Federal Communications Commission	DA 23-392


Before the
FEDERAL COMMUNICATIONS COMMISSION
WASHINGTON, D.C. 20554


In the Matter of

Communications Assistance 
for Law Enforcement Act 
Electronic Filing System (CEFS)	
)
)
)
)
)

	
PS Docket No. 22-217

ORDER

Adopted:  May 15, 2023	Released: May 15, 2023 

By the Chief, Public Safety and Homeland Security Bureau:

I. INTRODUCTION
1. In this Order, we amend the Commission’s rules to require electronic filing of new and updated System Security and Integrity Policies and Procedures (SSI Plans) by covered entities under the Communications Assistance for Law Enforcement Act (CALEA). CALEA’s requirements apply to common carriers, facilities-based broadband Internet access service providers and interconnected Voice over Internet Protocol (VoIP) service providers.  See Communications Assistance for Law Enforcement Act and Broadband Access and Services, First Report and Order and Further Notice of Proposed Rulemaking, 20 FCC Rcd 14989 (2005) (concluding that CALEA applies to facilities-based broadband Internet access providers and providers of interconnected VoIP service); Second Report and Order and Memorandum Opinion and Order, 21 FCC Rcd 5360, 5394-95, paras. 75-76 (2006) (requiring facilities-based broadband Internet access providers and interconnected Voice over Internet Protocol (VoIP) service providers to also file SSI Plans).  
  The new rule, 47 CFR § 1.20005(c), will require electronic filing of SSI Plans in the new CALEA Electronic Filing System (CEFS) CEFS is available at: https://www.fcc.gov/cefs.  
 and become effective 30 days after it is published in the Federal Register.  After publication in the Federal Register, we will issue a Public Notice to announce the specific date for mandatory electronic filing of SSI Plans.  Filers can continue to choose to voluntarily file their SSI Plan electronically in CEFS or by paper until the new rule becomes effective, after which paper filings will no longer be accepted.    
II. BACKGROUND
2. Section 105 of the Communications Assistance for Law Enforcement Act, 47 U.S.C. § 1004, and section 229(b) of the Communications Act, 47 U.S.C. § 229(b), require all covered entities to file SSI Plans with the Federal Communications Commission (Commission). The rules governing SSI Plans are set out at 47 CFR Part 1, Subpart Z.
  The Commission first specified the requirements for telecommunications carriers’ SSI Plans in 1999. Communications Assistance for Law Enforcement Act, Report and Order, 14 FCC Rcd 4151, 4159-77, paras. 19-56 (1999).
  Pursuant to section 1.20005 of the Commission’s rules, 47 CFR § 1.20005.
 all providers subject to CALEA must file their SSI Plans prior to commencing service and must re-file a complete updated SSI Plan within 90 days following any changes to information contained in a previously-filed SSI Plan. 47 CFR § 1.20005(a).
  All SSI Plans must contain all information listed under sections 1.20003 and 1.20004 of the Commission’s rules. 47 CFR §§ 1.20003, 1.20004, 1.20005(b).  
  
3. On June 1, 2022, the Public Safety and Homeland Security Bureau (Bureau) announced the launch of CEFS, which allows covered entities to file SSI Plans confidentially and securely online, eliminating the need for paper filing. Public Safety Homeland Security Bureau Provides Information on Implementation of Voluntary Electronic Filing of CALEA System Security and Integrity Plans and Seeks Comment on Mandatory Electronic Filing, Public Notice, DA 22-592 (PSHSB rel. June 1, 2022) (CEFS Announcement Public Notice).
  The system allows users to file SSI Plans electronically and, once they have electronically filed a plan in CEFS, to log back in to CEFS and retrieve and view that filing.  CEFS encourages timely filings of new SSI Plans and updated SSI Plans and reduces the risk of filing errors that require re-submission.  In the CEFS Announcement Public Notice, the Bureau stated that electronic filing of SSI Plans in CEFS would initially be voluntary and proposed to make electronic filing mandatory six months after activation. See CEFS Announcement Public Notice at p. 1.
  On December 12, 2022, the Bureau announced the availability of CEFS for voluntary filing of SSI Plans. Public Safety Homeland Security Bureau Announces Availability Of CALEA Electronic Filing System (CEFS) For Voluntary Filing Of System Security And Integrity Plan, Public Notice, DA 22-1299 (PSHSB rel. Dec. 12, 2022) (CEFS Implementation Public Notice).
  
4.  In response to the CEFS Announcement Public Notice, we received no comments regarding the proposal to mandate electronic filing of SSI Plans or the timing of the proposed requirement.  We received one comment from Subsentio, LLC (Subsentio), which serves as a Trusted Third Party (TTP) for entities subject to CALEA, requesting that CEFS implementation include the ability for TTPs to continue to file SSI Plans on behalf of multiple clients. See Subsentio, LLC comment, Letter from Stephen Pfeiffer, July 21, 2022.
  
III. DISCUSSION
5. Mandatory Electronic Filing.  As proposed, we add a new provision to the Commission’s rules to require electronic filing of SSI Plans in CEFS, which will become effective 30 days after we publish notice in the Federal Register.  Thus, all covered entities that update their SSI Plans or file new SSI Plans after that time will be required to do so electronically. Filers are required to file SSI Plans directly in CEFS, which is a secure, confidential electronic filing system, and should not file plans through the Electronic Comment Filing System (ECFS), which is a repository for docketed proceedings that is publicly available.  The Commission has recognized that SSI plans are sensitive in nature.  See Communications Assistance for Law Enforcement Act, Report and Order, 14 FCC Rcd 4151, 4177, para. 57 (1999). 
  By providing a transition period, as proposed, since voluntary filing commenced on December 12, 2022, we give covered entities sufficient time to familiarize themselves with CEFS and the Commission Registration System (CORES), if necessary, and obtain FCC Usernames and FCC User Registration Numbers (FRN) needed to file in CEFS. The FCC Registration Number (FRN) is a 10-digit unique identifying number that is assigned to entities doing business with the Commission.  47 CFR § 1.8001.
  Further, the transition period provides us the opportunity to continue implementing  necessary enhancements to CEFS for optimal functioning before its use becomes mandatory.  
6. Trusted Third Parties.  We agree with Subsentio that CEFS implementation should include the ability for TTPs to continue to file SSI Plans on behalf of multiple clients.  As explained in the CEFS User Manual, TTPs may continue to file SSI Plans for multiple clients in CEFS using the features of CEFS and CORES, which allows regulated entities to grant permission to authorized users to conduct Commission business on their behalf. The CEFS Manual can be found here: https://www.fcc.gov/cefs/user-manual.  Additional information can also be found at: https://www.fcc.gov/calea. 
  The transition period also enables TTPs without an associated or existing FCC Username to create an account and, with the carrier’s approval, associate that FCC Username with the carrier’s FRN.  
7. Paper Filings.  Although we encourage voluntary electronic filing of SSI Plans until mandatory electronic filing takes effect, we will continue to accept paper filings until the requirement becomes effective.  Parties submitting paper filings after mandatory filing takes effect will receive a notification to submit the SSI Plan electronically through CEFS.  Covered entities that have already filed their SSI Plans by paper are not required to re-file them in CEFS, unless and until the covered entity’s SSI Plan needs to be updated.  
IV. PROCEDURAL MATTERS
8. Paperwork Reduction Act.  This document does not adopt or propose new or substantively modified information collection(s) subject to the Paperwork Reduction Act of 1995 (PRA), Public Law 104-13.  In addition, therefore, it does not contain any new or modified information collection burden for small business concerns with fewer than 25 employees, pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107-198, see 44 U.S.C. 3506(c)(4).  This document may contain non-substantive modifications to an approved information collection. See OMB Approvals for Non-Substantive Changes to Currently Approved Information Collections (OMB Control Nos. 3060-0809, 3060-0917, 3060-0918, 3060-0862), May 6, 2022; see also OMB Approvals for Extension without Change of a currently approved collection for Control No. 3060-0809 (approved through Oct. 31, 2025), Oct. 18, 2022.
   Any such modifications will be submitted to the Office of Management and Budget for review pursuant to OMB’s non-substantive modification process. 
9. Final Regulatory Flexibility Certification.  The Regulatory Flexibility Act of 1980, as amended (RFA), 5 U.S.C. § 603.  The RFA, 5 U.S.C. §§ 601–612, was amended by the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA), Pub. L. No. 104-121, Title II, 110 Stat. 857 (1996).
 requires that an agency prepare a regulatory flexibility analysis for notice and comment rulemakings, unless the agency certifies that the proposed or final rule(s) “will not, if promulgated, have a significant economic impact on a substantial number of small entities.” Id. § 605(b).  
  The RFA generally defines the term “small entity” as having the same meaning as the terms “small business,” “small organization,” and “small governmental jurisdiction.” Id. § 601(6).
  In addition, the term “small business” has the same meaning as the term “small business concerns” under the Small Business Act. Id. § 601(3) (incorporating by reference the definition of “small-business concern” in the Small Business Act, 15 U.S.C. § 632).  Pursuant to 5 U.S.C. § 601(3), the statutory definition of a small business applies “unless an agency, after consultation with the Office of Advocacy of the Small Business Administration and after opportunity for public comment, establishes one or more definitions of such term which are appropriate to the activities of the agency and publishes such definition(s) in the Federal Register.”
  A “small business concern” is one that:  (1) is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the Small Business Administration (SBA). 15 U.S.C. § 632.
   If an agency files a certification with a rulemaking, the certification must contain a statement that provides a factual basis for its conclusion that there will not be significant economic impact on a substantial number of small entities. 5 U.S.C. § 605(b).  Although not required in this particular situation, we are optionally including a Final Regulatory Flexibility Certification here since an Initial Regulatory Flexibility Certification was included in the CEFS Announcement PN.  See 5 U.S.C. §§ 603, 604 (initial and final regulatory flexibility analyses are required only when the APA requires the agency to follow APA notice-and-comment procedures).
  
10. In the CEFS Announcement Public Notice, the Commission included an Initial Regulatory Flexibility Certification (IRFC) certifying that the rules and policy changes proposed would not have a significant economic impact on a substantial number of small entities. CEFS Announcement Public Notice at 7-8; see also Public Safety And Homeland Security Bureau Announces Comment And Reply Comment Dates For The Implementation Of Electronic Filing Of CALEA System Security And Integrity Plans, Public Notice, DA 22-681 (PSHSB rel. June 28, 2022). 
  No comments were filed addressing the Initial Regulatory Flexibility Certification.  For the reasons discussed below, the Commission has determined that the changes adopted in this CALEA Implementation Public Notice will not have a significant economic impact on a substantial number of small entities and has prepared this Final Regulatory Flexibility Certification (FRFC).  
11. Telecommunications carriers must file and maintain up-to-date System Security and Integrity (SSI) plans with the Commission, as those plans are described in 47 CFR § 1.20005.  This information includes a description of how the service provider complies with CALEA, and carrier contact information.  The FCC does not divulge SSI Plans to the public but may share the covered entity’s responsible personnel and contact information from the SSI Plan with law enforcement agencies when appropriate. Communications Assistance for Law Enforcement Act, Second Order on Reconsideration, FCC 01-126, 16 FCC Rcd 8959, 8968, paras. 26, 30 (2001).
  The Commission has recognized that SSI plans are sensitive in nature. See Communications Assistance for Law Enforcement Act, CC Docket No. 97-213, Report and Order, 14 FCC Rcd 4151, 4177, para. 57 (1999).
  This information collection has been approved by the Office of Management and Budget, control number 3060-0809. See OMB Approvals for Non-Substantive Changes to Currently Approved Information Collections (OMB Control Nos. 3060-0809, 3060-0917, 3060-0918, 3060-0862), May 6, 2022; see also OMB Approvals for Extension without Change of a currently approved collection for Control No. 3060-0809 (approved through Oct. 31, 2025), Oct. 18, 2022.

12. In the CEFS Announcement Public Notice, we proposed to modernize the Commission’s procedures governing the filing of CALEA SSI plans that telecommunications carriers must follow to submit their plans for Commission review.  We proposed to require telecommunications carriers to submit CALEA SSI plans electronically in the CALEA Electronic Filing System (CEFS) rather than by paper.  We also proposed that mandatory filing begin six months after the Bureau announces the availability of CEFS for voluntary filing.  We believe the new filing system will streamline the process for filing CALEA SSI plans for telecommunications carriers.  The entities subject to the new electronic filing requirement are new telecommunications carriers and telecommunications carriers that must update their SSI plans.  Consequently, the streamlined filing process is specific to those entities and their obligations under CALEA.  
13. The electronic filing process does not impose increased reporting burdens on small entities or other telecommunications carriers, nor do we expect the electronic filing process to result in increased costs for impacted carriers.  In fact, the new electronic database will reduce paperwork and the time burden on small entities.  For example, we approximate that that the estimated paper filing burden of 7.5 hours will be reduced to 5 hours with electronic filing.  Further, the CEFS presents a public-facing web form containing data entry fields for collection of key portions of the required data that will help ensure filers supply necessary information in their SSI Plans.  The use of the web form and electronic filing will not only reduce the time burden imposed on small entities for filing SSI Plans but also reduce the time burden for when a SSI plans requires additional information to sufficiently meet CALEA compliance requirements.  
14. In addition, the automated CEFS for SSI Plan submission replaces a cumbersome and space-consuming paper process, streamlines the review process using a web-based checklist system, and enhances recordkeeping and retrieval capabilities for small entities.  Consequently, consistent with our IRFC, we conclude that mandating electronic filing will not cause a significant economic impact on a substantial number of small entities.  Therefore, we certify that the changes adopted here will not have a significant economic impact on a substantial number of small entities.  
15. Congressional Review Act.  The Commission has determined, and the Administrator of the Office of Information and Regulatory Affairs, Office of Management and Budget, concurs, that this rule is non-major under the Congressional Review Act, 5 U.S.C. § 804(2).  The Commission will send a copy of this Order to Congress and the Government Accountability Office pursuant to 5 U.S.C. § 801(a)(1)(A).  
16. Further Information:  For further information regarding this Order, please contact Rosemary Cabral, Attorney Advisor, Policy and Licensing Division, Public Safety and Homeland Security Bureau, at (202) 418-0662 or Rosemary.Cabral@fcc.gov; or Christopher Fedeli, Attorney Advisor, Policy and Licensing Division, Public Safety and Homeland Security Bureau, at (202) 418-1514 or Christopher.Fedeli@fcc.gov.
V. ORDERING CLAUSES
17.  Accordingly, IT IS ORDERED, pursuant to Sections 4(i) and 229(b)(3) of the Communications Act of 1934, as amended, 47 U.S.C. §§ 154(i), 229(b)(3), and Section 1.49(f)(3) of the Commission’s rules, 47 CFR § 1.49(f)(3), that Part 1 of the Commission’s rules IS AMENDED, as set forth in Appendix A, and that this Order, including the amended rule, SHALL BE EFFECTIVE 30 days after publication in the Federal Register, which will not occur until after the Office of Management and Budget has completed review of any non-substantive change to an information collection under the Paperwork Reduction Act. 
18. IT IS FURTHER ORDERED that the Commission’s Consumer and Governmental Affairs Bureau, Reference Information Center, SHALL SEND a copy of the Report and Order, including the Final Regulatory Flexibility Certification, to the Chief Counsel for Advocacy of the Small Business Administration
19. IT IS FURTHER ORDERED that the Office of the Managing Director, Performance Evaluation and Records Management, SHALL SEND a copy of this Order in a report to be sent to Congress and the Government Accountability Office pursuant to the Congressional Review Act, 5 U.S.C. § 801(a)(1)(A).
20. This action is taken under delegated authority pursuant to Sections 0.191 and 0.392 of the Commission’s rules, 47 CFR §§ 0.191, 0.392.  

FEDERAL COMMUNICATIONS COMMISSION 



Debra Jordan
Chief, Public Safety and Homeland Security Bureau

APPENDIX A
Final Rules

For the reasons discussed in the preamble, the Federal Communications Commission amends 47 CFR Part 1 to read as follows: 
PART 1 – PRACTICE AND PROCEDURE 
1. The authority citation for part 1 continues to read as follows:  
Authority: 47 U.S.C. chs. 2, 5, 9, 13; 28 U.S.C. 2461 note, unless otherwise noted.
Subpart Z - Communications Assistance for Law Enforcement Act
2. Amend § 1.20005 by revising paragraph (a) and adding paragraph (c) to read as follows:
§ 1.20005 Submission of policies and procedures and Commission review.
(a) Each telecommunications carrier shall file with the Commission the policies and procedures it uses to comply with the requirements of this subpart. These policies and procedures shall be filed before commencing service and, thereafter, within 90 days of a carrier’s merger or divestiture or a carrier’s amendment of its existing policies and procedures.
* * * * *
c) As of [INSERT DATE THIRTY DAYS AFTER DATE OF PUBLICATION IN THE FEDERAL REGISTER], any filings required by paragraph (a) of this section shall be submitted electronically through the Commission’s CALEA Electronic Filing System (CEFS).

2