According to a final order issued by the Federal Communications Commission in late September, all broadband Internet service providers and many Voice over Internet Protocol, or VoIP, companies will have 18 months--until spring 2007--to ensure their systems have backdoors that allow police to eavesdrop on their customers' communications for investigative purposes.

The 59-page order (click for PDF) followed years of pressure from the FBI, the Justice Department and the Drug Enforcement Administration. It would broaden the Communications Assistance for Law Enforcement Act (CALEA), an 11-year-old wiretapping law that currently applies only to "telecommunications carriers."

The FCC has justified the expansion on the basis of terrorism and homeland security concerns, echoing Bush administration officials who have warned, for example, of the perils of VoIP services in rogue hands.

But even as the order kicks in, it remains unclear exactly what classes of providers within those broad categories must comply with the new rules or what exactly they must do to achieve compliance.

The FCC said in its original order that it reached "no conclusions" about whether universities, research institutions, and small or rural broadband providers should be subject the requirements. It sought comments on that topic through subsequent FCC notice. The deadline for receiving that initial round of suggestions also happens to be Monday.

The order's vagueness has perplexed some groups hoping to submit constructive suggestions. In comments filed last week with the agency, C&W Enterprises, a small broadband provider in rural Western Texas, wrote, "it is difficult to assess what the costs would be for our company or what type of exemption we would advocate without knowing what we will be required to do under the CALEA rules."

The FCC also sought comments on whether to broaden the scope of wiretapping requirements for VoIP services. The original order imposes that burden only on "interconnected" VoIP providers, such as Vonage and SkypeOut, which route calls through the public telephone network--leaving others, such as peer-to-peer services, unaffected by the rules.

An FCC representative acknowledged last week that the existing order does not set specific requirements. Instead, it is designed to "get the industry thinking" about making the changes "so they can begin to incorporate CALEA compliance," he said.

The agency plans to release another order clarifying those points--though as for when, the representative said, "I don't have any sense for that now." (The original order said a follow-up should be expected "in the coming months.")

Some industry representatives reported that they're already seeking ways to comply as they await the more detailed rules. The cable broadband industry, which counted about 1.2 million VoIP customers and 23.5 million Internet subscribers as of the second quarter of this year, is "working with the FBI on a CALEA solution for cable broadband service," said Brian Dietz, spokesman for the National Cable and Television Association.

Verizon executive Douglas Sullivan said Friday that his company supports the government's "legal conclusions" about expanding the reach of CALEA and has been working with vendors over the past few years to build compliant equipment. He noted that several unanswered questions remained, including how to recover costs associated with the changes and how enforcement will operate. "We understand that the commission intends to address these issues in a follow-up order we hope will be issued very soon," Sullivan said in an e-mail interview.

Meanwhile, preliminary legal challenges to the rules linger. The first one came from the American Council on Education, which has said universities and research institutions deserve to be exempted from the regulations because the changes required are too expensive and would prompt inevitable tuition hikes. A day later, a coalition of groups, including the Center for Democracy and Technology and the VoIP company Pulver.com, issued their own one-page notice of appeal. They intend to argue that Congress never intended for CALEA to apply to the Internet and that the FCC has stepped outside its bounds.

The court, as expected, consolidated both groups' challenges into one proceeding but has not yet taken any other actions, said John Morris of the Center for Democracy and Technology. The groups have until late November to file more detailed statements about the claims they're alleging.