All CPNI Violations Would be Reported to FBI Under Proposal
Carriers would have to notify the FBI and Secret Service within 7 days whenever a pretexter violates customer proprietary network information (CPNI) rules, under an FCC rule circulating on the 8th floor, industry sources said Thurs. But subscribers whose privacy was violated could be kept in the dark for a month or longer. CTIA is seeking a meeting with DoJ to work out a compromise and is asking the FCC not to include the requirement in a final rule until the agency seeks comment.
Sign up for a free preview to unlock the rest of this article
Communications Daily is required reading for senior executives at top telecom corporations, law firms, lobbying organizations, associations and government agencies (including the FCC). Join them today!
DoJ asked for the notification requirement in a brief letter Dec. 28, days before the CPNI item began to circulate. Chmn. Martin decided that since the request came from DoJ it should be part of the rule, sources said. DoJ also asked the Commission to bar carriers from immediately notifying customers that their privacy had been violated, while an investigation is started.
CTIA has begun to flag possible problems presented by the DoJ’s request in a series of visits at the FCC to discuss the CPNI order, Regulatory Affairs Vp Christopher Guttman- McCabe told us. Guttman-McCabe said the FCC should consider first seeking comment through a rulemaking and not make the DoJ request part of the final rule. “CTIA and the carriers want to work with the DoJ to get a sense of what they want and how we can protect it,” he said: “We think this is an issue that’s perfect for an NPRM, perfect to have a discussion. We want to meet with DoJ to set a sense of what they're trying to accomplish.”
A 2nd industry source noted that several states require notification of legal authorities in the event of a CPNI violation, but only on specified conditions. Under DoJ’s proposal all violations would be reported. The source also said discussion with DoJ could prove helpful: “It sounds like the kind of thing where if you have a dialog you might be able to work it out.”
DoJ’s letter asked the FCC to order carriers to delay telling customers of a CPNI breach until after law enforcement has been notified. “Immediate consumer notification of a breach may tip off the person(s) responsible, causing them, among other things, to destroy evidence, change their behavior, and accelerate their illegal use of any data before consumers or company victims can act,” DoJ said. “The carrier shall not notify its customers or disclose the breach publicly, whether voluntarily or under state or local law or these rules, until it has completed the process of notifying law enforcement.” Federal investigators could decide against public disclosure of the privacy violation for 30 days or longer if considered “reasonably necessary.” Carriers would have to file a report through a central reporting facility to be created.