Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations 22029

and-comment requirements of the FEDERAL COMMUNICATIONS Synopsis Administrative Procedure Act, see 5 COMMISSION I. Introduction U.S.C. 553(b)(A). 7. Implementation. As a temporary 47 CFR Part 64 1. Each day, Americans receive transition measure, for 90 days after millions of unwanted phone calls. One source indicates that Americans publication of this document in the [WC Docket Nos. 17–97, 20–67; FCC 20– received over 58 billion such calls in Federal Register, U.S. Bank will 42; FRS 16631] continue to process payments to P.O. 2019 alone. These include ‘‘spoofed’’ Box 979088. After that date, forfeiture Call Authentication Trust Anchor; calls whereby the caller falsifies caller payments must be made in accordance Implementation of TRACED Act— ID information that appears on a with the procedures set forth in each Knowledge of Customers by Entities recipient’s phone to deceive them into forfeiture order and on the With Access to Numbering Resources thinking the call is from someone they Commission’s website, www.fcc.gov/ know or can trust. Spoofing has legal licensing-databases/fees. For now, such AGENCY: Federal Communications and illegal uses. For example, medical payments will be made through the Fee Commission. professionals calling patients from their Filer Online System (Fee Filer), mobile phones often legally spoof the accessible at https://www.fcc.gov/ ACTION: Final rule. outgoing phone number to be the office licensing-databases/fees/fee-filer. As we phone number for privacy reasons, and assess and implement U.S. Treasury SUMMARY: In this document, the businesses often display a toll-free call- initiatives toward an all-electronic Commission adopts a rule that mandates back number. Illegal spoofing, on the payment system, we may transition to that all originating and terminating other hand, occurs when a caller other secure payment systems with voice service providers implement the transmits misleading or inaccurate appropriate public notice and guidance. STIR/SHAKEN caller ID authentication caller ID information with the intent to framework in the internet Protocol (IP) defraud, cause harm, or wrongly obtain III. Ordering Clauses portions of their networks by June 30, anything of value. And these spoofed 8. Accordingly, it is ordered, that 2021. In establishing this requirement, calls are not simply an annoyance—they pursuant to sections 4(i), 4(j), 158, 208, the Report and Order both acts on the result in billions of dollars lost to fraud, and 224 of the Communications Act of Commission’s proposal to require voice degrade consumer confidence in the 1934, as amended, 47 U.S.C. 154(i), service providers to implement the voice network, and harm our public 154(j), 158, 208, and 224, the Order is STIR/SHAKEN caller ID authentication safety. A 2019 survey estimated that hereby adopted and the rules set forth framework if major voice service spoofing fraud affected one in six in the Appendix of the Order are hereby providers did not voluntarily do so by Americans and cost approximately amended effective May 21, 2020. the end of 2019, and implements $10.5 billion in a single 12-month period. List of Subjects in 47 CFR Part 1 Congress’s direction in the recently enacted Pallone-Thune Telephone 2. The Commission, Congress, and Administrative practice and Robocall Abuse Criminal Enforcement state attorneys general all agree on the procedure. and Deterrence (TRACED) Act to need to protect consumers and put an Federal Communications Commission. mandate STIR/SHAKEN not later than end to illegal caller ID spoofing. Over Cecilia Sigmund, 18 months after the date of enactment of the past three years, the Commission Federal Register Liaison Officer. that Act. This action builds on the has taken a multi-pronged approach to Commission’s aggressive and multi- this problem—issuing hundreds of Final Rules pronged approach to ending illegal millions of dollars in fines for violations For the reasons discussed in the caller ID spoofing. of our Truth in Caller ID rules; preamble, the Federal Communications expanding those rules to reach foreign Commission amends 47 CFR part 1 as DATES: Effective May 21, 2020. calls and text messages; enabling voice service providers to block certain clearly follows: FOR FURTHER INFORMATION CONTACT: For unlawful calls before they reach further information, please contact PART 1—PRACTICE AND consumers’ phones; and clarifying that Mason Shefa, Competition Policy PROCEDURE voice service providers may offer call- Division, Wireline Competition Bureau, blocking services by default. We have at [email protected]. ■ 1. The authority citation for part 1 also called on industry to ‘‘trace back’’ continues to read as follows: SUPPLEMENTARY INFORMATION: The full illegal spoofed calls and text messages Authority: 47 U.S.C. chs. 2, 5, 9, 13; 28 text of this document, WC Docket Nos. to their original sources and encouraged U.S.C. 2461 note, unless otherwise noted. 17–97, 20–67; FCC 20–42, adopted and industry to develop and implement new ■ 2. Amend § 1.80 by revising paragraph released on March 31, 2020, is available caller ID authentication technology. (h) to read as follows: for public inspection during regular That technology, known as STIR/ business hours in the FCC Reference SHAKEN, allows voice service § 1.80 Forfeiture proceedings. Information Center, Portals II, 445 12th providers to verify that the caller ID *** Street SW, Room CY–A257, information transmitted with a (h) Payment. The forfeiture should be Washington, DC 20554 or at the particular call matches the caller’s paid electronically using the following internet address: https:// number. Entities variously refer to this Commission’s electronic payment docs.fcc.gov/public/attachments/FCC- technology as either ‘‘SHAKEN/STIR’’ system in accordance with the 20-42A1.pdf . The Further Notice of or ‘‘STIR/SHAKEN.’’ In the past, the procedures set forth on the Proposed Rulemaking WC Docket Nos. Commission has referred to the Commission’s website, www.fcc.gov/ 17–97, 20–67; FCC 20–42, adopted technology as ‘‘SHAKEN/STIR.’’ To licensing-databases/fees. concurrently with this document and ensure consistency with the TRACED * * * * * available at the same internet address, is Act, we use ‘‘STIR/SHAKEN’’ here. Its [FR Doc. 2020–07540 Filed 4–20–20; 8:45 am] published elsewhere in this issue of the widespread implementation will reduce BILLING CODE 6712–12–P Federal Register. the effectiveness of illegal spoofing,

VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00021 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES 22030 Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations

allow law enforcement to identify bad 5. To combat illegal spoofing, authentication service to create this actors more easily, and help voice industry technologists from the internet ‘‘Identity’’ header, which contains service providers identify calls with Engineering Task Force (IETF) and the encrypted identifying information as illegally spoofed caller ID information Alliance for Telecommunications well as the location of the public key before those calls reach their Industry Solutions (ATIS) developed that can be used to decode this subscribers. standards for the authentication and information. The authentication service 3. Today, we build on our aggressive verification of caller ID information for can be provided by the voice service and multi-pronged approach to ending calls carried over an IP network using provider itself, or by a third party acting illegal caller ID spoofing. First, we the Session Initiation Protocol (SIP). under the voice service provider’s mandate that all voice service providers The Session Initiation Protocol (SIP) is direction. When the terminating voice implement the STIR/SHAKEN caller ID ‘‘an application-layer control (signaling) service provider receives the call, it authentication framework in the protocol for creating, modifying, and sends the SIP INVITE with the Identity internet Protocol (IP) portions of their terminating sessions’’ such as internet header to a verification service, which networks by June 30, 2021. In Protocol (IP) telephony calls. The IETF uses the public key that corresponds recognition of the fact that it is caller ID formed the Secure Telephony Identity uniquely to the originating voice service information transmitted with a call that Revisited (STIR) working group, which provider’s private key to decode the is authenticated, we use the term ‘‘caller has produced several protocols for encrypted information and verify that it ID authentication’’ in this Report and authenticating caller ID information. is consistent with the information sent Order and Further Notice of Proposed ATIS, together with the SIP Forum, without encryption in the SIP INVITE. Rulemaking. We understand this term to produced the Signature-based Handling Like the corresponding authentication be interchangeable with the term ‘‘call of Asserted information using toKENs service on the originating voice service authentication’’ as used in other (SHAKEN) specification which provider’s end, the terminating voice contexts, including the TRACED Act. In standardizes how the protocols service provider’s verification service establishing this requirement, we both produced by STIR are implemented can be performed internally or by a act on our proposal to require voice across the industry. The SIP Forum is trusted third-party service. The service providers to implement the ‘‘an industry association with members verification service then sends the STIR/SHAKEN caller ID authentication from . . . IP communications results of the verification process— framework if major voice service companies,’’ with a mission ‘‘[t]o including whether the decoding process providers did not voluntarily do so by advance the adoption and was successful and whether the encrypted information is consistent the end of 2019, and implement interoperability of IP communications with the information sent without Congress’s direction in the recently products and services based on SIP.’’ encryption—to the terminating voice enacted Pallone-Thune Telephone Together, these technical standards service provider. STIR/SHAKEN thus Robocall Abuse Criminal Enforcement comprise the ‘‘STIR/SHAKEN’’ establishes a chain of trust back to the and Deterrence (TRACED) Act to framework for caller ID authentication. originating voice service provider. mandate STIR/SHAKEN not later than The STIR/SHAKEN framework consists of two high-level components: (1) The 7. Because the STIR/SHAKEN 18 months after the date of enactment of framework relies on transmission of that Act. Second, we propose and seek technical process of authenticating and verifying caller ID information; and (2) information in the Identity header of the comment on additional measures to SIP INVITE, it only operates on the IP the certificate governance process that combat illegal spoofing, including portions of a voice service provider’s maintains trust in the caller ID further implementation of the TRACED network—that is, those portions served authentication information transmitted Act. by network technology that is able to along with a call. II. Background initiate, maintain, and terminate SIP 6. Authenticating and Verifying Caller calls. If a call terminates on a network 4. Technological advancements and ID Information Through STIR/SHAKEN. or is routed at any point over an marketplace developments in IP-based The STIR/SHAKEN authentication and intermediate provider network that does telephony have made caller ID spoofing verification processes center on the not support the transmission of SIP easier and more affordable than ever transmission of encrypted information calls, the Identity header will be lost. before. Today, widely available Voice used to attest to the accuracy of caller Because STIR/SHAKEN only operates over internet Protocol (VoIP) software ID information transmitted with a call. on IP networks, some stakeholders have allows malicious callers to make Specifically, an originating voice service advocated for a solution referred to as spoofed calls with minimal experience provider adds a unique header to the ‘‘out-of-band STIR,’’ in which caller ID and cost. Taking advantage of the ability network-level message used to initiate a authentication information is sent to use spoofing to mask the true identity SIP call (the SIP INVITE). This SIP across the internet, out-of-band from the of an incoming call, these callers have INVITE contains a series of unencrypted call path, allowing STIR/SHAKEN to be turned to this technology as a quick and headers which provides information implemented on networks that are not cheap way to defraud targets and avoid about the message, such as a ‘‘From’’ fully IP. Out-of-band STIR remains in being discovered. Driven in part by the header, giving information about the the early stages of development. rise of VoIP, the telecommunications calling party; a ‘‘To’’ header, giving 8. The STIR/SHAKEN framework industry has transitioned from a limited information about the called party; and relies on the originating voice service number of carriers that all trusted each a ‘‘Via’’ header, which ‘‘indicates the provider attesting to the subscriber’s other to provide accurate caller path taken by the request so far and identity. The SHAKEN specification origination information to a helps in routing the responses back allows an originating voice service proliferation of different voice service along the same path.’’ Both originating provider to provide different ‘‘levels’’ of providers and entities originating calls, and downstream providers are attestation. Specifically, the voice which allows consumers to enjoy the technically capable of appending service provider can indicate that (i) it benefits of far greater competition but headers to the SIP INVITE. When a can confirm the identity of the also creates new ways for bad actors to subscriber places a call, the originating subscriber making the call, and that the undermine this trust. voice service provider uses an subscriber is using its associated

VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00022 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations 22031

telephone number (‘‘full’’ or ‘‘A’’ 11. Commission and North American mandating implementation of STIR/ attestation); (ii) it can confirm the Numbering Council Action to Promote SHAKEN in the event that major voice identity of the subscriber but not the STIR/SHAKEN Deployment. In July service providers did not voluntarily telephone number (‘‘partial’’ or ‘‘B’’ 2017, the Commission released a Notice implement the framework by the end of attestation); or merely that (iii) it is the of Inquiry, launching a broad inquiry 2019. We stressed that point of entry to the IP network for a into caller ID authentication and how to ‘‘[i]mplementation of the SHAKEN/STIR call that originated elsewhere, such as a expedite its development and framework across voice networks is call that originated abroad or on a implementation. In the Notice of important in the fight against unwanted, domestic network that is not STIR/ Inquiry, the Commission recognized the including illegal, robocalls’’ and SHAKEN-enabled (‘‘gateway’’ or ‘‘C’’ potential of caller ID authentication to proposed to extend any mandate to attestation). ‘‘reduc[e] the risk of fraud and ensur[e] ‘‘wireline, wireless, and Voice over 9. To maintain trust in the voice that callers be held accountable for their Internet Protocol (VoIP) providers’’; service providers that vouch for caller calls.’’ Among other issues, the sought comment on what we should ID information, the STIR/SHAKEN Commission sought comment on its role require voice service providers to framework uses digital ‘‘certificates’’ in promoting implementation of caller accomplish to meet an implementation issued through a neutral governance ID authentication technology; what mandate; and asked for comment on system. The STIR/SHAKEN credentials involvement, if any, it should have in how long voice service providers should are based on an X.509 credential system. STIR/SHAKEN governance; and how to be given to comply with such a X.509 is a specific standard for a type address caller ID authentication for mandate. We further sought comment of public key infrastructure system that networks that use non-IP technology. on whether we should establish uses certificates to facilitate secure 12. In February 2018, the Commission requirements regarding the display of internet communications. The directed the Call Authentication Trust STIR/SHAKEN attestation information, framework requires that each voice Anchor Working Group of the North what role the Commission should have service provider receive its own American Numbering Council (NANC) in STIR/SHAKEN governance, and how certificate that contains, among other to recommend ‘‘criteria by which a we could encourage caller ID components, that voice service [Governance Authority] should be authentication on non-IP networks. The provider’s public key, and states, in selected’’ and a ‘‘reasonable timeline or Declaratory Ruling and Third Further essence, that (i) the voice service set of milestones for adoption and Notice of Proposed Rulemaking also provider is that which it claims to be; deployment of a SHAKEN/STIR call affirmed that voice service providers (ii) the voice service provider is authentication system, including may, by default, block unwanted calls authorized to authenticate the caller ID metrics by which the industry’s progress based on reasonable call analytics, as information; and (iii) the voice service can be measured.’’ In its May 2018 long as their customers are informed provider’s claims about the caller ID report, the NANC recommended that and have the opportunity to opt out of information it is authenticating can thus representatives from various industry the blocking; proposed to create a safe be trusted. Every time an originating stakeholders comprise a board harbor for voice service providers that voice service provider originates an overseeing the Governance Authority, block calls which fail STIR/SHAKEN authenticated call, it transmits the and that ‘‘individual companies capable verification; and sought comment on location of its certificate in the Identity of signing and validating VoIP calls whether we should create a safe harbor header, allowing the verification service using SHAKEN/STIR should implement for voice service providers that block to acquire the public key and verify the the standard within a period of calls which do not have authenticated caller ID information, and have certainty approximately one year after completion caller ID information. that the public key is truly associated of the NANC CATA report.’’ Chairman 15. In July 2019, the Commission held with the voice service provider that Pai accepted these recommendations a summit focused on implementation of originated the call. The ‘‘location’’ is shortly after they were issued by the STIR/SHAKEN. Summit participants sent unencrypted in the form of a NANC. included representatives from large and Uniform Resource Locator (URL). 13. In November 2018, drawing on the small voice service providers, analytics 10. The STIR/SHAKEN governance NANC’s May 2018 recommendation that companies, vendors, and members of model requires several roles in order to capable voice service providers rapidly the Governance Authority. The operate: (1) A Governance Authority, implement STIR/SHAKEN, Chairman participants discussed implementation which defines the policies and Pai sent letters to major voice service progress made by major voice service procedures for which entities can issue providers urging them to implement a providers; using STIR/SHAKEN to or acquire certificates; (2) a Policy robust caller ID authentication improve the consumer experience; and Administrator, which applies the rules framework by the end of 2019. He asked implementation challenges faced by set by the governance authority, these providers for specific details about small voice service providers. confirms that certification authorities their implementation plans, and 16. Developments in STIR/SHAKEN are authorized to issue certificates, and encouraged those that did not appear to Governance. Currently, the Secure confirms that voice service providers are have established concrete plans to Telephone Identity Governance authorized to request and receive promptly protect their subscribers with Authority (STI–GA), established by certificates; (3) Certification Authorities, STIR/SHAKEN. In response, the ATIS, fills the Governance Authority which issue the certificates used to providers submitted letters detailing role. The STI–GA’s membership was authenticate and verify calls; and (4) the their implementation efforts. Since that designed to provide a diverse voice service providers themselves, time, Commission staff has closely representation of stakeholders from which, as call initiators, select an tracked the progress of major voice across the industry. The STI–GA approved certification authority from service providers in implementation of selected the Policy Administrator, which to request a certificate, and the STIR/SHAKEN framework. iconectiv, in May 2019. In December which, as call recipients, check with 14. In June 2019, the Commission 2019, the Policy Administrator certification authorities to ensure that adopted a Declaratory Ruling and Third approved the first Certification the certificates they receive were issued Further Notice of Proposed Rulemaking Authorities, and announced that voice by the correct certification authority. that proposed and sought comment on service providers are now able to

VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00023 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES 22032 Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations

register with the Policy Administrator to to Fios Digital customers later this Vonage reported that it was testing with obtain the credentials necessary to year.’’ ‘‘its two largest peering partners’’ and receive certificates from approved 19. These voice service providers, had ‘‘reached out to twenty additional Certification Authorities. however, were exchanging only a carriers to implement outbound and 17. Implementation by Voice Service limited amount of authenticated traffic inbound testing schedules.’’ Providers. We recognize that a number with other voice service providers as of 21. An additional category of voice of providers have been working hard to the end of 2019. For instance, Comcast service providers—namely CenturyLink, implement caller ID authentication. has begun to exchange authenticated TDS, and Google—has indicated limited Some voice service providers reported calls with AT&T and T-Mobile, and progress in making the necessary that, by the end of 2019, they had explained that, as of December 2019, network upgrades. CenturyLink, for completed the necessary network approximately 14.25% of all calls instance, stated that as of late 2019 it upgrades to support the STIR/SHAKEN ‘‘originating on other voice providers’ had ‘‘taken the steps necessary to framework and that they were networks and bound for Comcast prepare its network for SHAKEN/STIR exchanging a limited amount of traffic residential subscribers had a STIR/ deployment’’ and is currently with authenticated caller ID information SHAKEN-compliant header and were conducting testing for wider with other voice service providers. verified by Comcast.’’ T-Mobile deployment on its IP networks. TDS, Others, however, reported only that they explained that it is also authenticating meanwhile, reported that it had had completed necessary network some traffic exchanged with AT&T, completed work in 2019 to evaluate, upgrades by the end of 2019, but had Comcast, and Inteliquent. According to select, and lab test a vendor solution to not begun exchanging authenticated AT&T, it ‘‘exchanges approximately 40 allow it to integrate STIR/SHAKEN in traffic with other voice service percent of its SHAKEN/STIR consumer the IP portions of its network. It is in the providers. Still others have shown little VoIP traffic with one terminating service process of developing implementation to no progress in upgrading their provider.’’ Verizon stated that it was plans, but because many of its networks to be STIR/SHAKEN-capable. signing ‘‘under half of [its] outbound interconnection points with other 18. More specifically, as of the end of traffic’’ with one provider as of the end providers are not IP-enabled, it 2019, AT&T, Bandwidth, Charter, of 2019, and that ‘‘for the other three ‘‘forecast[s] that only a small percentage Comcast, Cox, T-Mobile, and Verizon partners,’’ its production levels were of traffic will be exchanged in IP when announced that they had upgraded their under 5%. Cox explained that it is SHAKEN/STIR is initially deployed in networks to support STIR/SHAKEN. ‘‘exchanging authenticated traffic with the TDS IP network.’’ Google provided AT&T, for example, confirmed that it four carriers resulting in over 14% of all limited detail about the status of ‘‘authenticates all calls on its network calls on Cox’ residential IP network implementation but stated that it that originate from [Voice over LTE] and being verified.’’ Charter stated that it is ‘‘remains committed to implementing consumer VoIP customers’’ and ‘‘exchanging signed and authenticated SHAKEN/STIR and . . . ha[s] taken ‘‘estimates that approximately 90 customer call traffic end-to-end with considerable steps toward doing so.’’ percent of its wireless customer base Comcast.’’ Bandwidth is also in early 22. Congressional Direction to Require (prepaid and postpaid) and more than stages of exchanging traffic and ‘‘has STIR/SHAKEN Implementation. On 50 percent of its consumer wireline designed, tested and deployed the December 30, 2019, Congress enacted customer base are SHAKEN/STIR capability to exchange some of its the TRACED Act, with the stated capable.’’ Charter stated that it ‘‘fulfilled production traffic with Verizon Wireless purpose of ‘‘helping to reduce illegal [its] commitment to complete the directly utilizing ‘self-signed’ and unwanted robocalls’’ through implementation of the STIR/SHAKEN certifications that are in keeping with numerous mechanisms. Along with framework by the end of [2019].’’ the STIR/SHAKEN framework.’’ other provisions directed at addressing Similarly, Comcast reported that 20. Other voice service providers— robocalls, the TRACED Act directs the ‘‘virtually all calls originating from a namely Frontier, Sprint, U.S. Cellular, Commission to require, no later than 18 Comcast residential subscriber and and Vonage—stated that they have months from enactment, all voice terminating with a Comcast residential performed necessary network upgrades, service providers to implement STIR/ subscriber are fully authenticated but had only begun the negotiating and SHAKEN in the IP portions of their through the STIR/SHAKEN protocol.’’ testing phase of exchanging networks and implement an effective Cox reported that it ‘‘has deployed authenticated traffic with other voice caller ID authentication framework in SHAKEN/STIR to over 99% of [its] service providers as of the end of 2019. the non-IP portions of their networks. residential customers enabling Cox to Frontier reported that it ‘‘established the The TRACED Act further creates sign originating and terminating calls.’’ capability to authenticate and sign processes by which voice service T-Mobile stated that it was ‘‘the first calls’’ and is in the negotiating and providers (1) may be exempt from this wireless provider to fully implement testing phase regarding authenticating mandate if the Commission determines STIR/SHAKEN standards on [its] traffic exchanged with other voice they have achieved certain network’’ and is ‘‘capable of signing and service providers. Sprint reported that it implementation benchmarks, and (2) authenticating 100% of SIP traffic that ‘‘deployed the core STIR/SHAKEN may be granted an extension for both originates and then terminates on capability in its network’’ and was compliance based on a finding of undue [its] network.’’ According to Verizon, it testing the exchange of authenticated hardship because of burdens or barriers ‘‘finished deploying STIR/SHAKEN to traffic with Comcast and T-Mobile. In to implementation or based on a delay its wireless customer base (which 2019, U.S. Cellular ‘‘successfully in development of a caller ID constitutes more than 95% of [its] total implemented the STIR/SHAKEN authentication protocol for calls traffic) in March 2019,’’ ‘‘is devoting technology in its network’’ and is delivered over non-IP networks. The substantial resources to deploying STIR/ currently ‘‘in various stages of the TRACED Act further directs us, not later SHAKEN to wireline customers that [interconnection agreement] process than December 30, 2020, to submit a receive service on IP platforms capable with three of the four national wireless report to Congress that includes: (1) an of being upgraded with the STIR/ carriers . . . including, the successful analysis of the extent to which voice SHAKEN protocol’’ and expects ‘‘to exchange of traffic on a test basis with service providers have implemented achieve deployment of STIR/SHAKEN at least one of . . . those carriers.’’ caller ID authentication frameworks and

VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00024 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations 22033

whether the availability of necessary A. Mandating the STIR/SHAKEN ‘‘cross-carrier implementation has been equipment and equipment upgrades has Framework relatively limited’’ and state that we impacted such implementation; and (2) 25. We require all originating and ‘‘should require phone companies to an assessment of the efficacy of the call terminating voice service providers to adopt effective call-authentication authentication frameworks. implement the STIR/SHAKEN policies and technologies.’’ AT&T explains that ‘‘SHAKEN/STIR must be 23. This rulemaking is one of several framework in the IP portions of their widely deployed to be effective.’’ steps we are taking to implement the networks by June 30, 2021 for several Verizon similarly explains that STIR/ TRACED Act. For instance, we recently compelling reasons. First, ubiquitous SHAKEN only works if all voice service proposed rules to establish a registration STIR/SHAKEN implementation will yield substantial benefits for American providers have implemented the process for a ‘‘single consortium that framework in the call path—increasing conducts private-led efforts to trace back consumers. We estimate that the benefits of eliminating the wasted time the utility of a mandate. Other the origin of suspected unlawful providers, including Comcast and robocalls.’’ Additionally, the Wireline and nuisances caused by illegal scam robocalls will exceed $3 billion Transaction Network Services, support a Competition Bureau (Bureau) has ‘‘measured’’ STIR/SHAKEN requirement charged the NANC Call Authentication annually. And more importantly, we expect STIR/SHAKEN paired with call that accounts for existing Trust Anchor Working Group with analytics to serve as a tool to effectively implementation challenges. We find providing recommendations regarding protect American consumers from that our June 30, 2021 implementation the TRACED Act’s direction that the fraudulent robocall schemes that cost date and application of the STIR/ Commission ‘‘issue best practices that Americans approximately $10 billion SHAKEN mandate to only the IP providers of voice service may use as annually. Further, we anticipate that portions of originating and terminating part of the implementation of effective implementation will increase consumer voice service providers’ networks call authentication frameworks . . . to trust in caller ID information and satisfies these commenters’ concerns. take steps to ensure the calling party is encourage consumers to answer the And even commenters who express accurately identified.’’ We will continue phone, thereby benefitting businesses, hesitation about a mandate are receptive to work swiftly and carefully to healthcare providers, and non-profit to one that accounts for the burdens and implement the TRACED Act and protect charities. Widespread implementation barriers confronted by rural and small Americans from illegal robocalls. also benefits public safety by decreasing voice service providers, which we proposed to address through the process III. Report and Order disruptions to healthcare and emergency communications systems, established in the TRACED Act. For 24. In this Report and Order, we and as a result, saving lives. Additional example, the Voice of America’s require all originating and terminating benefits include significantly reducing Broadband Providers and Teliax are receptive to a mandate that ‘‘focus[es] voice service providers to implement costs for voice service providers by on implementation of . . . legislation the STIR/SHAKEN framework in the IP eliminating unwanted network Congress enacts’’ and provides for a portions of their networks by June 30, congestion and decreasing the number more flexible implementation timeframe 2021. We adopt this mandate for several of consumer complaints about robocalls. for small and rural providers. reasons, including that (1) Widespread Ultimately, we expect widespread STIR/ implementation will result in significant SHAKEN implementation to reduce the 27. Third, although some major voice benefits from American consumers; (2) scourge of illegal robocalls that plague service providers have taken significant steps towards STIR/SHAKEN the record overwhelmingly reflects Americans every day. 26. Second, the record implementation, the level of support from a broad array of overwhelmingly reflects support from a implementation by the Commission’s stakeholders for rapid STIR/SHAKEN broad array of stakeholders for rapid end of 2019 deadline shows that, absent implementation; (3) the state of STIR/SHAKEN deployment, and many further governmental action, we will not industry-wide implementation at the commenters support a STIR/SHAKEN have timely ubiquitous implementation. end of 2019 demonstrates that further mandate. Commenters, including the As Verizon states, ‘‘verifying [c]aller ID government action is necessary for attorneys general of all fifty states and for consumers using STIR/SHAKEN timely, ubiquitous implementation; and the District of Columbia, consumer presents a classic collectivity challenge (4) the TRACED Act expressly directs us groups, and major voice service that industry may not be able to to require timely STIR/SHAKEN providers expressed support for overcome on its own.’’ As we have implementation. Below, we discuss Commission action if widespread explained, some voice service providers these reasons in more detail; describe voluntary implementation did not reported that, by the end of 2019, they the specific requirements that comprise occur. The unified state attorneys completed the necessary network our mandate; discuss our legal authority general argue that a mandate is upgrades to support the STIR/SHAKEN to adopt these requirements; respond to necessary ‘‘in the absence of prompt framework and that they were the limited record opposition to a voluntary implementation’’ by the end exchanging a limited amount of traffic mandate; and find that the benefits of of 2019 because without such action, with authenticated caller ID information STIR/SHAKEN implementation will far ‘‘[b]ad actors exploit inexpensive and with other voice service providers. exceed the costs. USTelecom and CTIA ubiquitous technology to scam Others, however, reported only that they ask us to adopt a broad call blocking consumers and to intrude upon had completed necessary network safe harbor today. Transaction Network consumers’ lives, and the problem upgrades by the end of 2019, but had Services suggests that we require or shows no signs of abating.’’ Consumer not begun exchanging with other voice recommend that providers pair STIR/ group commenters, including Consumer service providers. Still others have SHAKEN with analytics. We intend to Reports, the National Consumer Law shown little to no progress in upgrading address call-blocking issues and the role Center, Consumer Action, the Consumer their networks to be STIR/SHAKEN- of analytics in relation to call blocking Federation of America, the National capable. We find that the lack of in a separate item and thus decline to Association of Consumer Advocates, common exchange among these voice address these requests here. and Public Knowledge, observe that service providers—and the absence of

VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00025 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES 22034 Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations

substantial progress by several of administrative domain handles the the TRACED Act, we will plan to revisit them—demonstrate that major voice outbound routing for the call.’’ Further, our caller ID authentication rules service providers have failed to meet the granting a delay until standards bodies periodically to ensure that they remain goal of achieving full implementation by address every possible issue would risk up to date. the end of 2019. We therefore must act creating an incentive for some parties to 31. Finally, we disagree with ACA to ensure faster progress to protect the draw out standards-setting processes, to Connects’ suggestion that we limit our public from the scourge of illegal the detriment of widespread STIR/ implementation mandate to only those robocalls. SHAKEN implementation. To the voice service providers that originate 28. Finally, confirming our decision is contrary, by establishing a June 30, 2021 large volumes of illegal robocalls. ACA the recently-enacted TRACED Act, deadline for widespread STIR/SHAKEN Connects fails to account for the which provides additional support for implementation, we create an incentive importance of network-wide the implementation mandate we set for standards bodies to work quickly to implementation to the effectiveness of forth today. The TRACED Act directs issue actionable standards and solutions STIR/SHAKEN in reducing spoofed the Commission to ‘‘require a provider for enterprise calls. For this reason, we robocalls. Moreover, it fails to explain of voice service to implement the STIR/ need not adopt a separate deadline for how we would identify or define such SHAKEN authentication framework in industry development of standards and carriers or how such a scheme would the [IP] networks of the provider of solutions for enterprise calls, as stop malicious callers from simply using voice service.’’ Congress’s clear requested by Cloud Communications a different voice service provider. direction to require timely STIR/ Alliance. In any event, the TRACED Act 1. STIR/SHAKEN Implementation SHAKEN implementation further requires that voice service providers Requirements encourages us to adopt the mandate in implement the STIR/SHAKEN 32. We adopt our proposal in the 2019 this Report and Order. framework in their IP networks on this Further Notice to require voice service 29. Limited Record Opposition to a timetable, with only those extensions providers to implement the STIR/ STIR/SHAKEN Implementation and exceptions specified by Congress. SHAKEN framework. Specifically, we Mandate. We disagree with those We decline USTelecom’s request ‘‘to require all originating and terminating commenters who argue that we should remove the discussion surrounding voice service providers to fully not move forward with a STIR/SHAKEN enterprise signing from the Draft S/S implement STIR/SHAKEN on the implementation mandate. First, we Mandate Order and to move it to the portions of their voice networks that specifically disagree with the argument Draft S/S Mandate FNPRM to seek support the transmission of SIP calls that we should delay a mandate while further comment.’’ We find this request industry develops technical solutions to and exchange calls with authenticated inconsistent with the structure of the caller ID information with the providers allow the STIR/SHAKEN framework to TRACED Act, which creates a general accommodate certain more challenging with which they interconnect. This mandate and exceptions to that scenarios. According to some STIR/SHAKEN mandate will create the mandate, rather than limiting the scope commenters, the standards for trust ecosystem necessary for effective of the mandate to non-enterprise calls in attestation do not fully account for the caller ID authentication. the first instance. We also note that situation where an enterprise subscriber 33. As part of today’s mandate, we USTelecom has emphasized that some places outbound calls through a voice adopt the following three requirements: enterprise signing will be ‘‘possible in service provider other than the voice (i) A voice service provider that the near term’’ and that ‘‘some voice service provider that assigned the originates a call that exclusively transits service providers with enterprise telephone number. In such scenarios, its own network must authenticate and customers are already working on commenters claim, it would be difficult verify the caller ID information for an outbound call to receive ‘‘full’’ or providing the ability for their enterprise consistent with the STIR/SHAKEN ‘‘A’’ attestation because the outbound customers to have certain enterprise authentication framework; (ii) a voice call ‘‘will not pass through the calls signed (with A-level attestation) service provider originating a call that it authentication service of the voice this year.’’ We are confident that will exchange with another voice service provider that controls the mandating, consistent with the TRACED service provider or intermediate numbering resource.’’ To provide ‘‘full’’ Act, that voice service providers provider must authenticate the caller ID or ‘‘A’’ attestation, the voice service implement the STIR/SHAKEN information in accordance with the provider must be able to confirm the framework in their IP networks—subject STIR/SHAKEN authentication identity of the subscriber making the to the extensions and exceptions created framework and, to the extent technically call, and that the subscriber is using its by the TRACED Act—will create feasible, transmit that caller ID associated telephone number. We are beneficial incentives for industry to information with authentication to the optimistic that standards bodies, which continue to quickly develop standards next provider in the call path; and (iii) remain engaged on the impact of STIR/ to address enterprise calls. a voice service provider terminating a SHAKEN on more challenging use cases 30. Second, we disagree with call with authenticated caller ID and business models, will be able to Competitive Carriers Association’s information it receives from another resolve those issues—just as they have argument that adopting a STIR/ provider must verify that caller ID overcome numerous other barriers to SHAKEN mandate would ‘‘risk information in accordance with the caller ID authentication so far. We will impeding development of other STIR/SHAKEN authentication continue to monitor industry progress potential new strategies to block framework. We discuss these towards solutions to these issues. For robocalls.’’ The STIR/SHAKEN requirements below. The TRACED Act instance, the Internet Engineering Task framework is one important solution states in § 4(b)(1)(A) that the Force (IETF) has proposed a ‘‘certificate that should be part of an arsenal of Commission shall ‘‘require a provider of delegation’’ solution that would allow effective remedies to combat robocalls, voice service to implement the STIR/ ‘‘the carrier who controls the numbering and its implementation does not SHAKEN authentication framework’’ in resource . . . to delegate a credential preclude voice service providers from its IP networks. It goes on to create an that could be used to sign calls pursuing additional solutions. Further, exemption, stating that the Commission regardless of which network or consistent with Congress’s direction in ‘‘shall not take the action’’ set forth in

VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00026 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations 22035

§ 4(b)(1)(A) ‘‘if the Commission this approach, and we add specificity by over time, incorporating more determines [by December 30, 2020] that outlining particular obligations on voice comprehensive functionality and a such provider of voice service’’ in its service providers for this requirement. broader scope in a backward compatible Internet Protocol networks meets four More specifically, a voice service and forward looking manner.’’ We criteria focused on achieving certain provider that originates a call which it intend for our rules to provide this same benchmarks prior to the full mandate will exchange with another voice room for innovation, while maintaining going into effect. USTelecom has service provider or intermediate an effective caller ID authentication submitted proposed interpretations of provider must use an authentication ecosystem. Voice service providers may those four criteria for our consideration. service and insert the Identity header in incorporate any improvements to these Among other things, USTelecom the SIP INVITE and thus authenticate standards or additional standards into proposes requiring a showing that all the caller ID information in accordance their respective STIR/SHAKEN consumer VoIP and VoLTE traffic with the STIR/SHAKEN authentication authentication frameworks, so long as originating on a voice service provider’s framework; it further must transmit that any changes or additions maintain the network is capable of authentication, or call with authentication to the next baseline call authentication will be capable of authentication, by voice service provider or intermediate functionality exemplified by ATIS– June 30, 2021. CTIA and USTelecom provider in the call path, to the extent 1000074, ATIS–1000080, and ATIS– argue that we should consider replacing technically feasible. We recognize that 1000084. the implementation criteria that we the transmission of STIR/SHAKEN 37. For purposes of our rules, we also adopt with USTelecom’s interpretations authentication information over a non- adopt a definition of ‘‘voice service’’ of the four criteria in § 4(b)(2)(A). We IP interconnection point is not that aligns with the TRACED Act. The find this request inconsistent with the technically feasible at this time. TRACED Act employs a broad definition structure of the TRACED Act, which Additionally, a voice service provider of ‘‘voice service’’ that includes creates a general mandate to implement that terminates a call with authenticated ‘‘without limitation, any service that STIR/SHAKEN in § 4(b)(1)(A) and a caller ID information it receives from enables real-time, two-way voice separate exemption process in another voice service provider or communications, including any service § 4(b)(2)(A). Further, USTelecom’s intermediate provider must use a that requires [I]nternet [P]rotocol- suggested language would not verification service, which uses a public compatible customer premises adequately address the responsibilities key to review the information stored in equipment . . . and permits out-bound of voice service providers to the Identity header to verify that caller calling, whether or not the service is ‘‘implement the STIR/SHAKEN ID information in accordance with the one-way or two-way voice over authentication framework’’ in STIR/SHAKEN authentication [I]nternet [P]rotocol.’’ The TRACED Act accordance with § 4(b)(1)(A) because it framework. These actions are at the core definition is limited, however, to service would only require demonstration of of an effective STIR/SHAKEN ‘‘that is interconnected with the public testing and capability rather than the ecosystem, and each action requires the switched telephone network and that details of how authentication must other: A terminating voice service furnishes voice communications to an actually be applied. provider can only verify caller ID end user.’’ Thus, the rules we adopt 34. First, a voice service provider information that has been authenticated today apply to originating and must authenticate and verify, consistent by the originating voice service provider terminating voice service providers and exclude intermediate providers. with the STIR/SHAKEN authentication and transmitted with authentication, framework, the caller ID information of 38. In recognition of the fact that while an originating voice service those calls that it originates and STIR/SHAKEN is a SIP-based solution, provider’s authentication has little value terminates exclusively in the IP portions we limit application of the rules we if the terminating voice service provider of its own network. The most effective adopt today to only the IP portions of fails to verify that caller ID information. caller ID authentication system requires voice service providers’ networks— the application of STIR/SHAKEN to all 36. Definitions and Scope. For those portions that are able to initiate, calls, including calls solely originating purposes of the rules we adopt today, maintain, and terminate SIP calls. This and terminating on the same voice and consistent with the TRACED Act, approach is consistent with section service provider’s network. We we define ‘‘STIR/SHAKEN 4(b)(1)(A) of the TRACED Act, which recognize that certain components of the authentication framework’’ as ‘‘the directs us to require implementation of STIR/SHAKEN framework are designed secure telephone identity revisited and STIR/SHAKEN ‘‘in the [I]nternet to promote trust across different voice signature-based handling of asserted [P]rotocol networks of the provider of service provider networks and so are not information using tokens standards.’’ voice service.’’ We agree with necessary for calls that a voice service For purposes of compliance with this commenters that it would be provider originates and terminates definition, we find that it would be inappropriate to simply extend the solely on its own network. A provider sufficient to adhere to the three ATIS mandate we adopt to non-IP networks. satisfies its obligation under this standards that are the foundation of 39. We adopt the proposal from the requirement so long as it authenticates STIR/SHAKEN—ATIS–1000074, ATIS– 2019 Further Notice that our and verifies in a manner consistent with 1000080, and ATIS–1000084—and all implementation mandate apply to all the STIR/SHAKEN framework, such as documents referenced therein. We types of ‘‘voice service providers— by including origination and attestation recognize that industry is actively wireline, wireless, and Voice over information in the SIP INVITE used to working to improve STIR/SHAKEN. Internet Protocol (VoIP) providers.’’ The establish the call. Compliance with the most current Cloud Communications Alliance has 35. Our next two requirements relate versions of these three standards as of raised concerns over whether all voice to the exchange of caller ID March 31, 2020, including any errata as service providers are able to obtain the authentication information. In the 2019 of that date or earlier, represents the certificates used for the intercarrier Further Notice, we sought comment on minimum requirement to satisfy our exchange of authenticated caller ID whether we should ‘‘require providers rules. ATIS and the SIP Forum information under the Governance to sign calls on an intercarrier basis.’’ conceptualized ATIS–1000074 as Authority’s current policies. We look The record demonstrated support for ‘‘provid[ing] a baseline that can evolve forward to working with the Governance

VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00027 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES 22036 Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations

Authority and the Cloud statutory requirement with imposition unallocated, or unused numbers, none Communications Alliance and its of a mandate six months before that of which can actually be used to members to determine how best to date. originate a call. In the 2019 Further resolve these issues expeditiously going Notice, we proposed to rely on section 2. Legal Authority forward. This includes both two-way 251(e) of the Act for authority to and one-way interconnected VoIP 42. We conclude that section 251(e) of mandate implementation of caller ID providers. For STIR/SHAKEN to be the Communications Act of 1934, as authentication technology and, successful, all voice service providers amended (the Act), provides authority specifically, the STIR/SHAKEN capable of implementing the framework to mandate the adoption of the STIR/ framework; no commenter challenged must participate. If a subset of voice SHAKEN framework in the IP portions that proposal. We note, however, that service providers continue operating on of voice service providers’ networks. because STIR/SHAKEN implementation IP networks without implementing Section 251(e) provides us ‘‘exclusive is not a ‘‘numbering administration STIR/SHAKEN, it will undercut the jurisdiction over those portions of the arrangement,’’ section 251(e)(2), which framework’s effectiveness. Congress North American Numbering Plan that provides that ‘‘[t]he cost of establishing demonstrated its recognition of this fact pertain to the United States.’’ Pursuant telecommunications numbering when it adopted a broad definition of to this provision, we retain ‘‘authority to administration arrangements . . . shall ‘‘voice service’’ in the TRACED Act, set policy with respect to all facets of be borne by all telecommunications which includes ‘‘any service that is numbering administration in the United carriers on a competitively neutral interconnected with the public switched States.’’ Our exclusive jurisdiction over basis,’’ does not apply here. Even if telephone network and that furnishes numbering policy enables us to act section 251(e)(2) did apply, we find that voice communications to an end user flexibly and expeditiously with regard it is satisfied by our requirement that using resources from the North to important numbering matters. When each carrier bear its own costs, since American Numbering Plan.’’ This bad actors unlawfully falsify or spoof each carrier’s costs will be proportional includes, ‘‘without limitation, any the caller ID that appears on a to the size and quality of its network. service that enables real-time, two-way subscriber’s phone, they are using 43. The TRACED Act confirms our voice communications, including any numbering resources to advance an authority to mandate the adoption of the service that requires [I]nternet [P]rotocol illegal scheme. Mandating that voice STIR/SHAKEN framework in the IP -compatible customer premises service providers deploy the STIR/ portions of voice service providers’ equipment (commonly known as ‘CPE’) SHAKEN framework will help to networks. Indeed, the TRACED Act and permits out-bound calling, whether prevent the fraudulent exploitation of expressly directs us to require voice or not the service is one-way or two-way North American Numbering Plan service providers to implement the voice over [I]nternet [P]rotocol.’’ We (NANP) resources by permitting those STIR/SHAKEN framework in the IP find that our conclusion to apply the providers and their subscribers to portions of their networks no later than mandate to a broad category of voice identify when caller ID information has 18 months after the date of that Act’s service providers is consistent with been spoofed. Section 251(e) thus grants enactment. The TRACED Act thus Congress’s language in the TRACED Act. us authority to mandate that voice provides a second clear source of 40. Finally, we clarify that the rules service providers implement the STIR/ authority for the rules we adopt today. we adopt today do not apply to SHAKEN caller ID authentication 44. Finally, we note that Congress providers that lack control of the framework in order to prevent the charged us with prescribing regulations network infrastructure necessary to fraudulent exploitation of numbering to implement the Truth in Caller ID Act, implement STIR/SHAKEN. resources. The Commission has which made unlawful the spoofing of 41. Implementation Deadline. We set previously concluded that its caller ID information ‘‘in connection the implementation deadline of June 30, numbering authority allows it to extend with any telecommunications service or 2021 for two reasons. First, it is numbering-related requirements to IP-enabled voice service . . . with the consistent with the TRACED Act, which interconnected VoIP providers that use intent to defraud, cause harm, or requires us to set a deadline for telephone numbers. As the Commission wrongfully obtain anything of value.’’ implementation of STIR/SHAKEN that has explained, ‘‘the obligation to ensure Given the constantly evolving tactics by is not later than 18 months after that numbers are available on an malicious callers to use spoofed caller enactment of that Act, i.e., no later than equitable basis is reasonably understood ID information to commit fraud, we find June 30, 2021. Second, this deadline to include not only how numbers are that the rules we adopt today are will provide sufficient time for us to made available but to whom, and on necessary to enable voice service implement, and for voice service what terms and conditions. Thus, we providers to help prevent these providers to gain, a meaningful benefit conclude that the Commission has unlawful acts and to protect voice from the implementation exemption and authority under section 251(e)(1) to service subscribers from scammers and extension mechanisms established by extend to interconnected VoIP providers bad actors. Thus, section 227(e) the TRACED Act. Because we find that both the rights and obligations provides additional independent this implementation deadline is associated with using telephone authority for these rules. While we necessary to accommodate the various numbers.’’ Moreover, as the sought comment in the 2019 Robocall exemption and extension mechanisms Commission has previously found, Declaratory Ruling and Further Notice established by the TRACED Act, we section 251(e) extends to ‘‘the use of on the applicability of sections 201(b) decline to adopt the suggestion of some . . . unallocated and unused numbers’’; and 202(a) as sources of authority, we commenters that we mandate it thus gives us authority to mandate did so in the context of adopting rules implementation by June 1, 2020. As we that voice service providers implement to create a safe harbor for certain call- note in the accompanying Further the STIR/SHAKEN framework to blocking programs and requiring voice Notice, the TRACED Act contemplates address the spoofing of unallocated and service providers that offer call-blocking compliance extensions and exemptions unused numbers. The Commission programs to maintain a Critical Calls for those providers that we determine previously relied on this authority to List. Because we did not seek comment meet certain criteria by December 30, make clear that voice service providers in that item on whether these provisions 2020. We see no way to square this may block calls that spoof invalid, grant the Commission authority to

VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00028 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations 22037

mandate caller ID authentication, and 47. Eliminating Nuisance. In the 2019 While STIR/SHAKEN will not itself stop specifically STIR/SHAKEN, we do not Further Notice, we estimated benefits of a malicious party from using the voice rely on them here as sources of at least $3 billion from eliminating network to commit fraud, it will inform authority. illegal scam robocalls. That estimate a call recipient that the caller has used assumed a benefit of ten cents per call deceptive caller ID information to try to B. Summary of Costs and Benefits and multiplied it across a figure of 30 convince the called party to answer the 45. We are convinced that the benefits billion illegal scam robocalls per year, phone. Many commenters noted value of requiring STIR/SHAKEN derived from third-party data. We also in pairing STIR/SHAKEN with call implementation far outweigh the costs, sought comment on this $3 billion analytics, and we expect this will even if adoption of the TRACED Act estimate and concluded that ‘‘most of significantly reduce the effectiveness of makes a comprehensive cost-benefit these benefits can be achieved . . . spoofing fraud that costs Americans analysis of a STIR/SHAKEN primarily because SHAKEN/STIR will billions of dollars each year, and implementation mandate unnecessary. inform providers of the call’s true similarly reduce the incidence of such Because STIR/SHAKEN is a part of a origination.’’ We received no comment fraud. broader set of technological and on this conclusion. In its comments, 49. Restoring Confidence in Caller ID regulatory efforts necessary to address Smithville Telephone Company states Information. STIR/SHAKEN illegal calls, and its limited deployment that a $3 billion benefit amounts to 55 implementation and other efforts to makes it difficult to measure its full cents per voice line per month minimize illegal robocalls will begin to effects at this time, we compare the (calculated by dividing the $3 billion restore trust in caller ID information and estimated costs of implementing STIR/ benefit by 455 million retail voice make call recipients more likely to SHAKEN to the overall foreseeable telephone service connections based on answer the phone. Declines in range of quantifiable and non- the FCC’s Voice Telephone Services willingness to answer incoming calls in quantifiable benefits of eliminating Status as of June 30, 2017), and recent years have harmed businesses, illegal calls, recognizing that STIR/ questions whether such benefit is healthcare providers, and non-profit SHAKEN is necessary but not, alone, a enough to drive this decision. The charities. For example, utility solution to the problem. These benefits estimate of 30 billion scam calls consists companies often call to confirm include reduction in nuisance calls, of an estimated 47% of all robocalls. If installation appointments, ‘‘[b]ut if the increased protection from illegally the average line receives approximately customer doesn’t answer the phone for spoofed calls restoration of consumer 5 to 6 scam calls per month, the appointment reminder and the truck confidence in incoming calls, fewer Smithville’s calculation is consistent shows up when they’re not there, by one robocall-generated disruptions of with our previous estimate. Our burden estimate, that’s a $150 cost.’’ Similarly, healthcare and emergency is to determine that benefits exceed medical providers have indicated that communications, reduction in costs, and we find that the benefits of patients often fail to answer scheduling regulatory enforcement costs, and implementing STIR/SHAKEN far exceed calls from specialists’ offices and reduction in provider costs. We the costs. We agree with commenters eventually the office will give up after conclude that, based on any plausible that STIR/SHAKEN is one important repeated attempts. Donations to assumption about the scope of illegal part of a broader set of tools to solve charities have also declined as a result calls deterred by STIR/SHAKEN, the illegal robocalls. We thus reaffirm our of the decreased likelihood of answering foreseeable benefits of STIR/SHAKEN the phone. Such organizations likely finding that the potential benefits implementation—including reduction will benefit because recipients should resulting from eliminating the wasted in calls that cost Americans billions of be more likely to answer their phones if time and nuisances caused by illegal dollars each year—will far exceed caller ID information is authenticated. scam robocalls will exceed $3 billion estimated costs, including both Furthermore, while we do not adopt any annually. recurring operating costs of between display mandates in this item, we roughly $39 million and $780 million 48. Reducing Fraud. Fraudulent anticipate that voice service providers annually and estimated up-front costs, robocall schemes cost Americans an will implement voluntary efforts to which may be in the tens of millions of estimated $10.5 billion annually, restore confidence in caller ID dollars for the largest voice service according to a third-party survey. To information. Studies conducted by providers. It is implausible that total reach $10.5 billion, Truecaller Cequint indicate that including implementation costs will come close to multiplied the 17% of survey additional caller ID information (e.g., the expected benefits of our actions. For respondents who reported losing money showing a business logo along with example, broad industry support for in a scam during the past 12 months by caller ID information on a smartphone deploying STIR/SHAKEN strongly the 2018 U.S. Census adult population display to convey legitimacy) increased indicates that the benefits to industry estimate of 253 million. The estimated pick up rates from 21% to 71%. Such alone outweigh implementation costs, 43 million phone scam victims was then information will enhance the benefits even before considering the benefits to multiplied by the average loss of $244. achieved by STIR/SHAKEN consumers of implementation. A recent civil action filed by the U.S. implementation. Department of Justice against five VoIP 50. Ensuring Reliable Access to 1. Expected Benefits carriers identifies several examples of Emergency and Healthcare 46. We supplement our estimate of fraud where consumers individually Communications. Implementing STIR/ the benefits of eliminating illegal and lost between $700 and $9,800 in a single SHAKEN will lead to fewer disruptions unwanted robocalls in the 2019 Further instance. To reach $10.5 billion, of healthcare and emergency Notice with additional data. Consistent Truecaller multiplied the 17% of survey communication systems that needlessly with our earlier conclusion, we find that respondents who reported losing money put lives at risk. Hospitals and 911 the deployment requirements set forth in a scam during the past 12 months by dispatch centers have reported that in this Report and Order will be integral the 2018 U.S. Census adult population robocall surges have disabled or to solving illegal robocall spoofing estimate of 253 million. The estimated disrupted their communications specifically and illegal robocalling 43 million phone scam victims was then network, and such disruptions have the generally. multiplied by the average loss of $244. potential to impede communications in

VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00029 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES 22038 Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations

life-or-death emergency situations. In taken 145 enforcement actions against and states that a number of its members one instance, Tufts Medical Center in companies for Do Not Call Registry pay the highest annual fee. Based on the Boston received more than 4,500 violations, and 25 other federal, state, record, we estimate that the robocalls in a two-hour period. In and local agencies brought 87 approximately 2,600 voice service another, the phone lines of several 911 enforcement actions as part of a single providers together would spend dispatch centers in Tarrant County, 2019 initiative. By reducing overall between roughly $39 million and $780 Texas, were disabled because of an hour numbers of robocalls and providing million annually in operating costs, long surge in robocalls. In 2018, the additional information for enforcement, with up-front costs for the largest voice Commission imposed a $120 million industry-wide implementation of STIR/ service providers in the tens of millions penalty for an illegal robocall campaign SHAKEN will save resources at federal, of dollars. Approximately 2,600 that disrupted an emergency medical state, and local agencies. While we do companies offered mobile voice or fixed paging service. Enabling voice service not quantify these savings, we believe voice service in December 2018. We providers to more effectively identify they add to the benefits of STIR/ anticipate that voice service providers illegal calls, including spoofed calls, to SHAKEN implementation that will may be able to streamline their costs healthcare and emergency accrue. over time. Moreover, we recognize that communication systems should reduce smaller voice service providers may 2. Expected Costs the risk of such situations. The benefit have different costs and challenges than to public safety will be considerable. 53. Implementation costs for STIR/ larger providers, but we are confident 51. Reducing Costs to Voice Service SHAKEN will vary depending on a that benefits to all Americans far exceed Providers. An overall reduction in voice service provider’s existing one-time implementation and recurring robocalls will ‘‘greatly lower network network configuration. Commenters annual operating costs. One small, rural costs by eliminating unwanted traffic indicated that voice service providers provider, using estimates from the and by eliminating the labor costs of will incur ongoing costs in addition to Commission’s 2019 SHAKEN/STIR handling numerous customer one-time implementation costs. Robocall Summit, concludes that an complaints.’’ We treat these anticipated Estimated one-time costs include, annual recurring cost of $100,000 will reductions in cost as a benefit to among others, software licensing for result in a cost of $26 per line for its 319 providers in order to limit our analysis authentication and verification services; customers. Additionally, in the Further of expected costs to those for hardware upgrades to network elements Notice, we propose to extend the implementation and operation. Illegal such as session border controllers and compliance deadline for smaller voice robocalls have led to unnecessary hardware upgrades required for software service providers and anticipate that network congestion with broader compatibility; as well as connectivity increased competition between vendors possible impacts than the targeted and network configuration changes, may result in lower prices and higher disruption of healthcare and emergency depending on current network quality solutions. One small, rural operations described above. We agree configuration, and related testing. One provider, using estimates from the with Comcast’s assessment that ‘‘the of the largest voice service providers Commission’s 2019 SHAKEN/STIR ability to identify and address illegally estimates that it will face one-time Robocall Summit, concludes that an spoofed robocalls using STIR/SHAKEN implementation costs ‘‘in the tens of annual recurring cost of $100,000 will will help reduce network costs for voice millions of dollars.’’ We expect that result in a cost of $26 per line for its 319 service providers.’’ One commenter implementation costs are likely to vary customers. Additionally, in the Further argues that this benefit may be realized significantly based on voice service Notice, we propose to extend the by larger providers more than smaller provider size and choices as to compliance deadline for smaller voice providers and we acknowledge that the implementation solutions. For example, service providers and anticipate that benefits of changes in network capacity voice service providers choosing to increased competition between vendors will vary by provider. Voice service directly implement STIR/SHAKEN will may result in lower prices and higher providers should also realize cost likely face larger one-time costs than quality solutions. savings through the reduced need for voice service providers choosing a customer service regarding illegal calls. hosted solution, which are likely to C. Other Issues We find that the overall benefit of these have larger recurring costs. Recurring 54. Display. We are pleased by voice anticipated cost savings will be annual costs will include fees associated service providers’ efforts to incorporate substantial and represent a long-term with authenticating and verifying calls, STIR/SHAKEN verification results in reduction in provider costs attributable plus certificate fees. Estimates for the information that they display to to STIR/SHAKEN. Voice service recurring annual operating costs their customers. Voice service providers providers may pass on the cost savings discussed by panelists at the so far are taking a variety of approaches to subscribers in the form of lower Commission’s July 2019 SHAKEN/STIR to leveraging STIR/SHAKEN verification prices, resulting in additional benefit to Robocall Summit range anywhere from result information to protect their their subscribers. approximately $15,000 to $300,000. Our subscribers from fraudulently spoofed 52. Reducing Spending on estimate regarding recurring annual calls, including through display of that Enforcement Actions. Broad STIR/ operating costs reflects a range because information. For instance, AT&T SHAKEN implementation will both of variation in provider costs and the announced that it would display a green reduce the need for enforcement against uncertainty of costs given the ongoing checkmark and the words ‘‘Valid illegally spoofed robocalls and make nature of STIR/SHAKEN Number’’ to subscribers if the call has continued enforcement less resource implementation. One commenter asserts been authenticated and passed through intensive. The Commission has brought that recurring annual operating costs are screening. T-Mobile announced that it at least six enforcement actions against ‘‘likely to be on the lower end of th[is] would display the words ‘‘Caller apparently liable actors for illegally range.’’ On the other hand, USTelecom Verified,’’ on the end user’s device spoofing caller ID, and issued 38 points out that fees paid by voice when it has verified that the call is warning citations for violations of the service providers to the Governance authentic. Other voice service providers Telephone Consumer Protection Act. Authority and Policy Administrator have not yet announced plans to display The Federal Trade Commission has range from $825 to $240,000 per year STIR/SHAKEN authentication

VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00030 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations 22039

information. Because we expect voice is a flexible solution with an industry- filings in the proceeding, the presenter service providers to have marketplace led governance system that can adapt may provide citations to such data or incentives to make the best possible use and respond to new developments. We arguments in his or her prior comments, of STIR/SHAKEN information once it is do not think that our intervention in the memoranda, or other filings (specifying available, and because industry governance structure is appropriate at the relevant page or paragraph numbers practices regarding display of STIR/ this stage given that we do not know the where such data or arguments can be SHAKEN verification results are in their nature and scope of the problems that found) in lieu of summarizing them in early stages of development, we decline may arise and industry is already the memorandum. Documents shown or at this time to require voice service working to address specific use cases. given to Commission staff during ex providers to display STIR/SHAKEN Additionally, because the Governance parte meetings are deemed to be written verification results to their subscribers Authority is made up of a variety of ex parte presentations and must be filed or mandate the specifications voice stakeholders representing many consistent with Rule 1.1206(b). In service providers must use if they perspectives, we have no reason to proceedings governed by Rule 1.49(f) or choose to display. AARP and CUNA believe it will not operate on a neutral for which the Commission has made advocate for a display requirement but basis. The current STI–GA Leadership available a method of electronic filing, do not identify a reason for a mandate and Board of Directors is available at written ex parte presentations and beyond merely pointing to the value of https://www.atis.org/sti-ga/leadership. memoranda summarizing oral ex parte displaying verification information. IV. Procedural Matters presentations, and all attachments While display of verification thereto, must be filed through the information may be valuable, we 57. Paperwork Reduction Act. This electronic comment filing system decline to adopt a mandate on that basis document does not contain new or available for that proceeding, and must because we expect the marketplace to modified information collection be filed in their native format (e.g., .doc, drive display efforts, and because we requirements subject to the Paperwork .xml, .ppt, searchable .pdf). Participants anticipate that marketplace solutions Reduction Act of 1995 (PRA), Public in this proceeding should familiarize will be superior to a static regulatory Law 104–13. In addition, therefore, it themselves with the Commission’s ex mandate. In December 2019, the does not contain any new or modified parte rules. information collection burden for small Consumer Advisory Committee 60. Final Regulatory Flexibility recommended that stakeholders business concerns with fewer than 25 employees, pursuant to the Small Analysis. As required by the Regulatory ‘‘conduct studies and solicit input on Flexibility Act of 1980 (RFA), an Initial what factors voice service providers Business Paperwork Relief Act of 2002, Public Law 107–198. Regulatory Flexibility Analysis (IRFA) should consider for displaying caller ID was incorporated into the 2019 Robocall information to consumers, including 58. Congressional Review Act. The Declaratory Ruling and Further Notice. . . . SHAKEN/STIR verification.’’ We Commission has determined, and the The Commission sought written public do not seek to prevent the market from Administrator of the Office of comment on the possible significant determining which form of display, if Information and Regulatory Affairs, economic impact on small entities any, is most useful; instead, we seek to Office of Management and Budget, regarding the proposals addressed in the encourage voice service providers to concurs, that this rule is non-major 2019 Robocall Declaratory Ruling and find the solutions that work best for under the Congressional Review Act, 5 Further Notice, including comments on their subscribers. U.S.C. 804(2). The Commission will 55. Governance. Several commenters send a copy of this Report & Order and the IRFA. Pursuant to the RFA, a Final advocate changing the governance Further Notice of Proposed Rulemaking Regulatory Flexibility Analysis is set structure. These commenters suggest we to Congress and the Government forth in Appendix C. The Commission’s play an adjudicatory role in disputes Accountability Office pursuant to 5 Consumer and Governmental Affairs that may arise between voice service U.S.C. 801(a)(1)(A). Bureau, Reference Information Center, providers, or direct the Governance 59. Ex Parte Rules. This proceeding will send a copy of this Report and Authority to take action on specific use shall be treated as a ‘‘permit-but- Order, including the FRFA, to the Chief cases, or change the membership disclose’’ proceeding in accordance Counsel for Advocacy of the Small requirements of the Governance with the Commission’s ex parte rules. Business Administration (SBA). Authority. Persons making ex parte presentations A. Need for, and Objectives of, the Rules 56. We decline to impose new must file a copy of any written regulations on the STIR/SHAKEN presentation or a memorandum 61. Nefarious schemes that governance structure. Stakeholders met summarizing any oral presentation manipulate caller ID information to the aggressive timeline laid out in the within two business days after the deceive consumers about the name and report issued by the North American presentation (unless a different deadline phone number of the party that is Numbering Council (NANC), applicable to the Sunshine period calling them, in order to facilitate establishing a collaborative Governance applies). Persons making oral ex parte fraudulent and other harmful activities, Authority and selecting the Policy presentations are reminded that continue to plague American Administrator by May 2019. By memoranda summarizing the consumers. In this Report and Order December 2019, the Policy presentation must (1) List all persons (Order), we both act on our proposal to Administrator approved the first attending or otherwise participating in require voice service providers to Certification Authorities, and voice the meeting at which the ex parte implement the STIR/SHAKEN caller ID service providers were able to register presentation was made, and (2) authentication framework if major voice with the Policy Administrator to obtain summarize all data presented and service providers did not voluntarily do credentials necessary to receive arguments made during the so by the end of 2019, and implement certificates from approved Certificate presentation. If the presentation the Pallone-Thune Telephone Robocall Authorities. We agree with T-Mobile consisted in whole or in part of the Abuse Criminal Enforcement and that, at this time, it ‘‘is not necessary for presentation of data or arguments Deterrence (TRACED) Act, which the Commission to have a role in STIR/ already reflected in the presenter’s directs the Commission to require all SHAKEN governance.’’ STIR/SHAKEN written comments, memoranda or other voice service providers to implement

VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00031 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES 22040 Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations

STIR/SHAKEN in the IP portions of Transmission facilities may be based on Commission estimates that most their networks. a single technology or a combination of providers of incumbent local exchange technologies. Establishments in this service are small businesses that may be B. Summary of Significant Issues Raised industry use the wired affected by our actions. According to by Public Comments in Response to the telecommunications network facilities Commission data, one thousand three IRFA that they operate to provide a variety of hundred and seven (1,307) Incumbent 62. There were no comments filed services, such as wired telephony Local Exchange Carriers reported that that specifically addressed the proposed services, including VoIP services, wired they were incumbent local exchange rules and policies presented in the (cable) audio and video programming service providers. Of this total, an IRFA. distribution, and wired broadband estimated 1,006 have 1,500 or fewer C. Response to Comments by the Chief internet services. By exception, employees. Thus, using the SBA’s size Counsel for Advocacy of the SBA establishments providing satellite standard the majority of incumbent television distribution services using LECs can be considered small entities. 63. Pursuant to the Small Business facilities and infrastructure that they 69. Competitive Local Exchange Jobs Act of 2010, which amended the operate are included in this industry.’’ Carriers (competitive LECs), Competitive RFA, the Commission is required to The SBA has developed a small Access Providers (CAPs), Shared-Tenant respond to any comments filed by the business size standard for Wired Service Providers, and Other Local Chief Counsel for Advocacy of the Small Telecommunications Carriers, which Service Providers. Neither the Business Administration (SBA), and to consists of all such companies having Commission nor the SBA has developed provide a detailed statement of any 1,500 or fewer employees. U.S. Census a small business size standard change made to the proposed rules as a Bureau data for 2012 show that there specifically for these service providers. result of those comments. were 3,117 firms that operated that year. The appropriate NAICS Code category is 64. The Chief Counsel did not file any Of this total, 3,083 operated with fewer Wired Telecommunications Carriers and comments in response to the proposed than 1,000 employees. The largest under that size standard, such a rules in this proceeding. category provided by the census data is business is small if it has 1,500 or fewer D. Description and Estimate of the ‘‘1000 employees or more’’ and a more employees. U.S. Census Bureau data for Number of Small Entities to Which the precise estimate for firms with fewer 2012 indicate that 3,117 firms operated Rules Will Apply than 1,500 employees is not provided. during that year. Of that number, 3,083 Thus, under this size standard, the operated with fewer than 1,000 65. The RFA directs agencies to majority of firms in this industry can be employees. The largest category provide a description and, where considered small. provided by the census data is ‘‘1000 feasible, an estimate of the number of 67. Local Exchange Carriers (LECs). employees or more’’ and a more precise small entities that may be affected by Neither the Commission nor the SBA estimate for firms with fewer than 1,500 the final rules adopted pursuant to the has developed a size standard for small employees is not provided. Based on Order. The RFA generally defines the businesses applicable to local exchange these data, the Commission concludes term ‘‘small entity’’ as having the same services. The closest applicable NAICS that the majority of Competitive LECS, meaning as the terms ‘‘small business,’’ Code category is Wired CAPs, Shared-Tenant Service Providers, ‘‘small organization,’’ and ‘‘small Telecommunications Carriers. Under and Other Local Service Providers, are governmental jurisdiction.’’ In addition, the applicable SBA size standard, such small entities. According to Commission the term ‘‘small business’’ has the same a business is small if it has 1,500 or data, 1,442 carriers reported that they meaning as the term ‘‘small-business fewer employees. U.S. Census Bureau were engaged in the provision of either concern’’ under the Small Business Act. data for 2012 show that there were 3,117 competitive local exchange services or Pursuant to 5 U.S.C. 601(3), the firms that operated for the entire year. competitive access provider services. Of statutory definition of a small business Of that total, 3,083 operated with fewer these 1,442 carriers, an estimated 1,256 applies ‘‘unless an agency, after than 1,000 employees. The largest have 1,500 or fewer employees. In consultation with the Office of category provided by the census data is addition, 17 carriers have reported that Advocacy of the Small Business ‘‘1000 employees or more’’ and a more they are Shared-Tenant Service Administration and after opportunity precise estimate for firms with fewer Providers, and all 17 are estimated to for public comment, establishes one or than 1,500 employees is not provided. have 1,500 or fewer employees. Also, 72 more definitions of such term which are Thus under this category and the carriers have reported that they are appropriate to the activities of the associated size standard, the Other Local Service Providers. Of this agency and publishes such definition(s) Commission estimates that the majority total, 70 have 1,500 or fewer employees. in the Federal Register.’’A ‘‘small- of local exchange carriers are small Consequently, based on internally business concern’’ is one which: (1) Is entities. researched FCC data, the Commission independently owned and operated; (2) 68. Incumbent Local Exchange estimates that most providers of is not dominant in its field of operation; Carriers (incumbent LECs). Neither the competitive local exchange service, and (3) satisfies any additional criteria Commission nor the SBA has developed competitive access providers, Shared- established by the SBA. a small business size standard Tenant Service Providers, and Other specifically for incumbent local Local Service Providers are small 1. Wireline Carriers exchange services. The closest entities. 66. Wired Telecommunications applicable NAICS Code category is 70. We have included small Carriers. The U.S. Census Bureau Wired Telecommunications Carriers. incumbent LECs in this present RFA defines this industry as ‘‘establishments Under the applicable SBA size standard, analysis. As noted above, a ‘‘small primarily engaged in operating and/or such a business is small if it has 1,500 business’’ under the RFA is one that, providing access to transmission or fewer employees. U.S. Census Bureau inter alia, meets the pertinent small- facilities and infrastructure that they data for 2012 indicate that 3,117 firms business size standard (e.g., a telephone own and/or lease for the transmission of operated the entire year. Of this total, communications business having 1,500 voice, data, text, sound, and video using 3,083 operated with fewer than 1,000 or fewer employees) and ‘‘is not wired communications networks. employees. Consequently, the dominant in its field of operation.’’ The

VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00032 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations 22041

SBA’s Office of Advocacy contends that, does receive such information on a case- 1,500 employees. Thus, using available for RFA purposes, small incumbent by-case basis if a cable operator appeals data, we estimate that the majority of LECs are not dominant in their field of a local franchise authority’s finding that wireless firms can be considered small. operation because any such dominance the operator does not qualify as a small 75. Satellite Telecommunications. is not ‘‘national’’ in scope. We have cable operator pursuant to § 76.901(f) of This category comprises firms therefore included small incumbent the Commission’s rules. Therefore we ‘‘primarily engaged in providing LECs in this RFA analysis, although we are unable at this time to estimate with telecommunications services to other emphasize that this RFA action has no greater precision the number of cable establishments in the effect on Commission analyses and system operators that would qualify as telecommunications and broadcasting determinations in other, non-RFA small cable operators under the industries by forwarding and receiving contexts. Interexchange Carriers (IXCs). definition in the Communications Act. communications signals via a system of Neither the Commission nor the SBA satellites or reselling satellite 2. Wireless Carriers has developed a small business size telecommunications.’’ Satellite standard specifically for Interexchange 73. Wireless Telecommunications telecommunications service providers Carriers. The closest applicable NAICS Carriers (Except Satellite). This industry include satellite and earth station Code category is Wired comprises establishments engaged in operators. The category has a small Telecommunications Carriers. The operating and maintaining switching business size standard of $35 million or applicable size standard under SBA and transmission facilities to provide less in average annual receipts, under rules is that such a business is small if communications via the airwaves. SBA rules. For this category, U.S. it has 1,500 or fewer employees. U.S. Establishments in this industry have Census Bureau data for 2012 show that Census Bureau data for 2012 indicate spectrum licenses and provide services there were a total of 333 firms that that 3,117 firms operated for the entire using that spectrum, such as cellular operated for the entire year. Of this year. Of that number, 3,083 operated services, paging services, wireless total, 299 firms had annual receipts of with fewer than 1,000 employees. The internet access, and wireless video less than $25 million. The available U.S. largest category provided by the census services. The appropriate size standard Census Bureau data does not provide a data is ‘‘1000 employees or more’’ and under SBA rules is that such a business more precise estimate of the number of a more precise estimate for firms with is small if it has 1,500 or fewer firms that meet the SBA size standard of fewer than 1,500 employees is not employees. For this industry, U.S. annual receipts of $35 million or less. provided. Census Bureau data for 2012 show that Consequently, we estimate that the 71. According to internally developed there were 967 firms that operated for majority of satellite telecommunications Commission data, 359 companies the entire year. Of this total, 955 firms providers are small entities. reported that their primary employed fewer than 1,000 employees 3. Resellers telecommunications service activity was and 12 firms employed of 1000 the provision of interexchange services. employees or more. Available census 76. Local Resellers. The SBA has not Of this total, an estimated 317 have data does not provide a more precise developed a small business size 1,500 or fewer employees. estimate of the number of firms that standard specifically for Local Resellers. Consequently, the Commission have employment of 1,500 or fewer The SBA category of estimates that the majority of employees. The largest category Telecommunications Resellers is the interexchange service providers are provided is for firms with ‘‘1000 closest NAICs code category for local small entities. employees or more.’’ Thus under this resellers. The Telecommunications 72. Cable System Operators (Telecom category and the associated size Resellers industry comprises Act Standard). The Communications standard, the Commission estimates that establishments engaged in purchasing Act of 1934, as amended, also contains the majority of wireless access and network capacity from a size standard for small cable system telecommunications carriers (except owners and operators of operators, which is ‘‘a cable operator satellite) are small entities. telecommunications networks and that, directly or through an affiliate, 74. The Commission’s own data— reselling wired and wireless serves in the aggregate fewer than one available in its Universal Licensing telecommunications services (except percent of all subscribers in the United System—indicate that, as of August 31, satellite) to businesses and households. States and is not affiliated with any 2018 there are 265 Cellular licensees Establishments in this industry resell entity or entities whose gross annual that will be affected by our actions. For telecommunications; they do not revenues in the aggregate exceed the purposes of this FRFA, consistent operate transmission facilities and $250,000,000.’’ As of 2018, there were with Commission practice for wireless infrastructure. Mobile virtual network approximately 50,504,624 cable video services, the Commission estimates the operators (MVNOs) are included in this subscribers in the United States. number of licensees based on the industry. Under the SBA’s size Accordingly, an operator serving fewer number of unique FCC Registration standard, such a business is small if it than 505,046 subscribers shall be Numbers. The Commission does not has 1,500 or fewer employees. U.S. deemed a small operator if its annual know how many of these licensees are Census Bureau data from 2012 show revenues, when combined with the total small, as the Commission does not that 1,341 firms provided resale services annual revenues of all its affiliates, do collect that information for these types during that year. Of that number, all not exceed $250 million in the of entities. Similarly, according to operated with fewer than 1,000 aggregate. Based on available data, we internally developed Commission data, employees. Available census data does find that all but six incumbent cable 413 carriers reported that they were not provide a more precise estimate of operators are small entities under this engaged in the provision of wireless the number of firms that have size standard. We note that the telephony, including cellular service, employment of 1,500 or fewer Commission neither requests nor Personal Communications Service employees. The largest category collects information on whether cable (PCS), and Specialized Mobile Radio provided is for firms with ‘‘1000 system operators are affiliated with (SMR) Telephony services. Of this total, employees or more.’’ Thus, under this entities whose gross annual revenues an estimated 261 have 1,500 or fewer category and the associated small exceed $250 million. The Commission employees, and 152 have more than business size standard, the majority of

VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00033 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES 22042 Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations

these resellers can be considered small satellite) to businesses and households. affected by our action can be considered entities. According to Commission data, Establishments in this industry resell small. 213 carriers have reported that they are telecommunications; they do not E. Description of Projected Reporting, engaged in the provision of local resale operate transmission facilities and Recordkeeping, and Other Compliance services. Of these, an estimated 211 infrastructure. Mobile virtual networks Requirements for Small Entities have 1,500 or fewer employees and two operators (MVNOs) are included in this have more than 1,500 employees. industry. Under the applicable SBA size 80. This Order modifies the Consequently, the Commission standard, such a business is small if it Commission’s rules in accordance with estimates that the majority of local has 1,500 or fewer employees. U.S. our proposal to require voice service resellers are small entities. Census Bureau data for 2012 show that providers to implement the STIR/ 77. Toll Resellers. The Commission 1,341 firms provided resale services SHAKEN caller ID authentication has not developed a definition for Toll during that year. Of that number, 1,341 framework if major voice service Resellers. The closest NAICS Code operated with fewer than 1,000 providers did not voluntarily do so by Category is Telecommunications employees. Available census data does the end of 2019, and implements Resellers. The Telecommunications not provide a more precise estimate of Congress’s direction in the TRACED Act Resellers industry comprises the number of firms that have to mandate STIR/SHAKEN. The establishments engaged in purchasing employment of 1,500 or fewer amended rules adopted in the Order do access and network capacity from employees. The largest category not contain reporting or recordkeeping owners and operators of provided is for firms with ‘‘1000 requirements. telecommunications networks and employees or more.’’ Thus, under this reselling wired and wireless category and the associated small F. Steps Taken To Minimize the telecommunications services (except business size standard, the majority of Significant Economic Impact on Small satellite) to businesses and households. these prepaid calling card providers can Entities, and Significant Alternatives Establishments in this industry resell be considered small entities. According Considered telecommunications; they do not to Commission data, 193 carriers have 81. The RFA requires an agency to operate transmission facilities and reported that they are engaged in the describe any significant, specifically infrastructure. MVNOs are included in provision of prepaid calling cards. All small business, alternatives that it has this industry. The SBA has developed a 193 carriers have 1,500 or fewer considered in reaching its approach. small business size standard for the employees. Consequently, the This document does not distinguish category of Telecommunications Commission estimates that the majority between small entities and other entities Resellers. Under that size standard, such of prepaid calling card providers are and individuals. a business is small if it has 1,500 or small entities that may be affected by fewer employees. 2012 Census Bureau these rules. G. Report to Congress data show that 1,341 firms provided 4. Other Entities 82. The Commission will send a copy resale services during that year. Of that of the Order, including this FRFA, in a 79. All Other Telecommunications. number, 1,341 operated with fewer than report to Congress pursuant to the The ‘‘All Other Telecommunications’’ 1,000 employees. Available census data Congressional Review Act. In addition, category is comprised of establishments does not provide a more precise the Commission will send a copy of the primarily engaged in providing estimate of the number of firms that Order, including this FRFA, to the Chief specialized telecommunications have employment of 1,500 or fewer Counsel for Advocacy of the SBA. A services, such as satellite tracking, employees; the largest category copy of the Order and FRFA (or communications telemetry, and radar provided is for firms with ‘‘1000 summaries thereof) will also be employees or more.’’ Thus, under this station operation. This industry also published in the Federal Register. category and the associated small includes establishments primarily business size standard, the majority of engaged in providing satellite terminal V. Ordering Clauses these resellers can be considered small stations and associated facilities 83. Accordingly, IT IS ORDERED, entities. According to Commission data, connected with one or more terrestrial pursuant to sections 4(i), 4(j), 227(e), 881 carriers have reported that they are systems and capable of transmitting 227b, 251(e), and 303(r), of the engaged in the provision of toll resale telecommunications to, and receiving Communications Act of 1934, as services. Of this total, an estimated 857 telecommunications from, satellite amended (the Act), 47 U.S.C. 154(i), have 1,500 or fewer employees. systems. Establishments providing 154(j), 227(e), 227b, 251(e), and 303(r), Consequently, the Commission internet services or voice over internet that this Report and Order IS estimates that the majority of toll protocol (VoIP) services via client- resellers are small entities. supplied telecommunications ADOPTED. 78. Prepaid Calling Card Providers. connections are also included in this 84. IT IS FURTHER ORDERED that Neither the Commission nor the SBA industry. The SBA has developed a Part 64 of the Commission’s rules IS has developed a small business small business size standard for ‘‘All AMENDED as set forth in the following. definition specifically for prepaid Other Telecommunications,’’ which 85. IT IS FURTHER ORDERED that, calling card providers. The most consists of all such firms with annual pursuant to §§ 1.4(b)(1) and 1.103(a) of appropriate NAICS code-based category receipts of $35 million or less. For this the Commission’s rules, 47 CFR for defining prepaid calling card category, U.S. Census Bureau data for 1.4(b)(1), 1.103(a), this Report and Order providers is Telecommunications 2012 show that there were 1,442 firms SHALL BE EFFECTIVE 30 days after Resellers. This industry comprises that operated for the entire year. Of publication in the Federal Register. establishments engaged in purchasing those firms, a total of 1,400 had annual 86. IT IS FURTHER ORDERED that access and network capacity from receipts less than $25 million and 15 the Commission SHALL SEND a copy of owners and operators of firms had annual receipts of $25 million this Report and Order to Congress and telecommunications networks and to $49,999,999. Thus, the Commission to the Government Accountability reselling wired and wireless estimates that the majority of ‘‘All Other Office pursuant to the Congressional telecommunications services (except Telecommunications’’ firms potentially Review Act, see 5 U.S.C. 801(a)(1)(A).

VerDate Sep<11>2014 16:37 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00034 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations 22043

List of Subjects in 47 CFR Part 64 provider confirms that the caller DEPARTMENT OF COMMERCE Communications common carriers, identification information transmitted National Oceanic and Atmospheric Carrier equipment, Reporting and with a call it terminates was properly Administration recordkeeping requirements, authenticated. Telecommunications, Telephone. (g) Voice service. The term ‘‘voice 50 CFR Part 622 Federal Communications Commission. service’’— Cecilia Sigmund, (1) Means any service that is [Docket No. 200408–0106] Federal Register Liaison Officer, Office of the interconnected with the public switched RIN 0648–BI12 Secretary. telephone network and that furnishes voice communications to an end user Final Rules Fisheries of the Caribbean, Gulf of using resources from the North Mexico, and South Atlantic; Historical For the reasons discussed in the American Numbering Plan or any Captain Permits Conversions preamble, the Federal Communications successor to the North American Commission amends 47 CFR part 64 Numbering Plan adopted by the AGENCY: National Marine Fisheries follows: Commission under section 251(e)(1) of Service (NMFS), National Oceanic and Atmospheric Administration (NOAA), PART 64—MISCELLANEOUS RULES the Communications Act of 1934, as amended; and Commerce. RELATING TO COMMON CARRIERS ACTION: Final rule. (2) Includes— ■ 1. The authority citation for part 64 is (i) Transmissions from a telephone SUMMARY: NMFS issues regulations to revised to read as follows: facsimile machine, computer, or other implement management measures as Authority: 47 U.S.C. 154, 201, 202, 217, device to a telephone facsimile described in an abbreviated framework 218, 220, 222, 225, 226, 227, 227b, 228, machine; and action to the Fishery Management Plans 251(a), 251(e), 254(k), 262, 403(b)(2)(B), (c), (FMPs) for the Reef Fish Resources of (ii) Without limitation, any service 616, 620, 1401–1473, unless otherwise noted; the Gulf of Mexico (Reef Fish FMP) and Pub. L. 115–141, Div. P, sec. 503, 132 Stat. that enables real-time, two-way voice Coastal Migratory Pelagic Resources of 348, 1091. communications, including any service the Gulf of Mexico and Atlantic Region ■ 2. Add Subpart HH, consisting of that requires internet Protocol- (CMP FMP). This final rule enables §§ 64.6300 and 64.6301, to read as compatible customer premises eligible permit holders to replace follows: equipment and permits out-bound historical captain endorsements in the calling, whether or not the service is Subpart HH—Caller ID Authentication reef fish and CMP fisheries in the Gulf one-way or two-way voice over internet of Mexico (Gulf) with standard Federal § 64.6300 Definitions. Protocol. charter vessel/headboat permits to (a) Authenticate caller identification § 64.6301 Caller ID authentication. reduce the regulatory and economic information. The term ‘‘authenticate burden on historical captains. In caller identification information’’ refers (a) STIR/SHAKEN Implementation by addition, NMFS is correcting an to the process by which a voice service Voice Service Providers. Not later than inadvertent error in the final rule for provider attests to the accuracy of caller June 30, 2021, a voice service provider Amendment 20A to the CMP FMP identification information transmitted shall fully implement the STIR/ regarding commercial king mackerel with a call it originates. SHAKEN authentication framework in permit requirements. (b) Caller identification information. its internet Protocol networks. To fulfill DATES: This final rule is effective on The term ‘‘caller identification this obligation, a voice service provider May 21, 2020. shall: information’’ has the same meaning ADDRESSES: Electronic copies of the given the term ‘‘caller identification (1) Authenticate and verify caller abbreviated framework document that information’’ in 47 CFR 64.1600(c) as it identification information for all SIP contains an environmental assessment currently exists or may hereafter be calls that exclusively transit its own and a Regulatory Flexibility Act (RFA) amended. network; analysis may be obtained from the (c) Intermediate provider. The term Southeast Regional Office website at ‘‘intermediate provider’’ means any (2) Authenticate caller identification information for all SIP calls it originates https://www.fisheries.noaa.gov/action/ entity that carriers or processes traffic framework-action-replacement- that traverses or will traverse the PSTN and that will exchange with another voice service provider or intermediate historical-captain-permits-standard- at any point insofar as that entity federal-charter-headboat. neither originates nor terminates that provider and, to the extent technically traffic. feasible, transmit that call with caller ID FOR FURTHER INFORMATION CONTACT: Rich (d) SIP call. The term ‘‘SIP call’’ refers authentication information to the next Malinowski, NMFS Southeast Regional to calls initiated, maintained, and voice service provider or intermediate Office, telephone: 727–824–5305, email: terminated using the Session Initiation provider in the call path; and [email protected]. Protocol signaling protocol. (3) Verify caller identification SUPPLEMENTARY INFORMATION: NMFS and (e) STIR/SHAKEN authentication information for all SIP calls it receives the Gulf of Mexico Fishery Management framework. The term ‘‘STIR/SHAKEN from another voice service provider or Council (Gulf Council) manage reef fish authentication framework’’ means the intermediate provider which it will in Gulf Federal waters under the Reef secure telephone identity revisited and terminate and for which the caller Fish FMP. The CMP fishery in Gulf and signature-based handling of asserted identification information has been Atlantic Federal waters is managed information using tokens standards. authenticated. jointly by the Gulf Council and South (f) Verify caller identification Atlantic Fishery Management Council information. The term ‘‘verify caller (b) [Reserved]. (Councils). The Gulf Council prepared identification information’’ refers to the [FR Doc. 2020–07585 Filed 4–20–20; 8:45 am] the Reef Fish FMP and the Councils process by which a voice service BILLING CODE 6712–01–P jointly prepared the CMP FMP. NMFS

VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00035 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES