CALEA: What US Lawful Intercept Law Requires and How to Secure It

The Communications Assistance for Law Enforcement Act (CALEA) obliges US carriers to build interception capability into their networks, and every such capability is also a target for anyone who wants to read the same traffic without a warrant. CALEA has been law since 25 October 1994, but interest in it rose sharply after US agencies said in late 2024 that PRC-affiliated actors had accessed telecom systems holding information subject to court-ordered law enforcement requests. In January 2025 the FCC tried to read a network-wide cybersecurity duty into CALEA, then rescinded that ruling in November 2025, so many summaries online are out of date. This guide explains what the statute and the FCC rules actually require today, who is covered, how enforcement works and what a compliance programme looks like. It is for carrier compliance officers, security leads at broadband, VoIP and mobile providers, and the vendors and trusted third parties who serve them. The engineering of intercept platforms is covered in the Lawful Intercept System Security guide; the UK counterpart is the UK Investigatory Powers Act Guide for Security Teams.

Key takeaways

• CALEA is a capability law, not a surveillance power. It requires carriers to be able to isolate and deliver communications and call-identifying information when served with lawful authority; the authority itself comes from the Wiretap Act, FISA and pen register statutes.
• Coverage reaches broadband and interconnected VoIP. The FCC extended CALEA in its 23 September 2005 order to facilities-based broadband internet access and interconnected VoIP providers; information services remain excluded.
• Section 105 is the security clause. Interception within a carrier's switching premises may be activated only under a court order or other lawful authorisation, with the affirmative intervention of an individual carrier officer or employee.
• The 2025 cybersecurity ruling is gone, the procedural rules are not. FCC 25-81, adopted 20 November 2025, rescinded the January 2025 declaratory ruling (FCC 25-9); the System Security and Integrity rules in 47 CFR 1.20003 to 1.20005 still apply.
• Penalties run per day. A court can order compliance and impose a civil penalty of up to $10,000 per day under 18 U.S.C. 2522, and the FCC enforces its CALEA rules through forfeitures under 47 U.S.C. 503(b).

Scope: who and what is covered

CALEA applies to telecommunications carriers, and in parts to equipment manufacturers and providers of telecommunications support services. 47 U.S.C. 1001(8) defines a carrier as an entity transmitting or switching wire or electronic communications as a common carrier for hire, and includes commercial mobile service providers and any provider the FCC finds is a substantial replacement for local telephone exchange service where coverage is in the public interest. It excludes entities to the extent they provide information services, and any class the FCC exempts after consulting the Attorney General.

Two definitions decide most scope questions. Call-identifying information is dialling or signalling information identifying the origin, direction, destination or termination of each communication. Information services cover generating, acquiring, storing, transforming, processing, retrieving or making available information via telecommunications, including electronic messaging, but not a carrier's management of its own network. A provider offering both kinds of service is covered for the telecommunications part.

Key obligations

Assistance capability, 47 U.S.C. 1002

Section 1002(b) limits these duties. Law enforcement may not require any specific design or system configuration, or prohibit adoption of any equipment or feature. A carrier is not responsible for decrypting communications encrypted by a subscriber, unless the carrier provided the encryption and has the information needed to decrypt. In emergencies a carrier may meet the delivery requirement by allowing monitoring at its premises if that is the only means.

Systems security and integrity, Section 105 and the FCC rules

Section 105 (47 U.S.C. 1004) requires that interception or access to call-identifying information effected within a carrier's switching premises can be activated only under a court order or other lawful authorisation and with the affirmative intervention of an individual officer or employee of the carrier acting under FCC rules. The FCC implements this in 47 CFR Part 1 Subpart Z:

• Section 1.20003, policies and procedures: appoint a senior officer or employee responsible for lawful activation; state that personnel need both legal authorisation and carrier authorisation before enabling an interception; describe how long records are kept; append the senior officer's name and job function and 24 hours a day, seven days a week contact details for law enforcement; report any compromise of a lawful interception to unauthorised persons, and any unlawful electronic surveillance on the premises, to the affected agencies within a reasonable time upon discovery.
• Section 1.20004, records: for every interception, authorised or not, keep a single certification with the telephone or circuit numbers, start date and time, the officer who presented the authorisation, the signer of the legal authorisation, the type (for example pen register, trap and trace, Title III or FISA) and the overseeing carrier employee, who signs it; compile it at the time or within a reasonable period and keep it for a reasonable period set by the carrier.
• Section 1.20005, submission: file the System Security and Integrity (SSI) plan before starting service and within 90 days of a merger, divestiture or policy amendment. Since 29 June 2023 plans must be filed through the confidential CALEA Electronic Filing System (CEFS).

Standards and trusted third parties

Under 47 U.S.C. 1006(a)(2) a carrier that complies with publicly available technical requirements or standards from an industry association or standards body is treated as compliant with Section 1002; J-STD-025 is the best known example for circuit and mobile networks. The FCC says carriers may build their own solution, buy one from a manufacturer, or use a trusted third party (TTP), and that the carrier remains responsible for compliance when it uses a TTP. The FCC does not review manufacturer solutions.

Timeline and current status

The FCC gave four reasons for rescinding: it had announced an interpretation without implementing rules, on which CALEA enforcement depends; it ignored the "within its switching premises" limit in Section 105; it disregarded court readings of the Wiretap Act as covering real-time interception rather than stored data; and it imposed uniform duties without targeting specific threats. The order points instead to carriers' voluntary commitments after the Salt Typhoon intrusions (faster patching, updated access controls, disabled unnecessary outbound connections, threat hunting and stronger vendor contracts), information sharing through the communications ISACs and CSRIC, and targeted proceedings in other areas. Policy may change again, so treat the rescission as the position as of 8 November 2026.

Enforcement and penalties

• Court orders: under 18 U.S.C. 2522, a court that authorises an interception can, on finding that a carrier has failed to comply with CALEA, order the carrier to comply immediately and order a manufacturer or support service provider to supply needed modifications. The Attorney General can also seek such an order in a civil action.
• Civil penalty: a court issuing an order may impose up to $10,000 per day for each day in violation after the order or a later date it sets, against carriers, manufacturers and support service providers. Courts weigh the nature and extent of the violation, ability to pay, good faith and timely efforts to comply, effect on the ability to continue business, culpability and length of delay.
• FCC enforcement: 47 CFR 1.20008 says the FCC enforces violations of its CALEA rules using the forfeiture provisions of 47 U.S.C. 503(b) and 47 CFR 1.80.
• Petitions as a relief route: deficiency petitions challenge standards under 1006(b); extension petitions under 1006(c) may be granted where compliance is not reasonably achievable with available technology, for up to two years each; cost recovery petitions under 1008(b) ask whether a capability is reasonably achievable, and the FCC must decide within one year.

Beyond CALEA, a compromised intercept platform can trigger other duties, such as the FCC breach rules for customer proprietary network information covered in the FCC CPNI and Telecom Data Breach Rule Guide.

What it means for AI agents and non-human identities

CALEA was written for switches and human technicians, but intercept estates now run on automation, service accounts and certificates. Several rules bite directly.

• A human must stay in the activation path: Section 105 and 47 CFR 1.20003 require the affirmative intervention of an individual carrier officer or employee. Provisioning pipelines, orchestration tools or AI agents can prepare an intercept, but a named employee must approve its activation, and the certification must name that person.
• Machine credentials are the route in: the advisories behind the Salt Typhoon intrusions describe captured device credentials and AAA keys. The Salt Typhoon Telecom Intrusions breach page shows how stolen network device secrets kept access open for years. Vault, rotate and scope every account and key that can reach provisioning or mediation systems.
• Certificates are identities: intercept components authenticate each other with keys and certificates; give them an inventory, owners and expiry tracking like any other non-human identity. See the Telecoms Identity Security Guide.
• Reconciliation needs attributable logs: the 1.20004 certification is only useful if every activation, by human or system, is logged to an identity that can be compared with the order register.
• Third parties hold identities too: a TTP or vendor support account with access to intercept functions is the carrier's responsibility; restrict it to named, time-bound access with session recording.

Compliance steps

1. Confirm scope. Map each service to telecommunications or information service, and record the legal basis for any service treated as excluded.
2. Choose the capability route. In-house, manufacturer or TTP; document which industry standard you rely on for safe harbour and keep vendor attestations.
3. Write the SSI plan. Senior officer, dual legal and carrier authorisation, record retention period, 24x7 contact appendix and the compromise reporting procedure, filed through CEFS before service and within 90 days of changes.
4. Run the certification process. One signed certification per interception with all 1.20004 fields, kept in a restricted register.
5. Isolate and harden the intercept estate. Separate management plane, phishing-resistant MFA, least privilege and dual control, following the Lawful Intercept System Security guide.
6. Reconcile and monitor. Compare active intercepts against the authorised order register on a schedule and alert on any mismatch.
7. Rehearse compromise reporting. Tabletop an intercept compromise, including who notifies which agency and within what internal target time.
8. Track regulation. Watch FCC dockets, including PS Docket No. 22-329, for new rulemaking after the 2025 rescission.

Practitioner checklist

• Record which services are CALEA covered and why any are excluded as information services.
• Keep the SSI plan current in CEFS and refile within 90 days of any merger, divestiture or policy change.
• Confirm the senior officer and 24x7 contact details in the plan appendix are accurate today.
• Require a named employee approval for every activation, including automated provisioning.
• Keep a signed 1.20004 certification for every interception, authorised or not.
• Reconcile active intercepts against the order register and treat any orphan as an incident.
• Vault and rotate every credential and certificate that reaches intercept functions.
• Rehearse reporting of an intercept compromise to affected agencies.
• Review TTP and vendor access to intercept systems at least quarterly.

Standards and references

• Cornell LII: 47 U.S.C. 1002, Assistance capability requirements
• Cornell LII: 47 U.S.C. 1004, Systems security and integrity
• Cornell LII: 47 U.S.C. 1001, Definitions
• Cornell LII: 18 U.S.C. 2522, Enforcement of CALEA
• FCC: Communications Assistance for Law Enforcement Act
• Cornell LII: 47 CFR 1.20003, Policies and procedures for employee supervision and control
• Cornell LII: 47 CFR 1.20004, Maintaining secure and accurate records
• Federal Register: FCC 25-81 Order on Reconsideration rescinding the CALEA Declaratory Ruling

Related NHI Mgmt Group resources: Lawful Intercept System Security · Salt Typhoon Threat Actor Profile · Telecom Network Security Guide · Telecoms Security Laws Map. This guide summarises the Communications Assistance for Law Enforcement Act and the FCC's CALEA rules and is not legal advice.