4 May 2001 Source: http://www.access.gpo.gov/su_docs/aces/fr-cont.html ------------------------------------------------------------------------- [Federal Register: May 4, 2001 (Volume 66, Number 87)] [Rules and Regulations] [Page 22446-22448] From the Federal Register Online via GPO Access [wais.access.gpo.gov] [DOCID:fr04my01-11] ----------------------------------------------------------------------- FEDERAL COMMUNICATIONS COMMISSION 47 CFR Part 64 [CC Docket No. 97-213; FCC 01-126] Communications Assistance for Law Enforcement Act AGENCY: Federal Communications Commission. ACTION: Final rule; petitions for reconsideration. ----------------------------------------------------------------------- SUMMARY: In this document the Commission responds to petitions for reconsideration of previous Commission decisions in this proceeding which implements the Communications Assistance for Law Enforcement Act (CALEA). The Commission makes minor revisions to the Commission's rules to clarify the arrangements telecommunications carriers subject to CALEA must make to ensure that law enforcement agencies can contact them when necessary, and to clarify the interception activity that triggers a record keeping requirement. The Commission makes additional clarifications without altering the rules, but otherwise denies the requests for reconsideration. DATES: Effective June 4, 2001. FOR FURTHER INFORMATION CONTACT: John Spencer or Susan Kimmel, 202-418- 1310. SUPPLEMENTARY INFORMATION: This is a summary of the Commission's Second Order on Reconsideration (Second Order) in CC Docket No. 97-213; FCC 01-126, adopted April 9, 2001, and released April 16, 2001. The complete text of this Second Order is available for inspection and copying during normal business hours in the FCC Reference Information Center, Courtyard Level, 445 12th Street, SW., Washington, DC, and also may be purchased from the Commission's copy contractor, International Transcription Services (ITS, Inc.), CY-B400, 445 12th Street, SW., Washington, DC. Synopsis of the Second Order on Reconsideration 1. This Second Order on Reconsideration (Second Order) resolves two petitions for reconsideration of the Report and Order (R&O) in this proceeding (64 FR 51462, September 23, 1999) and one petition for reconsideration of the Second Report and Order (Second R&O) in this proceeding (64 FR 55164, October 12, 1999). These decisions implemented sections 102, 105, and 301 of the Communications Assistance for Law Enforcement Act (CALEA) (Communications Assistance for Law Enforcement Act, Public Law 104-414, 108 Stat. 4279, 1994.) The Second Order makes minor revisions to 47 CFR 64.2103 and 64.2104 to clarify the arrangements telecommunications carriers subject to CALEA must make to ensure that law enforcement agencies can contact them when necessary, and the interception activity that triggers a record keeping requirement. The Second Order makes additional clarifications without altering the Commission's rules, but otherwise denies the requests for reconsideration. 2. The U.S. Department of Justice and the Federal Bureau of Investigation (FBI) seek stronger personnel security measures than those adopted in the First R&O, in order to ``ensure the trustworthiness of the private-company employees who have become increasingly responsible for implementing electronic surveillance.'' As discussed in paragraphs 4 through 14 of the Second Order, the Commission denies the FBI's request. However, the Commission encourages carriers to consider voluntarily adopting, as internal procedures, measures to respond to the concerns presented by the FBI, as appropriate, and making them part of their systems security and integrity (SSI) policies and procedures. 3. The FBI also proposes a requirement that carriers generate an automated message that would permit law enforcement agencies (LEAs) to confirm periodically that the software used to conduct an interception is working correctly and is accessing the equipment, facilities, or services of the correct subscriber. The Commission, as detailed in paragraphs 15 through 17 of the Second Order, similarly denies this proposal. In so doing, however, the Commission notes that ``there is nothing that would prevent carriers from providing this capability either on a voluntary basis or with compensation from LEAs.'' 4. The FBI next asks the Commission to modify the rules, adopted in the R&O requiring that carriers report acts of unauthorized electronic surveillance that occur on their premises and compromises of their SSI procedures involving the execution of electronic surveillance ``within a reasonable period of time upon discovery.'' The FBI recommends that the Commission modify the rule to require reporting ``as soon after discovery as is reasonable in light of privacy and safety concerns and the needs of law enforcement.'' The Commission, as indicated in paragraphs 18 through 20 of the Second Order, shares the FBI's concern about the importance of prompt reporting of systems security breaches and expects carriers to report breaches with due diligence and dispatch. However, in the absence of significant problems to date, the Commission declines to adopt additional factors to further define how quickly a carrier should report a security breach to law enforcement. 5. The FBI seeks modification of the Commission's record keeping requirement in 47 CFR 64.2104(a)(1), pertaining to the commencement of interceptions. Specifically, FBI argues that the current language could lead to interpretations when the circuit is open for the duration of ``multiple intercepts, the carrier's records of these various intercepts would all show the same `start date and time,' '' as opposed to recording individual interceptions. Thus, FBI asks the Commission to modify the phrase in Sec. 64.2104(a)(1) from ``date and time of the opening of the circuit'' to ``date and time at which the interception of communications or access to call identifying information was enabled.'' The Commission, in paragraphs 21 through 24 of the Second Order, grants the FBI's request and modifies the rules accordingly with slight modification. 6. The National Telephone Cooperative Association (NCTA) asks that the Commission clarify the language of 47 CFR 64.2103 ``to make it obvious that a single person in not responsible for being law enforcement's point of contact[for CALEA matters], 24 hours a day, 7 days a week.'' The Commission agrees with NCTA and, as indicated in paragraphs 25 through 28 of the Second Order, modifies Sec. 64.2102 accordingly. The Commission [[Page 22447]] additionally makes two other clarifications regarding carrier SSI policies and procedures. First, the Commission revises Sec. 64.2103 to require carriers to place their information regarding responsible personnel and contacts in a separate appendix to their SSI policies and procedures. Second, the Commission clarifies that it will routinely make available to law enforcement agencies the carriers' responsible personnel and contact information. Finally, as discussed in paragraph 31 of the Second, Order, the Commission declines to adopt other FBI proposals contained in its late-filed supplement. 7. The Commission, in paragraphs 32 through 34 of the Second Order, denies NCTA's request that the Commission exempt small, rural telephone companies from the requirement to file with the Commission the policies and procedures they use to comply with the systems security and integrity rules. The Commission notes that small entitities have the flexibility to tailor their policies and procedures to its own unique circumstances. 8. Finally, as discussed in paragraphs 35 through 38 of the Second Order, FBI, in its petition for reconsideration and/or clarification of the Second R&O asks the Commission to clarify carriers' responsibility for CALEA compliance in resale situations. The Second R&O held that as telecommunications carriers, resellers are generally subject to all provisions of CALEA, but that ``resellers' responsibility under CALEA should be limited to their own facilities.'' FBI is concerned that law enforcement might be effectively disabled from enforcing CALEA's assistance capability obligations in certain resale situations. The FBI asks that the Commission clarify either that (1) a carrier that sells telecommunications services to a reseller is itself a ``telecommunications carrier'' under CALEA with respect to such services; or (2) if an underlying facilities-based service provider is not a ``telecommunications carrier,'' the reseller remains responsible in full for ensuring that the telecommunications services it provides to the public, and the equipment and facilities involved in providing that service, are CALEA-compliant. The Second Order clarifies that the language in the Second R&O regarding resellers exempts them from CALEA to the extent that they resell services of other, facilities-based carriers. The Commission clarifies that that decision was premised on the obligations of the underlying facilities-based carriers to comply with CALEA. Thus, to the extent that a reseller resells services or relies on facilities or equipment of an entity that is not a telecommunications carrier for purposes of the CALEA and thus is not subject to CALEA's assistance capability requirements, the Commission did not intend to exempt the reseller from its overall obligation to ensure that its services satisfy all the assistance capability requirements of section 103. Final Regulatory Flexibility Act Certification 9. The First Report and Order in this proceeding incorporated a Final Regulatory Flexibility Analysis of the effect on small entities of the CALEA rules adopted at that time, and the Second Report and Order incorporated a Final Regulatory Flexibility Analysis of the effect on small entities of the actions taken therein, which did not include CALEA rules. The Regulatory Flexibility Act of 1980, as amended (RFA) requires that a regulatory flexibility analysis be prepared for rulemaking proceedings, unless the agency certifies that ``the rule will not have a significant economic impact on a substantial number of small entities.'' (The RFA, 5 U.S.C. 601 et seq., has been amended by the Contract With America Advancement Act of 1996, Public Law 104-121, 110 Stat. 847 (1996) (CWAAA). Title II of the CWAAA is the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA). The RFA generally defines ``small entity'' as having the same meaning as the terms ``small business,'' ``small organization,'' and ``small governmental jurisdiction.'' In addition, the term ``small business'' has the same meaning as the term ``small business concern'' under the Small Business Act. A small business concern is one which: (1) Is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the Small Business Administration. 10. This Second Order on Reconsideration does not make major revisions to the existing CALEA rules or enact new requirements, but does make minor revisions to 47 CFR 64.2103 and 64.2104. First, it clarifies the arrangements that telecommunications carriers subject to CALEA must make to ensure that law enforcement agencies can contact them when necessary, by requiring the use of a ``pull-off'' page for submitting contact information to the Commission. Second, it clarifies the definition of the interception activity that triggers a record keeping requirement. Neither change requires the collection of additional information or increases the frequency of record keeping, and the cost of complying with these revisions is nominal. Third, it clarifies without rule change that resellers are not exempt from the obligation to ensure that their services satisfy all the assistance capability requirements of section 103 of CALEA. As such, this action imposes no reporting, recordkeeping or other compliance requirement beyond those imposed by CALEA itself. Accordingly, the Commission certifies, pursuant to section 605(b), that the rule revisions adopted in this Second Order on Reconsideration will not have a significant economic impact on a substantial number of small entities. 11. The Commission will send a copy of the Second Order on Reconsideration, including a copy of this final certification, in a report to Congress pursuant to the Small Business Regulatory Enforcement Fairness Act of 1996. The Commission will also send a copy of the Second Order on Reconsideration, including this final certification, to the Chief Counsel for Advocacy of the Small Business Administration. Paperwork Reduction Act of 1995 Analysis 12. This Second Order does not contain a new information collection, but only requires a change of format for future submissions of a carrier's SSI filing. Specifically, as described in paragraph 24, and in conformance with revised Sec. 64.2103(b)(4) of the Commission's rules, 47 CFR 64.2103(b)(4), point of contact information must appear in a separate appendix attached to the SSI report. 13. This action is taken pursuant to sections 1, 2, 4(i) and (j), 201, 229, 303(f) and (r), and 332 of the Communications Act of 1934, as amended, 47 U.S.C. 151, 152, 154(i) and (j), 201, 229, 303(f) and (r), and 332. Ordering Clauses 14. Part 64 of the Commission's rules is amended. 15. The rule amendments made by this Second Order shall become effective June 4, 2001. It Is Further Ordered that the Consumer Information Bureau, Reference Operations Division, shall send a copy of this Second Order, including the Final Regulatory Flexibility Certification, to the Chief Counsel for Advocacy of the Small Business Administration. 16. The DOJ/FBI Motion to File Consolidated Reply to Oppositions to Petition for Reconsideration Exceeding Ten Pages in Length is granted. 17. The Motion for Acceptance of Supplemental Comments filed by the [[Page 22448]] Department of Justice/Federal Bureau of Investigation is granted. 18. The Petition for Reconsideration of section 105 Report and Order filed by the Department of Justice/Federal Bureau of Investigation is granted to the extent indicated herein, and is otherwise denied. 19. The Petition for Reconsideration and/or Clarification filed by the National Telephone Cooperative Association is granted to the extent indicated herein, and is otherwise denied. 20. The Petition for Reconsideration and/or Clarification filed by the Department of Justice/Federal Bureau of Investigation is granted to the extent indicated herein, and is otherwise denied. List of Subjects in 47 CFR Part 64 Communications common carriers, Reporting and recordkeeping requirements. Federal Communications Commission. Magalie Roman Salas, Secretary. Rule Changes For the reasons discussed in the preamble, the Federal Communications Commission amends 47 CFR part 64 as follows: PART 64--MISCELLANEOUS RULES RELATING TO COMMON CARRIERS 1. The authority citation for part 64 continues to read as follows: Authority: 47 U.S.C. 154, 47 U.S.C. 225, 47 U.S.C. 251(e)(1), 151, 154, 201, 202, 205, 218-220, 254, 302, 303, and 337, unless otherwise noted. Interpret or apply section 201, 218, 225, 226, 227, 229, 332, 48 Stat. 1070, as amended. 47 U.S.C. 201-204, 208, 225, 226, 227, 229, 332, 501 and 503 unless otherwise noted. 2. Section 64.2103 is revised to read as follows: Sec. 64.2103 Policies and procedures for employee supervision and control. A telecommunications carrier shall: (a) Appoint a senior officer or employee responsible for ensuring that any interception of communications or access to call-identifying information effected within its switching premises can be activated only in accordance with a court order or other lawful authorization and with the affirmative intervention of an individual officer or employee of the carrier. (b) Establish policies and procedures to implement paragraph (a) of this section, to include: (1) A statement that carrier personnel must receive appropriate legal authorization and appropriate carrier authorization before enabling law enforcement officials and carrier personnel to implement the interception of communications or access to call-identifying information; (2) An interpretation of the phrase ``appropriate authorization'' that encompasses the definitions of appropriate legal authorization and appropriate carrier authorization, as used in paragraph (b)(1) of this section; (3) A detailed description of how long it will maintain its records of each interception of communications or access to call-identifying information pursuant to Sec. 64.2104; (4) In a separate appendix to the policies and procedures document: (i) The name and a description of the job function of the senior officer or employee appointed pursuant to paragraph (a) of this section; and (ii) Information necessary for law enforcement agencies to contact the senior officer or employee appointed pursuant to paragraph (a) of this section or other CALEA points of contact on a seven days a week, 24 hours a day basis. (c) Report to the affected law enforcement agencies, within a reasonable time upon discovery: (1) Any act of compromise of a lawful interception of communications or access to call-identifying information to unauthorized persons or entities; and (2) Any act of unlawful electronic surveillance that occurred on its premises. 3. Section 64.2104 is amended by revising paragraph (a)(1)(ii) to read as follows: Sec. 64.2104 Maintaining secure and accurate records. (a) * * * (1) * * * (ii) The start date and time that the carrier enables the interception of communications or access to call identifying information; * * * * * [FR Doc. 01-11168 Filed 5-3-01; 8:45 am] BILLING CODE 6712-01-P