FCC Adopts Anti-Spoofing Rules Implementing Truth In Caller ID Act

Implementing the Truth in Caller ID Act passed last December, the FCC adopted rules prohibiting the fraudulent manipulation of caller ID information.  These so-called anti-"spoofing" rules track the statutory language to prohibit any person from "knowingly transmit[ing] misleading or inaccurate caller identification information with the intent to defraud, cause harm, or wrongfully obtain anything of value."  The Commission also released a report to Congress recommending additional legislative changes to strengthen the spoofing protections.

Check back later for additional analysis of the orders, but in the meantime, we will hit a few of the highlights.

In the Report and Order, the FCC largely tracks its proposal in the NPRM.  The Commission prohibited the "knowing" transmission of misleading information with an intent to defraud, and clarified that to be liable the person possessing the fraudulent intent must also cause the transmission of misleading information.

Notably, the FCC adopted its proposal to take direct enforcement action against entities that violate the rules, even if those entities are not Commission licensees or holders of Commission authorizations.  This side-steps the "warn first" regime that applies to other violations.

The Commission denied the Department of Justice's requests to extend liability to VoIP providers not meeting the FCC's existing definition of "interconnected VoIP" service and to impose additional verification obligations on third-party spoofing providers.

In the Report to Congress, the FCC recommends several changes to strengthen the Act, including expansion of the Act to reach non-interconnected VoIP and to address text-messaging services.  As summarized in the Report, the Commission recommended the following:

Legislative recommendations include clarifying the scope of the Truth in Caller ID Act to include (1) persons outside the United States, (2) the use of IP-enabled voice services that are not covered under the Commission’s current definition of interconnected Voice over Internet Protocol (VoIP) service, (3) appropriate authority over third party spoofing services, and (4) SMS-based text messaging services.

 

Department of Justice Continues to Push to Apply Spoofing Rules to VoIP

As we've noted previously, the U.S. Department of Justice has urged the FCC to take an expansive interpretation of the Truth in Caller ID Act of 2009.  In comments filed last week, the Department continued its effort to have the FCC apply the rules to VoIP providers, including those not subject to any FCC rules today.

In its comments in response to the FCC Notice of Proposed Rulemaking, the Department urged the FCC to adopt rules regulating Caller ID spoofing providers directly.  It contends that this authority is rooted in the Truth in Caller ID Act of 2009 itself and in the Commission's "ancillary" authority over non-common carriers (the same authority at issue in the Comcast net neutrality case).  The Department does not explicitly mention non-interconnected VoIP providers or one-way VoIP providers in its comments, but its arguments would extend to any service provider offering spoofing services. 

The Department's comments are available here.

FCC Takes Enforcement Action in USF, Telemarketing and "Junk Fax" Cases

Last week brought new actions in three of the FCC's most common enforcement areas:  Failure to pay USF contributions, "robocall" telemarketing violations and "junk fax" solicitations.  One action also is an example of anti-spoofing enforcement by the Commission.  The Commission's actions are briefly described below.

USF Enforcement.  The Enforcement Bureau entered into a consent decree with Allegiance Communications, LLC, a cable TV provider in Shawnee, Oklahoma.  The Bureau's investigation concerned failures to pay Universal Service, TRS, NANPA and LNP fees, all of which are billed based on the FCC Form 499-A.  The action is a settlement, so we do not know all of the facts.  Nevertheless, it is clear that at one time Allegiance Communications had not paid these contributions, but "as of March 25, 2011," Allegiance had made its past due payments and submitted all required filings.  In stark contrast to other USF actions where the Commission imposed substantial fines for such activities, here, the Enforcement Bureau agreed to a fine of $20,000, payable in two installments.  Allegiance Communications is very fortunate, indeed.

"Robocall" Telemarketing Violations.  In Security First of Alabama, the FCC proposed a $342,000 Notice of Apparent Liability for violations of the Telephone Consumer Protection Act of 1991 (TCPA).  This case involved 43 unsolicited pre-recorded advertising messages ("robocalls") delivered to 33 consumers.  For 16 of the calls, the FCC proposes its standard fine of $4,500 per call.  However, it also concludes that Security First "spoofed" its caller ID display, which the FCC concluded was an egregious violation worthy of a $10,000 fine per call.

"Junk Fax" Forfeitures.  The FCC continues to clear its decks of allegations that entities were engaging in unsolicited facsimile advertising ("junk" faxing).  In two forfeiture orders released last week, the FCC fined Mexico Marketing and Travelcomm for sending unsolicited faxes to consumers.  In Mexico Marketing, the Commission issued a fine of $1.6 million for 89 violations.  In Travelcomm, the Commission issued a fine of $72,000 for 15 violations.  These orders were resolutions of several Notices of Apparent Liability issued in 2007 and 2008 against the companies.

FCC Opens Spoofing Proceeding

In response to the passage of anti-spoofing legislation late last year, the FCC recently adopted a Notice of Proposed Rulemaking to tighten rules relating to the "spoofing" of caller ID information.  The Commission is seeking comments in late April and early May, which would make it tough for the Commission to meet the legislation's six-month deadline for the adoption of implementing rules.

The NPRM contains a surprising proposal to bypass the ordinary enforcement processes the Commission uses.  See below for that and other highlights of the proposal.

With respect to the caller's liability, the NPRM closely tracks the statutory language.  The Commission proposes a new rule to prohibit any person or entity from displaying misleading or inaccurate caller ID information "with the intent to defraud, cause harm, or wrongfully obtain anything of value." 

With respect to the service provider's liability, the Commission seeks comment on the Department of Justice's proposal to require service providers to verify that the subscriber has authority over the number to be transmitted via the service.  The Commission did not take a stance on the merits of the proposal in the NPRM, however.

With respect to VoIP services, the Commission disagreed with the Department of Justice -- which sought an interpretation that would apply the rules to non-interconnected VoIP -- and proposed to apply the rules only to those services meeting its existing definition of interconnected VoIP.

Most notably, however, the Commission proposes new enforcement provisions that expand the FCC's traditional jurisdiction over entities that do not hold FCC licenses or authorizations.  As we've noted before, for non-licensed entities, the FCC ordinarily must proceed via a warning first, and may impose a fine only for conduct that occurs after the warning.  With respect to spoofing, however, the FCC concludes that the lack of a reference to this procedure in the Truth in Caller ID Act "suggests that Congress intended to give the Commission the authority to proceed expeditiously to stop and, were appropriate, assess a forfeiture against," unlawful spoofing.  Therefore, the FCC proposes that it may impose fines for first-time violations of the Act's restrictions. 

Comments on the proposal are due April 18; replies on May 3. 

The NPRM is available here.  An Erratum also was released by the FCC.

US Department of Justice Recommends Anti-Spoofing Rules to FCC

In late December, Congress passed new Anti-Spoofing legislation.  As we told you at the time, the Act requires the FCC to enact implementing regulations within 6 months.  In anticipation of that rulemaking, the U.S. Department of Justice's Criminal Division submitted a letter to the FCC with its recommendations for the regulations.

The DOJ letter is described in more detail below.  Most notably, DOJ recommends verification obligations be imposed on providers of spoofing services and proposes an expansive definition of "IP-enabled Voice Service" that would impose obligations on services heretofore not subject to FCC regulations.  If the FCC agrees, new classes of entities would be subject to compliance obligations relating to Caller ID spoofing.

The DOJ letter is available in full here.  The DOJ supports regulations in the following areas:

1.  Spoofing Service Providers.  Citing to a floor statement by the Truth in Caller ID Act's sponsor, now ex-Representative Rick Boucher (D-Va), DOJ supports the imposition of verification obligations on providers of spoofing services.  Specifically, DOJ recommends:

The Commission should consider the feasibility of requiring public providers of Caller ID spoofing services to make a good-faith effort to verify that a user has the authority to use the substituted number, such as by placing a one-time verification call to that number.

DOJ also recommends technical standards that would allow law enforcement to trace such calls to their true originating number upon appropriate authority.

2.  Law Enforcement Exception.  The Act excludes any spoofing conducted by any "lawfully authorized investigative, protective, or intelligence agency."  DOJ recommends specific language to implement this provision.

3.  Applicability to IP-Enabled Services.  The Act provides that it applies to the use of "any telecommunications service or IP-enabled voice service."  With respect to IP-enabled voice services, the Act provides that the term "has the meaning given to that term by Section 9.3 of the [FCC's] regulations."  Section 9.3, however, defines "interconnected VoIP" services, which are a subset of IP-enabled services. 

Noting the lack of a definition of "IP-enabled voice service," the DOJ argues for a definition that will expand the reach of the Caller ID regulations.  The DOJ's proposed definition would reach one-way VoIP services, Skype's service (which Skype contends does not meet the FCC's definition of "interconnected VoIP" service) and possibly other uses of VoIP, such as in video conferencing or gaming.  Specifically, the DOJ proposes the following definition of "IP-enabled voice services:"

The term 'IP-enabled voice service' means the provision of real-time voice communications offered to the public, or such class of users as to be effectively available to the public, transmitted through customer premises equipment using TCP/IP protocol, or a successor protocol, (whether part of a bundle of services or separately) with interconnection capability such that the service can originate traffic to, or terminate traffic from, the public switched telephone network, or a successor network.

The Department states that this definition is based on 18 U.S.C. 1039(h)(4), which protects the confidentiality of telephone records under the Telephone Records and Privacy Protection Act of 2006.

Comments on Telemarketing Sales Rule Due This Week

Last month, the FTC issued an “Advance Notice of Proposed Rulemaking” seeking comments on whether and how to strengthen the Caller ID provisions of its Telemarketing Sales Rule. The Rule presently requires telemarketers to provide Caller ID information to allow consumers to screen out unwanted calls. The FTC seeks comments on how to make Caller ID more useful to consumers and combat technologies that hide telemarketers’ identities. Currently, the Caller ID regulations give telemarketers flexibility in determining what telephone numbers to transmit, and in determining whether the name of the telemarketer, or the name of the seller or charity, is displayed on Caller ID services.

 According to the FTC, not all businesses abide by the these Caller ID requirements. Recent FTC cases have charged telemarketers pitching fraudulent extended auto warranties and credit card interest rate reduction programs with violating the Caller ID requirements. The FTC’s request for comments notes that “spoofing” or manipulating Caller ID names and numbers may become more common as telemarketers increasingly use advanced telecommunications technologies. The FTC’s Notice details specific areas of inquiry but does not propose specific rule changes. It can be found here. Those interested in filing public comments on the issue must do so by Friday, January 28, 2011.

Rules Against Caller ID Spoofing to Tighten

Two developments last month portend a more difficult time for entities "spoofing" caller ID information.  On December 22, President Obama signed into law the Truth in Caller ID Act of 2009 [sic], which makes it unlawful for a person to transmit misleading or inaccurate caller ID information with an intent to defraud.  In addition, the FTC is seeking comment on rule changes to strengthen the caller ID provisions of its Telemarketing Sales Rule (TSR). 

Descriptions of both developments are provided below.

Truth in Caller ID Act.  On December 22, President Obama signed into law the Truth in Caller ID Act of 2009 [sic].  The Act makes it unlawful for any person to cause any caller ID system "to knowingly transmit misleading or inaccurate caller identification information with the intent to defraud, cause harm, or wrongfully obtain anything of value."  The prohibition applies to caller ID used in connection with both telecommunications services and IP-enabled services (VoIP).

The FCC has 6 months to enact regulations to implement the prohibition.  In addition, the FCC must submit a recommendation whether additional legislation is necessary to prohibit the provision of inaccurate caller ID information in technologies that are successors to traditional telecommunications or VoIP.

FTC Rulemaking to Strengthen Caller ID.  On December 7, the FTC released a public notice seeking comment on ways to strengthen the caller ID provisions of its Telemarketing Sales Rule (TSR).  According to the FTC, "spoofing" has become more common and it is seeking comment on ways to strengthen the rules to prohibit the practice.  The FTC specifically identified the following issues for comment:

* How widespread is consumer use of Caller ID services to screen unwanted calls, and do consumers use other services that rely on the transmission of calling party numbers (CPN), such as call-blocking equipment, to avoid unwelcome telemarketing calls?
* Would changes to the Telemarketing Sales Rule improve the ability of Caller ID services to accurately disclose the source of telemarketing calls or improve the ability of service providers to block calls in which information on the source of the call is not available, or has been spoofed?
* Should the FTC amend the Caller ID provisions of the Rule to recognize or anticipate specific developments in telecommunications technologies relating to the transmission and use of Caller ID information, and if so, how?
* Should the FTC amend the Caller ID provisions of the Rule to further specify the characteristics of the phone number that a telemarketer must transmit to a Caller ID service? For example, should the Rule require that the phone number transmitted be one that is listed in publicly available phone directories, a number with an area code and prefix that are associated with the physical location of the telemarketer’s place of business, a number that is answered by a live representative, or automated service that identifies the telemarketer by name?
* Should the FTC amend the Caller ID provisions to allow a seller or telemarketer to use trade names or product names, rather than the actual name of the seller or telemarketer, in the name information displayed by Caller ID services?
 

Comments are due before the FTC by January 28.  Links to relevant FTC sites are available in our Resource Center.