A new addition to a 1994 wiretap law has colleges and universities across the nation worried, and Duke is no exception.
The Communications Assistance for Law Enforcement Act required telephone carriers to re-engineer switching systems to facilitate surveillance by federal agents more than a decade ago.
But under an order issued in August and announced publicly in the Federal Register two weeks ago, the law's reach will extend to allow easier monitoring of Internet communications.
The new rules concern providers of facilities-based broadband access and voice-over Internet protocol services, including universities, libraries, airports, commercial providers and cities that provide access. The change will take effect Nov. 14 and will require full compliance by spring 2007.
The American Council on Education, a coalition of colleges and universities, and EDUCAUSE, a group that aims to improve higher education through technology, have both begun exploring the rule change and possible legal avenues of response. Duke is a member of both groups.
ACE filed an appeal in the District of Columbia federal court Monday challenging the regulations. The brief described the changes as "arbitrary, capricious and contrary to law."
John Burness, senior vice president for public and government relations, voiced frustration with the change.
"This seems like a bit of overkill," he said. "At a time when government is criticizing higher education for raising tuition, this is a huge unfunded mandate."
Because the specifics of the law are not yet clear, it is difficult to estimate the potential cost of adapting existing systems.
"There is no consensus. In the best case, our current hardware will handle all the demands," said Chris Cramer, information technology security officer in the Office of Information Technology and an EDUCAUSE representative. "In the worst case, our hardware will not cover them at all."
As a result, the cost to Duke could run from nothing to a full system replacement valued at about $20 million. ACE estimates the total cost to universities and colleges nationwide will be $7 billion.
Cramer said part of the problem with interpreting the ramifications of the change is that it is vaguely worded.
EDUCAUSE has been working to establish what precisely the regulation will mean in practice, he said, adding that OIT may submit comments on the legal brief.
Burness said the University prefers the current system-requiring court intervention to monitor communications-instead of the sweeping mandate both for financial and invasion of privacy concerns. The new rules will still require a court order prior to surveillance.
Duke has not yet discussed any independent legal actions, he said.
"It feels as though the regulation has really snuck up on us," Cramer said. "This is one that has every university concerned to one degree or another."
Get The Chronicle straight to your inbox
Signup for our weekly newsletter. Cancel at any time.