Federal Communications Commission	DA 22-169


Before the
FEDERAL COMMUNICATIONS COMMISSION
WASHINGTON, D.C. 20554


In the Matter of

Call Authentication Trust Anchor 

Exemption From Caller ID Authentication Requirements
)
)
)
)
)
)



WC Docket No. 17-97

WC Docket No. 20-68

ORDER

Adopted:  February 17, 2022	Released:  February 17, 2022

By the Chief, Wireline Competition Bureau:

I. INTRODUCTION
1. In this Order, the Wireline Competition Bureau (Bureau) addresses the status of seven voice service providers granted an exemption in December 2020 from the Commission’s caller ID authentication requirements, based on a demonstration that they met the applicable criteria under the TRACED Act and the Commission’s rules. This order provides public notice as required by the commission’s rules.  47 CFR § 64.6306(e).  
  Based on the record before us, we find that Bandwidth Inc. (Bandwidth) and Vonage Holding Corp. (Vonage) did not achieve full implementation of the STIR/SHAKEN authentication framework and therefore lose their exemptions from section 64.6301 of the Commission’s rules. 47 CFR § 64.6301. 
  We also refer these providers to the Enforcement Bureau for possible enforcement action.  We conclude that the remaining voice service providers that received an exemption in December 2020 remain exempt. See Wireline Competition Bureau Announces Seven Voice Service Providers Qualified for STIR/SHAKEN Exemption, WC Docket Nos. 17-97, 20-68, Public Notice, 35 FCC Rcd 14830 (WCB 2020) (December 2020 Exemption Public Notice).
   
II. BACKGROUND
2. In the TRACED Act, Congress directed the Commission to mandate the implementation of STIR/SHAKEN caller ID authentication by June 30, 2021. TRACED Act, Pub. L. No. 116-105, 133 Stat. 3274, 3277, § 4(b)(1) (2019) (TRACED Act).  
  The TRACED Act also required the Commission to grant exemptions from that mandate for voice service providers that could demonstrate early implementation progress by December 30, 2020. TRACED Act § 4(b)(2) (2019) (TRACED Act); Call Authentication Trust Anchor, WC Docket No. 17-97, Second Report and Order, 36 FCC Rcd 1859, 1911, para. 102 (2020) (Second Caller ID Authentication Report and Order).  
  To receive the exemption at that time, a voice service provider was obligated to, among other requirements, “be capable of fully implementing the STIR/SHAKEN authentication framework” by June 30, 2021. TRACED Act § 4(b)(2)(A)(iv).  
  
3. The Commission implemented this TRACED Act requirement via a certification process and delegated authority to the Wireline Competition Bureau to make exemption determinations. 47 CFR § 64.6406; Second Caller ID Authentication Report and Order, 36 FCC Rcd at 1917, para. 119.
  Voice service providers seeking to qualify for the exemption were obligated to submit a certification and supporting statement by December 1, 2020, explaining in detail how they met the requirements for the exemption.  47 CFR § 64.6306(a), (c); see also Wireline Competition Bureau Provides Directions and Filing Information Regarding Caller ID Authentication Exemption Certifications, WC Docket No. 20-68, Public Notice, 35 FCC Rcd 12847, 12848 (WCB 2020).
  In December 2020, the Wireline Competition Bureau found that seven voice service providers qualified for the exemption:  AT&T Services Inc. (AT&T); AT&T’s exemption is limited only to its wireline IP network.  Id. at 148431 n.10.  All references to AT&T’s exemption in this Public Notice are limited to AT&T’s wireline IP network.  
 Bandwidth; Charter Communications, Inc. (Charter); Comcast Cable Communications, LLC (Comcast); Cox Communications, Inc. (Cox); Cellco Partnership, d/b/a Verizon Wireless (Verizon Wireless); and Vonage. December 2020 Exemption Public Notice, 35 FCC Rcd at 14831.
  These voice service providers were therefore exempt from the requirements of section 64.6301 of the Commission’s rules. Id. 
  They were nonetheless obligated to file in the Robocall Mitigation Database as required by section 64.6305 of the Commission’s rules and certify to their STIR/SHAKEN implementation status and, as appropriate, robocall mitigation efforts. 47 CFR § 64.6305(b).
  
4. Because a requirement of the exemption was based on a voice service provider’s prediction of its future ability to implement STIR/SHAKEN, the Commission required any voice service provider granted an exemption to submit a second certification, after June 30, 2021.  That certification was required to “attest to whether the voice service provider fully implemented the STIR/SHAKEN authentication framework because it completed all necessary network upgrades to its network infrastructure to enable the authentication and verification of caller identification information for all SIP calls exchanged with STIR/SHAKEN-enabled partners by June 30, 2021.” 47 CFR § 64.6306(e); see also Second Caller ID Authentication Report and Order, 36 FCC Rcd at 1918, para. 121.  
  Each voice service provider granted an exemption was required to “verify they completed full implementation in accordance with their commitments” and submit an accompanying statement explaining, in detail, how the company achieved the implementation goals it first certified to. December 2020 Exemption Public Notice, 35 FCC Rcd at 14831; see also Second Caller ID Authentication Report and Order, 36 FCC Rcd at 1918, para. 121.
  The Commission determined that any voice service provider that could not certify to full implementation would lose the exemption and be subject to the general rule requiring full STIR/SHAKEN implementation, effective immediately upon release of the Public Notice identifying which voice service providers achieved the implementation goals to which they previously committed. Second Caller ID Authentication Report and Order, 36 FCC Rcd at 1919, para. 124.
  The Commission also directed the Bureau, if it found “that a voice service provider filed its initial certification in bad faith or failed to take good faith steps towards implementation . . . to refer the voice service provider to the Enforcement Bureau for possible enforcement action based on filing a false initial certification.” Id. 
  
5. The Wireline Competition Bureau directed voice service providers to file implementation verification certifications by October 4, 2021. Wireline Competition Bureau Seeks Comment on Two TRACED Act Obligations Regarding Caller ID Authentication, WC Docket Nos. 17-97, 20-68, Public Notice, DA 21-1103, at 7 (WCB Sept. 3, 2021). 
  All seven voice service providers granted exemptions filed verification certifications and the Wireline Competition Bureau sought comment on these certifications. Wireline Competition Bureau Seeks Comment on STIR/SHAKEN Implementation Verification Certifications, WC Docket No. 20-68, Public Notice, DA 21-1554 (WCB Dec. 10, 2021).  
  NCTA—The Internet & Television Association filed the only comment on the verification statements and observed that Comcast, Charter, and Cox confirmed full implementation. NCTA—The Internet & Television Association Comments, WC Docket No. 17-97, at 1 (rec. Dec. 21, 2021).  

III. DISCUSSION
6. After reviewing the filed verification statements, we find that Bandwidth and Vonage did not achieve full implementation of the STIR/SHAKEN authentication framework by the June 30, 2021, deadline and lose their exemptions from section 64.6301 of the Commission’s rules.   
7. We find that Bandwidth did not achieve full implementation of STIR/SHAKEN.  Bandwidth, by its own admission, “has not yet completed all necessary network upgrades to support [STIR/SHAKEN] throughout its entire [IP] network.” Bandwidth Exemption Verification, WC Docket No. 20-68, at 1 (filed Oct. 21, 2021)
  It explains that, as of October 21, 2021, it “still operate[s] some legacy IP equipment that supports a de minim[i]s amount of traffic that cannot support the STIR/SHAKEN standards at this time.” Id. 
  Bandwidth’s status falls short of the Commission—and Congress’s—requirement of “fully implementing the STIR/SHAKEN authentication framework” by June 30, 2021. TRACED Act § 4(b)(2)(A)(iv); see also 47 CFR § 64.6306(e). 
  
8. We find that Vonage also did not achieve full implementation because its certification reflects that it is not verifying caller ID information for all authenticated calls it receives as required by section 64.6301(a)(3) of the Commission’s rules. 47 CFR § 64.6301(a)(3).
  Vonage claims that it “completed all necessary network upgrades to its network infrastructure to be able to authenticate and verify caller ID information for calls exchanged with STIR/SHAKEN-enabled partners by June 30, 2021.” Vonage Exemption Verification, WC Docket No. 20-68, at 3 (filed Nov. 23, 2021) (Vonage Verification).  
  However, Vonage also explains that only “50% of inbound SIP calls [are] being validated as of today,” and that it is “coordinating with . . . partners and expects to expeditiously re-enable inbound processing of STIR/SHAKEN identification headers.” Id.
  We find that this gap in Vonage’s use of STIR/SHAKEN falls short of the Commission’s requirement that a provider have “fully implemented the STIR/SHAKEN authentication framework” to maintain the exemption in section 64.6306(e). 47 CFR § 64.6306(e).
  We conclude that this section must be read in light of section 64.6301(a), which defines the requirements for a voice service provider to “fully implement the STIR/SHAKEN authentication framework” in the first instance. 47 CFR § 64.6301(a).
  In section 64.6301(a), the Commission requires a voice service provider to, among other things “verify caller identification information for all SIP calls it receives from another voice service provider . . . which it will terminate and for which the caller identification information has been authenticated.” 47 CFR § 64.6301(a)(3).
  By Vonage’s own admission in its certification, it is not doing so.  If Vonage were to remain exempt from the Commission’s rules it would have no obligation to ever re-enable authentication, leaving a potential gap in the STIR/SHAKEN network that might never be filled.  Further, we have no evidence suggesting that the authentication gap Vonage describes was not already present at the June 30 deadline.  We thus find Vonage was unable to verify it fully implemented STIR/SHAKEN as required by section 64.6306(e).  
9. Because we find that Bandwidth and Vonage did not achieve full implementation by June 30, 2021, they lose their exemptions and are subject to the requirements of section 64.6301(a)—requiring full STIR/SHAKEN implementation—upon release of this Order providing public notice. See 47 CFR § 64.6301(a).  
  We refer Bandwidth and Vonage to the Enforcement Bureau to closely monitor their compliance with the obligation to fully implement STIR/SHAKEN under section 64.6301(a) of the Commission’s rules. We have no evidence that Bandwidth or Vonage filed their initial certification in bad faith and so do not refer them to the Enforcement Bureau on that basis.  
 
10.  AT&T, Charter, Comcast, Cox, and Verizon Wireless retain the exemption.  We find that, based on their implementation verification certifications, these voice service providers completed implementation of STIR/SHAKEN in accordance with the goals to which they first certified. See AT&T Certification for Exemption, WC Docket No. 20-68, at 4 (filed Oct. 4, 2021); Charter Certification of Full Implementation, WC Docket No. 20-68, at 2 (filed Oct. 4, 2021); Comcast Caller ID authentication Certification, WC Docket No. 20-68, at 2 (filed Oct. 4, 2021); Cox Implementation Verification Certification, WC Docket No. 20-68, at 1 (filed Sept. 24, 2021); Verizon Verification, WC Docket No. 20-68, at 3 (filed Oct. 15, 2021).  
  
IV. ORDERING CLAUSES
11. Accordingly, IT IS ORDERED that, pursuant to the authority contained in sections 4(i), 4(j), 227b(b)(1), and 227b(b)(2) of the Communications Act of 1934, as amended, 47 U.S.C. §§ 154(i), 154(j), 227b(b)(1), 227b(b)(2), and section 64.6306(e) of the Commission’s rules, 47 CFR § 64.6306(e), and pursuant to the authority delegated under sections 0.91 and 0.291 of the Commission’s rules, 47 CFR §§ 0.91, 0.291, Bandwidth and Vonage lose their exemptions from section 64.6301(a) of the Commission’s rules.  
12. IT IS FURTHER ORDERED that, pursuant to the authority contained in sections 4(i), 4(j), 227b(b)(1), and 227b(b)(2) of the Communications Act of 1934, as amended, 47 U.S.C. §§ 154(i), 154(j), 227b(b)(1), 227b(b)(2), and section 64.6306(e) of the Commission’s rules, 47 CFR § 64.6306(e), and pursuant to the authority delegated under sections 0.91 and 0.291 of the Commission’s rules, 47 CFR §§ 0.91, 0.291, AT&T, Charter, Comcast, Cox, and Verizon Wireless retain their exemptions from section 64.6301(a) of the Commission’s rules.
13. IT IS FURTHER ORDERED that this Order SHALL BE EFFECTIVE upon release.

FEDERAL COMMUNICATIONS COMMISSION




						Kris Anne Monteith
						Chief
Wireline Competition Bureau 
2