Federal Communications Commission DA 08-404 Before the Federal Communications Commission Washington, D.C. 20554 In the Matter of CTC Communications Corp. Notice of Apparent Liability for Forfeiture ) ) ) ) ) ) ) ) ) File No. EB-06-TC-4483 NAL/Acct. No. 200732170037 FRN: 0005013669 ORDER Adopted: February 15, 2008 Released: February 19, 2008 By the Chief, Enforcement Bureau: 1. In this Order, we adopt the attached Consent Decree entered into between the Enforcement Bureau (the “Bureau”) of the Federal Communications Commission (the “FCC” or “Commission”) and CTC Communications Corp. (“CTC”). The Consent Decree terminates a Notice of Apparent Liability for Forfeiture (“NAL”) against CTC for its apparent violation of section 222 of the Communications Act of 1934, as amended (“Communications Act” or “Act”), 47 U.S.C. § 222, and section 64.2009(e) of the Commission’s rules, 47 C.F.R. § 64.2009(e). 2. The Bureau and CTC have negotiated the terms of a Consent Decree that would resolve this matter and terminate the investigation. A copy of the Consent Decree is attached hereto and incorporated by reference. 3. After reviewing the terms of the Consent Decree, we find that the public interest would be served by adopting the Consent Decree and terminating the NAL. We also conclude that, in the absence of material new information not previously disclosed to the Bureau, the matters raised in the investigation do not raise any substantial and material questions of fact regarding CTC's qualifications to be a Commission licensee. 4. Accordingly, IT IS ORDERED, pursuant to Section 4(i) of the Act that the attached Consent Decree IS ADOPTED. 5. IT IS FURTHER ORDERED that CTC shall make its voluntary contribution to the United States Treasury, as specified in the Consent Decree, by credit card through the Commission’s Revenue and Receivables Operations Group at (202) 418-1995, or by mailing a check or similar instrument payable to the order of the Federal Communications Commission, to Federal Communications Commission, P.O. Box 979088, St. Louis, MO 63197-9000. Payment by overnight mail may be sent to Federal Communications Commission DA 08-404 - -2 U.S. Bank – Government Lockbox #979088, SL-MO-C2-GL, 1005 Convention Plaza, St. Louis, MO 63101. Payment by wire transfer may be made to ABA Number 021030004, receiving bank Federal Reserve Bank of New York, and account number 27000001. 6. IT IS FURTHER ORDERED that the above-captioned NAL is cancelled. FEDERAL COMMUNICATIONS COMMISSION __________________________ Kris A. Monteith Chief, Enforcement Bureau Federal Communications Commission DA 08-404 Before the FEDERAL COMMUNICATIONS COMMISSION Washington, D.C. 20554 In the Matter of CTC Communications Corp. Notice of Apparent Liability for Forfeiture ) ) ) ) ) ) ) ) ) File No. EB-06-TC-4483 NAL/Acct. No. 200732170037 FRN: 0005013669 CONSENT DECREE I. INTRODUCTION 1. The Enforcement Bureau (the “Bureau”) of the Federal Communications Commission (the “FCC” or “Commission”) and CTC Communications Corp., (“CTC”)1 by their authorized representatives, hereby enter into this Consent Decree for the purpose of terminating the Bureau’s investigation into possible noncompliance by CTC with the requirements of 222 of the Communications Act of 1934, as amended (“Communications Act” or “Act”), 47 U.S.C. § 222, and section 64.2009(e) of the Commission’s rules, 47 C.F.R. § 64.2009(e). II. BACKGROUND 2. Section 222 imposes the general duty on all telecommunications carriers to protect the confidentiality of their subscribers’ proprietary information.2 The Commission has issued rules implementing section 222 of the Act.3 The Commission required carriers to establish and maintain a 1 CTC is headquartered at 220 Bear Hill Road, Waltham, Massachusetts, and is a provider of wireline telecommunications services. 2 Section 222 of the Communications Act provides that: “Every telecommunications carrier has a duty to protect the confidentiality of proprietary information of, and relating to, other telecommunications carriers, equipment manufacturers, and customers, including telecommunication carriers reselling telecommunications services provided by a telecommunications carrier.” 47 U.S.C § 222. 3 In the Matter of Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information and Implementation of the Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended, Order and Further Notice of Proposed Rulemaking, 13 FCC Rcd 8061 (1998) (“CPNI Order”); see also In the Matter of Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information and Implementation of the Non-Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended, Order on Reconsideration and Petitions for Forbearance, 14 FCC Rcd 14409 (1999); In the Matter of Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information and Implementation of the Non-Accounting Safeguards of Sections 271 and 272 of Federal Communications Commission DA 08-404 - -2 system designed to ensure that carriers adequately protected their subscribers’ CPNI. Section 64.2009(e) is one such requirement. Pursuant to section 64.2009(e): A telecommunications carrier must have an officer, as an agent of the carrier, sign a compliance certificate on an annual basis stating that the officer has personal knowledge that the company has established operating procedures that are adequate to ensure compliance with the rules in this subpart. The carrier must provide a statement accompanying the certificate explaining how its operating procedures ensure that it is or is not in compliance with the rules in this subpart.4 3. The Bureau has been investigating the adequacy of procedures implemented by telecommunications carriers to ensure confidentiality of their subscribers’ CPNI, based on concerns regarding the apparent availability to third parties of sensitive, personal subscriber information. For example, some companies, known as “data brokers,” have advertised the availability of records of wireless subscribers’ incoming and outgoing telephone calls for a fee.5 Data brokers have also advertised the availability of call information that relates to certain landline toll calls.6 4. As part of its inquiry into these issues, the Bureau sent a Letter of Inquiry (“LOI”) to CTC on January 5, 2007, directing it to produce the compliance certificates for the previous five (5) years that it had prepared pursuant to section 64.2009(e) of the Commission's rules.7 On January 12, 2007, CTC submitted a document in response to the Bureau's LOI.8 The Bureau concluded that the document submitted by CTC did not satisfy the requirements set forth in the rule and that CTC had apparently failed to comply with the requirement that it have an officer certify on an annual basis that the officer has personal knowledge that CTC has established operating procedures adequate to ensure compliance with the Commission’s CPNI rules.9 Accordingly, on March 26, 2007, the Bureau released an NAL against CTC proposing a monetary forfeiture of $100,000 for its apparent failure to comply with section 64.2009(e) of the Commission's rules.10 the Communications Act of 1934, as amended; 2000 Biennial Regulatory Review -- Review of Policies and Rules Concerning Unauthorized Changes of Consumers’ Long Distance Carriers, Third Report and Order and Third Further Notice of Proposed Rulemaking, 17 FCC Rcd 14860 (2002). 4 47 C.F.R. § 64.2009(e). 5 See, e.g. http://www.epic.org/privacy/iei/. 6 See id. 7 Letter from Marcy Greene, Deputy Division Chief, Telecommunications Consumers Division, Enforcement Bureau, Federal Communications Commission, to Mr. Ray Allieri, CEO, CTC Communications Corp., (January 5, 2007) (“January 5 LOI”). 8 Letter from James P. Prenetta, Jr., Executive Vice President and General Counsel, CTC Communications Corp., to Marcy Greene, Deputy Division Chief, Telecommunications Consumers Division, Enforcement Bureau, Federal Communications Commission (January 12, 2007) (“January 12 response”). 9 In the Matter of CTC Communications Corporation, Notice of Apparent Liability for Forfeiture, 22 FCC Rcd. 5506 (Enf. Bur. rel. March 26, 2007) (“NAL”). 10 Id. Federal Communications Commission DA 08-404 - -3 III. DEFINITIONS 5. For purposes of this Consent Decree, the following definitions shall apply: a. “Act” means the Communications Act of 1934, as amended. b. “Bureau” means the Enforcement Bureau of the Federal Communications Commission. c. “Commission” or “FCC” means the Federal Communications Commission. d. ”CTC” means CTC Communications Corp. and any affiliate, d/b/a, predecessor-in- interest, parent companies and any direct or indirect subsidiaries of such parent companies, or other affiliated companies or businesses and their successors and assigns. e. “Effective Date” means the date on which the Bureau releases the Adopting Order. f. “Investigation” means the investigation commenced by the Bureau's January 5, 2007 Letter of Inquiry to CTC. g. “Order” or “Adopting Order” means an Order of the Bureau adopting the terms and conditions of this Consent Decree without change, addition, or modification, and formally terminating the above-captioned Investigation. h. “Parties” means CTC and the Bureau. IV. AGREEMENT 6. CTC agrees that the Bureau, by delegated authority of the Commission, has jurisdiction over it and the subject matters contained in this Consent Decree and the authority to enter into and adopt this Consent Decree. 7. The Parties agree and acknowledge that this Consent Decree shall constitute a final settlement of the Investigation. In express reliance on the covenants and representations contained herein, and to avoid the potential expenditure of additional public resources, the Bureau agrees to terminate the Investigation. In consideration for the termination of this matter and in accordance with the terms of this Consent Decree, CTC agrees to the terms, conditions, and procedures contained herein. 8. The Parties agree that this Consent Decree does not constitute either an adjudication on the merits or a factual or legal finding or determination regarding any compliance or noncompliance by CTC with the requirements of the Act or the Commission's rules or orders. The Parties agree that this Consent Decree is for settlement purposes only, and that by agreeing to this Consent Decree, CTC does not admit or deny any noncompliance, violation, or liability associated with or arising from its actions or omissions involving the Act or the Commission's rules that are the subject of this Consent Decree. 9. In consideration for the termination of the Investigation in accordance with the terms of this Consent Decree, CTC agrees to make a voluntary contribution to the United States Treasury, without further protest or recourse to a trial de novo, in the amount of one hundred thousand dollars ($100,000) Federal Communications Commission DA 08-404 - -4 within thirty (30) calendar days after the Effective Date of the Adopting Order. This voluntary payment does not constitute a fine or penalty for, or admission of, the violation of any law. The payment must be made by check or similar instrument, payable to the order of the Federal Communications Commission. The payment must include the Account Number and FRN Number referenced in the caption to the Adopting Order. Payment by check or money order may be mailed to Federal Communications Commission, P.O. Box 979088, St. Louis, MO 63197-9000. Payment by overnight mail may be sent to U.S. Bank – Government Lockbox #979088, SL-MO-C2-GL, 1005 Convention Plaza, St. Louis, MO 63101. Payment by wire transfer may be made to ABA Number 021030004, receiving bank Federal Reserve Bank of New York, and account number 27000001. 10. To resolve and terminate the Investigation, and to ensure compliance with the Commission's CPNI rules, CTC agrees to full compliance with Section 64.2009(e) of the Commission’s rules. CTC agrees to train its personnel as to when they are and are not authorized to use CPNI. CTC further agrees to have an express disciplinary process in place for the unauthorized use of CPNI. Additionally, CTC agrees to submit a copy of its annual 64.2009(e) compliance certificate for each of two (2) years following the Effective Date of this Consent Decree to the Chief, Telecommunications Consumers Division, Enforcement Bureau, Federal Communications Commission, 445 12th Street, S.W. Room 4-C244, Washington, D.C. 20554, and must include the file number listed above. CTC will also send an electronic copy of its certification to other Telecommunications Consumers Division staff as directed by the Division Chief. This Consent Decree will expire two (2) years after the Effective Date or upon the termination of the certification requirement set forth in sections 64.2009(e) of the Commission's rules, 47 C.F.R. § 64.2009(e), whichever is earlier. 11. The Bureau agrees that, in the absence of new material evidence, it will not use the facts developed in this Investigation through the Effective Date of the Consent Decree, or the existence of this Consent Decree to initiate, on its own motion, any new proceeding, formal or informal, or take any action on its own motion against CTC, concerning the matters that were the subject of the Investigation, provided that CTC satisfies all of its obligations under this Consent Decree. The Bureau also agrees that, in the absence of new material evidence, it will not use the facts developed in this Investigation through the Effective Date of this Consent Decree, or the existence of this Consent Decree, to institute, on its own motion, any proceeding, formal or informal, or take any action on its own motion against CTC with respect to CTC's basic qualifications, including its character qualifications, to be a Commission licensee or authorized common carrier. Nothing in this Consent Decree will prevent the Bureau from instituting or recommending to the Commission any new investigation or enforcement proceeding against CTC in the event of any alleged future misconduct involving violation of this Consent Decree, or violation of the Act or the Commission's rules. Nothing in this Consent Decree shall prevent the Commission or its delegated authority from adjudicating complaints filed pursuant to section 208 of the Act, 47 U.S.C. §§ 208, against CTC for alleged violations of the Act, or for any other type of alleged misconduct, regardless of when such misconduct took place. The Commission's adjudication of any such complaint will be based solely on the record developed in that proceeding. 12. CTC's decision to enter into this Consent Decree is expressly contingent upon the Bureau's issuance of an Adopting Order which adopts that Consent Decree without change, addition, or modification. Provided the Bureau issues an Adopting Order, CTC waives any and all rights it may have to seek administrative or judicial reconsideration, review, appeal or stay, or to otherwise challenge or contest the validity of this Consent Decree and the Adopting Order. 13. If either Party (or the United States on behalf of the Commission) brings a judicial action to enforce the terms of the Adopting Order, neither CTC nor the Commission shall contest the validity of the Consent Decree or the Adopting Order, and CTC and the Commission will waive any statutory right Federal Communications Commission DA 08-404 - -5 to a trial de novo with respect to the issuance of the Adopting Order and shall consent to a judgment incorporating the terms of this Consent Decree. 14. In the event that this Consent Decree is rendered invalid by a court of competent jurisdiction, it shall become null and void and may not be used in any manner in any legal proceeding. 15. By this Consent Decree, CTC neither waives nor alters its right to assert and seek protection from disclosure of any privileged or otherwise confidential and protected documents and information, or to seek appropriate safeguards of confidentiality for any competitively sensitive or proprietary information. 16. CTC agrees that any violation of the Order or of this Consent Decree shall constitute a separate violation of a Commission order, entitling the Commission to exercise any rights and remedies attendant to the enforcement of a Commission order. 17. The Parties agree that if any provision of this Consent Decree is inconsistent with any subsequent rule or order adopted by the Commission, that provision will be superseded by such Commission rule or order. 18. This Consent Decree may be signed in counterparts. For: CTC Communications Corp. ______________ ___________________ Date James P. Prenetta, Jr. Executive Vice President and General Counsel CTC Communications Corp. For: Enforcement Bureau Federal Communications Commission ______________ ____________________ Date Kris A. Monteith Chief, Enforcement Bureau