Federal Communications Commission FCC 11-41 Before the Federal Communications Commission Washington, D.C. 20554 In the Matter of Rules and Regulations Implementing the Truth in Caller ID Act of 2009 ) ) ) ) WC Docket No. 11-39 NOTICE OF PROPOSED RULEMAKING Adopted: March 9, 2011 Released: March 9, 2011 Comment Date: April 18, 2011 Reply Comment Date: May 3, 2011 By the Commission: I. INTRODUCTION 1. In this Notice of Proposed Rulemaking (NPRM), we seek comment on proposed rules to implement the Truth in Caller ID Act of 2009 (Truth in Caller ID Act, or Act), signed into law on December 22, 2010.1 Caller ID services identify the telephone numbers and sometimes the names associated with incoming calls. Many telephone users—including subscribers to traditional wireline, interconnected Voice over Internet Protocol (VoIP) and mobile wireless services—routinely rely on Caller ID to determine who is calling and whether to answer the call. Increasingly, bad actors are manipulating or “spoofing” caller ID information to facilitate schemes that harm consumers or threaten public safety. Some caller ID spoofers, for example, transmit caller ID information that makes it appear that they are calling from consumers’ banks or credit card companies in an attempt to trick call recipients into providing their account numbers or other sensitive information. In other instances, caller ID spoofers have engaged in a practice referred to as “swatting,” which involves placing false emergency calls to law enforcement agencies to elicit a response from Special Weapons and Tactics (SWAT) teams. The Truth in Caller ID Act is aimed at preventing these harmful and dangerous practices. The Act prohibits intentionally harmful or fraudulent spoofing of caller ID information and gives the Federal Communications Commission (Commission) the authority to seek substantial penalties from those who violate the Act. 2. The Truth in Caller ID Act prohibits anyone in the United States from causing any caller identification service2 to knowingly transmit misleading or inaccurate caller ID information with the 1 Truth in Caller ID Act of 2009, Pub. L. No. 111-331, codified at 47 U.S.C. § 227(e). 2 We use the term “caller identification service” to mean any service or device that meets the statutory definition of being “designed to provide the user of the service or device with the telephone number of, or other information regarding the origination of, a call made using a telecommunications service or IP-enabled voice service.” See 47 U.S.C. § 227(e)(8)(B). Caller identification services include “caller ID services,” a term that we use here to refer specifically to services that permit the recipient of an incoming call to determine, before answering, the calling party number and, in some cases, a name associated with the number. “Caller identification services” may also include other services more generally, such as charge number services and automatic number identification (ANI) services including, for example, those used by public safety answering points. Federal Communications Commission FCC 11-41 2 intent to defraud, cause harm, or wrongfully obtain anything of value.3 The Truth in Caller ID Act requires the Commission to issue implementing regulations within six months of the law’s enactment.4 It also requires the Commission, by the same date, to submit a report to Congress on “whether additional legislation is necessary to prohibit the provision of inaccurate caller identification information in technologies that are successor or replacement technologies to telecommunications services or IP- enabled voice services.”5 II. BACKGROUND 3. Local caller ID services were made possible in the early 1980s when local exchange carriers (LECs) began adopting Signaling System Seven (SS7) signaling techniques, which carriers use to route and manage telephone calls.6 SS7 techniques place signaling information on a separate transmission channel from the telephone call (i.e., “out-of-band” instead of “in-band” signaling). Separating the signaling information from the voice traffic, along with other features of SS7, enables providers to transmit caller ID information across multiple carriers.7 4. In the 1990s, the Commission adopted rules to address interstate caller ID and other calling party number (CPN) services.8 Under the Commission’s rules, common carriers that use SS7 call set-up capabilities generally must transport the CPN on interstate calls to interconnecting carriers.9 In addition, a calling party can request that his or her calling number not be revealed by dialing *67 (or 1167 for rotary phones) before dialing the phone number.10 Carriers using SS7, or offering or subscribing to any service based on SS7 call set-up functionality, are required to recognize and honor calling parties’ 3 See 47 U.S.C. § 227(e)(1) (“In General - It shall be unlawful for any person within the United States, in connection with any telecommunications service or IP-enabled voice service, to cause any caller identification service to knowingly transmit misleading or inaccurate caller identification information with the intent to defraud, cause harm, or wrongfully obtain anything of value, unless such transmission is exempted pursuant to paragraph (3)(B).”). 4 Id. § 227(e)(3). President Obama signed the Act into law on December 22, 2010. 5 47 U.S.C. § 227(e)(4). 6 See Rules and Policies Regarding Calling Number Identification Service – Caller ID, CC Docket No. 91-281, Memorandum Opinion and Order on Reconsideration, Second Report and Order and Third Notice of Proposed Rulemaking, 10 FCC Rcd 11700, 11704-05, paras. 7-11 (1995) (Second Caller ID Order); see also Rules and Policies Regarding Calling Number Identification Service – Caller ID, CC Docket No. 91-281, Notice of Proposed Rulemaking, 6 FCC Rcd 6752, para. 2 (1991) (Caller ID NPRM). 7 See Caller ID NPRM, 6 FCC Rcd at 6752, paras. 1-2. Early subscribers to caller ID services typically paid a monthly fee for caller ID service and usually had to purchase a separate device that received and displayed caller ID information. Id. Today, caller ID is provided as a standard feature of many telephone services. 8 See Rules and Policies Regarding Calling Number Identification Service – Caller ID, CC Docket No. 91-281, Report and Order and Further Notice of Proposed Rulemaking, 9 FCC Rcd 1764 (1994) (First Caller ID Order); Second Caller ID Order, 10 FCC Rcd 11700. 9 47 C.F.R. § 64.1601. 10 47 C.F.R. § 64.1601(b). Federal Communications Commission FCC 11-41 3 privacy requests. As a result, on a call-by-call basis, most callers have the ability to block a call recipient from seeing the calling party’s telephone number or name. Thus, whether the CPN and other caller identification information are revealed to the called party generally depends on whether the called party receives caller ID service from his or her service provider, and whether the calling party has requested privacy.11 This basic framework reflects the Commission’s balancing of the benefits of caller ID with the privacy issues raised by this and other CPN services.12 5. When the Commission first adopted its rules relating to CPN, the use of caller ID services was a new phenomenon. Although the Commission did not require the adoption of SS7 techniques, over time, most telecommunications carriers in the United States adopted SS7 and, consequently, caller ID and other CPN services became commonplace. As carriers have begun migrating to packetized networks, new signaling techniques have emerged. Interconnected VoIP services, for example, often use session initiation protocol (SIP) signaling techniques, rather than SS7. The widespread availability of interconnected VoIP services has increased the control that calling parties can exercise over the information transmitted with their phone calls.13 Callers using interconnected VoIP services can easily spoof their caller ID by making a call appear to come from any phone number.14 Callers who subscribe to legacy telephone service also can easily spoof their caller ID by purchasing caller ID spoofing services from third parties. Indeed, caller ID spoofing services are openly advertised on the Internet.15 There are also companies that offer “caller identification management services” to business customers and make it 11 The Commission’s rules exempt certain types of calls, including calls from payphones and from most Private Branch Exchanges, from the requirements to transmit CPN and to recognize and honor calling parties’ privacy requests. See 47 C.F.R. § 64.1601(d). 12 The Commission’s rules concerning the delivery of CPN also address the transmission and use of ANI information, which is information about the phone number used for charging purposes, and may or may not be the same as the CPN. See 47 C.F.R. § 64.1602. When the Commission adopted its rules, it found that ANI blocking was not technologically feasible, and that use of ANI did not raise the same privacy concerns as the use of CPN services. Therefore, instead of requiring that ANI blocking be made available to subscribers, the Commission required carriers offering ANI services to limit the permissible uses of ANI. See First Caller ID Order, 9 FCC Rcd at 1772-74, paras. 51-58. 13 See Truth in Caller ID Act, Report of the Committee on Commerce, Science, and Transportation on S. 30, 111- 96, at 1-2 (2009) (Senate Commerce Committee Report). As discussed infra at para. 15, in adopting rules implementing the Act, we use the term “interconnected-VoIP services” to be consistent with our existing rules and the direction in the Act. Congress used the term “IP-enabled voice services.” 14 Id. 15 While the underlying technology used by caller ID spoofing services advertised on the web varies, callers using such services often access the spoofing service by dialing a toll-free access number and entering a PIN before dialing the called party’s number. The caller ID spoofing service will then transmit whatever caller ID information the calling party has provided to the spoofing service, rather than the caller ID information the telephone network passes with the call to the spoofing service. See, e.g., www.Itellas.com (“Welcome to our caller ID spoofing site!”); www.telespoof.com (“The highest quality caller ID services available anywhere in the world.”); www.phonegangster.com (offering “affordable caller ID spoofing services to both individuals and businesses alike”); www.spoofapp.com (“disguise your caller ID and be anyone”); www.spoofcard.com (“Call someone from your phone and the person’s Caller ID displays the number that you intend them to see.”). Federal Communications Commission FCC 11-41 4 possible for their customers to transmit different CPNs.16 Because the terminating provider often has no direct relationship with the person placing a call, that provider often has no way to discern whether the caller ID information it receives is accurate. 6. As noted above, there are a number of ways that caller identification information can be spoofed. Figure 1, below, offers one example of how a caller can spoof his phone number, using a third- party caller ID spoofing service. In the example depicted in Figure 1, the caller has already created an account with a caller ID spoofing service, and has a personal identification number (PIN) he uses to access the spoofing service. In order to make a call with a spoofed caller ID, the caller dials the spoofing service’s toll free number and when connected to the spoofing service, the caller enters his PIN, the telephone number he wants to call, and the number he wants to have displayed by the called party’s caller ID service (the “substitute number”). The spoofing service forwards the call to the telephone number specified by the caller and forwards the “substitute number” as the CPN. As a result, the called party’s caller ID service displays the substitute number as the caller ID. Figure 1 16 Several companies offering caller identification management services to business customers have filed comments with the Federal Trade Commission (FTC) in response to a recent Advanced Notice of Proposed Rulemaking regarding the Telemarketing Sales Rule and its Rules Regarding Caller ID issued by the FTC. (FTC File. No. P104405). See, e.g., Comments of NobelBiz, Inc., Infocision Management Corporation, and Omega Services, available at http://www.ftc.gov/os/comments/tsrcalleridnprm/index.shtm. Although their business models vary, caller identification management companies generally supply their clients with CPNs to transmit when making calls. NobelBiz, Inc., for example, offers a “LocalTouch” service that enables its telemarketing and debt collection clients to place calls from anywhere while transmitting CPNs that make it appear to call recipients that they are receiving local calls. The idea is that consumers are more likely to answer a call that appears to come from a local phone number. On its website, NobelBiz guarantees that its “LocalTouch” service will increase customer contact rates by a minimum of 30 percent. http://www.nobelbiz.com/local-touch.html. Federal Communications Commission FCC 11-41 5 7. As Congress recognized, not all instances of caller identification manipulation are harmful, and some may be beneficial.17 For example, because many phones are set to refuse calls where the caller ID information is not provided, domestic violence shelters often need to transmit caller ID to complete a call but may have important reasons for not revealing the actual number of the shelter.18 In addition, the Commission’s own rules require telemarketers to transmit caller identification information, but allow for the substitution of the name and customer service number of the seller on whose behalf the telemarketer is calling, as long as the telephone number provided is one a consumer can use to make a do-not-call request during regular business hours.19 8. Although caller ID manipulation may sometimes be in the public interest, it also is a practice ripe for abuse by criminals and others who intend to cause harm. Numerous well-publicized examples of caller ID spoofing led to Congressional concern about the misuse of caller ID systems. For instance, the AARP issued a “scam alert” about a scheme in which a person posing as a courthouse employee called a Michigan woman and accused her of missing jury duty. The caller warned the woman that a warrant was being issued for her arrest, and asked her to provide the caller with her Social Security number to confirm her identity. Because the bad actors were able to spoof the name and telephone number of the Michigan courthouse, the call appeared legitimate.20 These jury duty scams are just one way caller ID spoofing has been used to further identity theft schemes and defraud consumers.21 There also have been reports of caller ID spoofing directed at emergency services providers. This type of caller ID spoofing is sometimes referred to as “swatting” because it can result in the costly and potentially dangerous misdirection of SWAT teams and other first responders.22 17 Senate Commerce Committee Report at 2. 18 Id. 19 See 47 C.F.R. § 64.1601(e). Similarly, the FTC’s Telemarketing Sales Rule requires a telemarketer to transmit its own caller identification information or that of the entities on whose behalf the telemarketer is working. 16 C.F.R. § 310.4(a)(7). See infra para. 26 for a more extensive discussion of the benefits of requiring telemarketers to transmit caller ID information. 20 Senate Commerce Committee Report at 2. AARP and others have continued to issue alerts about jury duty scams perpetrated using caller ID spoofing. See, e.g., Scam Alert, AARP, Avoid Jury Notices Rigged to Get Your ID: Did You Really Miss Your Court Date, or is Someone Out to Get Your Information?, Jan. 11, 2011, http://www.aarp.org/money/scams-fraud/info-01-2011/scam_alert_rigged_jury_notice.html; Press Release, FBI, Telephone Fraud Involving Jury Duty, Sept. 28, 2005, available at http://www.fbi.gov/news/pressrel/press- releases/telephone-fraud-involving-jury-duty. 21 See, e.g., Roy Furchgott, Caller ID Fraud Is a Grim Reminder, N.Y. Times, May 18, 2009, http://gadgetwise.blogs.nytimes.com/2009/05/18/caller-id-scam-is-a-grim-reminder/ (describing an identify theft ring that took in more than $15 million through the use of caller ID spoofing); Elizabeth Leamy, Crooks Trick Your Caller ID for Identity Theft, ABC News, Apr. 13, 2009, http://abcnews.go.com/Technology/story?id=7325223&page=1 (describing a scheme that spoofed the information of a local bank to get account information from consumers). 22 Senate Commerce Committee Report at 2; see also Kevin Poulson, Guilty Plea: Phone Phreaks Use Caller ID Spoofing to Get Foes Raided by SWAT, Wired.Com, Nov. 15, 2007, http://www.wired.com/threatlevel/2007/11/guilty-plea-pho/# (describing the prosecution of a man who spoofed caller ID and phoned police with fake hostage crises); Kevin McMillan, Couple Swarmed by SWAT Team After 911 ‘Hack,’ PC World, Oct. 17, 2007, (continued….) Federal Communications Commission FCC 11-41 6 9. To address concerns about harmful caller ID spoofing, Congress passed the Truth in Caller ID Act. The Act makes it “unlawful for any person within the United States, in connection with any telecommunications service or IP-enabled voice service, to cause any caller identification service to knowingly transmit misleading or inaccurate caller identification information with the intent to defraud, cause harm, or wrongfully obtain anything of value.”23 The Act directs the Commission to adopt rules implementing the provisions of the Act, provides for additional civil penalties for violations of the Act, and establishes a two-year statute of limitations.24 III. IMPLEMENTATION OF THE TRUTH IN CALLER ID ACT 10. Congress took a measured approach to addressing concerns about caller ID spoofing. In the immediate term, Congress directed the Commission to adopt rules – and associated penalties for rule violations – to prohibit malevolent caller ID spoofing. And Congress established a six-month time frame to ensure that its immediate concerns are addressed without delay. In the longer term, Congress indicated that it wants to evaluate whether additional legislation is necessary to address caller ID spoofing concerns that may arise as technology changes. We propose to adopt rules that reflect Congress’s directive to prohibit caller ID spoofing done with the intent to defraud, cause harm, or wrongfully obtain anything of value. We also seek comments that will assist us in preparing the statutorily required report to Congress regarding the need for additional legislation in this area. 11. We propose to (i) add a section to our current rules governing CPN services, and (ii) enhance our forfeiture rules. The proposed additions to our CPN rules are modeled on the Act’s prohibition against engaging in caller ID spoofing with fraudulent or harmful intent, and include the statutory exemptions to the prohibition. The proposed rules also include new definitions. The proposed amendments to our forfeiture rules implement the forfeiture penalties and forfeiture process provided for in the Act. A. Proposed Amendments to the Commission’s Rules Relating to Calling Party Numbers 12. We propose rules that would prohibit any person or entity in the United States, with the intent to defraud, cause harm, or wrongfully obtain anything of value, from knowingly causing, directly or indirectly, any caller identification service to transmit or display misleading or inaccurate caller identification information.25 The Act’s prohibition is directed at spoofing “in connection with any telecommunications service or IP-enabled voice service.”26 Our proposed rules define “caller identification service” and “caller identification information” to encompass both types of calls; therefore, the proposed rules would apply to calls made using both types of services.27 We seek comment on this (Continued from previous page) http://www.pcworld.com/article/138591/couple_swarmed_by_swat_team_after_911_hack.html; Letter from Lanny A. Breuer, Assistant Attorney General, U.S. Department of Justice, to Marlene H. Dortch, Secretary, FCC, at 2 (Jan. 26, 2011) (DOJ Jan. 26, 2011 Letter). 23 47 U.S.C. § 227(e)(1). 24 Id. § 227(e)(3), (e)(5)(A)(i), and (e)(5)(A)(iv). The Act also provides for criminal penalties for anyone who is convicted of willfully and knowingly violating the Act, and gives the States authority to bring civil actions in federal district court to enforce the Act on behalf of their residents. Id. § 227(e)(5)(B) and (e)(6). 25 Proposed rules can be found in Appendix A. 26 47 U.S.C. § 227(e)(1). 27 See infra para. 16. Federal Communications Commission FCC 11-41 7 approach, and whether we need to take any other steps to ensure that calls made using telecommunications services and interconnected VoIP services are covered by the proposed rules. 13. We also seek comment on the use of the word “knowingly” in the statute and our proposed rules. The statutory language prohibits anyone from “causing any caller identification service to knowingly transmit misleading or inaccurate caller identification information with the intent to defraud, cause harm or wrongfully obtain anything of value” and could be read to require knowledge by either the caller identification service or the actor employing the caller identification service. However, in many instances, the caller identification service has no way of knowing whether or not the caller identification information it receives has been manipulated. The proposed rules thus focus on whether the caller has knowingly manipulated the caller identification information that is seen by the call recipient in order to defraud, cause harm, or wrongfully obtain anything of value. Our proposed rules provide that the person or entity prohibited from “knowingly” causing transmission or display of inaccurate or misleading caller identification is the same person or entity that must be acting with intent to defraud, cause harm, or wrongfully obtain anything of value. The proposed rules address both transmitting and displaying inaccurate caller identification information to make clear that, even if a carrier or interconnected VoIP provider transmits accurate caller identification information, it would be a violation for a person or entity to cause a device that displays caller identification information to display inaccurate or misleading information with the intent to defraud, cause harm, or wrongfully obtain anything of value. We seek comment on whether these proposed rules accurately reflect Congress’ intent. Are there any changes to the proposed rules that would improve how this prohibition is expressed? 14. We also seek comment on whether the proposed prohibition on causing any caller identification service to transmit or display “misleading or inaccurate” caller identification information with the “intent to defraud, cause harm, or wrongfully obtain anything of value” provides sufficiently clear guidance about what actions are prohibited. Do the proposed rules provide the public with “ascertainable certainty” about what would constitute a violation of the Act?28 Are the terms used in the proposed rules sufficiently well understood concepts that the public reasonably should know which actions are prohibited? For example, must the legal elements of common law “fraud” be met for a finding of intent to “defraud” under the Commission’s proposed rules? Are there other statutes that provide relevant and well-defined standards for what it means to “defraud” someone? To the extent that greater specification is desirable, how should the proposed rules be changed to provide the desired clarity while remaining faithful to Congress’ intent? We also seek comment on the different methods that a person or entity can employ to cause a caller identification service to transmit misleading or inaccurate information, and whether our proposed rules adequately encompass all such methods. 15. Definitions. The Act specifies that “IP-Enabled Voice Service” has the “meaning given that term by section 9.3 of the Commission’s regulations (47 C.F.R. 9.3) as those regulations may be amended by the Commission from time to time.”29 The Commission’s regulations define “Interconnected VoIP Service” rather than “IP-Enabled Voice Services.”30 Although the Act’s use of a term other than 28 See Trinity Broadcasting of Florida, Inc. v. FCC, 211 F.3d 618, 628 (D.C. Cir. 2000) (for purposes of determining whether the Commission can impose a substantial civil penalty for violation of one of its rules, the Court must find that “a regulated party acting in good faith would be able to identify, with ascertainable certainty, the standards with which the agency expects parties to conform” (quoting General Elec. Co. v. EPA, 53 F.3d 1324, 1329 (DC Cir. 1995))). 29 See Truth in Caller ID Act; 47 U.S.C. § 227(e)(8)(C). 30 See 47 C.F.R. § 9.3 which defines “Interconnected VoIP Service” and states: (continued….) Federal Communications Commission FCC 11-41 8 the one set forth in the Commission’s regulations might allow other interpretations, the Act’s specific reference to the Commission’s rule defining interconnected VoIP service indicates that Congress intended the scope of the caller ID spoofing prohibition to track the Commission’s definition of interconnected VoIP service. Consequently, the proposed rules use the term “Interconnected VoIP service” and specify that it has the same meaning given the term “Interconnected VoIP service” in 47 C.F.R. § 9.3 as it currently exists or may hereafter be amended. We seek comment on this proposal. The Department of Justice (DOJ) has suggested that the Commission could instead model a definition of IP- enabled voice service on the definition of that term in 18 U.S.C. § 1039(h)(4).31 DOJ’s proposed definition is broader than the Commission’s and would not require the user to have a broadband connection, and would not require that users be able to originate traffic to and terminate traffic from the public switched telephone network. We seek comment on DOJ’s suggestion, and on other suggestions for defining “IP-Enabled Voice Services,” including the advantages and disadvantages of adopting a particular definition. Commenters should also explain how such an interpretation is in accord with the reference to 47 C.F.R. § 9.3 in the statute. 16. We propose defining “Caller Identification Information” to mean “information provided by a caller identification service regarding the telephone number of, or other information regarding the origination of, a call made using a telecommunications service or interconnected VoIP service,” and defining “Caller Identification Service” to mean “any service or device designed to provide the user of the service or device with the telephone number of, or other information regarding the origination of, a call made using a telecommunications service or interconnected VoIP service. Such term includes automatic number identification services.” Our proposed rules adopt the definitions in the Act, except that, as described above, the proposed definitions use the term “interconnected VoIP services” instead of “IP-enabled voice services.”32 17. We seek comment on whether the definitions of “Caller Identification Information” and “Caller Identification Service” in the proposed rules are sufficiently clear. Are there services other than traditional caller ID services (i.e., services that terminating carriers and Interconnected VoIP provide to their subscribers) that are, or should be, included within the definition of “Caller Identification Service”? For example, spoofing caller identification information transmitted to emergency services providers is a particularly dangerous practice, and one which Congress was particularly concerned about when (Continued from previous page) An Interconnected Voice over Protocol Service (VoIP) is a service that: (1) Enables real-time, two-way voice communications; (2) Requires a broadband connection from the user’s location; (3) Requires Internet protocol-compatible customer premises equipment (CPE); and (4) Permits users generally to receive calls that originate on the public switched telephone network and to terminate calls to the public switched telephone network. 31 DOJ Jan. 26, 2011 Letter at 4-5. 18 U.S.C. § 1039(h)(4) defines IP-enabled voice service to mean: the provision of real-time voice communications offered to the public, or such class of users as to be effectively available to the public, transmitted through customer premises equipment using TCP/IP protocol, or a successor protocol, (whether part of a bundle of services or separately) with interconnection capability such that the service can originate traffic to, or terminate traffic from, the public switched telephone network, or a successor network. 32 See discussion supra para. 15. Federal Communications Commission FCC 11-41 9 adopting the Truth in Caller ID Act.33 Should the delivery of caller identification information to E911 public safety answering points, which use ANI to look up the caller’s name and location information on emergency calls, be considered a type of “Caller Identification Service” for purposes of our rules? What are the benefits and drawbacks to including information about calling parties provided to E911 public safety answering points as “Caller Identification Information?” 18. The term “Caller Identification Service” in the Act explicitly includes “automatic number identification services.” Our current rules relating to the delivery of CPN services define ANI as the “delivery of the calling party’s billing number by a local exchange carrier to any interconnecting carrier for billing or routing purposes, and to the subsequent delivery of such number to end users.34 We seek comment on whether we should use a different definition of ANI for purposes of the Truth in Caller ID Act.35 In particular, should we include in the proposed rules a definition of ANI that encompasses charge party numbers delivered by interconnected VoIP providers? What are the consequences of referencing automatic number identification services in the definition of “Caller Identification Service”, but not in the definition of “Caller Identification Information”? 19. The Act and proposed rules define “Caller Identification Information” and “Caller Identification Service” to include “the telephone number of, or other information regarding the origination of, a call.” We propose to define “information regarding the origination” to mean any: (i) telephone number; (ii) portion of a telephone number, such as an area code; (iii) name; (iv) location information; or (v) other information regarding the source or apparent source of a telephone call. We seek comment on this proposed definition. Are there other things that should be included in the definition? For example, should the definition explicitly reference information transmitted in the SS7 Jurisdiction Information Parameter (JIP) code that provides information about the location of a caller who has ported his number or is calling over a mobile service? Does the proposed definition provide sufficient clarity about what is included? 20. The Act is directed at “any person,” but does not define the term “person.” In order to make clear that the rules are not limited to natural persons and to be consistent with the Commission’s current rules concerning the delivery of CPN,36 the proposed amendments to the CPN rules use the phrase any “person or entity.” By contrast, the proposed amendments to the Commission’s forfeiture rules use the term “person” in order to be consistent with the use of the term “person” in the forfeiture rules. In both cases, we intend for the entities covered to be those that are considered to be a “person” under the definition of “person” in the Communication Act.37 We seek comment on this approach. Should we, consistent with our stated intent, incorporate the Communications Act definition of person in both rules 33 See Senate Commerce Committee Report at 2. 34 47 C.F.R. § 64.1601(b). 35 Although ANI’s original purpose was to enable carriers to bill customers for calls, carriers now offer ANI services to their business customers who use ANI services for a wide range of purposes including improving customer service provided on in-bound calls by pulling up customer-specific information based on identification of the billing number. 36 47 C.F.R. § 64.1601(e). 37 47 U.S.C. § 153(32) (“The term ‘person’ includes an individual, partnership, association, joint-stock company, trust or corporation.”). Federal Communications Commission FCC 11-41 10 rather than use different terminology in each rule? We also seek comment on whether the Commission should exclude any class of persons or entities from the definition of “person” and if so, whom should we exclude? Should the same rules apply to individuals and businesses? We also seek comment on whether there are other terms that should be defined in the Commission’s implementing regulations. 21. Third-Party Spoofing Services. As discussed above, there are numerous third-party providers of caller ID spoofing services, which can make it easy for callers to engage in caller ID spoofing.38 Third-party spoofing services can facilitate lawful and legitimate instances of caller ID manipulation as well as unlawful and illegitimate caller ID manipulation. DOJ has urged us to consider adopting rules requiring “public providers of caller ID spoofing services to make a good-faith effort to verify that a user has the authority to use the substituted number, such as by placing a one-time verification call to that number.”39 We invite comment on whether we may, and should, adopt rules imposing obligations on providers of caller ID spoofing services when they are not themselves acting with intent to defraud, cause harm, or wrongfully obtain anything of value. For example, are there reporting or record-keeping requirements that we can and should impose on third-party spoofing services that would assist the Commission in preventing callers from knowingly spoofing caller identification information with intent to defraud, cause harm, or wrongfully obtain anything of value or that would assist the Commission in identifying callers who engage in such practices? 40 We also seek comment on DOJ’s specific proposal relating to providers of caller ID spoofing services, and more broadly on what rules we can adopt to discourage or prevent caller ID spoofing services from enabling or facilitating unlawful conduct. If a third-party provider knows or has reason to believe that a caller is seeking to use the caller ID spoofing service for impermissible purposes, should the third party be held liable, or have a duty to report its concerns to the Commission? To what extent does the Commission’s jurisdiction allow the Commission to impose obligations on third-party providers? How would DOJ’s proposal, or other possible approaches to address third-party services that may facilitate unlawful activity, affect the callers that use third-party services for permissible purposes? 22. Exemptions. The Act directs the Commission to exempt from its regulations: (i) any authorized activity of a law enforcement agency; and (ii) court orders that specifically authorize the use of caller identification manipulation.41 The Act also makes clear that it “does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State or a political subdivision of a State, or of an intelligence agency of the United States.”42 The proposed rules therefore incorporate the two exemptions specified in the Act, and expand the exemption for law enforcement activities to cover protective and intelligence activities. We seek comment on this proposal. 23. The Act gives the Commission authority to adopt additional exemptions to the prohibition on 38 See supra para. 5. 39 DOJ Jan. 26, 2011 Letter at 4. 40 The current set of proposed rules does not impose record-keeping obligations on third-party providers. Should the Commission adopt rules imposing such obligations on third-party providers of caller ID spoofing services, the Commission would conduct the appropriate Paperwork Reduction Act analysis at that time. 41 See Truth in Caller ID Act, 47 U.S.C. § 227(e)(3)(ii). 42 Id. § 227(e)(7). Federal Communications Commission FCC 11-41 11 using caller ID spoofing as the Commission determines appropriate.43 Therefore, we also seek comment on whether we should adopt any additional exemptions. Do carriers or interconnected VoIP providers engage in legitimate conduct that could be implicated by the proposed rules? For example, in many instances, the carrier or provider merely transmits the caller ID information it receives from another carrier, provider, or customer. Should the Commission expressly exempt carrier or provider conduct under these circumstances, even if the information conveyed is not accurate? Should the Commission more generally exempt conduct by carriers or interconnected VoIP providers that is necessary to provide services to their customers? The Act exempts authorized activity of law enforcement agencies and court orders that specifically authorize the use of caller identification manipulation. Should the proposed rules also exempt conduct by carriers or interconnected VoIP providers that is authorized or required by law? Are any such exemptions for carriers and interconnected VoIP providers necessary, given the Act’s requirement that a violation involve intent to defraud, cause harm, or wrongfully obtain anything of value? 24. Some caller identification manipulation services allow customers to select which caller identification information is displayed. Likewise, certain services—such as pick-your-own-area-code— enable customers to select phone numbers that are not geographically associated with their location, and thus are potentially misleading with respect to the “origination of” calls by such persons. Does the Commission need to adopt an exemption to avoid stifling innovative new services, such as call back services, or services that involve manipulation of area codes or location? 25. Caller ID Blocking. The Truth in Caller ID Act specifies that it is not intended to be construed to prevent or restrict any person from blocking the transmission of caller identification information.44 The legislative history shows that Congress intended to protect subscribers’ ability to block the transmission of their own caller identification information to called parties.45 Therefore, the proposed rules provide that a person or entity that blocks or seeks to block a caller identification service from transmitting or displaying that person or entity’s own caller identification information shall not be liable for violating the Commission’s Truth in Caller ID Act implementing rules. We seek comment on whether the proposed rules appropriately implement this provision of the Act. 26. Although our rules generally allow callers to block caller ID, telemarketers are not allowed to do so.46 Telemarketers are required to transmit caller identification information, and the phone number they transmit must be one that a person can call to request placement on a company-specific do-not-call list.47 This requirement benefits consumers and law enforcement.48 It allows consumers to more easily identify incoming telemarketing calls and to make informed decisions about whether to answer particular 43 Id. § 227(e)(3)(B)(i). 44 Id. § 227(e)(2). 45 See Senate Commerce Committee Report at 3 (“FCC regulations currently provide callers with the right to block the capability of any caller identification service to transmit caller identification information. This bill makes clear that it would not prevent or restrict persons from blocking services this way.”). 46 47 C.F.R. § 1601(e)(2) 47 Id. § 1601(e)(1). 48 See Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991, CG Docket No. 02- 278, Report and Order, 18 FCC Rcd 14014, para. 179 (2003). Federal Communications Commission FCC 11-41 12 calls. It also facilitates consumers’ ability to request placement on company-specific do-not-call lists. The requirement also assists law enforcement investigations into telemarketing complaints. Therefore, our proposed rules specify that they “do not relieve any person or entity that engages in telemarketing, as defined in section 64.1200(f)(10), of the obligation to transmit caller identification information under section 64.1601(e).” We seek comment on this provision of the proposed rules. 27. Some entities – often the same ones that offer spoofing services – also offer the ability to unmask a blocked number, effectively stripping out the privacy indicator chosen by the calling party.49 Are there ways that carriers and interconnected VoIP providers can prevent third parties from overriding calling parties’ privacy choice? If so, would it be appropriate for the Commission to impose such obligations? What is the scope of the Commission’s legal authority to address this practice? Commenters that support amending our rules should identify specific rule changes that will prevent these practices while ensuring that consumers’ privacy preferences are respected. 28. Finally, we seek comment on the benefits and burdens, including the burdens on small entities, of adopting the proposed rules implementing the provisions of the Truth in Caller ID Act. Are there any other considerations the Commission should take into account as it evaluates rules to implement the Act? B. Enforcement Issues 29. The Truth in Caller ID Act provides for additional forfeiture penalties for violations of subsection 227(e) of the Communications Act, and new procedures for imposing and recovering such penalties.50 In order to implement the forfeiture provisions of the Truth in Caller ID Act, we propose modifications to the Commission’s forfeiture rules.51 We seek comment on the proposed amendments to our forfeiture rules and on some additional issues relating to enforcement of the Truth in Caller ID Act. 30. Amount of Penalties. The Act specifies that the penalty for a violation of the Act “shall not exceed $10,000 for each violation, or 3 times that amount for each day of a continuing violation, except that the amount assessed for any continuing violation shall not exceed a total of $1,000,000 for any single act or failure to act.”52 These forfeitures are in addition to penalties provided for elsewhere in the Communications Act.53 Thus the Truth in Caller ID Act establishes the maximum amount of additional forfeiture the Commission can assess for a violation of the Act, but it does not specify how the Commission should determine the forfeiture amount in any particular situation. Therefore, we propose to amend section 1.80(b) of our rules to include a provision specifying the maximum amount of the additional fines that can be assessed for violations of the Truth in Caller ID Act. We also propose to employ the balancing factors we typically use to inform the amount of a forfeiture, which are set forth in section 503(b)(2)(E) of the Communications Act and section 1.80(b)(4) of the Commission’s rules. The balancing factors include “the nature, circumstances, extent, and gravity of the violation, and, with respect to the violator, the degree of culpability, any history of prior offenses, ability to pay, and such 49 See, e.g., www.trapcall.com. 50 47 U.S.C. § 227(e)(5). 51 47 C.F.R. § 1.80. 52 47 U.S.C. § 227(e)(5)(i). 53 Id. Federal Communications Commission FCC 11-41 13 other matters as justice may require.”54 We seek comment on these proposals. 31. Procedure for Determining Penalties. With respect to the procedure for determining or imposing a penalty, the Act provides that “[a]ny person that is determined by the Commission, in accordance with paragraphs (3) and (4) of section 503(b) [of the Communications Act], to have violated this subsection shall be liable to the United States for a forfeiture penalty.”55 It also states that “[n]o forfeiture penalty shall be determined under clause (i) against any person unless such person receives the notice required by section 503(b)(3) or section 503(b)(4) [of the Communications Act].”56 Taken together, sections 503(b)(3) and 503(b)(4) allow the Commission to impose a forfeiture penalty against a person through either a hearing or a written notice of apparent liability (NAL), subject to certain procedures. The Truth in Caller ID Act makes no reference to Section 503(b)(5) of the Communications Act, which states that the Commission may not assess a forfeiture under any provision of section 503(b) against any person, who: (i) “does not hold a license, permit, certificate, or other authorization issued by the Commission;” (ii) “is not an applicant for a license, permit, certificate, or other authorization issued by the Commission;” or (iii) is not “engaging in activities for which a license, permit, certificate, or other authorization is required,” unless the Commission first issues a citation to such person in accordance with certain procedures.57 That omission suggests that Congress intended to give the Commission the authority to proceed expeditiously to stop and, where appropriate, assess a forfeiture against, unlawful caller ID spoofing by any person or entity engaged in that practice without first issuing a citation.58 Therefore, we propose rules that allow the Commission to determine or impose a forfeiture penalty for a violation of section 227(e) against “any person,” regardless of whether that person holds a license, permit, certificate, or other authorization issued by the Commission; is an applicant for any of the identified instrumentalities; or is engaged in activities for which one of the instrumentalities is required. We propose to clarify that the citation-first requirements in the Commission’s rules do not apply to penalties imposed for violations of the Truth in Caller ID Act. We invite comment on this interpretation of the relationship between the Truth in Caller ID Act and section 503(b)(5) of the Communications Act. 32. In contrast to section 503(b)(1)(B) of the Communications Act, which provides for a forfeiture penalty against anyone who has “willfully or repeatedly” failed to comply with any provisions of the Communications Act, or any regulations issued by the Commission under the Act, the Truth in Caller ID Act does not require “willful” or “repeated” violations to justify imposition of a penalty. Therefore, we propose to amend section 1.80(a) of our rules to add a new subsection (4) providing that forfeiture penalties may be assessed against any person found to have “violated any provision of section 227(e) or 54 See id. § 503(b)(2)(E). 55 Id. § 227(e)(5)(i). By “subsection,” the Act is referring to subsection (e) of 47 U.S.C. § 227. 56 Id. § 227(e)(5)(iii). 57 See id. § 503(b)(5). 58 See generally Senate Commerce Committee Report at 1-3. The Senate Commerce Committee Report discusses the harm caused by caller ID spoofing engaged in by individuals and specifies that, if passed, the Act would authorize civil penalties of up to $10,000 for each violation or up to three times that amount for each day of a continuing violation, up to a total of $1 million. Federal Communications Commission FCC 11-41 14 of the rules issued by the Commission under that section of the Act.”59 We seek comment on that proposal. 33. Statute of Limitations. The Truth in Caller ID Act specifies that “[n]o forfeiture penalty shall be determined or imposed against any person under [section 227(e)(5)(i)] if the violation charged occurred more than 2 years prior to the date of issuance of the required notice or notice of apparent liability.”60 This statute differs from the one in section 403(b)(6) of the Communications Act, which provides for a one-year statute of limitations. We propose to adopt a two-year statute of limitations for taking action on violations of the Truth in Caller ID Act. We seek comment on this proposal. 34. Miscellaneous. We also take this opportunity to revise the undesignated paragraph in section 1.80(a) to address issues not directly related to implementation of the Truth in Caller ID Act and to redesignate that undesignated text as “Note to paragraph 1.80(a).” With respect to the proposed revisions, first, in order to ensure that the language in the rule encompasses the language used in all of the statutory provisions, we propose amending the rule to say that the forfeiture amounts set forth in section 1.80(b) are inapplicable “to conduct which is subject to a forfeiture penalty or fine” under the various statutory provisions listed. (Emphasis added.) Second, we propose changing the references to sections 362(a) and 362(b) to sections 364(a) and 364(b) in order that the statutory provision references match those used in the Communications Act, rather than the U.S. Code. (Section 364 of the Communications Act is codified as 47 U.S.C. § 362.) Third, we propose deleting section 503(b) from the list of statutory provisions to which the forfeiture amounts in section 1.80(b) do not apply, because the inclusion was error; section 1.80(b) implements the forfeiture amounts of section 503(b), and so the penalties set forth in section 1.80(b) apply to forfeiture under section 503(b). We seek comment on these proposed changes to the Commission’s forfeiture rules. IV. REPORT 35. The Truth in Caller ID Act requires the Commission to issue a report to Congress within six months of the law’s enactment on “whether additional legislation is necessary to prohibit the provisions of inaccurate caller identification information in technologies that are successor or replacement technologies to telecommunications services or IP-enabled voice services.”61 We seek comment on which technologies parties anticipate will be successor or replacement technologies to telecommunications services or IP-enabled voice services. We also seek comment on the provision of inaccurate caller ID information with respect to such technologies, and whether the Commission will need additional authority to address concerns about caller ID spoofing associated with such successor or replacement technologies. In particular, we seek comment on communications services that are not interconnected with the public switched telephone network. In addition, we seek comment on whether there are other issues that we should include in our report to Congress. 59 In order to find someone in violation of section 227(e) of the Communications Act, the Commission will need to find that the person engaged in caller ID spoofing with intent to “defraud, cause harm, or wrongfully obtain anything of value.” See discussion supra para. 12. 60 47 U.S.C. § 227(e)(5)(iv). 61 Truth in Caller ID Act; 47 U.S.C. § 227(e)(4). Federal Communications Commission FCC 11-41 15 V. PROCEDURAL MATTERS A. Paperwork Reduction Act 36. This document does not contain proposed information collection(s) subject to the Paperwork Reduction Act of 1995 (PRA), Public Law 104-13. In addition, therefore, it does not contain any new or modified information collection burdens for small business concerns with fewer than 25 employees, pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107-198, see 44 U.S.C. 3506(c)(4). B. Regulatory Flexibility 37. As required by the Regulatory Flexibility Act of 1980, as amended, the Commission has prepared an Initial Regulatory Flexibility Analysis (IRFA) for this notice of proposed rulemaking, of the possible significant economic impact on a substantial number of small entities by the policies and rules proposed in this notice of proposed rulemaking. The IRFA is in Appendix B. Written public comments are requested on this IRFA. Comments must be identified as responses to the IRFA and must be filed by the deadlines for comments on the notice of proposed rulemaking. The Commission will send a copy of the notice of proposed rulemaking, including this IRFA, to the Chief Counsel for Advocacy of the SBA. In addition, the notice of proposed rulemaking and IRFA (or summaries thereof) will be published in the Federal Register. C. Ex Parte Presentations 38. This proceeding shall be treated as a “permit-but-disclose” proceeding in accordance with the Commission’s ex parte rules. Persons making oral ex parte presentations are reminded that memoranda summarizing the presentations must contain summaries of the substance of the presentations and not merely a listing of the subjects discussed. More than a one or two sentence description of the views and arguments presented is generally required. Other requirements pertaining to oral and written presentations are set forth in section 1.1206(b) of the Commission’s rules. D. Comment Filing Procedures 39. Pursuant to sections 1.415 and 1.419 of the Commission’s rules, 47 C.F.R. §§ 1.415, 1.419, interested parties may file comments and reply comments on or before the dates indicated on the first page of this document. All pleadings are to reference WC Docket No. 11-39. Comments may be filed using: (1) the Commission’s Electronic Comment Filing System (ECFS), (2) the Federal Government’s eRulemaking Portal, or (3) by filing paper copies. o Electronic Filers: Comments may be filed electronically using the Internet by accessing the ECFS: http://fjallfoss.fcc.gov/ecfs2/. o Paper Filers: Parties who choose to file by paper must file an original and four copies of each filing. If more than one docket or rulemaking number appears in the caption of this proceeding, filers must submit two additional copies for each additional docket or rulemaking number. 40. Filings can be sent by hand or messenger delivery, by commercial overnight courier, or by first-class or overnight U.S. Postal Service mail. All filings must be addressed to the Commission’s Secretary, Office of the Secretary, Federal Communications Commission. 41. All hand-delivered or messenger-delivered paper filings for the Commission’s Secretary must be delivered to FCC Headquarters at 445 12th Street, S.W., Room TW-A325, Washington, D.C. 20554. Federal Communications Commission FCC 11-41 16 All hand deliveries must be held together with rubber bands or fasteners. Any envelopes must be disposed of before entering the building. The filing hours are 8:00 a.m. to 7:00 p.m. Commercial overnight mail (other than U.S. Postal Service Express Mail and Priority Mail) must be sent to 9300 East Hampton Drive, Capitol Heights, MD 20743. U.S. Postal Service first-class, Express, and Priority mail must be addressed to 445 12th Street, S.W., Washington D.C. 20554. 42. People with Disabilities: To request materials in accessible formats for people with disabilities (Braille, large print, electronic files, audio format), send an e-mail to fcc504@fcc.gov or call the Consumer & Governmental Affairs Bureau at (202) 418-0530 (voice), (202) 418-0432 (tty). 43. Parties should send a copy of each filing to the Competition Policy Division, Wireline Competition Bureau, Federal Communications Commission, 445 12th Street, SW, Washington, D.C. 20554, or by e-mail to CPDcopies@fcc.gov. Parties shall also serve one copy with the Commission’s copy contractor, Best Copy and Printing, Inc. (BCPI), Portals II, 445 12th Street, SW, Room CY-B402, Washington, D.C. 20554, (202) 488-5300, or via e-mail to fcc@bcpiweb.com. 44. Filings and comments will be available for public inspection and copying during regular business hours at the FCC Reference Information Center, Portals II, 445 12th Street, S.W., Room CY- A257, Washington, D.C. 20554. They may also be purchased from the Commission’s duplicating contractor, Best Copy and Printing, Inc., Portals II, 445 12th Street, S.W., Room CY-B402, Washington, D.C. 20554, telephone: (202) 488-5300, fax: (202) 488-5563, or via e-mail www.bcpiweb.com. E. Contact Persons 45. For further information about this rulemaking proceeding, please contact Lisa Hone, Competition Policy Division, Wireline Competition Bureau at (202) 418-1580. VI. ORDERING CLAUSES 46. Accordingly, IT IS ORDERED that, pursuant to section 2 of the Truth in Caller ID Act of 2009, Pub. L. No. 11-331, and Sections 1, 4(i), 4(j), 227, and 303(r) of the Communications Act of 1934, as amended, 47 U.S.C. §§ 151, 154(i), 154(j), 227 and 303 (r), this Notice, with all attachments, IS ADOPTED. 47. IT IS FURTHER ORDERED that the Commission’s Consumer and Governmental Affairs Bureau, Reference Information Center, SHALL SEND a copy of this Notice of Proposed Rulemaking, including the Initial Regulatory Flexibility Analysis, to the Chief Counsel for Advocacy of the Small Business Administration. FEDERAL COMMUNICATIONS COMMISSION Marlene H. Dortch Secretary Federal Communications Commission FCC 11-41 17 Appendix A Proposed Rules For the reasons discussed in the preamble, the Federal Communications Commission proposes to amend 47 CFR parts 1 and 64 as follows: PART I – PRACTICE AND PROCEDURE 1. The authority citation for part 1, of Title 47 of the Code of Federal Regulation is revised to read as follows: Authority: 15 U.S.C. 79 et seq; 47 U.S.C. 151, 154(i), 154(j), 155, 157, 225, 227, 303(r), and 309. § 1.80 [Amended] 2. Amend section 1.80 as follows: a. Designate the undesignated paragraph following (a)(4) as “Note to Paragraph (a)” and revise it; b. Redesignate paragraphs (a)(4), (b)(3), (b)(4), (b)(5), and (c)(3), as paragraphs (a)(5), (b)(4), (b)(5), (b)(6), and (c)(4), respectively; c. Redesignate “Note to Paragraph (b)(4)” as “Note to paragraph (b)(5)”; d. Add new paragraphs (a)(4), (b)(3), and (c)(3); e Revise redesignated paragraph (b)(4); and f. Revise paragraph (d). § 1.80 Forfeiture proceedings. (a) * * * (4) Violated any provision of section 227(e) of the Communications Act or of the rules issued by the Commission under section 227(e) of the Act; or Note to paragraph (a): A forfeiture penalty assessed under this section is in addition to any other penalty provided for by the Communications Act, except that the penalties provided for in paragraphs (b)(1), (b)(2), (b)(3), (b)(4) of this section shall not apply to conduct which is subject to a forfeiture penalty or fine under sections 202(c), 203(e), 205(b), 214(d), 219(b), 220(d), 223(b), 364(a), 364(b), 386(a), 386(b), 506, and 634 of the Communications Act. The remaining provisions of this section are applicable to such conduct. (b) * * * Federal Communications Commission FCC 11-41 18 (3) Any person determined to have violated section 227(e) of the Communications Act or of the rules issued by the Commission under section 227(e) of the Communications Act shall be liable to the United States for a forfeiture penalty of not more than $10,000 for each violation or three times that amount for each day of a continuing violation, except that the amount assessed for any continuing violation shall not exceed a total of $1,000,000 for any single act or failure to act. Such penalty shall be in addition to any other forfeiture penalty provided for by the Communications Act. (4) In any case not covered by paragraphs (b)(1), (b)(2) or (b)(3) of this section, the amount of any forfeiture penalty determined under this section shall not exceed $16,000 for each violation or each day of a continuing violation, except that the amount assessed for any continuing violation shall not exceed a total of $112,500 for any single act or failure to act described in paragraph (a) of this section. * * * * * (c) * * * (3) In the case of a forfeiture imposed under section 227(e), no forfeiture will be imposed if the violation occurred more than 2 years prior to the date on which the appropriate notice is issued. (d) Preliminary procedure in some cases; citations. Except for a forfeiture imposed under subsection 227(e)(5) of the Act, no forfeiture penalty shall be imposed upon any person under this section of the Act if such person does not hold a license, permit, certificate, or other authorization issued by the Commission, and if such person is not an applicant for a license, permit, certificate, or other authorization issued by the Commission, unless, prior to the issuance of the appropriate notice, such person: (1) Is sent a citation reciting the violation charged; (2) Is given a reasonable opportunity (usually 30 days) to request a personal interview with a Commission official, at the field office which is nearest to such person’s place of residence; and (3) Subsequently engages in conduct of the type described in the citation. However, a forfeiture penalty may be imposed, if such person is engaged in (and the violation relates to) activities for which a license, permit, certificate, or other authorization is required or if such person is a cable television operator, or in the case of violations of section 303(q), if the person involved is a nonlicensee tower owner who has previously received notice of the obligations imposed by section 303(q) from the Commission or the permittee or licensee who uses that tower. Paragraph (c) of this section does not limit the issuance of citations. When the requirements of this paragraph have been satisfied with respect to a particular violation by a particular person, a forfeiture penalty may be imposed upon such person for conduct of the type described in the citation without issuance of an additional citation. * * * * * Federal Communications Commission FCC 11-41 19 PART 64 – MISCELLANEOUS RULES RELATING TO COMMON CARRIERS 3. The authority citation for Part 64 is revised to read as follows: Authority: 47 U.S.C. 154, 254(k), 227; secs. 403(b)(2)(B), (c), Pub. L. 104-104, 100 Stat. 56. Interpret or apply 47 U.S.C. 201, 218, 222, 225, 226, 207, 228, and 254(k) unless otherwise noted. 4. Section 64.1600 is amended by redesignating paragraphs (c), (d), (e) and (f) as paragraphs (e), (f), (i) and (j) respectively and by adding new paragraphs (c), (d), (g), and (h) to read as follows: § 64.1600 Definitions * * * * * (c) Caller identification information. The term “Caller identification information” means information provided by a caller identification service regarding the telephone number of, or other information regarding the origination of, a call made using a telecommunications service or interconnected VoIP service. (d) Caller identification service. The term “Caller identification service” means any service or device designed to provide the user of the service or device with the telephone number of, or other information regarding the origination of, a call made using a telecommunications service or interconnected VoIP service. Such term includes automatic number identification services. * * * * * (g) Information regarding the origination. The term “Information regarding the origination” means any: (1) Telephone number; (2) Portion of a telephone number, such as an area code; (3) Name; (4) Location information; or (5) Other information regarding the source or apparent source of a telephone call (h) Interconnected VoIP service. The term “Interconnected VoIP service” has the same meaning given the term “Interconnected VoIP service” in 47 CFR 9.3 as it currently exists or may hereafter be amended. * * * * * 5. Section 64.1604 is redesignated as section 64.1605, and a new section 64.1604 is added to read as follows: § 64.1604 Prohibition on transmission of inaccurate or misleading caller identification information. (a) No person or entity in the United States, shall, with the intent to defraud, cause harm, or wrongfully obtain anything of value, knowingly cause, directly or indirectly, any caller Federal Communications Commission FCC 11-41 20 identification service to transmit or display misleading or inaccurate caller identification information. (b) Exemptions. Paragraph (a) of this section shall not apply to: (1) Lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States; or (2) Activity engaged in pursuant to a court order that specifically authorizes the use of caller identification manipulation. (c) A person or entity that blocks or seeks to block a caller identification service from transmitting or displaying that person or entity’s own caller identification information shall not be liable for violating the prohibition in paragraph (a) of this section. This subsection does not relieve any person or entity that engages in telemarketing, as defined in § 64.1200(f)(10) of the obligation to transmit caller identification information under § 64.1601(e). Federal Communications Commission FCC 11-41 21 APPENDIX B Initial Regulatory Flexibility Analysis 1. As required by the Regulatory Flexibility Act (RFA),1 the Commission has prepared this Initial Regulatory Flexibility Analysis (IRFA) of the possible significant economic impact on small entities by the policies and rules proposed in this Notice of Proposed Rule Making (NPRM). Written public comments are requested on this IRFA. Comments must be identified as responses to the IRFA and must be filed by the deadlines for comments provided in this NPRM. The Commission will send a copy of this NPRM, including this IRFA, to the Chief Counsel for Advocacy of the Small Business Administration (SBA).2 In addition, the NPRM and IRFA (or summaries thereof) will be published in the Federal Register.3 A. Need for, and Objectives of, the Proposed Rules 2. The Truth in Caller ID Act of 2009 (Truth in Caller ID Act, or Act) was enacted on December 22, 2010.4 The Act prohibits anyone in the United States from causing any caller identification service to knowingly transmit misleading or inaccurate caller ID information with the intent to defraud, cause harm, or wrongfully obtain anything of value.5 The Truth in Caller ID Act requires the Commission to issue implementing regulations within six months of the law’s enactment.6 It also requires the Commission, by the same date, to submit a report to Congress on “whether additional legislation is necessary to prohibit the provision of inaccurate caller identification information in technologies that are successor or replacement technologies to telecommunications services or IP-enabled voice services.”7 The NPRM proposes to (i) add a new section and new definitions to the Commission’s current rules governing Calling Party Number (CPN) services, 47 C.F.R. § 64.1600 et seq., and (ii) enhance the Commission’s forfeiture rules, 47 C.F.R. § 1.80. 3. The proposed additions to the Commission’s CPN rules are modeled on the Act’s prohibition against engaging in caller ID spoofing with fraudulent or harmful intent. The proposed rules would prohibit any person or entity in the United States, with the intent to defraud, cause harm, or wrongfully obtain anything of value, from knowingly causing, directly or indirectly, any caller identification service to transmit or display misleading or inaccurate caller identification information. The Act directs the Commission to exempt from its regulations: (i) any authorized activity of a law enforcement agency; and 1 See 5 U.S.C. § 603. The RFA, see 5 U.S.C. § 601 et seq., has been amended by the Contract With America Advancement Act of 1996, Pub. L. No. 104-121, 110 Stat. 847 (1996) (CWAAA). Title II of the CWAAA is the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA). 2 See 5 U.S.C. § 603(a). 3 See id. 4 Truth in Caller ID Act of 2009, Pub. L. No. 111-331, codified at 47 U.S.C. § 227(e). 5 See 47 U.S.C. § 227(e)(1). 6 Id. § 227(e)(3). President Obama signed the Act into law on December 22, 2010. 7 47 U.S.C. § 227(e)(4). Federal Communications Commission FCC 11-41 22 (ii) court orders that specifically authorize the use of caller identification manipulation.8 The Act also makes clear that it “does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State or a political subdivision of a State, or of an intelligence agency of the United States.”9 The proposed rules therefore incorporate the two exemptions specified in the Act, and expand the exemption for law enforcement activities to cover protective and intelligence activities. 4. The proposed amendments to the Commission’s forfeiture rules are intended to implement the penalties and procedures for imposing penalties provided for in the Act. The Act specifies that the penalty for a violation of the Act “shall not exceed $10,000 for each violation, or 3 times that amount for each day of a continuing violation, except that the amount assessed for any continuing violation shall not exceed a total of $1,000,000 for any single act or failure to act.”10 These forfeitures are in addition to penalties provided for elsewhere in the Communications Act.11 Therefore, the proposed amendments to section 1.80(b) of the Commission’s rules include a provision specifying the maximum amount of the additional fines that can be assessed for violations of the Truth in Caller ID Act. Also, consistent with the specifications of the Act, the proposed rules would allow the Commission to determine or impose a forfeiture penalty for a violation of section 227(e) against “any person,” regardless of whether that person holds a license, permit, certificate, or other authorization issued by the Commission; is an applicant for any of the identified instrumentalities; or is engaged in activities for which one of the instrumentalities is required. 5. The proposed rules do not impose recording keeping or reporting obligations on any entity. Paragraph 21 of the NPRM does, however, seek comment on whether the Commission can and should adopt rules imposing obligations on providers of caller ID spoofing services. The NPRM also seeks comment on whether there are ways that carriers and interconnected VoIP providers can prevent third parties from unmasking a blocked number and overriding calling parties’ privacy choice. B. Legal Basis 6. The proposed action is authorized under the Truth in Caller ID Act, Pub. L. No. 111-331, codified at 47 U.S.C. § 227(e), and Sections 1, 4(i), 4(j), and 303 of the Communications Act of 1934, as amended, 47 U.S.C. §§ 151, 154(i)-(j), and 303. C. Description and Estimate of the Number of Small Entities to Which the Proposed Rules Will Apply 7. The RFA directs agencies to provide a description of and, where feasible, an estimate of the number of small entities that may be affected by the proposed rules, if adopted.12 The RFA generally defines the term “small entity” as having the same meaning as the terms “small business” and “small 8 See Truth in Caller ID Act, 47 U.S.C. § 227(e)(3)(ii). 9 Id. § 227(e)(7). 10 Id. § 227(e)(5)(i). 11 Id. 12 5 U.S.C. § 603(b)(3). Federal Communications Commission FCC 11-41 23 organization.”13 In addition, the term “small business” has the same meaning as the term “small business concern” under the Small Business Act.14 A small business concern is one which: (1) is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the SBA.15 8. Small Business. Nationwide as of 2009, there are approximately 27.5 million small businesses, according to the SBA.16 9. Small Organizations. Nationwide as of 2002, there were approximately 1.6 million small organizations.17 A “small organization” is generally “any not-for-profit enterprise which is independently owned and operated and is not dominant in its field.” 10. The Small Businesses and Small Organizations that will be directly affected by the proposed rules are those that knowingly spoof caller ID with the intent to defraud, cause harm, or wrongfully obtain anything of value. We are not aware of any attempts to quantify the number of small businesses or organizations engaged in such practices, nor have we have identified a feasible way to quantify the number of such entities. 11. In addition to entities that spoof their caller identification information, there are entities that provide caller ID spoofing services – services that make it possible for callers to alter or modify the caller identification information that is displayed to call recipients by their caller ID services. We have not proposed rules that directly affect providers of caller ID spoofing services, however, paragraph 21 of the NPRM requests comment on whether the Commission can and should adopt rules imposing obligations on providers of caller ID spoofing services. We are not aware of any attempts to quantify the number of caller ID spoofing services and we have not identified a feasible way to quantify the number of such entities. D. Description of Projected Reporting, Recordkeeping, and Other Compliance Requirements 12. The proposed rules prohibit any person or entity acting with the intent to defraud, cause harm, or wrongfully obtain anything of value from knowingly causing a caller ID service to alter or manipulate caller ID information. That prohibition does not distinguish between large businesses and entities, small businesses and entities, or individuals. The NPRM does not propose rules that include any reporting or record keeping requirements. However, paragraph 21 of the NPRM does invite comment on whether the Commission can and should adopt rules imposing obligations, including record keeping and reporting 13 5 U.S.C. § 601(6). 14 5 U.S.C. § 601(3) (incorporating by reference the definition of “small business concern” in 15 U.S.C. § 632). Pursuant to the RFA, the statutory definition of a small business applies “unless an agency, after consultation with the Office of Advocacy of the Small Business Administration and after opportunity for public comment, establishes one or more definitions of such term which are appropriate to the activities of the agency and publishes such definition(s) in the Federal Register.” 5 U.S.C. § 601(3). 15 Small Business Act, 15 U.S.C. § 632 (1996). 16 See SBA, Office of Advocacy, “Frequently Asked Questions,” http://web.sba.gov/faqs/faqindex.cfm?areaID=24 (last visited Feb. 28, 2011). 17 Independent Sector, The New Nonprofit Almanac & Desk Reference (2002). Federal Communications Commission FCC 11-41 24 obligations, on providers of caller ID spoofing services when they are not themselves acting with intent to defraud, cause harm, or wrongfully obtain anything of value. Certain providers of caller ID spoofing services may be considered small businesses or small entities. E. Steps Taken to Minimize Significant Economic Impact on Small Entities, and Significant Alternatives Considered 13. The Truth in Caller ID Act, which prohibits anyone in the United States from causing any caller identification service to knowingly transmit misleading or inaccurate caller ID information with the intent to defraud, cause harm, or wrongfully obtain anything of value, does not distinguish between small entities and other entities and individuals. In paragraph 28 of the NPRM, the Commission has sought comment on the benefits and economically adverse burdens, including the burdens on small entities, of adopting the proposed rules implementing the provisions of the Truth in Caller ID Act. In addition the Commission seeks comment on the issue of reducing the economically adverse impact of the proposed rules on small entities, on alternatives to the proposed rules, and on alternative ways of implementing the proposed rules. F. Federal Rules that May Duplicate, Overlap, or Conflict with the Proposed Rules 14. None.