Federal Communications Commission DA 07-4090 Before the Federal Communications Commission Washington, D.C. 20554 In the Matter of Cbeyond Communications, Inc. Notice of Apparent Liability for Forfeiture ) ) ) ) ) ) ) File No. EB-06-IH-0840 NAL/Acct. No. 200632080153 FRN: 0003759602 ORDER Adopted: October 5, 2007 Released: October 9, 2007 By the Chief, Enforcement Bureau: 1. In this Order, the Enforcement Bureau (“Bureau”) of the Federal Communications Commission (“FCC” or “Commission”) adopts the attached Consent Decree entered into between the Bureau and Cbeyond Communications, Inc. (“Cbeyond”). The Consent Decree terminates a Notice of Apparent Liability for Forfeiture (“NAL”) against Cbeyond for its apparent violation of section 222 of the Communications Act of 1934, as amended, (“the Act”) and section 64.2009(e) of the Commission’s rules.1 In addition, the Consent decree terminates an investigation into Cbeyond’s compliance with section 64.2007(a)(3) of the Commission’s rules regarding customer proprietary network information (“CPNI”).2 2. The Bureau and Cbeyond have negotiated the terms of a Consent Decree that resolves this matter. A copy of the Consent Decree is attached hereto and incorporated by reference. 3. Based on the record before the Bureau, and in the absence of material new evidence relating to this matter, the Bureau concludes that there are no substantial or material questions of fact as to whether Cbeyond possesses the basic qualifications, including those related to character, to hold or obtain any Commission license or authorization. 4. After reviewing the terms of the Consent Decree, the Bureau finds that the public interest would be served by adopting the Consent Decree and terminating the NAL and the investigation. 5. Accordingly, IT IS ORDERED, pursuant to Sections 4(i) and 503 of the Communications Act of 1934, as amended,3 that the attached Consent Decree IS ADOPTED. 1 47 U.S.C. § 222; 47 C.F.R. § 64.2009(e). 2 47 C.F.R. § 64.2007(a)(3). 3 47 U.S.C. § 154(i). Federal Communications Commission DA 07-4090 - -2 6. IT IS FURTHER ORDERED that the above-captioned NAL is terminated. FEDERAL COMMUNICATIONS COMMISSION __________________________ Kris Anne Monteith Chief, Enforcement Bureau Federal Communications Commission DA 07- 4090 Before the FEDERAL COMMUNICATIONS COMMISSION Washington, D.C. 20554 In the Matter of Cbeyond Communications, Inc. Notice of Apparent Liability for Forfeiture ) ) ) ) ) ) ) File No. EB-06-IH-0840 NAL Acct. No. 200632080153 FRN: 0003759602 CONSENT DECREE 1. The Enforcement Bureau (“Bureau”) of the Federal Communications Commission (the “FCC” or “Commission”) and Cbeyond, Inc. (“Cbeyond”), by their authorized representatives, hereby enter into this Consent Decree for the purpose of terminating the Bureau’s investigation into possible noncompliance by Cbeyond with the requirements of section 222 of the Communications Act of 1934, as amended (the “Act”), and sections 64.2007(a) and 64.2009(e) of the Commission’s rules.1 2. For purposes of this Consent Decree, the following definitions shall apply: a) “Act” means the Communications Act of 1934, as amended, 47 U.S.C. § 151 et seq. b) “Bureau” means the Enforcement Bureau of the Federal Communications Commission. c) “Cbeyond” means Cbeyond, Inc., any of its affiliates and any successors or assigns. d) “CPNI” means customer proprietary network information as defined in 47 U.S.C. § 222(h)(1). e) “Commission” means the Federal Communications Commission. f) “Effective date” means the date on which the Commission releases the Adopting Order. g) “Investigation” means the investigation commenced on February 1, 2006 by the Bureau letter of inquiry regarding Cbeyond’s compliance with 47 U.S.C. § 222 of the Act and 47 C.F.R. §§ 64.2001-2009 that resulted in the Bureau’s issuance of the NAL on April 21, 2006. h) “NAL” means the proceeding commenced on April 21, 2006 by the Bureau Notice of Apparent Liability for Forfeiture against Cbeyond Communications, Inc. for the apparent violation of section 64.2009(e) of the Commission’s rules, 47 C.F.R § 64.2009(e). i) “Order” or “Adopting Order” means an Order of the Commission adopting the terms and conditions of this Consent Decree without change, addition, or modification, and formally terminating the above-captioned Investigation and NAL. j) “Parties” means Cbeyond and the Bureau. k) “Rules” means the Commission’s regulations set forth in Title 47 of the Code of Federal Regulations. 1 47 U.S.C. § 222; 47 C.F.R. §§ 64.2007(a), 64.2009(e). Federal Communications Commission DA 07- 4090 - -2 I. BACKGROUND 3. Section 222 of the Act requires telecommunications carriers to ensure that CPNI is adequately protected from unauthorized disclosure. The Commission’s rules effectuated pursuant to section 222 protect the privacy of CPNI collected and held by providers of communications services.2 For example, section 64.2009(e) requires telecommunications carriers to sign annually a certificate stating that it has established adequate procedures to ensure compliance with the Commission’s CPNI rules. Carriers must also provide a statement accompanying the certificate explaining how its operating procedures ensure compliance with the Commission’s CPNI rules.3 In addition, section 64.2007(a)(3) of the Commission’s rules requires a carrier to obtain approval for the use of CPNI and to maintain records of any such approval for one year. 4 4. Cbeyond is a competitive telecommunications carrier headquartered in Atlanta, Georgia that provides competitive local and long distance wireline and wireless services to small businesses.5 The Enforcement Bureau has been investigating the adequacy of procedures implemented by telecommunications carriers to ensure confidentiality of CPNI based on concerns regarding the apparent availability to third parties of sensitive, personal subscriber information.6 5. As part of its inquiry to ascertain the adequacy of procedures implemented by telecommunications carriers to ensure the confidentiality of their subscribers’ CPNI, the Bureau directed all carriers by Public Notice to submit their most recent certification prepared in compliance with section 64.2009(e) of the Commission’s rules.7 On February 6, 2006, Cbeyond failed to submit its CPNI certification. Instead, Cbeyond submitted a statement that it “has commenced a comprehensive internal 2 Implementation of the Telecommunications Act of 1996: Telecommunications Carriers' Use of Customer Proprietary Network Information and Other Customer Information and Implementation of the Non-Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended, CC Docket Nos. 96-115 and 96-149, Order and Further Notice of Proposed Rulemaking, 13 FCC Rcd 8061 (1998) (“CPNI Order”). See also Implementation of the Telecommunications Act of 1996: Telecommunications Carriers' Use of Customer Proprietary Network Information and Other Customer Information and Implementation of the Non-Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended, CC Docket Nos. 96-115 and 96-149, Order on Reconsideration and Petitions for Forbearance, 14 FCC Rcd 14409 (1999); Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information and Implementation of the Non-Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended; 2000 Biennial Regulatory Review -- Review of Policies and Rules Concerning Unauthorized Changes of Consumers’ Long Distance Carriers, CC Docket Nos. 95-115, 96-149 and 00-257, Third Report and Order and Third Further Notice of Proposed Rulemaking, 17 FCC Rcd 14860 (2002). 3 47 C.F.R. § 64.2009(e) states that “[a] telecommunications carrier must have an officer, as an agent of the carrier, sign a compliance certificate on an annual basis stating that the officer has personal knowledge that the company has established operating procedures that are adequate to ensure compliance with the rules in this subpart. The carrier must provide a statement accompanying the certificate explaining how its operating procedures ensure that it is or is not in compliance with the rules in this subpart.” 4 47 C.F.R. § 64.2007(a)(3) requires telecommunications carriers to maintain records of approval required for use of CPNI, whether oral, written or electronic, for one year. 5 www.Cbeyond.net. 6 Some companies, known as “data brokers,” have advertised the availability of wireless and wireline subscriber information. See, e.g. http://www.epic.org/privacy/iei/ 7 Enforcement Bureau Directs all Telecommunications Carriers to Submit CPNI Compliance Certifications, Public Notice, 21 FCC Rcd 756 (Enf. Bur. rel Jan. 30, 2006); Enforcement Bureau Opens New Docket for the February 6, 2006, Filing of CPNI, Public Notice, 21 FCC Rcd 1122 (Enf. Bur. rel Feb. 2, 2006). Federal Communications Commission DA 07- 4090 - -3 review of its operating procedures for CPNI compliance . . . [but]does not presently have documents responsive to this request.” The Bureau concluded that Cbeyond’s statement constituted an admission that Cbeyond was not in compliance with section 64.2009(e) of the Commission’s rules because the company had not established operating procedures adequate to ensure compliance with the Commission’s CPNI rules and on April 21, 2006 issued a Notice of Apparent Liability for Forfeiture (“NAL”) proposing a forfeiture of $100,000 for this apparent violation. 6. Following the NAL, Cbeyond filed with the Commission a certificate executed by its Vice President for Regulatory and Legislative Affairs stating that the Company had established operating procedures adequate to ensure compliance with the Commission’s rules governing protection and use of CPNI. Cbeyond also provided information regarding the Company’s security measures to protect consumer information. 7. At the same time, the Bureau also was investigating allegations that Cbeyond had obtained proprietary information from another carrier and used that information in violation of section 222(b) of the Act and section 64.2001 et seq. of the Commission’s rules.8 The Bureau sent a letter of inquiry to Cbeyond on February 1, 2006. Cbeyond responded to the inquiry letter on February 13, 2006. In May 2006, Cbeyond and the Bureau began discussions to settle the investigations and signed an agreement tolling the existing statute of limitations and extending the date on which Cbeyond was required to pay the forfeiture or submit a response to the NAL. II. AGREEMENT 8. The Parties agree and acknowledge that this Consent Decree shall constitute a final settlement of the Investigation between Cbeyond and the Bureau. In express reliance on the covenants and representations contained herein, the Bureau agrees to terminate the Investigation and the NAL. In consideration for the termination of this Investigation and NAL and in accordance with the terms of this Consent Decree, Cbeyond agrees to the terms, conditions and procedures contained herein. 9. Cbeyond agrees that the Bureau has jurisdiction over it and the matters contained in this Consent Decree and the authority to enter into and adopt this Consent Decree. 10. Cbeyond agrees to make a voluntary contribution to the United States Treasury, without further protest or recourse to a trial de novo, in the amount of $200,000 within thirty (30) calendar days after the Effective Date of the Adopting Order. The payment must be made by check or similar instrument, payable to the order of the Federal Communications Commission. The payment must include “Acct. No. 200632080153” and “FRN No. 0003759602.” Payment by check or money order may be mailed to Federal Communications Commission, P.O. Box 358340, Pittsburgh, PA 15251-8340. Payment by overnight mail may be sent to Mellon Bank /LB 358340, 500 Ross Street, Room 1540670, Pittsburgh, PA 15251. Payment by wire transfer may be made to ABA Number 043000261, receiving bank Mellon Bank, and account number 911-6229. 11. The Parties agree that this Consent Decree does not constitute either an adjudication on the merits or a factual or legal finding or determination regarding any compliance or noncompliance by Cbeyond with the requirements of the Act or the Commission’s rules or orders. The Parties agree that this Consent Decree is for settlement purposes only and that by agreeing to this Consent Decree, Cbeyond does not admit or deny any noncompliance, violation, or liability associated with or arising from its actions or omissions involving the Act or the Commission’s rules that are the subject of this Consent 8 Letter from Hillary S. DeNigro, Deputy Chief, Investigations and Hearings Division, Enforcement Bureau, to James Geiger, Chief Executive Officer, and Julia Strow, Vice President, Regulatory and Legislative Affairs, Cbeyond Communications, LLC, dated February 1, 2006 (“LOI”). Federal Communications Commission DA 07- 4090 - -4 Decree. 12. In consideration for the termination of the Investigation and NAL in accordance with the terms of this Consent Decree, Cbeyond agrees to submit to the Chief, Investigations & Hearings Division, Enforcement Bureau, Federal Communications Commission, 445 12th Street, S.W., Washington, D.C. 20554, a copy of its most recent 64.2009(e) certification each year for the next two years no later than the anniversary of the Effective Date of this consent decree. In addition, Cbeyond agrees to continue to comply with the following practices and policies that it has already implemented: a) Cbeyond shall obtain written authorization from the customer of another carrier or provider of interconnected VoIP prior to accessing that customer’s Customer Service Records (“CSRs”) stored on the Operational Support Systems (“OSS”) of such customer’s service provider. Cbeyond shall maintain such written prior authorization (in hard-copy or via version-protected electronic copy) in a central location for two years from the date of the access and will make these records available to the FCC upon request. b) Cbeyond shall periodically inspect its written forms for obtaining prior approval as described in subparagraph a) to ensure that they are being filled out completely and properly. c) Cbeyond shall obtain a signed acknowledgement from each of its employees who might have access to Cbeyond customer CPNI stating that the employee understands Cbeyond’s CPNI policy and that the employee agrees to comply with the terms of the policy. Violation of the policy will lead to disciplinary action up to and including termination. d) Cbeyond shall obtain a signed acknowledgement of Cbeyond’s policy for obtaining access to the CPNI of other carriers or providers of interconnected VoIP (the “CSR policy”) from each of its employees who might need to access CSRs stored in the OSS of other carriers or interconnected VoIP providers. The acknowledgement shall state that the employee understands Cbeyond’s CSR policy and that the employee agrees to comply with the terms of the policy. Violation of this policy will lead to disciplinary action up to and including termination. e) Cbeyond shall conduct biannual CPNI policy and CSR policy training for all relevant employees, and Cbeyond shall also conduct monthly refresher training for its sales personnel to reinforce Cbeyond's CSR policies. f) Cbeyond shall place all terminals used for accessing CPNI in locations that allow for close supervision. g) Cbeyond shall utilize equipment and software that allows it to monitor and log websites being visited by individual computers in its network; Cbeyond shall analyze this information twice monthly to see if there are unusual usage patterns that might suggest improper use of CPNI or improper CSR access. 13. The Bureau agrees in the absence of new material evidence that it will not use the facts developed in this Investigation through the Effective Date or the existence of this Consent Decree to initiate, on its own motion, any new proceeding, formal or informal, or take any action on its own motion against Cbeyond concerning the matters that were the subject of the Investigation. The Bureau further agrees that it will not use the facts developed in the Investigation through the Effective Date or the existence of this Consent Decree to initiate, on its own motion, any proceeding, formal or informal, or take any action on its own motion against Cbeyond with respect to Cbeyond’s basic qualifications, including its character qualifications, to be a Commission licensee or authorized common carrier, or with Federal Communications Commission DA 07- 4090 - -5 respect to compliance with the Commission’s rules and policies. 14. Nothing in this Consent Decree shall prevent the Commission or its delegated authority from considering or adjudicating any complaint that may be filed pursuant to section 208 of the Act, 47 U.S.C. § 208, and to take any action in response to such formal complaint. The Commission’s adjudication of any such complaint will be based solely on the record established in that proceeding. Except as expressly provided in this Consent Decree, this Consent Decree shall not prevent the Commission or its delegated authority from investigating new evidence of noncompliance by Cbeyond of the Act, the Commission’s rules, or the Order. 15. Cbeyond waives any and all rights it may have to seek administrative or judicial reconsideration, review, appeal or stay or to otherwise challenge or contest the validity of this Consent Decree and the Adopting Order, provided the Order adopts this Consent Decree without change, addition, or modification. 16. Cbeyond’s decision to enter into this Consent Decree is expressly contingent upon the Bureau’s issuance of an Order that is consistent with this Consent Decree and adopts the Consent Decree without change, addition or modification. 17. In the event that this Consent Decree is rendered invalid by a court of competent jurisdiction, it shall become null and void and may not be used in any manner in any legal proceeding. 18. The Parties agree that if either Party (or the United States on behalf of the Commission) brings a judicial action to enforce the terms of the Order, neither Cbeyond nor the Commission shall contest the validity of the Consent Decree or the Order, and Cbeyond and the Commission will waive any statutory right to a trial de novo regarding the terms or validity of the Consent Decree. 19. The parties agree that this Consent Decree shall become effective on the Effective Date. Upon release, the Adopting Order and this Consent Decree shall have the same force and effect as any other order of the Commission. Any violation of any term of this Consent Decree shall constitute a separate violation of a Commission order entitling the Commission to exercise any rights and remedies attendant to the enforcement of a Commission order. 20. The Parties agree that if any provision of this Consent Decree conflicts with any subsequent rule or order adopted by the Commission (except an order specifically intended to revise the terms of this Consent Decree to which Cbeyond does not consent), that provision will be superseded by such Commission rule or order. 21. Cbeyond agrees that the provisions of this Consent Decree shall be binding on its successors and assigns. 22. Cbeyond agrees to waive any claims it may otherwise have under the Equal Access to Justice Act, 5 U.S.C. § 504 and 47 C.F.R. § 1.1501 et seq., relating to the matters addressed in this Consent Decree. 23. Cbeyond and the Bureau each represents and warrants to the other that it has full power and authority to enter into this Consent Decree. 24. By this Consent Decree, Cbeyond neither waives nor alters its right to assert and seek protection from disclosure of any privileged or otherwise confidential and protected documents and information, or to seek appropriate safeguards of confidentiality for any competitively sensitive or proprietary information. 25. Cbeyond agrees that any violation of the Order or of this Consent Decree shall constitute a separate violation of a Commission order, entitling the Commission to exercise any rights and remedies attendant to the enforcement of a Commission order. Federal Communications Commission DA 07- 4090 - -6 26. The Parties agree that the requirements of this Consent Decree shall expire twenty-four (24) months from the Effective Date. 27. This Consent Decree may be signed in counterparts. ________________________________ Kris Anne Monteith Chief, Enforcement Bureau Federal Communications Commission ________________________________ Date ________________________________ William H. Weber Vice-President and Corporate Counsel Cbeyond, Inc. ________________________________ Date