2020-17268. Advanced Methods To Target and Eliminate Unlawful Robocalls

AGENCY:

Federal Communications Commission.

ACTION:

Final rule.

SUMMARY:

In this document, the Commission adopts two safe harbors for voice service providers that block calls in certain situations, and adopts certain measures to ensure that erroneous blocking is quickly remedied. Specifically, the Commission adopts a safe harbor from liability under the Communications Act and the Commission's rules for terminating voice service providers that block calls on an opt-out basis based on reasonable analytics designed to identify unwanted calls, so long as those take into account information provided by caller ID authentication where available for a particular call. Second, the Commission adopts a safe harbor enabling voice service providers to block traffic from bad-actor upstream voice service providers that continue to allow unwanted calls to traverse their networks. Finally, the Commission requires that blocking providers furnish a single point of contact to resolve unintended or inadvertent blocking, and emphasizes that, when blocking, they should make all reasonable efforts to ensure that critical calls, such as those from Public Safety Answering Points (PSAPs), are not blocked and that they should never block calls to 911. These rules both respond to voice service providers that seek assurance that their good-faith blocking will not result in liability if they inadvertently block wanted calls and implement the call blocking provisions of the TRACED Act, and provide safeguards against erroneous blocking.

DATES:

Effective October 14, 2020.

FOR FURTHER INFORMATION CONTACT:

Jerusha Burnett, Consumer Policy Division, Consumer and Governmental Affairs Bureau, email at [e-mail] or by phone at [phone].

SUPPLEMENTARY INFORMATION:

This is a summary of the Commission's Report and Order, in CG Docket No. 17-59, FCC 20-96, adopted on July 16, 2020, and released on July 17, 2020. The Further Notice of Proposed Rulemaking that was adopted concurrently with the Report and Order published July 31, 2020 at 85 FR 46063. The full text of document FCC 20-96 is available for public inspection and copying via the Commission's Electronic Comment Filing System (ECFS). The full text of document FCC 20-96 and any subsequently filed documents in this matter may also be found by searching ECFS at: http://apps.fcc.gov/​ecfs/​ (insert CG Docket No. 17-59 into the Proceeding block). To request materials in accessible formats for people with disabilities (Braille, large print, electronic files, audio format), send an email to [e-mail], or call the Consumer and Governmental Affairs Bureau at [phone] (voice).

Final Paperwork Reduction Act of 1995 Analysis

The Report and Order does not contain any new or modified information collection requirements subject to the Paperwork Reduction Act of 1995, Public Law 104-13. It, therefore, does not contain any new or modified information collection burden for small business concerns with fewer than 25 employees, pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107-198, see 44 U.S.C. 3506(c)(4).

Congressional Review Act

The Commission sent a copy of the Report and Order to Congress and the Government Accountability Office pursuant to the Congressional Review Act, see 5 U.S.C. 801(a)(1)(A).

Synopsis

1. With the Report and Order, the Commission takes specific and concrete steps to further protect consumers against unwanted calls. The Commission adopts a safe harbor from liability under the Communications Act and its rules for terminating voice service providers that block calls based on reasonable analytics designed to identify unwanted calls, so long as those take into account information provided by STIR/SHAKEN (or, for non-IP based calls, any other effective call authentication framework that satisfies the Pallone-Thune Telephone Robocall Abuse Criminal Enforcement And Deterrence (TRACED) Act) when such information is available for a particular call. And the Commission establishes a second safe harbor enabling voice service providers to block traffic from bad-actor upstream voice service providers that continue to allow unwanted calls to traverse their networks. Finally, the Commission requires that blocking providers furnish a single point of contact to resolve unintended or inadvertent blocking, and emphasizes that, when blocking, they should make all reasonable efforts to ensure that critical calls, such as those from PSAPs, are not blocked and that they should never block calls to 911.

Safe Harbors

2. Consistent with the TRACED Act and in light of the record garnered in response to the Commission's Call Blocking Declaratory Ruling and Further Notice, the Commission adopts two safe harbors from liability under the Communications Act and the Commission's rules for certain call blocking by voice service providers. The first is a call-by-call safe harbor based on reasonable analytics including caller ID authentication information. The second safe harbor targets bad-actor upstream voice service providers who do not police their networks to minimize bad traffic after being notified of such traffic.

3. Scope of Safe Harbor Protection. The safe harbors the Commission establishes here will protect blocking providers from liability arising from any obligations related to completing the call under the Communications Act and the Commission's rules.

Safe Harbor Based on Reasonable Analytics

4. First, the Commission adopts a safe harbor from liability under the Communications Act and the Commission's rules for the unintended or inadvertent blocking of wanted calls where terminating voice service providers block based on reasonable analytics that include caller ID authentication information and the consumer is given the opportunity to opt out. Consistent with the Commission's statement in the Call Blocking Declaratory Ruling, published at 84 FR 29387, June 24, 2019, and Further Notice (NPRM), published at 84 FR 29478, June 24, 2019; and Congress' guidance in the TRACED Act, the Commission requires terminating voice service providers that take advantage of this safe harbor to offer these services without a line-item charge to consumers.

5. Caller ID Authentication Requirement. To avail themselves of the safe harbor, terminating voice service providers must incorporate caller ID authentication information into their reasonable analytics programs. At this time, only the STIR/SHAKEN caller ID authentication framework satisfies this requirement. As the Commission explains, however, should it later identify other effective caller ID authentication methods that would satisfy the TRACED Act, including non-IP methods, those methods would also satisfy its requirements here.

6. At a minimum, a terminating voice service provider seeking safe harbor protection must have deployed an effective caller ID authentication framework within their own network, accept caller ID authentication information transmitted by an upstream voice service provider, and incorporate that information into its analytics where that information is available. The terminating voice service provider may also rely on this safe harbor even when blocking calls where caller ID authentication information is not available, so long as it incorporates caller ID authentication information into its analytics wherever possible.

7. In recognition of commenter concerns, and of the need to adapt to evolving threats, the Commission gives terminating voice service providers flexibility in how to incorporate authentication into their analytics. They may, for example, take into account the level of attestation, including looking at what level of attestation has historically been present where such data is available. The Commission reiterates that voice service providers must apply analytics reasonably in a non-discriminatory, competitively neutral manner.

8. The TRACED Act acknowledges that voice service providers' ability to deploy STIR/SHAKEN varies because, in part, it is not designed to work on non-IP networks. As a result, this requirement means that terminating voice service providers with exclusively non-IP based networks will not be able to avail themselves of the safe harbor immediately. Should industry develop alternative caller ID authentication technologies that it later determines satisfy this requirement under the TRACED Act, those technologies would also be sufficient to claim the safe harbor. Further, the Commission recognizes that all terminating voice service providers are likely to receive calls from upstream voice service providers with non-IP networks. If a portion of the calls received by the terminating voice service provider are authenticated and the terminating voice service provider is verifying those calls and incorporating that information into a program of reasonable analytics, the safe harbor would still be available for the blocking of calls from non-IP networks. Limiting the safe harbor to authenticated calls could encourage bad actors to ensure that their calls originate or transit on non-IP networks, undermining the value of the safe harbor.

Safe Harbor for Blocking of Bad-Actor Providers

9. The Commission clarifies that voice service providers may block calls from certain bad-actor upstream voice service providers and establishes a safe harbor from liability related to call completion obligations arising under the Communications Act and the Commission's rules for this blocking. Unlike the reasonable analytics safe harbor, the Commission focuses here on criteria that clearly indicate a particular upstream voice service provider is facilitating, or at a minimum shielding, parties originating illegal calls.

10. Permitting Provider-Based Blocking. Until very recently, the Commission has only authorized call blocking for particular calls, not based on the provider. Here, the Commission clarifies that voice service providers are permitted to block calls from “bad-actor” upstream voice service providers. Specifically, the Commission makes clear that a voice service provider may block calls from an upstream voice service provider that, when notified that it is carrying bad traffic by the Commission, fails to effectively mitigate such traffic or fails to implement effective measures to prevent new and renewing customers from using its network to originate illegal calls. The notification from the Commission will be based on information obtained through traceback, likely in coordination with the Traceback Consortium. Failure of the bad-actor provider to sign calls may be an additional factor in this notification.

11. Notification and Effective Mitigation Measures. If the Commission identifies illegal traffic on the network, it may notify the voice service provider that it is passing identified bad traffic and that specific calls are illegal. Upon receipt of this notification, the voice service provider should promptly investigate and, if necessary, prevent the illegal caller from continuing to use the network to place illegal calls. If the upstream voice service provider fails to take effective mitigation measures within 48 hours, a voice service provider may then, after notifying the Commission as discussed below, block calls from this bad-actor provider. Similarly, if the upstream voice service provider fails to implement effective measures to prevent new and renewing customers from using its network to originate illegal calls, a voice service provider may also block calls from this bad-actor provider.

12. A notified voice service provider should inform the Commission and the Traceback Consortium within 48 hours of steps it has taken to mitigate the illegal traffic. A voice service provider that is aware of the notice provided to an upstream voice service provider must consider whether the steps taken were sufficient to effectively mitigate the identified bad traffic. The Commission declines to mandate specific metrics to make this determination, but expects that they will generally involve a significant reduction in the traffic stemming from a particular illegal calling campaign or regarding calls from the particular upstream voice service provider. The voice service provider may meet this criterion if it determines, in good faith and upon a rational basis, that the upstream voice service provider has failed to effectively mitigate the illegal traffic. The Commission expects the voice service provider to inform the upstream voice service provider of that determination in order to give the upstream voice service provider another opportunity to take further mitigation steps. In addition, before taking any action to block calls of the upstream voice service provider, a voice service provider must provide the Commission with notice and a brief summary of its basis for making such a determination. By obtaining such information from both parties, the Commission will be in a position to monitor the actions of both parties prior to commencement of any blocking.

13. A notified voice service provider should also inform the Commission and the Traceback Consortium within a reasonable period of time of the steps it takes to prevent new and renewing customers from originating illegal calls. Failure to provide this information within a reasonable time shall be equivalent to having failed to have effective measures in place for purposes of the safe harbor. Where upstream voice service providers disclose their measures, a voice service provider may in good faith assess whether the measures are effective based on objective criteria, such as whether customers can show a legitimate business need for those services. Again, before taking any action to block calls of the upstream voice service provider, a voice service provider must provide the Commission with notice and a brief summary of its basis for making such a determination.

14. Risk of Legal Calls Being Blocked. The Commission finds that the benefits of this safe harbor outweigh the potential costs of blocking some legal calls in the process. Voice service providers are in the best position to detect and combat this problem. Accordingly, the Commission believes that enabling voice service providers to use all available technologies and methodologies at their disposal without fear of liability is crucial to combat illegal calls. This safe harbor encourages voice service providers to both mitigate bad traffic once they have actual notice of that traffic, and to take proactive steps to prevent their networks from being used to transmit illegal calls.

Protections Against Erroneous Blocking

15. Protections for Critical Calls. The Commission requires that all voice service providers must make all reasonable efforts to ensure that calls from PSAPs and government outbound emergency numbers are not blocked.

16. Calls to PSAPs via 911 are also extremely important and the Commission makes clear that they should never be blocked unless the voice service provider knows without a doubt that the calls are unlawful. Though some unwanted and illegal calls may reach 911 call centers, the Commission believes that 911 call centers themselves are best equipped to determine how to handle the calls they receive.

17. Point of Contact for Blocking Disputes. The Commission requires that any voice service provider that blocks calls must designate a single point of contact for callers, as well as other voice service providers, to report blocking errors at no charge to callers or other voice service providers.

18. Blocking providers must investigate and resolve these blocking disputes in a reasonable amount of time and at no cost to the caller, so long as the complaint is made in good faith. What amount of time is “reasonable” may vary depending on the specific circumstances of the blocking and the resolution of the blocking dispute, and pending further developments in the record Blocking providers must also publish contact information clearly and conspicuously on their public-facing websites. The Commission further requires that when a caller makes a credible claim of erroneous blocking and the voice service provider determines that the calls should not have been blocked, a voice service provider must promptly cease blocking calls from that number unless circumstances change. Finally, because the TRACED Act requires that the establishment of a safe harbor be consistent with the Act's requirement of “transparency and effective redress options,” the Commission confirms that implementation of these redress mechanisms is a condition of obtaining the protections of the safe harbors it establishes in the Report and Order.

19. Consistent with what the Commission permitted in June 2019, consumers may choose, either via opt in or opt out consent, to have their terminating voice service provider block categories of calls that may include legal calls. In these cases, terminating voice service providers are not obliged to cease blocking such calls merely because the caller claims they are legal. Rather, a terminating voice service provider's analysis should hinge on whether the disputed calls fit within the blocking categories to which their customers have consented.

20. No Critical Calls List at this Time. The Commission declines to adopt a Critical Calls List at this time, in light of a record largely in opposition and in recognition that such a list would likely to do more harm than good. The Commission does not, however, foreclose the possibility of adopting such a list at a future point in time should circumstances change.

Final Regulatory Flexibility Analysis

21. As required by the Regulatory Flexibility Act of 1980 (RFA), as amended, an Initial Regulatory Flexibility Analysis (IRFA) was incorporated into the Declaratory Ruling and Further Notice. The Commission sought written public comment on the proposals in the NPRM, including comment on the IRFA. The comments received are discussed below. The Final Regulatory Flexibility Analysis (FRFA) conforms to the RFA.

Need for, and Objectives of, the Order

22. The Report and Order takes important steps in the fight against illegal robocalls by enabling terminating voice service providers to block certain calls before they reach consumers' phones while also requiring certain protections for lawful calls. The rules the Commission adopts today outline two safe harbors for terminating voice service providers that block calls in these circumstances. First, the Report and Order establishes a safe harbor for terminating voice service providers that block calls on a default, opt-out, basis based on reasonable analytics so long as those analytics include caller ID authentication information and the customer is given sufficient information to make an informed choice. Second, it establishes a safe harbor for voice service providers that block and then cease accepting all traffic from an upstream voice service provider that, when notified that it is carrying bad traffic by the Commission, fails to effectively mitigate such traffic or fails to implement effective measures to prevent new and renewing customers from using its network to originate illegal calls. The Report and Order also adopts rules to ensure that callers and other voice service providers can resolve potential erroneous blocking and to require all voice service providers to make all reasonable efforts to ensure that critical calls complete.

23. Reasonable Analytics. The Report and Order provides a safe harbor from liability under the Communication Act and the Commission's rules for voice service providers that block calls based on reasonable analytics that must include Caller ID authentication information, so long as consumers are given a meaningful opportunity to opt out. This safe harbor builds on the blocking the Commission made clear was permitted under the Declaratory Ruling and Further Notice and adds the requirement that voice service provides incorporate Caller ID authentication information into their analytics programs.

24. Bad Actor Providers. Additionally, the Report and Order establishes a safe harbor for terminating voice service providers that block calls from upstream voice service providers that, when notified that it is carrying bad traffic by the Commission, fails to effectively mitigate such traffic or fails to implement effective measures to prevent new and renewing customers from using its network to originate illegal calls. This safe harbor incentivizes bad-actor providers to better police their networks by raising the cost of passing bad traffic.

25. Other Issues. The Report and Order clarifies that any terminating voice service provider that blocks calls must designate a single point of contact for callers to report blocking errors at no charge. It further makes clear that blocking providers must investigate and resolve these blocking disputes in a reasonable amount of time that is consistent with industry best practices. To avoid abuse, the Report and Order declines to mandate a Critical Calls List at this time. It does, however, make clear that the Commission expects all voice service providers will take all possible steps to ensure that calls from PSAPs and government outbound emergency numbers are not blocked. Finally, it makes clear that calls to 911 should never be blocked unless the voice service provider knows without a doubt that the calls are unlawful.

Summary of Significant Issues Raised by Public Comments in Response to the IRFA

26. In the Declaratory Ruling and Further Notice, the Commission solicited comments on how to minimize the economic impact of the new rules on small business. The Commission received four comments either directly referencing the IRFA or addressing small business concerns. Two of these comments focused on concerns about the ability of small businesses to implement STIR/SHAKEN and how this would impact the safe harbors proposed in the Further Notice. The remaining two comments focused on small business challenge mechanism issues.

27. SHAKEN/STIR. Both ITTA and Spoofcard raised concerns about safe harbors contingent on SHAKEN/STIR, noting that many small voice service providers have TDM networks and therefore will not be able to implement SHAKEN/STIR quickly. ITTA instead argues for a safe harbor for blocking based on reasonable analytics, while Spoofcard simply argues against blocking based solely on SHAKEN/STIR. The Commission recognizes that some small voice service providers will not be able to implement SHAKEN/STIR quickly. The first safe harbor the Commission adopts in the Report and Order does not prevent these voice service providers from blocking pursuant to the Declaratory Ruling. Additionally, as other effective Caller ID authentication technologies are developed, they may also satisfy the requirements of the first safe harbor. Finally, neither safe harbor the Commission adopts permits blocking solely on SHAKEN/STIR.

28. Challenge Mechanisms. Capio highlighted the importance of a robust challenge mechanism for small businesses. Both Capio and CUNA called for this mechanism to be offered free of charge, with CUNA noting that this is particularly important for small businesses such as credit unions. In the Report and Order, the Commission requires terminating voice service providers to designate a single point of contact for resolving blocking disputes and make contact information clear and conspicuous on their public-facing websites. The Commission further requires terminating voice service providers to resolve disputes in a reasonable amount of time, noting that what is reasonable may vary on a case-by-case basis. Finally, the Commission requires that this be offered at no charge to callers.

Response to Comments by the Chief Counsel for Advocacy of the Small Business Administration

29. Pursuant to the Small Business Jobs Act of 2010, which amended the RFA, the Commission is required to respond to any comments filed by the Chief Counsel for Advocacy of the Small Business Administration (SBA), and to provide a detailed statement of any change made to the proposed rules as a result of those comments. The Chief Counsel did not file any comments in response to the proposed rules in this proceeding.

Description of Projected Reporting, Recordkeeping, and Other Compliance Requirements for Small Entities

30. The Report and Order makes clear that voice service providers may block calls in certain circumstances and provides safe harbors for that blocking. The Report and Order also adopts certain protections for lawful callers. These changes affect small and large companies equally and apply equally to all the classes of regulated entities identified above.

31. Reporting and Recordkeeping Requirements. The Report and Order establishes blocking safe harbors that will require terminating providers that choose to block to maintain certain records to ensure that their blocking is in compliance with the safe harbor. The specific records that a terminating provider would need to retain will depend on the particular safe harbor the terminating provider is relying on as well as their specific blocking program. Terminating providers that choose to block calls based on reasonable analytics including caller ID authentication information will need to maintain records on calls blocked, as well as opt-out decisions made by consumers. These records are necessary to ensure that opt-out requests are honored and to aid in resolving blocking disputes. Terminating providers that choose to block all calls from a bad-actor upstream provider will need to retain information relevant to that decision to ensure that all requirements were met prior to blocking and to help respond to blocking disputes. Originating, intermediate, and terminating providers will also need to communicate with other providers regarding traceback, illegal traffic, and measures to prevent new customers from originating illegal traffic.

Steps Taken To Minimize the Significant Economic Impact on Small Entities, and Significant Alternatives Considered

32. The RFA requires an agency to describe any significant alternatives that it has considered in reaching its approach, which may include the following four alternatives, among others: (1) The establishment of differing compliance or reporting requirements or timetables that take into account the resources available to small entities; (2) the clarification, consolidation, or simplification of compliance or reporting requirements under the rule for small entities; (3) the use of performance, rather than design, standards; and (4) an exemption from coverage of the rule, or any part thereof, for small entities.

33. The Commission considered feedback from the Declaratory Ruling and Further Notice in crafting the final order. The Commission evaluated the comments with the goal of removing regulatory roadblocks and giving industry the flexibility to block calls while still protecting the interests of lawful callers. For example, the rules the Commission adopts are permissive rather than mandatory, allowing small businesses to determine whether, and what type of, blocking is the correct approach for their network. A terminating provider may choose to block based on reasonable analytics, including caller ID authentication information, and benefit from that safe harbor. Should a terminating provider do so, they have flexibility to design their own reasonable analytics program and make that program either opt out or opt in. Alternatively, or in addition to that blocking, a terminating provider may choose to block all calls from an originating or intermediate provider that fails to meet the criteria the Commission lays out in the bad-actor provider safe harbor. The Commission recognizes small business concerns regarding the difficulty of deploying SHAKEN/STIR. Small businesses that cannot rapidly deploy SHAKEN/STIR have alternative blocking options, such as those from the Declaratory Ruling and Further Notice to ensure that they are not left behind. The Commission further took the concerns of small business into consideration in establishing the requirements to make challenging erroneous blocking simpler and at no cost to the caller.

34. The Commission does not see a need to establish a special timetable for small entities to reach compliance with the modification to the rules. No small business has asked for a delay in implementing the rules. Small businesses may avoid compliance costs entirely by declining to block robocalls, or may delay implementation of call blocking indefinitely to allow for more time to come into compliance with the rules. Similarly, there are no design standards or performance standards to consider in this rulemaking.

The Commission will send a copy of the Report and Order, including this FRFA, in a report to be sent to Congress and the Government Accountability Office pursuant to the Congressional Review Act.

Ordering Clauses

35. Pursuant to sections 4(i), 201, 202, 227, 227b, 251(e), 303(r), and 403 of the Communications Act of 1934, as amended, 47 U.S.C. 154(i), 201, 202, 227, 227b, 251(e), 303(r), and 403, the Report and Order is adopted and that part 64 of the Commission's rules, 47 CFR 64.1200, is amended.

List of Subjects in 47 CFR Part 64

• Communications common carriers
• Reporting and recordkeeping requirements
• Telecommunications
• Telephone

Federal Communications Commission.

Marlene Dortch,

Secretary, Office of the Secretary.

Final Rules

For the reasons discussed in the preamble, the Federal Communications Commission amends 47 part 64 as follows:

PART 64—MISCELLANEOUS RULES RELATING TO COMMON CARRIERS

1. The authority citation for part 64 continues to read as follows:

Authority: 47 U.S.C. 154, 201, 202, 217, 218, 220, 222, 225, 226, 227, 227b, 228, 251(a), 251(e), 254(k), 262, 403(b)(2)(B), (c), 616, 620, 1401-1473, unless otherwise noted; Pub. L. 115-141, Div. P, sec. 503, 132 Stat. 348, 1091.

2. Amend § 64.1200 by

a. Adding paragraph (f)(17);

b. Revising paragraph (k) introductory text, paragraphs (k)(3) and (4) and adding paragraphs (k)(5) through (8).

The additions and revisions read as follows:

§ 64.1200

Delivery restrictions.

* * * * *

(f) * * *

(17) The term effectively mitigate means identifying the source of the traffic and preventing that source from continuing to originate traffic of the same or similar nature.

* * * * *

(k) Voice service providers may block calls so that they do not reach a called party as follows:

* * * * *

(3) A terminating provider may block a voice call without liability under the Communications Act or the Commission's rules where:

(i) Calls are blocked based on the use of reasonable analytics designed to identify unwanted calls;

(ii) Those analytics include consideration of caller ID authentication information where available;

(iii) A consumer may opt out of blocking and is provided with sufficient information to make an informed decision;

(iv) All analytics are applied in a non-discriminatory, competitively neutral manner;

(v) Blocking services are provided with no additional line-item charge to consumers; and

(vi) The terminating provider provides, without charge to the caller, the redress requirements set forth in paragraph (k)(8) of this section.

(4) A provider may block voice calls or cease to accept traffic from an originating or intermediate provider without liability under the Communications Act or the Commission's rules where the originating or intermediate provider, when notified by the Commission, fails to effectively mitigate illegal traffic within 48 hours or fails to implement effective measures to prevent new and renewing customers from using its network to originate illegal calls. Prior to initiating blocking, the provider shall provide the Commission with notice and a brief summary of the basis for its determination that the originating or intermediate provider meets one or more of these two conditions for blocking.

(5) A provider may not block a voice call under paragraphs (k)(1) through (4) of this section if the call is an emergency call placed to 911.

(6) A provider may not block calls under paragraphs (k)(1) through (4) of this section unless that provider makes all reasonable efforts to ensure that calls from public safety answering points and government emergency numbers are not blocked.

(7) For purposes of this section, a provider may rely on Caller ID information to determine the purported originating number without regard to whether the call, in fact originated from that number.

(8) Any terminating provider blocking pursuant to this subsection must provide a single point of contact, readily available on the terminating provider's public-facing website, for handling call blocking error complaints and must resolve disputes within a reasonable time. When a caller makes a credible claim of erroneous blocking and the terminating provider determines that the calls should not have been blocked, the terminating provider must promptly cease blocking calls from that number unless circumstances change. The terminating provider may not impose any charge on callers for reporting, investigating, or resolving blocking error complaints.