did not include information from which we could determine the number of overlapping communications interceptions. In addition, as outlined below, stating the capacity requirements in such terms would have had little meaning or usefulness to other law enforcement agencies. We offer the following explanation to illustrate why it was reasonable for the capacity requirements to be based on, and expressed in terms of, a number of ongoing surveillances.

The FBI's particular expertise includes knowledge of the historical patterns of criminal activity within our jurisdiction, and of the investigative resources historically needed to detect and prevent such activity. Our expertise also includes an understanding of the frequency with which we have had to rely on electronic surveillance as a tool, and of the implications of limitations on its use in the future. Indeed, we are necessarily familiar with the frequency with which we have sought to conduct communications interceptions, in part through our compliance with the requirements of Federal law regarding reports to the Administrative Office of the Courts. See 18 U.S.C. 2519. Therefore, we believe it was reasonable that our survey focus on determining the frequency with which all law enforcement agencies nationwide have relied upon electronic surveillance in their investigations.

As already stated, the data acquired through our survey cannot be used to determine the frequency of overlapping communications interceptions. Such data did not include any information regarding the hours, minutes and times of day that particular communications interceptions occurred. Rather, the survey data reflects the days over which surveillances were ongoing.

The FBI now offers this further explanation to justify why our reliance on data reflecting numbers of ongoing surveillances was reasonable. First and foremost, an analysis thereof was within the FBI's expertise in assessing the level of investigative resources needed to combat crime. Conversely, a survey and analysis focused on the number of overlapping communications interceptions would not be within our traditional expertise. Such an exercise would be more akin to the “traffic engineering” studies traditionally engaged in by the telecommunications industry. For example, it would require us to make determinations about the extent to which individuals will make or receive phone calls at the same time. As discussed above, if that assessment were relevant to the system design chosen by a carrier, then the carrier is in the most appropriate position to make it.

Second, the capacity requirements set forth in the final notice, in addition to satisfying the requirement for notice to carriers, will serve as guidance to law enforcement agencies in understanding potential technical limitations on the use of electronic surveillance. Agencies can readily comprehend, and if necessary, plan for, being able to conduct only a certain limited number of surveillances at a given time. On the other hand, stating the capacity requirements in terms of a number of overlapping communications interceptions would have little or no meaning to law enforcement agencies.

We further note that initiating a new study to determine the frequency of overlapping communications interceptions would consume a large amount of time and resources, would be problematic, and, for all of the reasons discussed herein, would ultimately not be beneficial to our goal of ensuring that law enforcement's needs are met. Such a study would require us to gather and analyze numerous evidence files in an attempt to determine the exact times at which communications were intercepted and whether or not they overlapped. Because most surveillances are conducted by agencies other than the FBI, most of these files would need to be obtained from third parties, such as other law enforcement agencies or the courts. Given the number of surveillances determined from our survey, this could involve hundreds of files. Moreover, it is also doubtful that such data could even be used to derive a “typical” frequency of overlap among interceptions on which we could reliably base the capacity requirements. First, not every communication that might be intercepted through an ongoing surveillance actually is intercepted, such that it is recorded and entered into evidence files. In particular, some communications made over the facilities subject to the surveillance are not recorded because they are not pertinent to the investigation. See 18 U.S.C. 2518(5) (this is often referred to as the “minimization” requirement under Title III). An incomplete picture of the potential for overlap might therefore be presented through a review of evidence files. Second, the probability for overlap when conducting surveillances in different types of cases could vary greatly. In our experience, some surveillances, such as those in bookmaking or drug dealing cases, may involve many communications interceptions over a relatively short period of time. In other cases, such as kidnaping, only a few communications may be actually intercepted.

Finally, as described above, we believe that estimating the number of overlapping intercepted communications would not be ultimately beneficial to effectively estimating law enforcement's capacity requirements. In particular, as we discuss above, we believe that capacity requirements are most appropriately based on a number of surveillances being conducted on the same day, not on a number of overlapping interceptions.

B. Breakdown of Capacity Requirements by Type of Surveillance

The second issue we address in this publication is the breakdown of capacity requirements by type of surveillance. The statute, as discussed above, directs us to provide “notice of the actual number of communications interceptions, pen registers, and trap and trace devices.” 47 U.S.C. 1003(a)(1) (emphasis added). The FBI decided, therefore, in the final notice to provide an “actual” and a “maximum” number representing a total number of surveillances, for each county and market service area. The Court questioned our explanation of the basis for this decision, noting that the FBI's numbers “drew no distinction between different types of interceptions (e.g., communications content versus mere pen registers).” USTA, 276 F.3d at 626. According to the Court, different types of surveillance may “impose different demands” on the carrier's ability to meet the capacity requirements. Id. at 627. The Court further noted, as we stated in the final notice, that more delivery channels may be needed in order to facilitate a communications interception as opposed to the operation of a pen register and/or a trap and trace device. Id. The Court therefore remanded this issue to us for a more adequate explanation.

The FBI has considered this issue and continues to find that it is appropriate, given the statutory requirements, to state the capacity requirements for each geographic region as a single actual and single maximum number. Moreover, our approach was consistent with the methodology we used to determine the capacity requirements, which, as described above, focused on the highest number of surveillances of any type that were ongoing on a single day or days during the survey period.

Nevertheless, we find that we can further address the court's concerns and at the same time benefit law enforcement agencies and telecommunications carriers, by providing additional guidance on the application of the capacity requirements. We set forth our analysis of the issue and our finding that the method described below achieves this goal by limiting the number of simultaneous communications interceptions that are required to be accommodated in the counties and market service areas with the highest capacity requirements. By so limiting the number of communications interceptions, we are now giving the carriers providing service in these regions guidance that allows them to draw a distinction between different types of surveillances in meeting the capacity requirements.

1. National Average Ratio Is Not an Appropriate Basis

As we stated in the final notice, the ratio of interceptions to pen registers/traps and traces according to the national average, is not an appropriate basis on which to determine capacity requirements. 63 FR 12235-36. This is because our survey determined that the historical experience of each county and market service area varies greatly. In some regions, all or nearly all historical surveillances consisted of communications interceptions, while in others, all of the surveillances were pen registers or traps and traces. Id. The national average ratio of communications interceptions to pen registers/traps and traces is not therefore representative of any specific geographic region.

2. Conclusions From Historical Survey Information

Because a national average ratio would not be appropriate to use, we decided to examine the breakdown between different types of surveillance at the county and market service area level. Using the FBI's original survey data, we examined the percentage of communications interceptions that were included within the historical experience of each county and market service area.^[8] Some general conclusions were able to be drawn from this examination, as described below.

We first examined the data for geographic regions with low historical experience figures, and correspondingly low capacity requirements. Within this group, the portion of total historical experience that consisted of communications interceptions varied widely. For example, for counties with a total historical experience of 10 or less, the percentage amount of communications interceptions from total historical experience ranged from zero to 100. The same variance (zero to 100) was found for wireless services licensed by MSA/RSA, MTA and BTA, but only in market service areas with a total historical experience of 5 or less.^[9]

Continuing with this comparison process for regions with successively higher total historical experience amounts, we found that the percentage of communications interceptions tended to decrease as the total historical experience increased. For the county with the highest historical experience, we found that 25 percent of the total experience were communications interceptions. For the market services area with the highest historical experience, 50 percent of the total historical experience consisted of communications interceptions.

3. Establishment of Percentage Groups

Based on the overall relationships described above, we determined that a breakdown of the capacity requirements by surveillance type could be achieved by placing limits on the extent to which the number of surveillances reflected in the capacity requirements could include communications interceptions. The tendency in our data, as described above, was for a decreasing proportion of communications interceptions as the total number of surveillances increased. We concluded therefore that a set of percentages that decrease as historical experience increases, could be used to limit the number of communications interceptions as a proportion of the total capacity requirement.

We therefore established decreasing percentages, and assigned groups of particular geographic regions to those percentages (hereinafter “percentage groups”) with respect to all counties and market service areas described in the final notice. For counties, the FBI has established four percentage groups: 100, 75, 50, and 25 percent. For each of the three different types of wireless geographic regions (i.e., MSA/RSA, MTA, and BTA) the FBI has established three percentage groups: 100, 75, and 50 percent.

As explained further below, the applicable percentage indicates the highest proportion of capacity requirements (actual and maximum capacity requirements) that could consist of communications interceptions. Regions with low historical experience, and correspondingly low capacity requirements, fall within the 100 percent group. A carrier operating within such a region must be able to accommodate the number of surveillances indicated by the capacity requirement such that all (100 percent) of the surveillances are communications interceptions, or all are pen registers/traps and traces, or some combination of both types of surveillance equal to the capacity requirement. This is consistent with our findings regarding the variability of the types of surveillances within the historical experience of regions with low levels of such experience.

At the other end of the range, regions with high historical experience levels fall within the 25 percent group for counties, or the 50 percent group for market service areas. Carriers operating within these regions must still be able to accommodate the total number of surveillances indicated by their capacity requirement, but the proportion of that number that could be communications interceptions is limited by the applicable percentage. The determination of the percentage groups and the application of the percentage is described in further detail below.

4. Determination of Percentage Groups Applicable to Geographic Regions

Carriers can determine the applicable percentage group by looking at the “historical experience” number associated with their capacity requirements as published in the final notice.

We assigned particular regions to the percentage groups based on their total historical experience. We first examined the historical data to locate the region with the highest number of historical surveillances wherein 100 percent of them were communications interceptions. This number was 10 for capacity requirements determined by county and 5 for capacity requirements determined by market service area. This number became the upper limit of the 100 percent group, and all counties with a historical experience of 10 or less, and market service areas with a historical experience of 5 or less, were then deemed within the 100 percent group.

The process was continued by examining the historical data for all those counties not already falling within the 100 percent group, in order to determine the appropriate upper limit for the 75 percent group. We examined the data for the remaining regions for the highest number of surveillances wherein 75 percent of the total consisted of communications interceptions. This number was 44 for counties and 10 for market service areas. Again, the process was continued with those geographic regions not already deemed to be within the 100 or 75 percent groups. That is, we examined the data regarding the remaining regions to determine the region with the highest number of historical surveillances wherein 50 percent of the total consisted of communications interceptions. This number was 100 for counties. For wireless market service areas, this number was 106, which was also the highest historical experience figure. Hence, all remaining market service areas, those with historical experience figures between 11 and 106 (inclusive), were assigned to the 50 percent group. For wireline services, the remaining counties with a historical experience of 101 or more, were determined to be within the 25 percent group.

Thus, the percentage group applicable to a particular county or market service area can be determined according to its total historical experience, as summarized below.

a. Counties

Counties with a total historical experience between 0 and 10 (inclusive), are in the 100 percent group; between 11 and 44 (inclusive), are in the 75 percent group; between 45 and 100 (inclusive) are in the 50 percent group; and greater than 100, are in the 25 percent group. The following chart summarizes these determinations:

Historical experience	Percentage group
0-10	100
11-44	75
45-100	50
101 or more	25

b. Market Service Areas

The following describes the percentage groups for wireless carriers regardless of the type of geographic region (MSA/RSA, MTA, and BTA). Market service areas with a total historical experience between zero and five (inclusive) are in the 100 percent group; between six and ten (inclusive) are in the 75 percent group; and greater than ten, are in the 50 percent group. The following chart summarizes these determinations:

Historical experience	Percentage group
0-5	100
6-10	75
11 or more	50

5. Application of Percentage to Actual and Maximum Capacity Requirements

Carriers can use the applicable percentage to determine the number of simultaneous communications interceptions that they should be capable of accommodating within their total capacity requirements.

As described above, the actual and maximum capacity requirements specify a total number of surveillances. The applicable percentage is then multiplied by the capacity requirement to determine the highest number of simultaneous surveillances that could be in the form of communications interceptions. If the calculation results in a fraction, then the number of communications interceptions should be rounded up.

The percentage does not change the total number of surveillances specified in the actual and maximum capacity requirements, and does not change the total number of surveillances that carriers must be able to accommodate simultaneously in order to meet the capacity requirements. In cases where the carrier's capacity requirements fall within the 75 percent group, or lower, the percentage will clearly limit the number of simultaneous communications interceptions that a carrier is required to be capable of accommodating. Thus, a carrier must at all times be able to accommodate a number of surveillances equal to its capacity requirement, and the total number of surveillances may be all pen registers/traps and traces or a combination of these and communications interceptions. However, the number of communications interceptions will not exceed the limit, if any, indicated by the applicable percentage. The examples below will illustrate this.

Example 1

Montgomery County, Maryland has a historical experience of 66, an actual capacity requirement of 84, and a maximum capacity requirement of 110. The historical experience of 66 places it within the 50 percent group. Multiplying the percentage by the capacity requirements indicates that the actual capacity requirement is limited to 42 communications interceptions and the maximum capacity requirement is limited to 55 communications interceptions. A carrier providing service in this county is required to be capable of accommodating an actual capacity of 84 pen registers/traps and traces, or any combined number of surveillances equal to 84 where the number of communications interceptions is equal to 42 or less. For example, the carrier must be capable of accommodating 42 simultaneous communications interceptions and 42 simultaneous pen registers/traps and traces. For a further example, the carrier must be capable of accommodating 10 simultaneous communications interceptions and 74 simultaneous pen registers/traps and traces. The same form of analysis applies to the maximum capacity requirements.

Example 2

Metropolitan Statistical Area / Rural Statistical Area (MSA/RSA) 234, Athens, Georgia, has a historical experience of 7, an actual capacity requirement of 12, and a maximum capacity requirement of 20. The historical experience of 7 places it within the 75 percent group. Multiplying the percentage by the capacity requirements indicates that the actual capacity requirement is limited to 9 communications interceptions and the maximum capacity requirement is limited to 15 communications interceptions. A carrier providing service in this MSA/RSA is required to be capable of accommodating an actual capacity of 12 pen registers/traps and traces, or any combined number of both types of surveillances equal to 12, where the number of communications interceptions is equal to 9 or less. For example, the carrier must be capable of accommodating 9 simultaneous communications interceptions and 3 simultaneous pen registers/traps and traces. For a further example, the carrier must be capable of accommodating 2 simultaneous communications interceptions and 10 simultaneous pen registers/traps and traces. The same form of analysis applies to the maximum capacity requirements.

Example 3

Harris County, Texas has a historical experience of 294, an actual capacity requirement of 371, and a maximum capacity requirement of 484. The historical experience of 294 places it within the 25 percent group. Twenty-five percent of 371 is 92.75, which is rounded up to 93. The actual capacity requirement is limited to 93 communications interceptions and the maximum capacity requirement is limited to 121 communications interceptions. A carrier providing service in this county is required to be capable of accommodating an actual capacity of 371 pen registers/traps and traces, or any combined number of both types of surveillances equal to 371 where the number of communications interceptions is equal to 93 or less. For example, the carrier must be capable of accommodating 93 simultaneous communications interceptions and 278 simultaneous pen registers/traps and traces. For a further example, the carrier must be capable of accommodating 10 simultaneous communications interceptions and 361 simultaneous pen registers/traps and traces. The same form of analysis applies to the maximum capacity requirements.

III. Applicable Administrative Procedures and Executive Orders

A. Initial Regulatory Flexibility Analysis

The Regulatory Flexibility Act, 5 U.S.C. 601 et seq. requires the preparation of an initial regulatory flexibility analysis whenever an agency is required by law “to publish general notice of proposed rulemaking for any proposed rule.” 5 U.S.C. 603(a). This publication provides our response to the remand instructions of the Court of Appeals, by providing further explanation and guidance regarding the final notice of capacity issued pursuant to CALEA, 47 U.S.C. 1003. We are not republishing the final notice of capacity, and are therefore not changing the final regulatory flexibility analysis provided with the final notice. Rather, this publication pertains only to the two discrete issues remanded by the Court, those being our interpretation of the term “simultaneously” and our decision to present only one “actual” and one “maximum” capacity requirement per geographic region. Our initial regulatory flexibility analysis is therefore limited to those issues.

The reason for this publication is to respond to the Court's remand instructions. Our objective in issuing it, is to provide further explanation for our interpretation of the term “simultaneously” and to provide additional guidance on the application of the capacity requirements with respect to different types of surveillance (interceptions versus pen registers/traps and traces).

The Regulatory Flexibility Act requires a description of, and if feasible, an estimate of the number of small entities to which a proposed rule will apply. 5 U.S.C. 603(b)(3). A “small entity” in the wired or wireless telecommunications business includes an entity that is independently owned and operated, not dominant in its field of operation, and has fewer than 1,500 employees. 5 U.S.C. 601(6)(1); 15 U.S.C. 632; 13 CFR 121.201. The Bureau of the Census issued the 1997 Economic Census on October 20, 2000. The Economic Census profiles the U.S. economy every 5 years, from the national to the local level. The 2002 Economic Census is currently being conducted, and thus the 1997 data represents the most current information. The 1997 Economic Census reports that there were 2,797 wired telecommunications communications (NAICS code 513310) firms, of which all but 24 had fewer than 1,000 employees. See 1997 Economic Census, Establishment and Firm Size, Publication EC97S51S-SZ. It further reports that there were 1,238 cellular and other wireless telecommunications (NAICS code 513322) firms, of which all but 12 had fewer than 1,000 employees. Firms engaged as telecommunications resellers (NAICS code 513330) numbered 1,417, of which all but 2 had fewer than 1,000 employees. We are unaware of any source of further information from which we could determine the number of firms that are independently owned and operated and not dominant in their field of operation.

This publication imposes no reporting or record-keeping requirements. The final notice imposed certain compliance requirements, the application of which is further guided and clarified by the statements herein. We are not republishing the final notice, nor changing the existing numerical capacity requirements stated therein. We are also providing further guidance as to the application of the capacity requirements in regions with the highest requirements, by setting a maximum number of communications interceptions that is lower than the total capacity requirement. The economic impact of compliance with the capacity requirements for small entities that operate in regions affected by this guidance, therefore, might be lowered if the entity employed a system that could benefit from a requirement for fewer simultaneous communications interceptions. In all other cases the economic impact created by the final notice will remain unchanged by this publication. We therefore find that there will be no significant economic impact on small businesses as a result of this publication. The FBI is unaware of any rules which would overlap, duplicate or conflict with this publication or the statements therein.

B. Executive Order 12866: Regulatory Planning and Review

This publication has been drafted and reviewed in accordance with Executive Order 12866. The FBI does not find that it constitutes a “significant regulatory action” in accordance with that Order. In particular, we had already determined that the final notice of capacity did not meet the criterion for a “significant regulatory action” and that it would not result in an annual impact on the economy in excess of $100,000,000, nor would economically impact State, local or tribal governments. 63 FR 12220. This publicaton does not significantly alter the economic analysis contained in the final notice, except that compliance costs may be reduced in some cases.

In this publication, we are neither republishing the final notice, nor changing the existing numerical capacity requirements stated therein. We are providing further guidance as to the application of the capacity requirements in regions with the highest requirements, by setting a maximum number of communications interceptions that is lower than the total capacity requirement. The economic impact of compliance with the capacity requirements for entities that operate in regions affected by this guidance, therefore, might be lowered if the entity employed a system that could benefit from a requirement for fewer simultaneous communications interceptions. In all other cases the economic impact created by the final notice, remains unchanged by this publication. Although not required by Executive Order 12866, this publication has been submitted for review by the Office of Management and Budget.

C. Executive Order 13132: Federalism

This publication will not have a substantial direct effect of the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government. Therefore, in accordance with Executive Order 13132, it is determined that this publication does not have any federalism implications that warrant preparation of a federalism impact statement.

D. Executive Order 12988: Civil Justice Reform

This publication meets the applicable standards set forth in sections 3(a) and 3(b) of Executive Order 12988, Civil Justice Reform.

E. Unfunded Mandates Reform Act of 1995

We determined in the final notice of capacity that it would not result in the expenditure by State, local or tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more in any one year, and it will not significantly or uniquely affect small governments. This publication only provides further explanation and guidance with regard to two matters contained in the final notice of capacity and would neither alter the analysis contained in the final notice, nor would result in any increase in any expenditures. Therefore, no actions deemed necessary under the provisions of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. 1532(a).

F. Small Business Regulatory Enforcement Fairness Act of 1996

This publication is not a major rule as defined by the Small Business Regulatory Enforcement Fairness Act of 1996, 5 U.S.C. 804. We determined in the final notice of capacity that it would not have an annual effect on the economy of $100,000,000 or more; would not cause a major increase in costs or prices; and would not result in a significant adverse effect on competition, employment, investment or productivity, and innovation, or on the ability of the United States-based companies to compete with foreign-based companies in domestic and export markets. This publication only provides further explanation and guidance with regard to two matters contained in the final notice of capacity and would neither alter the analysis contained in the final notice, nor would result in any increase in expenditures. Some reductions in expenditures by small businesses are possible in certain cases.

G. Paperwork Reduction Act

This Supplement contains no information collection or record-keeping requirements under the Paperwork Reduction Act, 44 U.S.C. 3501 et seq.

Dated: November 4, 2003.

Valerie E. Caproni,

General Counsel, Federal Bureau of Investigation.

Footnotes

1.  See 28 CFR 0.85(o).

2.  We use the term “surveillances” herein, to refer to multiple instances of any type of surveillance, whether communications interceptions, pen registers, and/or traps and traces.

3.  See 63 FR 12220. In the final notice of capacity, PCS was considered a service operating in the licensed portion of the 2 GHz band of the electromagnetic spectrum, from 1850 MHz to 1990 MHz. Id.

4.  The term “counties” includes boroughs and parishes as well as the District of Columbia and independent cities. U.S. territories (i.e., American Samoa, Guam, Mariana Islands, Puerto Rico, and the U.S. Virgin Islands) were considered as single entities.

5.  A single surveillance is an interception, pen register or trap and trace established with respect to a single subscriber line. Thus, a single court order might authorize multiple “surveillances” as that term is used herein. See 63 FR 12224.

6.  For the purposes of this publication, we will use the term “pen register/trap and trace” to refer to the acquisition of call-identifying information, whether incoming, outgoing or both.

7.  The Court referred only to overlapping communications interceptions, and not to pen registers/traps and traces, in its discussion of “simultaneously.” As set forth below, however, the statute also refers to the simultaneous use of pen register or trap and trace devices, as well as the simultaneous use of such a device along with the conduct of one or more communications interceptions. For purposes of this publication, we will first address the Court's cited concerns with regard to non-overlapping communications interceptions.

8.  A “historical experience” figure, representing the baseline number of simultaneous surveillances is published for each county and market service area in the appendices to the final notice.

9.  We used the historical interception activity of cellular carriers to develop projections of future capacity requirements for PCS carriers. See 63 FR 12226.