Federal Communications Commission FCC 07-66 Before the Federal Communications Commission Washington, D.C. 20554 In the Matter of Facilitating Opportunities for Flexible, Efficient, and Reliable Spectrum Use Employing Cognitive Radio Technologies ) ) ) ) ) ) ET Docket No. 03-108 MEMORANDUM OPINION AND ORDER Adopted: April 20, 2007 Released: April 25, 2007 By the Commission: I. INTRODUCTION 1. By this action, we respond to two petitions concerning the rules adopted in the Report and Order in this proceeding (“Cognitive Radio Report and Order”).1 Specifically, we grant a petition for clarification filed by Cisco Systems, Inc. (“Cisco”) requesting that the Commission clarify: 1) the requirement to approve certain devices as software defined radios, and 2) its policy on the confidentiality of software that controls security measures in software defined radios. We grant in part and deny in part a petition for reconsideration filed by Marcus Spectrum Solutions (“MSS”) requesting that the Commission 1) clarify the rules concerning the submission of radio software source code, 2) clarify the rules concerning the certification of software defined amateur radio equipment, and 3) initiate a further proceeding to adopt regulatory requirements for high-power, high-speed digital-to-analog (D/A) converters. II. BACKGROUND 2. In 2001, the Commission adopted changes to its equipment authorization rules to accommodate emergent software defined radio (SDR) technology.2 The Commission defined an SDR as a transmitter in which the operating parameters of frequency range, modulation type, or maximum output power (either radiated or conducted) can be altered by making a change in software that controls the operation of the device without making any changes in the hardware components that affect the radio frequency emissions.3 This broad definition covers both radios that have software embedded on chips or implemented in other ways so that the software can not be readily changed by the user and radios that are designed so the software can be easily changed after manufacture. The SDR rules were intended to permit manufacturers to obtain approval for changes to the operating parameters of a radio resulting from software changes, without the need to physically re-label the device with a new FCC identification number in the field. Under these rules, a manufacturer that modifies the operating parameters of a radio 1 See Report and Order in ET Docket No. 03-108, 20 FCC Rcd 5486 (2005), (“Cognitive Radio Report and Order”). 2 See First Report and Order in ET Docket No. 00-47, 16 FCC Rcd 17373 (2001) (“SDR Report and Order”). 3 See 47 C.F.R. § 2.1. Federal Communications Commission FCC 07-66 2 product through a software change is required only to submit to the Commission a Class III permissive change request. The Commission made the SDR rules voluntary, rather than mandatory, thereby permitting a manufacturer the option to declare a device an SDR at the time of filing for certification, but not requiring the manufacturer to do so. In the SDR Report and Order, the Commission adopted the following rules for SDRs: 1) established a new streamlined procedure for obtaining approval for changes to the operating parameters of SDRs that result from changing the software in the device, i.e. the Class III permissive change process,4 2) allowed a device’s FCC identification number to be displayed electronically, rather than requiring a physical label,5 3) required SDRs to incorporate security features to ensure that only software that is part of an approved hardware/software combination can be loaded into an SDR,6 and 4) required manufacturers to supply a copy of the software that controls the operating parameters of a radio to the Commission upon request.7 3. On March 17, 2005, the Commission adopted the Cognitive Radio Report and Order in which it modified the rules to reflect ongoing technical developments in cognitive and software defined radio technologies.8 Specifically, the Commission eliminated the rule that a manufacturer supply radio software (source code) to the Commission upon request because such software is generally not useful for certification review and may have become an unnecessary barrier to entry. Instead, the rules now require that a manufacturer supply a high level operational description of the radio software that controls the transmitter’s RF characteristics for certification of a software defined radio. The Commission also clarified the rules to permit manufacturers to market radios that have the hardware-based capability to transmit outside authorized United States frequency bands, but have software controls to limit operation to authorized frequency bands when used in the United States. In addition, the Commission broadened the definition of SDR to include devices designed such that a software change could modify not only the operating parameters of frequency range, modulation type or maximum output power, but also the circumstances under which a transmitter operates in accordance with the rules, such as the operation of a dynamic frequency selection (DFS) mechanism in accordance with Commission requirements. 9 The Commission also modified the rules to require that radios with software that is designed or expected to be modified by a party other than the manufacturer have reasonable security measures to prevent unauthorized modifications that would affect the RF operating parameters or the circumstances under which the transmitter operates in accordance with Commission rules. Further, the Commission described the technical measures that cognitive radios could employ to allow secondary use of spectrum by lessees 4 See 47 C.F.R. § 2.1043(b)(3). 5 See 47 C.F.R. § 2.925(e). 6 See 47 C.F.R. § 2.932(e). The exact methods are left to the manufacturer. 7 See 47 C.F.R. § 2.944. 8 An SDR is a radio in which the operating parameters of frequency range, modulation type or maximum output power, or the circumstances under which the radio transmits in accordance with the rules, can be altered by making a change in software without making any changes to hardware components that affect the radio frequency emissions. See 47 C.F.R. § 2.1. An SDR can be programmed to transmit and receive on any of a variety of frequencies and/or to use one or more different transmission formats supportable by its hardware design. A cognitive radio goes one step further and can alter its transmitter parameters based on interaction with the environment in which it operates. This interaction may involve active negotiation or communications with other spectrum users and/or passive sensing and decision making within the radio. 9 DFS is a mechanism that dynamically detects signals from other systems and avoids co-channel operation with these systems, notably radar systems. See 47 C.F.R. § 15.403(g). DFS is required for Unlicensed National Information Infrastructure (U-NII) devices in certain frequency bands. Before a device incorporating DFS may transmit on a channel, it must monitor the channel for 60 seconds and determine that there are no radar signals present above a specified threshold. It must also continuously monitor the channel during operation and vacate the channel within ten seconds and not re-use the channel for 30 minutes if a radar signal is detected. See 47 C.F.R. § 15.407(h)(2). Federal Communications Commission FCC 07-66 3 while maintaining the availability of the spectrum for a higher priority use by the licensee when needed. 4. Cisco and MSS each filed a petition seeking reconsideration or clarification of various aspects of the Commission’s decisions in the Cognitive Radio Report and Order.10 The Information Industry Technology Council (“ITI”) filed comments in opposition of MSS’ petition.11 No comments were filed in response to Cisco’s petition. These petitions are discussed in detail below. III. DISCUSSION 5. The Cisco Petition for Clarification. Cisco requests two clarifications of the rules adopted in the Cognitive Radio Report and Order. First, Cisco requests that Section 2.1 of the rules be clarified to match the text of the Order, which states that radios “not designed or expected to be modified by a party other than the manufacturer” are not required to be certified as SDRs.12 This section defines an SDR as a radio containing a transmitter in which the operating parameters can be altered by making a change in software without making any changes to the hardware components that affect the RF emissions, but does not indicate that only certain radios are required to be certified as SDRs. Cisco is concerned that while many devices can be altered by software and fall within the SDR definition, devices are often designed in a way that does not facilitate software changes because the manufacturer intends no future software changes and does not intend others to make software changes. Therefore, it believes that Section 2.1 needs to be clarified to better reflect the excluded classes of devices that do not require SDR certification. 6. Second, Cisco requests that the Commission issue a policy statement that software supporting security measures must not intentionally be made public if doing so would reasonably increase the risk that security measures could be breached so that the radio could be operated in a manner inconsistent with U.S. rules. It believes that such an expression of Federal Government policy could help guide open source software manufacturers in the future and could be a useful point of reference if disputes arise.13 Cisco states that there are radios that rely on open source software which has licensing agreements that require the user to make public any modifications to the open source code, and that these requirements may be at odds with what it believes is the Commission’s strong preference to keep information on security measures out of the public domain. 7. Decision. In the SDR Report and Order, the Commission adopted a broad definition of SDR which covers both radios that have software embedded on chips or implemented in other ways so the software can not be easily changed after manufacture, as well as radios designed so the software can be easily changed after manufacture. The Commission intentionally adopted a broad definition of SDR to enable manufacturers to take advantage of the streamlined Class III permissive change if they so desire, but did not require that manufacturers certify radios as SDRs if they did not wish to.14 In the Cognitive Radio Report and Order, the Commission modified the rules to require that radios in which the software is designed or expected to be modified by a party other than the manufacturer be certified as software defined radios.15 To minimize the filing burden on manufacturers, this requirement was narrowly tailored 10 See Cisco petition for clarification dated June 3, 2005 and MSS petition for reconsideration dated June 1, 2005. 11 See ITI opposition to MSS petition for reconsideration dated July 29, 2005. 12 See Cognitive Radio Report and Order at 5504 and 47 C.F.R. § 2.1. 13 Open Source Software (OSS) is software in which the source code is made available for others to study, use, modify and/or redistribute. Some parties use the term Free Software (FS) rather than OSS to describe such software because parties are free to study, use, modify and/or redistribute to the code. GNU/Linux is a widely used OSS operating system and is sometimes referred to simply as Linux. 14 See SDR Report and Order, supra at 17375. 15 See Cognitive Radio Report and Order at 5502. Federal Communications Commission FCC 07-66 4 to affect only those radios where the software can be modified by a party other than the manufacturer because such radios pose a higher risk of interference to authorized radio services.16 Thus, the definition of SDR is intentionally broad, while the category of equipment that is required to be certified as SDRs is intentionally narrow. We agree with Cisco that a reading of the definition of SDR in the rules by itself may give the incorrect impression that more devices must be certified as SDRs than the rules are intended to require. We find that the appropriate solution to Cisco’s concern is to add an additional sentence following the definition of SDR to indicate the class of radios that must be certified as SDRs. We are therefore clarifying the rules by adding the following statement to the definition of SDR: “In accordance with § 2.944 of this part, only radios in which the software is designed or expected to be modified by a party other than the manufacturer and would affect the above-listed operating parameters or circumstances under which the radio transmits must be certified as software defined radios.”17 This action clarifies the intent of the rules adopted in the Cognitive Radio Report and Order. 8. With regard to Cisco’s second request, we recognize that some manufacturers may wish to use open source software (e.g., GNU/Linux) in developing SDRs. The use of such software may have advantages for manufacturers such as lower cost and decreased product development time. However, as Cisco notes, open source software may be subject to licensing agreements that require the party modifying the code to make the source code publicly available.18 9. In the Cognitive Radio Report and Order, the Commission adopted a rule to automatically make confidential the information on SDR security features that is submitted with an application for certification. The Commission gave two reasons for this rule change. The first was that information about security measures employed to prevent unauthorized modifications to a device is typically company proprietary information that manufacturers may not wish to supply to the Commission without a reasonable assurance that such information will be held as confidential. Second, the Commission was concerned that making information on security measures publicly available could assist parties in determining ways to defeat them. The Commission did not address the possibility of manufacturers using open source software to implement security measures. However, we recognize that hardware and software security measures that interact with the open source software need not be subject to an open source agreement. We are hereby stating that it is our policy, consistent with the intent of Cognitive Radio Report and Order and Cisco’s request, that manufacturers should not intentionally make the distinctive elements that implement that manufacturer’s particular security measures in a software defined radio public, if doing so would increase the risk that these security measures could be defeated or otherwise circumvented to allow operation of the radio in a manner that violates the Commission’s rules. A system that is wholly dependent on open source elements will have a high burden to demonstrate that it is sufficiently secure to warrant authorization as a software defined radio. 10. The MSS Petition for Reconsideration. MSS requests clarification or reconsideration of three 16 While the certification procedure for software defined radios is not significantly more burdensome than for other equipment, there is some additional information required. An application for a software defined radio must demonstrate that the radio contains security features to prevent unauthorized modifications to the radio frequency operating parameters and must include a high level operational description or flow diagram of the software that controls the radio frequency operating parameters. See 47 C.F.R. § 2.944. In addition, software defined radios may currently be certified only by the Commission’s Laboratory and not by designated Telecommunication Certification Bodies as is permitted for most other equipment. 17 Modifications by the manufacturer are modifications done at a manufacturer’s facility or by an agent of the manufacturer, such as an authorized service facility. Radios in which the software is designed or expected to be modified by other parties, such as by a user installing software downloaded over the Internet, must be certified as software defined radios. 18 For example, the widely used GNU General Public License gives parties the right to modify and redistribute code only if they also make the source code available to the user. See http://www.gnu.org/licenses/licenses.html. Federal Communications Commission FCC 07-66 5 issues in the Cognitive Radio Report and Order. First, it requests that the Commission clarify whether it has in fact deleted the requirement to submit software source code and to make sure the codified rules reflect its decision. MSS submits that while the Commission states it has deleted this requirement, several statements in the Cognitive Radio Report and Order seem to disagree with this outcome.19 It believes that if the Commission decides that a software submission requirement is necessary, it should modify the rules to state explicitly that source code is a record not routinely available for public inspection, and should adopt internal handling procedures similar to those for sensitive Commission agenda items or other sensitive proprietary information. 11. MSS also requests that the Commission issue a Further Notice of Proposed Rule Making on the regulation of D/A converters. It believes that D/A converters that meet certain criteria for sampling rate, output power, digital interface and analog output should be classified as Class A digital devices with marketing to the general public as standalone products prohibited. MSS predicts that if high power, high speed D/A converters with antenna-like connectors are ever readily available to the general public, then the whole FCC equipment authorization program will be bypassed and third party providers will have an immediate market for software that will make computers equipped with converters operate in any frequency band. 12. MSS additionally requests that the Commission continue to exempt all amateur radio equipment from equipment authorization requirements, or initiate further rule making to make amateur radio SDR equipment explicitly subject to equipment authorization and the requirements of the new Section 2.944. It would include a provision for “safe harbor” without equipment authorization if there are hardware provisions or non-user changeable software that controls the frequency bands of transmissions. MSS states that while paragraph 62 of the Cognitive Radio Report and Order appears to avoid adopting regulatory requirements for amateur equipment, Section 2.944, which requires radios in which the software is designed or expected to be modified by a party other than the manufacturer to be certified as software defined radios, appears to apply to amateur equipment. 13. ITI opposes MSS’ request for additional regulations for D/A converters. ITI states that there is no public record to indicate that widespread misuse of D/A converters as radios is likely. It states that all devices operating as radios, whether modified via hardware or software, are required to be certified for operation in the designated band. ITI states that enforcement of these existing regulations will adequately prevent D/A converter radio devices such as those described by MSS from being readily available to the public. In response, MSS argues that the ITI opposition fails to respond to any of the specifics of the MSS petition for reconsideration. MSS agrees with ITI that there has been no reported misuse of D/A converters, but states that this is because there are presently no high speed, high power D/A converters available to the general public at reasonable prices. MSS claims that while high speed D/A converters are over $1000 now, they might drop to consumer range within a few years. It believes that it would be possible to convert a high speed, high power D/A converter into a transmitter, and that hobbyists have already figured out how to use existing video cards, close cousins of D/A converters, as short range transmitters in the AM and TV broadcasting bands. 14. In the Cognitive Radio Report and Order the Commission stated that a specific rule requiring the submission of software source code upon request could be a disincentive for manufacturers to certify equipment as software defined radio. The presence of such a rule could give manufacturers the incorrect impression that the Commission’s staff would frequently request software source code, which is typically company proprietary information. Further, software source code is generally not a useful aid in determining whether unauthorized changes have been made to the operating parameters of a device. For these reasons, the Commission removed the specific rule requiring the submission of radio software upon 19 Specifically, MSS references statements in footnote 4 and paragraphs 20, 39 and 67 of the Cognitive Radio Report and Order. Federal Communications Commission FCC 07-66 6 request. In the event that questions arise about the compliance of a particular device, the Commission’s staff already has the authority to request and examine any component, whether software or hardware, of a radio system when needed for certification under Commission rules.20 The manufacturer could request that we hold the information confidential, and we would generally grant such a request absent a compelling reason otherwise. We expect that Commission requests for software source code would be extremely rare. It would not be burdensome for a manufacturer to request confidentiality for software source code in the event we request it, and we find there is no need to modify the confidentiality rules to address a specific class of information that we expect would be requested only infrequently. 15. We decline to take any actions with respect to regulating the marketing of certain types of D/A converters. MSS does not demonstrate any current need for regulation of D/A converters. It admits that the types of D/A converters that it is concerned about are not presently on the market, and that it is not aware of any discussions about the possible marketing of these types of D/A converters.21 We therefore find that MSS’ concerns about possible misuse of equipment not available now or in the foreseeable future are premature, speculative, and not a basis for initiating a further rule making proceeding at this time. 16. In regard to MSS’ request for clarification about the regulatory treatment of amateur radio equipment, the Commission did not intend to impose any new certification requirements for amateur radio equipment in the Report and Order. External RF amplifiers that operate below 144 MHz that are marketed for use with amateur stations will continue to require certification before they can be marketed.22 Other amateur radio equipment, including equipment that meets the definition of a software defined radio and that has software that is designed or expected to be modified by a party other than the manufacturer, will continue to be exempt from a certification requirement. However, as the Commission noted in the Report and Order, certain unauthorized modifications of amateur transmitters are unlawful.23 We may revisit the issue of the certification of amateur equipment with software modifiable features as identified above in the future if misuse of such devices results in significant interference to authorized spectrum users. V. PROCEDURAL MATTERS 17. Final Regulatory Flexibility Certification. The Regulatory Flexibility Act of 1980, as 20 Grantees of equipment certification are required to maintain records of equipment specifications and any changes that may affect compliance and must make these records available for inspection by the Commission. See 47 C.F.R. §§ 2.936(a) and 2.938(a). We note that Section 303(e) and Section 4(i) of the Communications Act give the Commission authority to request data that will assist it in carrying out its responsibilities under the Act. See 47 U.S.C. §§ 154(i) and 303(e). 21 See MSS petition at 9 and MSS reply to opposition at 3. 22 Such amplifiers must comply with limits on the gain over the frequency range of 24 to 35 MHz. See 47 C.F.R. §§ 97.315 and 97.317. 23 See In the Matter of Pilot Travel Centers, L.L.C., Knoxville, Tennessee, Notice of Apparent Liability for Forfeiture, 19 FCC Rcd 23113, 23114 (2004). In this forfeiture proceeding, the Commission issued a Notice of Apparent Liability for violations of Section 302(b) of the Communications Act of 1934, as amended, and Section 2.803(a)(1) of the Commission’s rules for marketing unapproved radio transmitters. The transmitters in question were marketed as amateur equipment, which is normally exempt from a certification requirement. However, the transmitters had the capability of being easily altered to operate on frequency bands in the Citizen’s Band (CB) Radio Service, so the Commission held that they met the definition of a CB transmitter under Section 95.603(c) of the rules, which requires such transmitters to be certified before they can be imported into or marketed within the United States. The equipment being marketed, which complied with all requirements for amateur equipment, was capable at transmitting at power levels well above those permitted for CB transmitters. Federal Communications Commission FCC 07-66 7 amended (RFA),24 requires that a regulatory flexibility analysis be prepared for rulemaking proceedings, unless the agency certifies that “the rule will not have a significant economic impact on a substantial number of small entities.”25 The RFA generally defines the term "small entity" as having the same meaning as the terms "small business," "small organization," and "small governmental jurisdiction."26 In addition, the term "small business" has the same meaning as the term "small business concern" under the Small Business Act.27 A small business concern is one which: (1) is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the Small Business Administration. 18. In the Cognitive Radio Report and Order, the Commission expanded the definition of software defined radio (SDR) to include radios in which software can control the circumstances under which the radio operates in accordance with the Commission’s rules. This broad definition covers both radios that have software embedded on chips or implemented in other ways so that the software can not be readily changed by the user, as well as radios that are designed so the software can be easily changed after manufacture. In the Cognitive Radio Report and Order, the Commission also modified the rules to require that a radio be approved as an SDR if the software that controls the operating parameters or the circumstances under which it transmits is designed or expected to be modified by party other than the manufacturer. This requirement applies to only a narrow subset of radios that meet the definition of SDR. A Final Regulatory Flexibility Analysis was incorporated in the Cognitive Radio Report and Order. Following publication of the Cognitive Radio Report and Order, Cisco filed its petition seeking clarification of which radios require certification as SDRs. In this Memorandum Opinion and Order we are amending the definition of SDR to reference the requirements concerning which radios must be certified as SDRs. This change clarifies the rules adopted in the Cognitive Radio Report and Order and does not modify any compliance requirements. For this reason, this change will not result in a “significant economic burden” on manufacturers. Therefore, we certify that the amendments included in this Memorandum Opinion and Order will not have a significant economic impact on a substantial number of small entities. 19. The Commission will send a copy of the Memorandum Opinion and Order, including a copy of this final certification, in a report to Congress pursuant to the Congressional Review Act.28 In addition, the Memorandum Opinion and Order and this certification will be sent to the Chief Counsel for Advocacy of the Small Business Administration, and will be published in the Federal Register.29 20. This document does not contain any information collection requirements subject to the Paperwork Reduction Act of 1995 (PRA), Public Law 104-13. 24 The RFA, see 5 U.S.C § 601-612, has been amended by the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA), Pub. L. No. 104-121, Title II, 110 Stat. 857 (1996). 25 5 U.S.C. § 605(b). 26 5 U.S.C. § 601(6). 27 5 U.S.C. § 601(3) (incorporating by reference the definition of “small business concern” in the Small Business Act, 15 U.S.C. § 632). Pursuant to 5 U.S.C. § 601(3), the statutory definition of a small business applies “unless an agency, after consultation with the Office of Advocacy of the Small Business Administration and after opportunity for public comment, establishes one or more definitions of such term which are appropriate to the activities of the agency and publishes such definition(s) in the Federal Register.” 28 See 5 U.S.C. § 801(a)(1)(A). 29 See 5 U.S.C. § 605(b). Federal Communications Commission FCC 07-66 8 VI. ORDERING CLAUSES 21. Accordingly, IT IS ORDERED that pursuant to the Section 1, 4, 301, 302(a), and 303, of the Communications Act of 1934, as amended, 47 U.S.C. §§ 151, 154, 301, 302(a), and 303, this Memorandum Opinion and Order IS ADOPTED, and Part 2 of the Commission’s Rules IS AMENDED as specified in the attached appendix, and WILL BECOME EFFECTIVE 30 days after publication in the Federal Register. 22. IT IS FURTHER ORDERED that the petition for clarification filed by Cisco Systems, Inc. IS HEREBY GRANTED. This action is taken pursuant to the authority contained in Sections 4(i), 301, 302, 303(e), 303(f), and 303(r) of the Communications Act of 1934, as amended, 47 U.S.C. Sections 154(i), 301, 302, 303(e), 303(f), and 303(r). 23. IT IS FURTHER ORDERED that the petition for reconsideration filed by Marcus Spectrum Solutions IS HEREBY GRANTED IN PART AND DENIED IN PART as described above. This action is taken pursuant to the authority contained in Sections 4(i), 301, 302, 303(e), 303(f), and 303(r) of the Communications Act of 1934, as amended, 47 U.S.C. Sections 154(i), 301, 302, 303(e), 303(f), and 303(r). 24. IT IS FURTHER ORDERED that the Commission’s Consumer and Governmental Affairs Bureau, Reference Information Center, SHALL SEND a copy of this Memorandum Opinion and Order, including the Final Regulatory Flexibility Certification, to the Chief Counsel for Advocacy of the Small Business Administration. 25. For further information regarding this Memorandum Opinion and Order, contact Mr. Hugh L. Van Tuyl, Office of Engineering and Technology, (202) 418-7506, e-mail Hugh.VanTuyl@fcc.gov. FEDERAL COMMUNICATIONS COMMISSION Marlene H. Dortch Secretary Federal Communications Commission FCC 07-66 9 APPENDIX Final Rule Changes Part 2 of Title 47 of the Code of Federal Regulations is amended as follows: 1. The authority citation for Part 2 continues to read as follows: AUTHORITY: 47 U.S.C. 154, 302a, 303 and 336, unless otherwise noted. Section 2.1 is revised by changing the following definition: 2. § 2.1 Terms and definitions. * * * * * (c) * * * Software defined radio. A radio that includes a transmitter in which the operating parameters of frequency range, modulation type or maximum output power (either radiated or conducted), or the circumstances under which the transmitter operates in accordance with Commission rules, can be altered by making a change in software without making any changes to hardware components that affect the radio frequency emissions. In accordance with § 2.944 of this part, only radios in which the software is designed or expected to be modified by a party other than the manufacturer and would affect the above-listed operating parameters or circumstances under which the radio transmits must be certified as software defined radios. * * * * *