Subscriber Rules NPRM Likely to be Short on Tentative Conclusions
The FCC likely will ask a battery of questions but draw few “tentative conclusions” in an imminent notice of proposed rulemaking on guarding customer records, sources said. Given the current dearth of detailed customer proprietary network information (CPNI) rules at FCC, the Commission is expected to issue few additional citations based on thousands of CPNI certifications filed for the record in recent days, a mandate the agency temporarily reimposed as part of an investigation (CD Feb 1 p5), they said. The FCC remains on track to release the NPRM later this week, Chmn. Martin told reporters Wed.
Sign up for a free preview to unlock the rest of this article
Communications Daily is required reading for senior executives at top telecom corporations, law firms, lobbying organizations, associations and government agencies (including the FCC). Join them today!
The FCC may be weighing whether to reimpose electronic audit tracking mandates included in the original CPNI rules -
an element the FCC pulled at carriers’ request, Carol Mattey of Deloitte & Touche, who headed efforts to develop CPNI rules at the FCC in the late 1990s, told us Wed. Carriers insisted the tracking requirements were too burdensome, she said: “CPNI is not just your name and address -- it’s every phone call you make… It’s a huge amount of data.”
“That may be an area the FCC will focus on,” Mattey said. “Keeping such an audit trail is exactly what you need to figure out how the breach is occurring.” Requiring firms to track that sort of thing would be a way to learn if the issue is carrier misfeasance or data broker fraud, she said. Mattey predicted an NPRM long on questions but short on conclusions. “As a general rule, the FCC tends not to draw conclusions except on a limited subset of things where they know they want to go,” she said.
A probable tentative conclusion will be one that the FCC should require carriers to file annual CPNI certifications with the FCC -- which Martin said last week the FCC will propose. The original CPNI rule required carriers to file annual certifications at the Commission, but the FCC reversed itself, acting on a petition for reconsideration. As part of its investigation into cellphone record security, the FCC last week required wireline and wireless carriers to file CPNI certification documents. Staff will have to examine thousands of these documents.
The FCC likely will mine the newly acquired certification documents for information on how carriers are complying with standards. But the agency may not act against many carriers because the rules aren’t that detailed, an industry source said. “The certification is just a careful statement of compliance with the rules,” the source said. “There is some squishiness… The FCC hasn’t specified every jot and tittle.”
“We have submitted our filing with everybody else. I think everyone is trying to be cooperative,” said a carrier source. “The CPNI rules have kind of been a backwater for some time at the FCC. They're clearly no longer a backwater.” The FCC could have problems taking enforcement actions in that the rules may not be fully developed, this source said: “That being the case, it’s difficult to enforce what’s not there.” Still, the source said, the FCC does have rules on the books: “There is a set of rules. There is a set of requirements. It’s unclear whether those requirements were followed or not.”
The FCC will likely be looking for “outliers,” carriers that clearly violated the rules, Mattey said. “It would be very difficult to take action against a carrier that outlines a process that meets the reasonable person stand,” she said. “They will be taking a hard look at certifications that have very little substance and don’t appear to meet that threshold.”
The FCC Jan. 30 issued notices of apparent liability against carriers AT&T and Alltel for failure to file proper certification documents. AT&T said it couldn’t find the document for the old AT&T, pre-merger with SBC. Alltel filed a 2nd document Tues. saying it “inadvertently” filed “an earlier version of the certification” and asking the FCC to replace the older version with the newer one.