2021-23213. Wireline Competition Bureau Announces Best Practices for Equipment Disposal and Revises FCC Form 5640 Certifications for the Secure and Trusted Communications Networks Reimbursement Program  

  • Start Preamble Start Printed Page 59304

    AGENCY:

    Federal Communications Commission.

    ACTION:

    Final action.

    SUMMARY:

    In this document, the Wireline Competition Bureau (Bureau) provides guidance and voluntary best practices regarding the Secure and Trusted Communications Networks Reimbursement Program (Reimbursement Program) disposal and verification requirements to assist providers of advanced communications services participating in the Reimbursement Program; revises the certification language in the FCC Form 5640, which participants must submit to request funding allocations and disbursements from the Reimbursement Program; and makes minor corrections to the Catalog of Eligible Expenses and Estimated Costs that is used by Reimbursement Program applicants to assist with reporting cost estimates for funding allocation requests.

    DATES:

    The guidance and voluntary best practices provided in this document are applicable beginning October 27, 2021.

    Start Further Info

    FOR FURTHER INFORMATION CONTACT:

    Christopher Koves, Wireline Competition Bureau, 202-418-7400 or by emailing SupplyChain@fcc.gov.

    End Further Info End Preamble Start Supplemental Information

    SUPPLEMENTARY INFORMATION:

    This is a summary of the Commission's document (Public Notice), in WC Docket No. 18-89; DA 21-1234, released on September 30, 2021. The full text of this document is available at the following internet address: https://docs.fcc.gov/​public/​attachments/​DA-21-1234A1.pdf. Due to the COVID-19 pandemic, the Federal Communications Commission's headquarters will be closed to the general public until further notice. See FCC Announces Closure of FCC Headquarters Open Window and Change in Hand-Delivery Policy, Public Notice, DA 20-304 (March 19, 2020), https://www.fcc.gov/​document/​fcccloses-headquarters-open-window-andchanges-hand-delivery-policy.

    1. By this document, the Bureau provides guidance and voluntary best practices regarding the Secure (Reimbursement Program disposal and verification requirements to assist providers of advanced communications services participating in the Reimbursement Program. The Bureau finds that the best practices set forth in this guidance comply with the requirements in § 1.50004(j) of the Commission's rules. Reimbursement Program participants are free to choose alternative approaches to comply with the Reimbursement Program's disposal and verification requirements. In such instances, the Commission will review the specific circumstances to determine whether or not the alternative approach selected by the provider complies with the disposal and verification requirements set forth in § 1.50004(j) of the Commission's rules.

    2. Separately, pursuant to § 1.108 of the Commission's rules, the Bureau reconsiders and revises, on its own motion, the certifications contained in FCC Form 5640 Application Request for Funding Allocation and the Reimbursement Claim Request that the Bureau adopted in the Finalized Reimbursement Process Public Notification (PN), 86 FR 48521, August 31, 2021. These revised certifications will further protect the Reimbursement Program against waste, fraud, and abuse. The Bureau also makes minor corrections to certain cost estimates incorrectly identified in the Final Catalog of Eligible Expenses and Estimated Costs (Cost Catalog) adopted in the Finalized Reimbursement Process PN.

    3. Disposal and Verification Obligations. In accordance with the Secure and Trusted Communications Networks Act of 2019 (Secure Networks Act), the Commission adopted a rule requiring Reimbursement Program participants to: (1) “dispose of the covered communications equipment and services in a manner to prevent the equipment or service from being used in the networks of other advanced communications service providers;” and (2) “retain documentation demonstrating compliance with this requirement.” The disposal, according to the Commission, “must result in the destruction of the covered communications equipment or service, making the covered communications equipment or service inoperable permanently,” and participants “must retain documentation demonstrating compliance with this requirement.” The Commission also specifically prohibited the “transfer of covered communications equipment or service to non-U.S. providers in an operable state that would allow for use of the equipment or service in another provider's network, foreign or domestic.” The Commission expected the Bureau to provide participants with additional guidance with the disposal and verification process.

    4. Best Practices Overview. Based on comments addressing the disposal process filed in this docket, presentations from entities with disposal experience, and Bureau staff's review of similar disposal processes, it identifies certain voluntary “best practices,” in the released document, to help guide participants as they fulfill their Reimbursement Program disposal and verification obligations. These best practices include procedures to effectuate equipment removal, data destruction, media sanitization, storage, transportation, physical destruction and recycling, and also cover the selection of certified data sanitization services, equipment destruction services, and electronic waste (e-waste) recycling services. The best practices further discuss documentation sufficient to demonstrate compliance, including the use of detailed equipment inventories, certificates of media disposition, and certificates of destruction. While the best practices are voluntary, the Bureau finds that these practices will help companies meet their disposal obligations efficiently, while also ensuring the safe and secure removal and disposal of covered communications equipment and services that pose a national security threat consistent with the Secure Networks Act and the Commission's rules.

    5. Providers can employ alternative compliance measures, but risk the Commission subsequently finding that such measures are not in compliance with § 1.50004(j) of its rules. Non-compliance can result in the assessment of fines and forfeitures by the Commission and can also result in additional enforcement actions provided for in § 1.50005 of the Commission's rules, including the repayment of Reimbursement Program funding. The Commission directed the Office of Managing Director (OMD), or a third-party identified by OMD, to prepare a system to conduct audits and field investigations to ensure Reimbursement Program participants are acting in compliance with the Commission's rules. These audits and field investigations will include the inspection of documentation to verify compliance with the disposal and verification requirements in § 1.50004(j) of the Commission's rules.

    6. Providers participating in the Reimbursement Program are likely to encounter different categories of Start Printed Page 59305 covered communications equipment and services. These different categories may pose different security threats based on their individual capabilities, including processing and/or retaining sensitive network or customer identifiable information. Therefore, as part of the best practices, the Bureau identifies recommended practices for treating covered communications equipment based on the category of equipment. The Bureau understands that it may be more efficient for a destruction company to destroy and recycle a large amount of equipment at once, for example, by destroying all equipment in a box at one time that may include a combination of the categories of equipment described in the following, and the Bureau defers to both the provider and the destruction company as to the most efficient process to achieve the required disposal obligation.

    7. The categories are organized by level of risk, starting with equipment posing the highest risk, based on whether the equipment retains or processes data. Category 1 equipment is equipment that processes and retains data. Category 2 equipment is equipment that processes but does not retain data. Category 3 equipment is equipment that does not retain or process data. For category 1 equipment, the Bureau recommends the provider sanitize any media, followed by physical destruction and then recycling. For category 2 equipment, the Bureau recommends physical destruction and then recycling. For category 3 equipment, the Bureau recommends recycling this equipment. The Bureau will consider category 3 equipment as “inoperable” if permanently dismantled from other communications equipment and services and it is unable to be reconnected to any other communications equipment. Reimbursement Program participants are encouraged to retain certain documentation, based on the categories of covered communications equipment, including certificates of media disposition and certificates of destruction, which will help participants and the Bureau verify compliance with their disposal and verification obligations.

    8. Guidance is also provided on selecting certified disposal services and e-waste recyclers. If using a third party, the Bureau recommends using a company that provides complete asset management solutions, from removal to destruction, including transportation and chain of custody tracking to avoid the potential for misplaced or lost equipment containing sensitive information. Providers may utilize one company for the entire disposal and recycling process, or different companies for different aspects of the disposal and recycling process based upon the categories of covered communications equipment outlined in this document. Because the Commission in the 2020 Supply Chain Order, 86 FR 2904, January 13, 2021, prohibited the transfer of operable covered communications equipment or service to non-U.S. providers, the Bureau recommends providers use U.S. disposal companies that conduct the disposal process on U.S. soil. Equipment is still considered operable until it is properly disposed.

    9. In particular, the Bureau recommends providers use a U.S. disposal company registered with the U.S. Department of State's Directorate of Defense Trade Controls pursuant to the International Traffic in Arms Regulations (ITAR). The Bureau agrees with Advanced Technology Recycling that “utilizing ITAR processing guidelines is an ideal mechanism to ensure sensitive electronics as outlined in the [Secure Networks Act] are properly disposed of in a manner that protects national security.” While the covered communications equipment may not fall within the scope of ITAR, the Bureau finds that an ITAR-registered disposal company will likely have the procedures in place and the facilities necessary to effectively handle the safe and secure destruction of covered communications equipment, including the most sensitive equipment. The Bureau finds that, based on the record, ITAR-registered companies likely can provide complete asset management services, including tracking equipment, maintaining records, and documentation and certifying destruction. According to Advanced Technology Recycling, “ITAR registered service providers must follow strict disposal guidelines to ensure scrap materials generated throughout the disposal process remain on U.S. soil and be processed exclusively by U.S. persons.” ITAR-registered companies are required to maintain records concerning manufacture, acquisition, and disposition of defense articles, including technical data, subject to ITAR, and are subject to civil and criminal penalties for violations. According to Advanced Technology Recycling and Gannon & Scott, ITAR-registered companies may also hold e-waste recycling or other certifications and provide media sanitization services, allowing for a one-stop disposal facility to handle the disposal of different categories of equipment according to the best practices outlined in the released document.

    10. The Bureau agrees with Teltech Group that through the disposal process it should “consider environmental issues” so that the covered communications equipment “do not create environmental problems.” Accordingly, the Bureau recommends for providers to recycle covered communications equipment to ensure the secure and environmentally responsible disposal of equipment as recommended by the Environmental Protection Agency (EPA). Consistent with EPA guidelines, the Bureau recommends utilizing electronic waste (e-waste) recyclers that are certified by either the Responsible Recycling (R2) Standard for Electronics Recyclers or the e-Stewards Standard for Responsible Recycling and Reuse of Electronic Equipment (e-Stewards). As noted in this document, ITAR-registered companies may also hold R2 and e-Stewards certifications. For example, according to Advanced Technology Recycling, as an ITAR-registered disposal company, disposal processes are “carried out . . . at R2 certified and ITAR registered facilities.”

    11. The best practices also provide guidance on disposal verification documentation. The Bureau recommends providers retain shipping or transportation documentation, including detailed inventories supported by an affidavit, dates, locations, transportation service provider name, and means of transportation. These may be kept individually or as part of a larger asset management solution. Reimbursement Program participants are encouraged to retain documentation, including certificates of media disposition and certificates of destruction, that will help participants and the Bureau verify compliance with their disposal and verification obligations. These recommendations reflect input received from the Rural Wireless Association, Teltech Group, and the Competitive Carriers Association on the importance of tracking the removal and destruction of covered equipment and on clarifying the “level of detail any documentation will need to contain to be compliant.”

    12. In sum, these best practices will help ensure the security of sensitive data processed or retained by the covered equipment, including network and customer proprietary information, from unauthorized access. These best practices will also help participants comply with the requirements of § 1.50004(j) of the Commission's rules, to ensure that covered communications Start Printed Page 59306 equipment and service that pose an unacceptable risk to the national security of the United States or the security and safety of United States persons is made inoperable and recycled in an environmentally safe manner.

    13. Prospective-Only Guidance. The Rural Wireless Association asserts that some of its “members have already completed the destruction of, or are in the process of disposing of,” covered communications equipment. Providers of advanced communications services that have already removed and disposed of covered communications equipment or services could not have known the best practices provided in the released document. Accordingly, the Bureau will take this into account when evaluating compliance with § 1.50004(j) for disposal occurring prior to the release of these best practices. The Bureau expects providers have acted reasonably, however, in carrying out the safe and secure disposal of covered communications equipment and have retained sufficient documentation to verify the disposal efforts taken. To the extent that covered communications equipment is still in a provider's custody and not destroyed, providers are encouraged to follow the disposal guidance provided herein going forward.

    14. Reimbursement Program Certifications. Additionally, the Bureau, on its own motion pursuant to § 1.108 of the Commission's rules, hereby reconsiders and revises the certifications contained in the FCC Form 5640 Application Request for Funding Allocation and the Reimbursement Claim Request. These revised certifications, included in the release document, are consistent with the certifications recently employed for other funding programs implemented by the Commission and will further protect the Reimbursement Program from waste, fraud, and abuse.

    15. The Commission directed the Bureau to “create one or more forms to be used by entities to claim reimbursement from the Reimbursement Program, to report on their use of money disbursed and the status of their construction efforts, and for any other Reimbursement Program-related purposes.” The Commission also delegated authority to the Bureau to “adopt the necessary policies and procedures relating to allocations, draw downs, payments, obligations, and expenditures of money from the Reimbursement Program to protect against waste, fraud, and abuse . . . .” In the Reimbursement Process PN, 86 FR 31464, June 14, 2021, the Bureau sought comment on the proposed information fields for FCC Form 5640, including the form certifications required by applicants. The Bureau finalized the FCC Form 5640 Application Request for Funding Allocation and Reimbursement Claim Request in the Finalized Reimbursement Process PN.

    16. The Bureau, on its own motion, now reconsiders and revises these FCC Form 5640 certifications. The revised certifications largely track the substance of the prior certifications that were derived from the Secure Networks Act and the Commission's rules. However, to further protect the Reimbursement Program from waste, fraud, and abuse and to align the certifications with other recently implemented funding programs by the Commission, the Bureau has added additional certifications. For example, the Bureau now explicitly requires certifying officials to certify that they are authorized to certify on behalf of the applicant. The certifying official must also acknowledge that any false, fictitious, or fraudulent information or statement, or the omission of any material fact on the form or any other documents submitted may subject the participant to fine or forfeiture under the Communications Act, fine or imprisonment under Title 18 of the United States Code, or liability under the False Claims Act. The Bureau also requires certifying officials to acknowledge that failure to comply with the statute, rules, and orders governing the Reimbursement Program could result in civil and criminal prosecution by law enforcement authorities. The certifying official must further certify that the applicant will not use Reimbursement Program funds for any portion of expenses that have been or will be reimbursed by other sources of state or federal funding. This certification, in particular, is aimed at protecting against the receipt and use of duplicative funding from different state and federal sources. Finally, certifying officials will also need to certify that no “kickbacks” ( i.e., money or anything of value) were paid or received by the participant from a contractor or vendor in connection with the Reimbursement Program. Collectively, the revised and added certifications provide additional notice to certifying officials and applicants as to potential civil and criminal penalties for violating Reimbursement Program requirements and will strengthen the Commission's ability to investigate and hold applicants accountable for rule violations and fraudulent conduct. The text of the revised certifications can be found in Appendix B of the Public Notice, https://www.fcc.gov/​document/​wcb-announces-best-practices-supply-chain-equipment-disposal.

    17. These revised certifications will become effective immediately upon publication in the Federal Register , pursuant to section 553(d)(3) of the Administrative Procedure Act. The Bureau finds good cause exists for an expedited effective date to ensure these certifications can be included in the forms necessary for the expeditious opening of the Reimbursement Program filing window, which is now scheduled to occur on October 29, 2021. An expedited effective date will further assist the Commission in speedily addressing the pressing national security concerns that prompted the establishment this Reimbursement Program.

    18. Cost Catalog Corrections. Finally, the Bureau corrects cost estimates incorrectly identified in the Cost Catalog adopted on August 3, 2021, in the Finalized Reimbursement Process PN. Since the release of the Cost Catalog on August 3, 2021, the Bureau was made aware of a few instances where the cost estimate identified in that version of the Cost Catalog was listed incorrectly. Specifically, the average cost estimate reported for items 2.1.2 and, 2.2.3 was inaccurate given the range of cost estimates reported. In addition, the low-end cost range for item 5.16.5 was incorrectly listed as $1,7687.17 instead of $17,687.17. The average cost estimate for item 5.16.5 is, however, correct. Separately, the final version of the Cost Catalog incorrectly included a cost estimate for item 5.1.4 regarding “Participation for FCC Rulemaking” even though the Bureau explicitly called for the removal of this item in the Finalized Reimbursement Process PN. Accordingly, the Bureau will make these corrections to the Cost Catalog and publish a corrected version on the Commission's website.

    A. Paperwork Reduction Act of 1995 Analysis

    19. This document does not contain any new information collection(s) subject to the Paperwork Reduction Act of 1995 (PRA), Public Law 104-13. The Commission has separately sought and obtained approval, per the PRA, from the Office of Management and Budget (OMB) for the information collection requirements contained in the 2020 Supply Chain Order from which the rules and obligations discussed herein, where applicable, are derived. Therefore, this document does not contain any new or modified information collection burden for small Start Printed Page 59307 business concerns with fewer than 25 employees, pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107-198. While the revised certifications adopted in this document for the FCC Form 5640 are exempt from the requirements of the PRA, pursuant to 5 CFR 1320.3(h)(1), we will update the information on file for OMB Control No. 3060-1270 to reflect the revised certifications adopted herein for the FCC Form 5640.

    B. Congressional Review Act

    20. The Commission has determined, and the Administrator of the Office of Information and Regulatory Affairs, Office of Management and Budget, concurs, that these modified certification requirements are non-major under the Congressional Review Act, 5 U.S.C. 804(2). The Bureau will send a copy of this document to Congress and the Government Accountability Office pursuant to 5 U.S.C. 801(a)(1)(A).

    C. Final Regulatory Flexibility Certification

    The Regulatory Flexibility Act of 1980, as amended (RFA), requires that an agency prepare a regulatory flexibility analysis for notice and comment rulemakings, unless the agency certifies that “the rule will not, if promulgated, have a significant economic impact on a substantial number of small entities.” The RFA generally defines the term “small entity” as having the same meaning as the terms “small business,” “small organization,” and “small governmental jurisdiction.” In addition, the term “small business” has the same meaning as the term “small business concerns” under the Small Business Act. A “small business concern” is one that: (1) Is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the Small Business Administration (SBA). The Commission prepared Initial Regulatory Flexibility Analyses (IRFAs) in connection with the 2020 Supply Chain Declaratory Ruling, 85 FR 47211, August 4, 2020, and Second Further Notice of Proposed Rulemaking (FNPRM), 85 FR 48134, August 10, 2020, and the 2021 Supply Chain Third FNPRM, 86 FR 15165, March 22, 2021. The Commission sought written public comment on the proposals in the 2020 Supply Chain Declaratory Ruling and Second FNPRM and the 2021 Supply Chain Third FNPRM, including comments on the IRFAs. No comments were filed addressing the IRFAs. The Commission included Final Regulatory Flexibility Analyses (FRFAs) in connection with the 2020 Supply Chain Order and the 2021 Supply Chain Order, 86 FR 46995, August 23, 2021.

    21. This document provides: (1) Voluntary guidance on complying with the Reimbursement Program's disposal and verification requirements; (2) revises the certifications associated with the FCC Form 5640 application filings; and (3) corrects cost estimates identified in the Cost Catalog that were listed incorrectly. These actions flow from the proposals set forth in the 2020 Supply Chain Declaratory Ruling and Second FNPRM and the 2021 Supply Chain Third FNPRM and discussed in the IRFAs accompanying those Notices, and are consistent with the requirements established in the 2020 Supply Chain Order and the 2021 Supply Chain Order and addressed in the FRFAs accompanying those orders. Accordingly, no changes to the earlier analyses are required.

    22. The Bureau has determined that the impact on the entities affected by the requirements contained in this document will not be significant. The effect of these measures is to establish for the benefit of those entities, including small entities, the procedures for filing an application consistent with existing rules, to participate in the Reimbursement Program to obtain funding support to remove from their networks, replace, and dispose of communications equipment and service considered a national security risk.

    23. Additional Information. For additional information about the Reimbursement Program application and filing process, interested parties should review the Finalized Reimbursement Process PN and visit the Reimbursement Program web page: https://www.fcc.gov/​supplychain. Questions specific to the Reimbursement Program or application process should be directed to the Reimbursement Program Fund Administrator by emailing SCRPFundAdmin@fcc.gov or by calling (202) 418-7540 from 9:00 a.m. ET to 5:00 p.m. ET, Monday through Friday, except for Federal holidays. For further information regarding this document, please contact supplychain@fcc.gov.

    Start Signature

    Federal Communications Commission.

    Cheryl Callahan,

    Assistant Chief, Telecommunications Access Policy Division, Wireline Competition Bureau.

    End Signature End Supplemental Information

    [FR Doc. 2021-23213 Filed 10-26-21; 8:45 am]

    BILLING CODE 6712-01-P

Document Information

Published:
10/27/2021
Department:
Federal Communications Commission
Entry Type:
Rule
Action:
Final action.
Document Number:
2021-23213
Dates:
The guidance and voluntary best practices provided in this document are applicable beginning October 27, 2021.
Pages:
59304-59307 (4 pages)
Docket Numbers:
WC Docket No. 18-89, DA 21-1234, FR ID 54036
PDF File:
2021-23213.pdf
CFR: (1)
47 CFR 54