Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations 22029 and-comment requirements of the FEDERAL COMMUNICATIONS Synopsis Administrative Procedure Act, see 5 COMMISSION I. Introduction U.S.C. 553(b)(A). 7. Implementation. As a temporary 47 CFR Part 64 1. Each day, Americans receive transition measure, for 90 days after millions of unwanted phone calls. One source indicates that Americans publication of this document in the [WC Docket Nos. 17–97, 20–67; FCC 20– received over 58 billion such calls in Federal Register, U.S. Bank will 42; FRS 16631] continue to process payments to P.O. 2019 alone. These include ‘‘spoofed’’ Box 979088. After that date, forfeiture Call Authentication Trust Anchor; calls whereby the caller falsifies caller payments must be made in accordance Implementation of TRACED Act— ID information that appears on a with the procedures set forth in each Knowledge of Customers by Entities recipient’s phone to deceive them into forfeiture order and on the With Access to Numbering Resources thinking the call is from someone they Commission’s website, www.fcc.gov/ know or can trust. Spoofing has legal licensing-databases/fees. For now, such AGENCY: Federal Communications and illegal uses. For example, medical payments will be made through the Fee Commission. professionals calling patients from their Filer Online System (Fee Filer), mobile phones often legally spoof the accessible at https://www.fcc.gov/ ACTION: Final rule. outgoing phone number to be the office licensing-databases/fees/fee-filer. As we phone number for privacy reasons, and assess and implement U.S. Treasury SUMMARY: In this document, the businesses often display a toll-free call- initiatives toward an all-electronic Commission adopts a rule that mandates back number. Illegal spoofing, on the payment system, we may transition to that all originating and terminating other hand, occurs when a caller other secure payment systems with voice service providers implement the transmits misleading or inaccurate appropriate public notice and guidance. STIR/SHAKEN caller ID authentication caller ID information with the intent to framework in the internet Protocol (IP) defraud, cause harm, or wrongly obtain III. Ordering Clauses portions of their networks by June 30, anything of value. And these spoofed 8. Accordingly, it is ordered, that 2021. In establishing this requirement, calls are not simply an annoyance—they pursuant to sections 4(i), 4(j), 158, 208, the Report and Order both acts on the result in billions of dollars lost to fraud, and 224 of the Communications Act of Commission’s proposal to require voice degrade consumer confidence in the 1934, as amended, 47 U.S.C. 154(i), service providers to implement the voice network, and harm our public 154(j), 158, 208, and 224, the Order is STIR/SHAKEN caller ID authentication safety. A 2019 survey estimated that hereby adopted and the rules set forth framework if major voice service spoofing fraud affected one in six in the Appendix of the Order are hereby providers did not voluntarily do so by Americans and cost approximately amended effective May 21, 2020. the end of 2019, and implements $10.5 billion in a single 12-month period. List of Subjects in 47 CFR Part 1 Congress’s direction in the recently enacted Pallone-Thune Telephone 2. The Commission, Congress, and Administrative practice and Robocall Abuse Criminal Enforcement state attorneys general all agree on the procedure. and Deterrence (TRACED) Act to need to protect consumers and put an Federal Communications Commission. mandate STIR/SHAKEN not later than end to illegal caller ID spoofing. Over Cecilia Sigmund, 18 months after the date of enactment of the past three years, the Commission Federal Register Liaison Officer. that Act. This action builds on the has taken a multi-pronged approach to Commission’s aggressive and multi- this problem—issuing hundreds of Final Rules pronged approach to ending illegal millions of dollars in fines for violations For the reasons discussed in the caller ID spoofing. of our Truth in Caller ID rules; preamble, the Federal Communications expanding those rules to reach foreign Commission amends 47 CFR part 1 as DATES: Effective May 21, 2020. calls and text messages; enabling voice service providers to block certain clearly follows: FOR FURTHER INFORMATION CONTACT: For unlawful calls before they reach further information, please contact PART 1—PRACTICE AND consumers’ phones; and clarifying that Mason Shefa, Competition Policy PROCEDURE voice service providers may offer call- Division, Wireline Competition Bureau, blocking services by default. We have at [email protected]. ■ 1. The authority citation for part 1 also called on industry to ‘‘trace back’’ continues to read as follows: SUPPLEMENTARY INFORMATION: The full illegal spoofed calls and text messages Authority: 47 U.S.C. chs. 2, 5, 9, 13; 28 text of this document, WC Docket Nos. to their original sources and encouraged U.S.C. 2461 note, unless otherwise noted. 17–97, 20–67; FCC 20–42, adopted and industry to develop and implement new ■ 2. Amend § 1.80 by revising paragraph released on March 31, 2020, is available caller ID authentication technology. (h) to read as follows: for public inspection during regular That technology, known as STIR/ business hours in the FCC Reference SHAKEN, allows voice service § 1.80 Forfeiture proceedings. Information Center, Portals II, 445 12th providers to verify that the caller ID *** Street SW, Room CY–A257, information transmitted with a (h) Payment. The forfeiture should be Washington, DC 20554 or at the particular call matches the caller’s paid electronically using the following internet address: https:// number. Entities variously refer to this Commission’s electronic payment docs.fcc.gov/public/attachments/FCC- technology as either ‘‘SHAKEN/STIR’’ system in accordance with the 20-42A1.pdf . The Further Notice of or ‘‘STIR/SHAKEN.’’ In the past, the procedures set forth on the Proposed Rulemaking WC Docket Nos. Commission has referred to the Commission’s website, www.fcc.gov/ 17–97, 20–67; FCC 20–42, adopted technology as ‘‘SHAKEN/STIR.’’ To licensing-databases/fees. concurrently with this document and ensure consistency with the TRACED * * * * * available at the same internet address, is Act, we use ‘‘STIR/SHAKEN’’ here. Its [FR Doc. 2020–07540 Filed 4–20–20; 8:45 am] published elsewhere in this issue of the widespread implementation will reduce BILLING CODE 6712–12–P Federal Register. the effectiveness of illegal spoofing, VerDate Sep<11>2014 15:57 Apr 20, 2020 Jkt 250001 PO 00000 Frm 00021 Fmt 4700 Sfmt 4700 E:\FR\FM\21APR1.SGM 21APR1 lotter on DSKBCFDHB2PROD with RULES 22030 Federal Register / Vol. 85, No. 77 / Tuesday, April 21, 2020 / Rules and Regulations allow law enforcement to identify bad 5. To combat illegal spoofing, authentication service to create this actors more easily, and help voice industry technologists from the internet ‘‘Identity’’ header, which contains service providers identify calls with Engineering Task Force (IETF) and the encrypted identifying information as illegally spoofed caller ID information Alliance for Telecommunications well as the location of the public key before those calls reach their Industry Solutions (ATIS) developed that can be used to decode this subscribers. standards for the authentication and information. The authentication service 3. Today, we build on our aggressive verification of caller ID information for can be provided by the voice service and multi-pronged approach to ending calls carried over an IP network using provider itself, or by a third party acting illegal caller ID spoofing. First, we the Session Initiation Protocol (SIP). under the voice service provider’s mandate that all voice service providers The Session Initiation Protocol (SIP) is direction. When the terminating voice implement the STIR/SHAKEN caller ID ‘‘an application-layer control (signaling) service provider receives the call, it authentication framework in the protocol for creating, modifying, and sends the SIP INVITE with the Identity internet Protocol (IP) portions of their terminating sessions’’ such as internet header to a verification service, which networks by June 30, 2021. In Protocol (IP) telephony calls. The IETF uses the public key that corresponds recognition of the fact that it is caller ID formed the Secure Telephony Identity uniquely to the originating voice service information transmitted with a call that Revisited (STIR) working group, which provider’s private key to decode the is authenticated, we use the term ‘‘caller has produced several protocols for encrypted information and verify that it ID authentication’’ in this Report and authenticating caller ID information. is consistent with the information sent Order and Further Notice of Proposed ATIS, together with the SIP Forum, without encryption in the SIP INVITE. Rulemaking. We understand this term to produced the Signature-based Handling Like the corresponding authentication be interchangeable with the term ‘‘call of Asserted information using toKENs service on the originating voice service authentication’’ as used in other (SHAKEN) specification which provider’s end, the terminating voice contexts, including the TRACED Act. In standardizes how the protocols service provider’s verification service establishing this requirement, we both produced by STIR are implemented can be performed internally or by a act on our proposal to require voice across the industry. The SIP Forum is trusted third-party