Protecting Against National Security Threats to the Communications Supply Chain Through the Equipment Authorization Program and the Competitive Bidding Program, 46641-46644 [2021-16087]

Download as PDF Federal Register / Vol. 86, No. 158 / Thursday, August 19, 2021 / Proposed Rules FEDERAL COMMUNICATIONS COMMISSION 47 CFR Part 2 [ET Docket No. 21–232, EA Docket No. 21– 233; FCC 21–73; FR ID 39556] Protecting Against National Security Threats to the Communications Supply Chain Through the Equipment Authorization Program and the Competitive Bidding Program Federal Communications Commission. ACTION: Request for comments. lotter on DSK11XQN23PROD with PROPOSALS1 AGENCY: SUMMARY: The Commission seeks comment on how to leverage its equipment authorization program to encourage manufacturers who are building devices that will connect to U.S. networks to consider cybersecurity standards and guidelines. DATES: Comments are due on or before September 20, 2021; reply comments are due on or before October 18, 2021. ADDRESSES: You may submit comments, identified by ET Docket No. 21–232, by any of the following methods: • Federal Communications Commission’s Website: https:// apps.fcc.gov/ecfs/. Follow the instructions for submitting comments. • Mail: Filings can be sent by hand or messenger delivery, by commercial overnight courier, or by first-class or overnight U.S. Postal Service mail. All filings must be addressed to the Commission’s Secretary Office of the Secretary, Federal Communications Commission. For detailed instructions for submitting comments and additional information on the rulemaking process, see the SUPPLEMENTARY INFORMATION section of this document. FOR FURTHER INFORMATION CONTACT: Jamie Coleman Office of Engineering and Technology, 202–418–2705, Jamie.Coleman@fcc.gov. SUPPLEMENTARY INFORMATION: This is a summary of the Commission’s Notice of Inquiry (NOI), that is part of ET Docket No. 21–232, EA Docket No. 21–233, FCC 21–73, that was adopted and released June 17, 2021. The full text of this document is available by downloading the text from the Commission’s website at: https://www.fcc.gov/document/ equipment-authorization-andcompetitive-bidding-supply-chainnprm. When the FCC Headquarters reopens to the public, the full text of this document will also be available for public inspection and copying during regular business hours in the FCC Reference Center, 45 L Street NE, VerDate Sep<11>2014 16:45 Aug 18, 2021 Jkt 253001 Washington, DC 20554. Alternative formats are available for people with disabilities (Braille, large print, electronic files, audio format), by sending an email to fcc504@fcc.gov or calling the Consumer and Governmental Affairs Bureau at 202–418–0530 (voice), 202–418–0432 (TTY). Comment Filing Procedures Pursuant to §§ 1.415 and 1.419 of the Commission’s rules, 47 CFR 1.415, 1.419, interested parties may file comments and reply comments on or before the dates indicated on the first page of this document. Comments may be filed using the Commission’s Electronic Comment Filing System (ECFS). See Electronic Filing of Documents in Rulemaking Proceedings, 63 FR 24121 (1998). • Electronic Filers: Comments may be filed electronically using the internet by accessing the ECFS: https://apps.fcc.gov/ ecfs/. • Paper Filers: Parties who choose to file by paper must file an original and one copy of each filing. • Filings can be sent by commercial overnight courier, or by first-class or overnight U.S. Postal Service mail. All filings must be addressed to the Commission’s Secretary, Office of the Secretary, Federal Communications Commission. • Commercial overnight mail (other than U.S. Postal Service Express Mail and Priority Mail) must be sent to 9050 Junction Drive, Annapolis Junction, MD 20701. • U.S. Postal Service first-class, Express, and Priority mail must be addressed to 45 L Street NE, Washington, DC 20554. • Effective March 19, 2020, and until further notice, the Commission no longer accepts any hand or messenger delivered filings. This is a temporary measure taken to help protect the health and safety of individuals, and to mitigate the transmission of COVID–19. See FCC Announces Closure of FCC Headquarters Open Window and Change in Hand-Delivery Policy, Public Notice, DA 20–304 (March 19, 2020). https://www.fcc.gov/document/fcccloses-headquarters-open-window-andchanges-hand-delivery-policy. Initial Paperwork Reduction Act of 1995 Analysis This document does not contain proposed information collection requirements subject to the Paperwork Reduction Act of 1995, Public Law 104– 13. In addition, therefore, it does not contain any proposed information collection burden for small business concerns with fewer than 25 employees, PO 00000 Frm 00036 Fmt 4702 Sfmt 4702 46641 pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107–198, see 44 U.S.C. 3506(c)(4). Ex Parte Rules—Permit-But-Disclose The proceeding this NOI initiates shall be treated as a ‘‘permit-butdisclose’’ proceeding in accordance with the Commission’s ex parte rules, 47 CFR 1.1200 et seq. Persons making ex parte presentations must file a copy of any written presentation or a memorandum summarizing any oral presentation within two business days after the presentation (unless a different deadline applicable to the Sunshine period applies). Persons making oral ex parte presentations are reminded that memoranda summarizing the presentation must (1) list all persons attending or otherwise participating in the meeting at which the ex parte presentation was made, and (2) summarize all data presented and arguments made during the presentation. If the presentation consisted in whole or in part of the presentation of data or arguments already reflected in the presenter’s written comments, memoranda or other filings in the proceeding, the presenter may provide citations to such data or arguments in his or her prior comments, memoranda, or other filings (specifying the relevant page and/or paragraph numbers where such data or arguments can be found) in lieu of summarizing them in the memorandum. Documents shown or given to Commission staff during ex parte meetings are deemed to be written ex parte presentations and must be filed consistent with rule 1.1206(b). In proceedings governed by rule 1.49(f) or for which the Commission has made available a method of electronic filing, written ex parte presentations and memoranda summarizing oral ex parte presentations, and all attachments thereto, must be filed through the electronic comment filing system available for that proceeding, and must be filed in their native format (e.g., .doc, .xml, .ppt, searchable .pdf). Participants in this proceeding should familiarize themselves with the Commission’s ex parte rules. Synopsis The Commission adopted this Notice of Inquiry (NOI) in conjunction with a Notice of Proposed Rulemaking, ET Docket No. 21–232, EA Docket No. 21– 233, FCC 21–73, in which it proposes direct action to limit the presence of untrusted equipment and services in U.S. networks. The Commission believes that ensuring continued U.S. leadership requires that the Commission E:\FR\FM\19AUP1.SGM 19AUP1 lotter on DSK11XQN23PROD with PROPOSALS1 46642 Federal Register / Vol. 86, No. 158 / Thursday, August 19, 2021 / Proposed Rules also explore opportunities to spur trustworthy innovation for more secure equipment. In this NOI, the Commission seeks comment on how the Commission can leverage its equipment authorization program to encourage manufacturers who are building devices that will connect to U.S. networks to consider cybersecurity standards and guidelines. The development and implementation of effective cybersecurity practices requires the continued cooperation and participation of all stakeholders. In this regard, the Commission observes that both the public and private sectors have come together to develop measures to protect the integrity of communications networks and guard against malicious or foreign intrusions that can compromise network services, steal proprietary information, and harm consumers. In particular, the National Institute of Standards and Technology (NIST) has worked with both industry and government to produce multiple cybersecurity frameworks and other forms of guidance that help protect the integrity of communications networks. Pursuant to Executive Order No. 13636, NIST began working with public and private stakeholders to develop a voluntary cybersecurity framework designed to reduce risks to critical infrastructure. Exec. Order No. 13636, 78 FR 11737 (Feb. 19, 2013; see Nat’l Inst. of Standards & Tech., Cybersecurity Framework: New to Framework (last updated Sept. 23, 2020), https:// www.nist.gov/cyberframework/newframework. This framework consists of ‘‘voluntary guidance, based on existing standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk.’’ See Nat’l Inst. of Standards & Tech., Cybersecurity Framework: New to Framework (last updated Sept. 23, 2020), https:// www.nist.gov/cyberframework/newframework. Originally issued in 2013, the NIST cybersecurity framework was updated in 2018 to clarify and refine certain aspects and better explain how entities should use the framework to improve their cybersecurity practices. See Nat’l Inst. of Standards & Tech., Framework for Improving Critical Infrastructure Cybersecurity: Version 1.1 (Apr. 16, 2018), https:// nvlpubs.nist.gov/nistpubs/CSWP/ NIST.CSWP.04162018.pdf. In addition, among other organizations, the Federal Trade Commission has been active in cybersecurity matters for years, bringing multiple enforcement actions against firms for having poor cybersecurity practices and offering cybersecurity guidance for Internet of Things (IoT) VerDate Sep<11>2014 16:45 Aug 18, 2021 Jkt 253001 devices as early as 2015. Fed. Trade Comm’n, Careful Connections: Building Security in the Internet of Things (Jan. 2015), https://www.bulkorder.ftc.gov/ system/files/publications/pdf0199carefulconnections-buildingsecurity internetofthings.pdf. Further, industry trade groups, including CTIA–The Wireless Association, GSMA, the ioXt Alliance, and TIA have produced cybersecurity guidance applicable to various sectors of the communications industry. Non-profit standards bodies and think tanks have also produced cybersecurity guidance that could be useful to the communications industry. See, e.g., internet Soc’y, Internet of Things (IoT) Trust Framework v2.5 (May 22, 2019), https:// www.internetsociety.org/resources/doc/ 2018/iot-trust-framework-v2-5/. More recently, NIST has developed a Cybersecurity for IoT Program, which specifically ‘‘supports the development and application of standards, guidelines, and related tools to improve the cybersecurity of connected devices and the environments in which they are deployed.’’ Nat’l Inst. of Standards & Tech., NIST Cybersecurity for IoT Program (last updated Mar. 19, 2021), https://www.nist.gov/programs-projects/ nist-cybersecurity-iot-program. Devices that operate as part of the IoT specifically raise concerns about security risks. For example, NTIA has recognized that connected devices in the IoT can extend the scope and scale of automated, distributed attacks. This Cybersecurity for IoT program has produced multiple reports, but perhaps most notable is Internal Report 8259, released in May 2020. Nat’l Inst. of Standards & Tech., Foundational Cybersecurity Activities for IoT Device Manufacturers, Internal Report 8259 (May 2020) (NIST IoT Report), https:// nvlpubs.nist.gov/nistpubs/ir/2020/ NIST.IR.8259.pdf. This NIST IoT Report details activities that ‘‘can help manufacturers lessen the cybersecurityrelated efforts needed by customers, which in turn can reduce the prevalence and severity of IoT device compromises and the attacks performed using compromised devices.’’ Id. The NIST IoT Report is voluntary guidance intended to help promote the best available practices for mitigating risks to IoT security. The report describes six recommended foundational cybersecurity activities that manufacturers should consider performing to improve the securability of the new IoT devices they make. They include identifying expected customers and users and defining expected use cases; researching customer cybersecurity needs and goals; PO 00000 Frm 00037 Fmt 4702 Sfmt 4702 determining how to address customer needs and goals; planning for adequate support of customer needs and goals; defining approaches for communicating to customers; and deciding what to communicate to customers and how to communicate it. These activities are intended to fit within a manufacturer’s existing development process. The Commission seeks comment on how it can leverage its equipment authorization program to help address the particular security risks that are associated with IoT devices. Should the Commission encourage manufacturers of IoT devices to follow the guidance in the NIST IoT Report? If the Commission were to utilize the equipment authorization process to incentivize better cybersecurity practices, either for all devices or specifically for IoT devices, what form should such provisions take and how would such a program be structured most effectively? Should the FCC allow IoT manufacturers to voluntarily certify during the equipment authorization process that they have performed or plan to perform the activities described in the guidance? Are there other technologies or cybersecurity methods that mitigate security risks (e.g., RF fingerprinting or some other method)? What, if anything, should the Commission be doing to encourage development and adoption of such technologies or methods? Which standards should be considered? Are there other incentives or considerations that could encourage manufacturers to build security into their products? Commenters should discuss the potential costs and benefits associated with their proposals or with the potential approaches discussed herein. Even with broad adoption of industry best practices and standards, some equipment sold in the United States may lack appropriate security protections. What is the role of retailers in voluntarily limiting the sale of such equipment? How can retailers educate consumers about the importance of security protections for their devices? The Commission also seeks to understand developments in international standards-setting bodies. What is the status of international standards-setting that could be relevant to supply chain security, and what can the FCC do to encourage action by international standards-setting bodies and participation by American companies in their efforts? The Commission observes that the Consumer Technology Association (CTA) published a white paper offering guidance for how government, industry, and consumers can all work together to E:\FR\FM\19AUP1.SGM 19AUP1 Federal Register / Vol. 86, No. 158 / Thursday, August 19, 2021 / Proposed Rules lotter on DSK11XQN23PROD with PROPOSALS1 promote better cybersecurity practices going forward. Consumer Tech. Ass’n, Smart Policy to Secure our Smart Future: How to Promote a Secure Internet of Things for Consumers (Mar. 2021) (CTA Cybersecurity White Paper), https://www.cta.tech/Resources/ Newsroom/Media-Releases/2021/ March/IOT-Device-Security-WhitePaper-Release. In this white paper, CTA encourages public-private partnerships to develop and deploy risk-based approaches to cybersecurity, and argues that ‘‘neither the new Administration nor Congress should embrace rules, product labels or certification regimes for consumer IoT.’’ They claim that ‘‘[c]ybersecurity mandates, pre-market ‘approval,’ and government certification or labeling of IoT devices are likely to require an enormous bureaucracy and have unintended consequences.’’ The Commission seeks comment on these views. Are there any gaps in the NIST IoT Report or other federal efforts to address IoT security that the Commission could help address? The Commission recognizes that consideration of how to incentivize cybersecurity best practices through the equipment authorization process aligns closely with the recently issued Executive Order 14028, which directs NIST to work with the Federal Trade Commission and other agencies to develop a labeling program to identify specific IoT cybersecurity criteria and provide that information to consumers. Exec. Order No. 14028, Executive Order on Improving the Nation’s Cybersecurity, 86 FR 26633, 26640–41, § 4(s)–(u) (May 17, 2021). While the Director of NIST has not yet identified the agencies that will participate in the forthcoming IoT cybersecurity labeling program, the Commission seeks comment on whether the Commission can support these efforts, either directly or indirectly. If so, how? Legal Authority Adopting rules that take security into consideration in the equipment authorization process would serve the public interest by addressing significant national security risks that have been identified by this Commission in other proceedings, and by Congress and other federal agencies, and doing so would be consistent with the Commission’s statutory ‘‘purpose of regulating interstate and foreign commerce in communication by wire and radio . . . for the purpose of the national defense [and] for the purpose of promoting safety of life and property through the use of wire and radio communications.’’ 47 U.S.C. 151. The Commission tentatively concludes that doing so is VerDate Sep<11>2014 16:45 Aug 18, 2021 Jkt 253001 not specifically authorized by the Secure Networks Act itself, pursuant to which the Commission adopted the Covered List. However, the Commission has broad authority to adopt rules, not inconsistent with the Communications Act, ‘‘as may be necessary in the execution of its functions.’’ 47 U.S.C. 154(i). The Commission believes that, in order to ensure that the Commission’s rules under the Secure Networks Act effectively preclude use of equipment on the Covered List by USF recipients as contemplated by Congress, it is necessary to rely on the Commission’s established equipment authorization procedures to restrict further equipment authorization, and the importation and marketing, of such devices in the first instance. As discussed above, the Commission also relies on the equipment authorization process to implement other statutory duties, including the duty to promote efficient use of the radio spectrum, the duties under the National Environmental Policy Act to regulate human RF exposure, the Commission’s duty to ensure that mobile handsets are compatible with hearing aids, and the duty to deny federal benefits to certain individuals who have been convicted multiple times of federal offenses related to trafficking in or possession of controlled substances. The Commission believes that these processes can and should also serve the purpose of fulfilling other Commission responsibilities under the Secure Networks Act, and the Commission seeks comment on that issue. The Commission also believes that other authorities in the Communications Act of 1934, as amended, provide authority for the Commission to rely on for potential modifications to its rules and procedures governing equipment authorization. Since Congress added section 302 to the Act, the Commission’s part 2 equipment authorization rules and processes have served to ensure that RF equipment marketed, sold, imported, and used in the United States complies with the applicable rules governing use of such equipment. See Equipment Authorization of RF Devices, Docket No. 19356, Report and Order, 39 FR 5912, 5912, para. 2 (1970). That section authorizes the Commission to, ‘‘consistent with the public interest, convenience, and necessity, make reasonable regulations . . . governing the interference potential of devices which in their operation are capable of emitting radio frequency energy by radiation, conduction, or other means in sufficient degree to cause harmful PO 00000 Frm 00038 Fmt 4702 Sfmt 4702 46643 interference to radio communications.’’ 47 U.S.C. 302(a)(1). Regulations that the Commission adopts in implementing that authority ‘‘shall be applicable to the manufacture, import, sale, offer for sale, or shipment of such devices and . . . to the use of such devices.’’ 47 U.S.C. 302(a)(2). The authorization processes are primarily for the purpose of evaluating equipment’s compliance with technical specifications intended to minimize the interference potential of devices that emit RF energy. As noted above, however, these rules are also designed to implement other statutory responsibilities. The Commission seeks comment on the scope of the authority to rely on such rules to effectuate other public interest responsibilities, including the Commission’s section 303(e) authority to ‘‘[r]egulate the kind of apparatus to be used with respect to its external effects.’’ 47 U.S.C. 303(e). Section 302(a) directs the Commission to make reasonable regulations consistent with the public interest governing the interference potential of devices; it would appear to be in the public interest not to approve devices capable of emitting RF energy in sufficient degree to cause harmful interference to radio communications if such equipment has been deemed, pursuant to law, to pose an unacceptable risk to the national security of the United States or the security and safety of United States persons. The Commission seeks comment on this tentative conclusion. The Commission also seeks comment on a potential alternative basis for such security rules. The Communications Assistance for Law Enforcement Act (CALEA) includes security requirements that apply directly to equipment intended for use by providers of telecommunications services. 47 U.S.C. 1001–1010. Section 105 requires telecommunications carriers to ensure that the surveillance capabilities built into their networks ‘‘can be activated only in accordance with a court order or other lawful authorization and with the affirmative intervention of an individual officer or employee of the carrier acting in accordance with regulations prescribed by the Commission,’’ (47 U.S.C. 1004) and the Commission has concluded that its rule prohibiting the use of equipment produced or provided by any company posing a national security threat implements that provision. Supply Chain First Report and Order, 34 FCC Rcd at 11436–37, paras. 35–36. The Commission is required to prescribe rules necessary to implement CALEA’s requirements. 47 U.S.C. 229. E:\FR\FM\19AUP1.SGM 19AUP1 46644 Federal Register / Vol. 86, No. 158 / Thursday, August 19, 2021 / Proposed Rules As noted above, the Commission believes it has ancillary authority under section 4(i) of the Act to consider revisions to its part 2 rules as reasonably necessary to the effective enforcement of the Secure Networks Act. The Commission also tentatively concludes that such rules would be consistent with the Commission’s specific statutorily mandated responsibilities under the Communications Act to make reasonable regulations consistent with the public interest governing the interference potential of electronic devices, to protect consumers through the oversight of common carriers under Title II of that Act, and to prescribe the nature of services to be rendered by radio licensees under section 303(b) of that Act. The Commission seeks comment on this reasoning as well. The Commission also seeks comment on any other sources of authority for the Commission to propose rules as a result of this Notice of Inquiry. Federal Communications Commission. Marlene Dortch, Secretary. [FR Doc. 2021–16087 Filed 8–18–21; 8:45 am] BILLING CODE 6712–01–P FEDERAL COMMUNICATIONS COMMISSION 47 CFR Part 2 [ET Docket No. 21–232, EA Docket No. 21– 233; FCC 21–73; FR ID 39522] Protecting Against National Security Threats to the Communications Supply Chain Through the Equipment Authorization Program and the Competitive Bidding Program Federal Communications Commission. ACTION: Proposed rule. lotter on DSK11XQN23PROD with PROPOSALS1 AGENCY: SUMMARY: The Commission proposes to revise rules related to its equipment authorization processes to prohibit authorization of any ‘‘covered’’ equipment on the recently established Covered List. The Commission also seeks comment on whether to require additional certification relating to national security from applicants who wish to participate in the Commission’s competitive bidding auctions. This action explores steps the Commission can take to further its goal of protecting communications networks from communications equipment and services that pose a national security risk. Comments are due September 20, 2021. Reply comments are due DATES: VerDate Sep<11>2014 16:45 Aug 18, 2021 Jkt 253001 October 18, 2021. Written comments on the Paperwork Reduction Act proposed information collection requirements must be submitted by the public, Office of Management and Budget (OMB), and other interested parties on or before October 18, 2021. ADDRESSES: You may submit comments, identified by ET Docket No. 21–232, by any of the following methods: • Electronic Filers: Comments may be filed electronically using the internet by accessing the ECFS: https://apps.fcc.gov/ ecfs/. • Paper Filers: Parties who choose to file by paper must file an original and one copy of each filing. • Filings can be sent by commercial overnight courier, or by first-class or overnight U.S. Postal Service mail. All filings must be addressed to the Commission’s Secretary, Office of the Secretary, Federal Communications Commission. • Commercial overnight mail (other than U.S. Postal Service Express Mail and Priority Mail) must be sent to 9050 Junction Drive, Annapolis Junction, MD 20701. • U.S. Postal Service first-class, Express, and Priority mail must be addressed to 45 L Street NE, Washington, DC 20554. • Effective March 19, 2020, and until further notice, the Commission no longer accepts any hand or messenger delivered filings. This is a temporary measure taken to help protect the health and safety of individuals, and to mitigate the transmission of COVID–19. See FCC Announces Closure of FCC Headquarters Open Window and Change in Hand-Delivery Policy, Public Notice, DA 20–304 (March 19, 2020). https://www.fcc.gov/document/fcccloses-headquarters-open-window-andchanges-hand-delivery-policy. People with disabilities: To request materials in accessible formats for people with disabilities (braille, large print, electronic files, audio format), send an email to fcc504@fcc.gov or calling the Consumer and Governmental Affairs Bureau at 202–418–0530 (voice), 202–418–0432 (TTY). FOR FURTHER INFORMATION CONTACT: Jamie Coleman, Office of Engineering and Technology, 202–418–2705, Jamie.Coleman@fcc.gov. For information regarding the PRA information collection requirements contained in this PRA, contact Nicole Ongele, Office of Managing Director, at (202) 418–2991 or Nicole.Ongele@ fcc.gov. SUPPLEMENTARY INFORMATION: This is a summary of the Commission’s Notice of Proposed Rulemaking (NPRM), in ET PO 00000 Frm 00039 Fmt 4702 Sfmt 4702 Docket No. 21–232 and EA Docket No. 21–233; FCC 21–73, adopted and released June 17, 2021. The full text of this document is available by downloading the text from the Commission’s website at: https:// www.fcc.gov/document/equipmentauthorization-and-competitive-biddingsupply-chain-nprm. When the FCC Headquarters reopens to the public, the full text of this document will also be available for public inspection and copying during regular business hours in the FCC Reference Center, 45 L Street NE, Washington, DC 20554. Initial Paperwork Reduction Act of 1995 Analysis This document contains proposed information collection requirements. The Commission, as part of its continuing effort to reduce paperwork burdens, invites the general public and the Office of Management and Budget (OMB) to comment on the information collection requirements contained in this document, as required by the Paperwork Reduction Act of 1995, Public Law 104–13. Public and agency comments are due October 18, 2021. Comments should address: (a) Whether the proposed collection of information is necessary for the proper performance of the functions of the Commission, including whether the information shall have practical utility; (b) the accuracy of the Commission’s burden estimates; (c) ways to enhance the quality, utility, and clarity of the information collected; (d) ways to minimize the burden of the collection of information on the respondents, including the use of automated collection techniques or other forms of information technology; and (e) way to further reduce the information collection burden on small business concerns with fewer than 25 employees. In addition, pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107–198, see 44 U.S.C. 3506(c)(4), we seek specific comment on how we might further reduce the information collection burden for small business concerns with fewer than 25 employees. OMB Control Number: 3060–0057. Title: Application for Equipment Authorization, FCC Form 731. Form No.: FCC Form 731. Type of Review: Revision of a currently approved collection. Respondents: Business or other forprofit. Number of Respondents and Responses: 11,305 respondents; 24,873 responses. Estimated Time per Response: 8.11 hours (rounded). E:\FR\FM\19AUP1.SGM 19AUP1

Agencies

[Federal Register Volume 86, Number 158 (Thursday, August 19, 2021)]
[Proposed Rules]
[Pages 46641-46644]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2021-16087]



[[Page 46641]]

=======================================================================
-----------------------------------------------------------------------

FEDERAL COMMUNICATIONS COMMISSION

47 CFR Part 2

[ET Docket No. 21-232, EA Docket No. 21-233; FCC 21-73; FR ID 39556]


Protecting Against National Security Threats to the 
Communications Supply Chain Through the Equipment Authorization Program 
and the Competitive Bidding Program

AGENCY: Federal Communications Commission.

ACTION: Request for comments.

-----------------------------------------------------------------------

SUMMARY: The Commission seeks comment on how to leverage its equipment 
authorization program to encourage manufacturers who are building 
devices that will connect to U.S. networks to consider cybersecurity 
standards and guidelines.

DATES: Comments are due on or before September 20, 2021; reply comments 
are due on or before October 18, 2021.

ADDRESSES: You may submit comments, identified by ET Docket No. 21-232, 
by any of the following methods:
     Federal Communications Commission's Website: https://apps.fcc.gov/ecfs/. Follow the instructions for submitting comments.
     Mail: Filings can be sent by hand or messenger delivery, 
by commercial overnight courier, or by first-class or overnight U.S. 
Postal Service mail. All filings must be addressed to the Commission's 
Secretary Office of the Secretary, Federal Communications Commission.
    For detailed instructions for submitting comments and additional 
information on the rulemaking process, see the SUPPLEMENTARY 
INFORMATION section of this document.

FOR FURTHER INFORMATION CONTACT: Jamie Coleman Office of Engineering 
and Technology, 202-418-2705, [email protected].

SUPPLEMENTARY INFORMATION: This is a summary of the Commission's Notice 
of Inquiry (NOI), that is part of ET Docket No. 21-232, EA Docket No. 
21-233, FCC 21-73, that was adopted and released June 17, 2021. The 
full text of this document is available by downloading the text from 
the Commission's website at: https://www.fcc.gov/document/equipment-authorization-and-competitive-bidding-supply-chain-nprm. When the FCC 
Headquarters reopens to the public, the full text of this document will 
also be available for public inspection and copying during regular 
business hours in the FCC Reference Center, 45 L Street NE, Washington, 
DC 20554. Alternative formats are available for people with 
disabilities (Braille, large print, electronic files, audio format), by 
sending an email to [email protected] or calling the Consumer and 
Governmental Affairs Bureau at 202-418-0530 (voice), 202-418-0432 
(TTY).

Comment Filing Procedures

    Pursuant to Sec. Sec.  1.415 and 1.419 of the Commission's rules, 
47 CFR 1.415, 1.419, interested parties may file comments and reply 
comments on or before the dates indicated on the first page of this 
document. Comments may be filed using the Commission's Electronic 
Comment Filing System (ECFS). See Electronic Filing of Documents in 
Rulemaking Proceedings, 63 FR 24121 (1998).
     Electronic Filers: Comments may be filed electronically 
using the internet by accessing the ECFS: https://apps.fcc.gov/ecfs/.
     Paper Filers: Parties who choose to file by paper must 
file an original and one copy of each filing.
     Filings can be sent by commercial overnight courier, or by 
first-class or overnight U.S. Postal Service mail. All filings must be 
addressed to the Commission's Secretary, Office of the Secretary, 
Federal Communications Commission.
     Commercial overnight mail (other than U.S. Postal Service 
Express Mail and Priority Mail) must be sent to 9050 Junction Drive, 
Annapolis Junction, MD 20701.
     U.S. Postal Service first-class, Express, and Priority 
mail must be addressed to 45 L Street NE, Washington, DC 20554.
     Effective March 19, 2020, and until further notice, the 
Commission no longer accepts any hand or messenger delivered filings. 
This is a temporary measure taken to help protect the health and safety 
of individuals, and to mitigate the transmission of COVID-19. See FCC 
Announces Closure of FCC Headquarters Open Window and Change in Hand-
Delivery Policy, Public Notice, DA 20-304 (March 19, 2020). https://www.fcc.gov/document/fcc-closes-headquarters-open-window-and-changes-hand-delivery-policy.

Initial Paperwork Reduction Act of 1995 Analysis

    This document does not contain proposed information collection 
requirements subject to the Paperwork Reduction Act of 1995, Public Law 
104-13. In addition, therefore, it does not contain any proposed 
information collection burden for small business concerns with fewer 
than 25 employees, pursuant to the Small Business Paperwork Relief Act 
of 2002, Public Law 107-198, see 44 U.S.C. 3506(c)(4).

Ex Parte Rules--Permit-But-Disclose

    The proceeding this NOI initiates shall be treated as a ``permit-
but-disclose'' proceeding in accordance with the Commission's ex parte 
rules, 47 CFR 1.1200 et seq. Persons making ex parte presentations must 
file a copy of any written presentation or a memorandum summarizing any 
oral presentation within two business days after the presentation 
(unless a different deadline applicable to the Sunshine period 
applies). Persons making oral ex parte presentations are reminded that 
memoranda summarizing the presentation must (1) list all persons 
attending or otherwise participating in the meeting at which the ex 
parte presentation was made, and (2) summarize all data presented and 
arguments made during the presentation. If the presentation consisted 
in whole or in part of the presentation of data or arguments already 
reflected in the presenter's written comments, memoranda or other 
filings in the proceeding, the presenter may provide citations to such 
data or arguments in his or her prior comments, memoranda, or other 
filings (specifying the relevant page and/or paragraph numbers where 
such data or arguments can be found) in lieu of summarizing them in the 
memorandum. Documents shown or given to Commission staff during ex 
parte meetings are deemed to be written ex parte presentations and must 
be filed consistent with rule 1.1206(b). In proceedings governed by 
rule 1.49(f) or for which the Commission has made available a method of 
electronic filing, written ex parte presentations and memoranda 
summarizing oral ex parte presentations, and all attachments thereto, 
must be filed through the electronic comment filing system available 
for that proceeding, and must be filed in their native format (e.g., 
.doc, .xml, .ppt, searchable .pdf). Participants in this proceeding 
should familiarize themselves with the Commission's ex parte rules.

Synopsis

    The Commission adopted this Notice of Inquiry (NOI) in conjunction 
with a Notice of Proposed Rulemaking, ET Docket No. 21-232, EA Docket 
No. 21-233, FCC 21-73, in which it proposes direct action to limit the 
presence of untrusted equipment and services in U.S. networks. The 
Commission believes that ensuring continued U.S. leadership requires 
that the Commission

[[Page 46642]]

also explore opportunities to spur trustworthy innovation for more 
secure equipment. In this NOI, the Commission seeks comment on how the 
Commission can leverage its equipment authorization program to 
encourage manufacturers who are building devices that will connect to 
U.S. networks to consider cybersecurity standards and guidelines.
    The development and implementation of effective cybersecurity 
practices requires the continued cooperation and participation of all 
stakeholders. In this regard, the Commission observes that both the 
public and private sectors have come together to develop measures to 
protect the integrity of communications networks and guard against 
malicious or foreign intrusions that can compromise network services, 
steal proprietary information, and harm consumers. In particular, the 
National Institute of Standards and Technology (NIST) has worked with 
both industry and government to produce multiple cybersecurity 
frameworks and other forms of guidance that help protect the integrity 
of communications networks. Pursuant to Executive Order No. 13636, NIST 
began working with public and private stakeholders to develop a 
voluntary cybersecurity framework designed to reduce risks to critical 
infrastructure. Exec. Order No. 13636, 78 FR 11737 (Feb. 19, 2013; see 
Nat'l Inst. of Standards & Tech., Cybersecurity Framework: New to 
Framework (last updated Sept. 23, 2020), https://www.nist.gov/cyberframework/new-framework. This framework consists of ``voluntary 
guidance, based on existing standards, guidelines, and practices for 
organizations to better manage and reduce cybersecurity risk.'' See 
Nat'l Inst. of Standards & Tech., Cybersecurity Framework: New to 
Framework (last updated Sept. 23, 2020), https://www.nist.gov/cyberframework/new-framework. Originally issued in 2013, the NIST 
cybersecurity framework was updated in 2018 to clarify and refine 
certain aspects and better explain how entities should use the 
framework to improve their cybersecurity practices. See Nat'l Inst. of 
Standards & Tech., Framework for Improving Critical Infrastructure 
Cybersecurity: Version 1.1 (Apr. 16, 2018), https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf. In addition, among other 
organizations, the Federal Trade Commission has been active in 
cybersecurity matters for years, bringing multiple enforcement actions 
against firms for having poor cybersecurity practices and offering 
cybersecurity guidance for Internet of Things (IoT) devices as early as 
2015. Fed. Trade Comm'n, Careful Connections: Building Security in the 
Internet of Things (Jan. 2015), https://www.bulkorder.ftc.gov/system/files/publications/pdf0199-carefulconnections-buildingsecurityinternetofthings.pdf. Further, industry trade groups, 
including CTIA-The Wireless Association, GSMA, the ioXt Alliance, and 
TIA have produced cybersecurity guidance applicable to various sectors 
of the communications industry. Non-profit standards bodies and think 
tanks have also produced cybersecurity guidance that could be useful to 
the communications industry. See, e.g., internet Soc'y, Internet of 
Things (IoT) Trust Framework v2.5 (May 22, 2019), https://www.internetsociety.org/resources/doc/2018/iot-trust-framework-v2-5/.
    More recently, NIST has developed a Cybersecurity for IoT Program, 
which specifically ``supports the development and application of 
standards, guidelines, and related tools to improve the cybersecurity 
of connected devices and the environments in which they are deployed.'' 
Nat'l Inst. of Standards & Tech., NIST Cybersecurity for IoT Program 
(last updated Mar. 19, 2021), https://www.nist.gov/programs-projects/nist-cybersecurity-iot-program. Devices that operate as part of the IoT 
specifically raise concerns about security risks. For example, NTIA has 
recognized that connected devices in the IoT can extend the scope and 
scale of automated, distributed attacks.
    This Cybersecurity for IoT program has produced multiple reports, 
but perhaps most notable is Internal Report 8259, released in May 2020. 
Nat'l Inst. of Standards & Tech., Foundational Cybersecurity Activities 
for IoT Device Manufacturers, Internal Report 8259 (May 2020) (NIST IoT 
Report), https://nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8259.pdf. 
This NIST IoT Report details activities that ``can help manufacturers 
lessen the cybersecurity-related efforts needed by customers, which in 
turn can reduce the prevalence and severity of IoT device compromises 
and the attacks performed using compromised devices.'' Id. The NIST IoT 
Report is voluntary guidance intended to help promote the best 
available practices for mitigating risks to IoT security. The report 
describes six recommended foundational cybersecurity activities that 
manufacturers should consider performing to improve the securability of 
the new IoT devices they make. They include identifying expected 
customers and users and defining expected use cases; researching 
customer cybersecurity needs and goals; determining how to address 
customer needs and goals; planning for adequate support of customer 
needs and goals; defining approaches for communicating to customers; 
and deciding what to communicate to customers and how to communicate 
it. These activities are intended to fit within a manufacturer's 
existing development process.
    The Commission seeks comment on how it can leverage its equipment 
authorization program to help address the particular security risks 
that are associated with IoT devices. Should the Commission encourage 
manufacturers of IoT devices to follow the guidance in the NIST IoT 
Report? If the Commission were to utilize the equipment authorization 
process to incentivize better cybersecurity practices, either for all 
devices or specifically for IoT devices, what form should such 
provisions take and how would such a program be structured most 
effectively? Should the FCC allow IoT manufacturers to voluntarily 
certify during the equipment authorization process that they have 
performed or plan to perform the activities described in the guidance? 
Are there other technologies or cybersecurity methods that mitigate 
security risks (e.g., RF fingerprinting or some other method)? What, if 
anything, should the Commission be doing to encourage development and 
adoption of such technologies or methods? Which standards should be 
considered? Are there other incentives or considerations that could 
encourage manufacturers to build security into their products? 
Commenters should discuss the potential costs and benefits associated 
with their proposals or with the potential approaches discussed herein.
    Even with broad adoption of industry best practices and standards, 
some equipment sold in the United States may lack appropriate security 
protections. What is the role of retailers in voluntarily limiting the 
sale of such equipment? How can retailers educate consumers about the 
importance of security protections for their devices? The Commission 
also seeks to understand developments in international standards-
setting bodies. What is the status of international standards-setting 
that could be relevant to supply chain security, and what can the FCC 
do to encourage action by international standards-setting bodies and 
participation by American companies in their efforts?
    The Commission observes that the Consumer Technology Association 
(CTA) published a white paper offering guidance for how government, 
industry, and consumers can all work together to

[[Page 46643]]

promote better cybersecurity practices going forward. Consumer Tech. 
Ass'n, Smart Policy to Secure our Smart Future: How to Promote a Secure 
Internet of Things for Consumers (Mar. 2021) (CTA Cybersecurity White 
Paper), https://www.cta.tech/Resources/Newsroom/Media-Releases/2021/March/IOT-Device-Security-White-Paper-Release. In this white paper, CTA 
encourages public-private partnerships to develop and deploy risk-based 
approaches to cybersecurity, and argues that ``neither the new 
Administration nor Congress should embrace rules, product labels or 
certification regimes for consumer IoT.'' They claim that 
``[c]ybersecurity mandates, pre-market `approval,' and government 
certification or labeling of IoT devices are likely to require an 
enormous bureaucracy and have unintended consequences.'' The Commission 
seeks comment on these views. Are there any gaps in the NIST IoT Report 
or other federal efforts to address IoT security that the Commission 
could help address?
    The Commission recognizes that consideration of how to incentivize 
cybersecurity best practices through the equipment authorization 
process aligns closely with the recently issued Executive Order 14028, 
which directs NIST to work with the Federal Trade Commission and other 
agencies to develop a labeling program to identify specific IoT 
cybersecurity criteria and provide that information to consumers. Exec. 
Order No. 14028, Executive Order on Improving the Nation's 
Cybersecurity, 86 FR 26633, 26640-41, Sec.  4(s)-(u) (May 17, 2021). 
While the Director of NIST has not yet identified the agencies that 
will participate in the forthcoming IoT cybersecurity labeling program, 
the Commission seeks comment on whether the Commission can support 
these efforts, either directly or indirectly. If so, how?

Legal Authority

    Adopting rules that take security into consideration in the 
equipment authorization process would serve the public interest by 
addressing significant national security risks that have been 
identified by this Commission in other proceedings, and by Congress and 
other federal agencies, and doing so would be consistent with the 
Commission's statutory ``purpose of regulating interstate and foreign 
commerce in communication by wire and radio . . . for the purpose of 
the national defense [and] for the purpose of promoting safety of life 
and property through the use of wire and radio communications.'' 47 
U.S.C. 151. The Commission tentatively concludes that doing so is not 
specifically authorized by the Secure Networks Act itself, pursuant to 
which the Commission adopted the Covered List. However, the Commission 
has broad authority to adopt rules, not inconsistent with the 
Communications Act, ``as may be necessary in the execution of its 
functions.'' 47 U.S.C. 154(i). The Commission believes that, in order 
to ensure that the Commission's rules under the Secure Networks Act 
effectively preclude use of equipment on the Covered List by USF 
recipients as contemplated by Congress, it is necessary to rely on the 
Commission's established equipment authorization procedures to restrict 
further equipment authorization, and the importation and marketing, of 
such devices in the first instance. As discussed above, the Commission 
also relies on the equipment authorization process to implement other 
statutory duties, including the duty to promote efficient use of the 
radio spectrum, the duties under the National Environmental Policy Act 
to regulate human RF exposure, the Commission's duty to ensure that 
mobile handsets are compatible with hearing aids, and the duty to deny 
federal benefits to certain individuals who have been convicted 
multiple times of federal offenses related to trafficking in or 
possession of controlled substances. The Commission believes that these 
processes can and should also serve the purpose of fulfilling other 
Commission responsibilities under the Secure Networks Act, and the 
Commission seeks comment on that issue.
    The Commission also believes that other authorities in the 
Communications Act of 1934, as amended, provide authority for the 
Commission to rely on for potential modifications to its rules and 
procedures governing equipment authorization. Since Congress added 
section 302 to the Act, the Commission's part 2 equipment authorization 
rules and processes have served to ensure that RF equipment marketed, 
sold, imported, and used in the United States complies with the 
applicable rules governing use of such equipment. See Equipment 
Authorization of RF Devices, Docket No. 19356, Report and Order, 39 FR 
5912, 5912, para. 2 (1970). That section authorizes the Commission to, 
``consistent with the public interest, convenience, and necessity, make 
reasonable regulations . . . governing the interference potential of 
devices which in their operation are capable of emitting radio 
frequency energy by radiation, conduction, or other means in sufficient 
degree to cause harmful interference to radio communications.'' 47 
U.S.C. 302(a)(1). Regulations that the Commission adopts in 
implementing that authority ``shall be applicable to the manufacture, 
import, sale, offer for sale, or shipment of such devices and . . . to 
the use of such devices.'' 47 U.S.C. 302(a)(2). The authorization 
processes are primarily for the purpose of evaluating equipment's 
compliance with technical specifications intended to minimize the 
interference potential of devices that emit RF energy. As noted above, 
however, these rules are also designed to implement other statutory 
responsibilities. The Commission seeks comment on the scope of the 
authority to rely on such rules to effectuate other public interest 
responsibilities, including the Commission's section 303(e) authority 
to ``[r]egulate the kind of apparatus to be used with respect to its 
external effects.'' 47 U.S.C. 303(e).
    Section 302(a) directs the Commission to make reasonable 
regulations consistent with the public interest governing the 
interference potential of devices; it would appear to be in the public 
interest not to approve devices capable of emitting RF energy in 
sufficient degree to cause harmful interference to radio communications 
if such equipment has been deemed, pursuant to law, to pose an 
unacceptable risk to the national security of the United States or the 
security and safety of United States persons. The Commission seeks 
comment on this tentative conclusion.
    The Commission also seeks comment on a potential alternative basis 
for such security rules. The Communications Assistance for Law 
Enforcement Act (CALEA) includes security requirements that apply 
directly to equipment intended for use by providers of 
telecommunications services. 47 U.S.C. 1001-1010. Section 105 requires 
telecommunications carriers to ensure that the surveillance 
capabilities built into their networks ``can be activated only in 
accordance with a court order or other lawful authorization and with 
the affirmative intervention of an individual officer or employee of 
the carrier acting in accordance with regulations prescribed by the 
Commission,'' (47 U.S.C. 1004) and the Commission has concluded that 
its rule prohibiting the use of equipment produced or provided by any 
company posing a national security threat implements that provision. 
Supply Chain First Report and Order, 34 FCC Rcd at 11436-37, paras. 35-
36. The Commission is required to prescribe rules necessary to 
implement CALEA's requirements. 47 U.S.C. 229.

[[Page 46644]]

    As noted above, the Commission believes it has ancillary authority 
under section 4(i) of the Act to consider revisions to its part 2 rules 
as reasonably necessary to the effective enforcement of the Secure 
Networks Act. The Commission also tentatively concludes that such rules 
would be consistent with the Commission's specific statutorily mandated 
responsibilities under the Communications Act to make reasonable 
regulations consistent with the public interest governing the 
interference potential of electronic devices, to protect consumers 
through the oversight of common carriers under Title II of that Act, 
and to prescribe the nature of services to be rendered by radio 
licensees under section 303(b) of that Act. The Commission seeks 
comment on this reasoning as well. The Commission also seeks comment on 
any other sources of authority for the Commission to propose rules as a 
result of this Notice of Inquiry.

Federal Communications Commission.
Marlene Dortch,
Secretary.
[FR Doc. 2021-16087 Filed 8-18-21; 8:45 am]
BILLING CODE 6712-01-P
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.