Wireline Competition Bureau Announces Best Practices for Equipment Disposal and Revises FCC Form 5640 Certifications for the Secure and Trusted Communications Networks Reimbursement Program, 59304-59307 [2021-23213]

Agencies

• FEDERAL COMMUNICATIONS COMMISSION

[Federal Register Volume 86, Number 205 (Wednesday, October 27, 2021)]
[Rules and Regulations]
[Pages 59304-59307]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2021-23213]



[[Page 59304]]

=======================================================================
-----------------------------------------------------------------------

FEDERAL COMMUNICATIONS COMMISSION

47 CFR Part 54

[WC Docket No. 18-89; DA 21-1234; FR ID 54036]


Wireline Competition Bureau Announces Best Practices for 
Equipment Disposal and Revises FCC Form 5640 Certifications for the 
Secure and Trusted Communications Networks Reimbursement Program

AGENCY: Federal Communications Commission.

ACTION: Final action.

-----------------------------------------------------------------------

SUMMARY: In this document, the Wireline Competition Bureau (Bureau) 
provides guidance and voluntary best practices regarding the Secure and 
Trusted Communications Networks Reimbursement Program (Reimbursement 
Program) disposal and verification requirements to assist providers of 
advanced communications services participating in the Reimbursement 
Program; revises the certification language in the FCC Form 5640, which 
participants must submit to request funding allocations and 
disbursements from the Reimbursement Program; and makes minor 
corrections to the Catalog of Eligible Expenses and Estimated Costs 
that is used by Reimbursement Program applicants to assist with 
reporting cost estimates for funding allocation requests.

DATES: The guidance and voluntary best practices provided in this 
document are applicable beginning October 27, 2021.

FOR FURTHER INFORMATION CONTACT: Christopher Koves, Wireline 
Competition Bureau, 202-418-7400 or by emailing [email protected].

SUPPLEMENTARY INFORMATION: This is a summary of the Commission's 
document (Public Notice), in WC Docket No. 18-89; DA 21-1234, released 
on September 30, 2021. The full text of this document is available at 
the following internet address: https://docs.fcc.gov/public/attachments/DA-21-1234A1.pdf. Due to the COVID-19 pandemic, the Federal 
Communications Commission's headquarters will be closed to the general 
public until further notice. See FCC Announces Closure of FCC 
Headquarters Open Window and Change in Hand-Delivery Policy, Public 
Notice, DA 20-304 (March 19, 2020), https://www.fcc.gov/document/fcccloses-headquarters-open-window-andchanges-hand-delivery-policy.
    1. By this document, the Bureau provides guidance and voluntary 
best practices regarding the Secure (Reimbursement Program disposal and 
verification requirements to assist providers of advanced 
communications services participating in the Reimbursement Program. The 
Bureau finds that the best practices set forth in this guidance comply 
with the requirements in Sec.  1.50004(j) of the Commission's rules. 
Reimbursement Program participants are free to choose alternative 
approaches to comply with the Reimbursement Program's disposal and 
verification requirements. In such instances, the Commission will 
review the specific circumstances to determine whether or not the 
alternative approach selected by the provider complies with the 
disposal and verification requirements set forth in Sec.  1.50004(j) of 
the Commission's rules.
    2. Separately, pursuant to Sec.  1.108 of the Commission's rules, 
the Bureau reconsiders and revises, on its own motion, the 
certifications contained in FCC Form 5640 Application Request for 
Funding Allocation and the Reimbursement Claim Request that the Bureau 
adopted in the Finalized Reimbursement Process Public Notification 
(PN), 86 FR 48521, August 31, 2021. These revised certifications will 
further protect the Reimbursement Program against waste, fraud, and 
abuse. The Bureau also makes minor corrections to certain cost 
estimates incorrectly identified in the Final Catalog of Eligible 
Expenses and Estimated Costs (Cost Catalog) adopted in the Finalized 
Reimbursement Process PN.
    3. Disposal and Verification Obligations. In accordance with the 
Secure and Trusted Communications Networks Act of 2019 (Secure Networks 
Act), the Commission adopted a rule requiring Reimbursement Program 
participants to: (1) ``dispose of the covered communications equipment 
and services in a manner to prevent the equipment or service from being 
used in the networks of other advanced communications service 
providers;'' and (2) ``retain documentation demonstrating compliance 
with this requirement.'' The disposal, according to the Commission, 
``must result in the destruction of the covered communications 
equipment or service, making the covered communications equipment or 
service inoperable permanently,'' and participants ``must retain 
documentation demonstrating compliance with this requirement.'' The 
Commission also specifically prohibited the ``transfer of covered 
communications equipment or service to non-U.S. providers in an 
operable state that would allow for use of the equipment or service in 
another provider's network, foreign or domestic.'' The Commission 
expected the Bureau to provide participants with additional guidance 
with the disposal and verification process.
    4. Best Practices Overview. Based on comments addressing the 
disposal process filed in this docket, presentations from entities with 
disposal experience, and Bureau staff's review of similar disposal 
processes, it identifies certain voluntary ``best practices,'' in the 
released document, to help guide participants as they fulfill their 
Reimbursement Program disposal and verification obligations. These best 
practices include procedures to effectuate equipment removal, data 
destruction, media sanitization, storage, transportation, physical 
destruction and recycling, and also cover the selection of certified 
data sanitization services, equipment destruction services, and 
electronic waste (e-waste) recycling services. The best practices 
further discuss documentation sufficient to demonstrate compliance, 
including the use of detailed equipment inventories, certificates of 
media disposition, and certificates of destruction. While the best 
practices are voluntary, the Bureau finds that these practices will 
help companies meet their disposal obligations efficiently, while also 
ensuring the safe and secure removal and disposal of covered 
communications equipment and services that pose a national security 
threat consistent with the Secure Networks Act and the Commission's 
rules.
    5. Providers can employ alternative compliance measures, but risk 
the Commission subsequently finding that such measures are not in 
compliance with Sec.  1.50004(j) of its rules. Non-compliance can 
result in the assessment of fines and forfeitures by the Commission and 
can also result in additional enforcement actions provided for in Sec.  
1.50005 of the Commission's rules, including the repayment of 
Reimbursement Program funding. The Commission directed the Office of 
Managing Director (OMD), or a third-party identified by OMD, to prepare 
a system to conduct audits and field investigations to ensure 
Reimbursement Program participants are acting in compliance with the 
Commission's rules. These audits and field investigations will include 
the inspection of documentation to verify compliance with the disposal 
and verification requirements in Sec.  1.50004(j) of the Commission's 
rules.
    6. Providers participating in the Reimbursement Program are likely 
to encounter different categories of

[[Page 59305]]

covered communications equipment and services. These different 
categories may pose different security threats based on their 
individual capabilities, including processing and/or retaining 
sensitive network or customer identifiable information. Therefore, as 
part of the best practices, the Bureau identifies recommended practices 
for treating covered communications equipment based on the category of 
equipment. The Bureau understands that it may be more efficient for a 
destruction company to destroy and recycle a large amount of equipment 
at once, for example, by destroying all equipment in a box at one time 
that may include a combination of the categories of equipment described 
in the following, and the Bureau defers to both the provider and the 
destruction company as to the most efficient process to achieve the 
required disposal obligation.
    7. The categories are organized by level of risk, starting with 
equipment posing the highest risk, based on whether the equipment 
retains or processes data. Category 1 equipment is equipment that 
processes and retains data. Category 2 equipment is equipment that 
processes but does not retain data. Category 3 equipment is equipment 
that does not retain or process data. For category 1 equipment, the 
Bureau recommends the provider sanitize any media, followed by physical 
destruction and then recycling. For category 2 equipment, the Bureau 
recommends physical destruction and then recycling. For category 3 
equipment, the Bureau recommends recycling this equipment. The Bureau 
will consider category 3 equipment as ``inoperable'' if permanently 
dismantled from other communications equipment and services and it is 
unable to be reconnected to any other communications equipment. 
Reimbursement Program participants are encouraged to retain certain 
documentation, based on the categories of covered communications 
equipment, including certificates of media disposition and certificates 
of destruction, which will help participants and the Bureau verify 
compliance with their disposal and verification obligations.
    8. Guidance is also provided on selecting certified disposal 
services and e-waste recyclers. If using a third party, the Bureau 
recommends using a company that provides complete asset management 
solutions, from removal to destruction, including transportation and 
chain of custody tracking to avoid the potential for misplaced or lost 
equipment containing sensitive information. Providers may utilize one 
company for the entire disposal and recycling process, or different 
companies for different aspects of the disposal and recycling process 
based upon the categories of covered communications equipment outlined 
in this document. Because the Commission in the 2020 Supply Chain 
Order, 86 FR 2904, January 13, 2021, prohibited the transfer of 
operable covered communications equipment or service to non-U.S. 
providers, the Bureau recommends providers use U.S. disposal companies 
that conduct the disposal process on U.S. soil. Equipment is still 
considered operable until it is properly disposed.
    9. In particular, the Bureau recommends providers use a U.S. 
disposal company registered with the U.S. Department of State's 
Directorate of Defense Trade Controls pursuant to the International 
Traffic in Arms Regulations (ITAR). The Bureau agrees with Advanced 
Technology Recycling that ``utilizing ITAR processing guidelines is an 
ideal mechanism to ensure sensitive electronics as outlined in the 
[Secure Networks Act] are properly disposed of in a manner that 
protects national security.'' While the covered communications 
equipment may not fall within the scope of ITAR, the Bureau finds that 
an ITAR-registered disposal company will likely have the procedures in 
place and the facilities necessary to effectively handle the safe and 
secure destruction of covered communications equipment, including the 
most sensitive equipment. The Bureau finds that, based on the record, 
ITAR-registered companies likely can provide complete asset management 
services, including tracking equipment, maintaining records, and 
documentation and certifying destruction. According to Advanced 
Technology Recycling, ``ITAR registered service providers must follow 
strict disposal guidelines to ensure scrap materials generated 
throughout the disposal process remain on U.S. soil and be processed 
exclusively by U.S. persons.'' ITAR-registered companies are required 
to maintain records concerning manufacture, acquisition, and 
disposition of defense articles, including technical data, subject to 
ITAR, and are subject to civil and criminal penalties for violations. 
According to Advanced Technology Recycling and Gannon & Scott, ITAR-
registered companies may also hold e-waste recycling or other 
certifications and provide media sanitization services, allowing for a 
one-stop disposal facility to handle the disposal of different 
categories of equipment according to the best practices outlined in the 
released document.
    10. The Bureau agrees with Teltech Group that through the disposal 
process it should ``consider environmental issues'' so that the covered 
communications equipment ``do not create environmental problems.'' 
Accordingly, the Bureau recommends for providers to recycle covered 
communications equipment to ensure the secure and environmentally 
responsible disposal of equipment as recommended by the Environmental 
Protection Agency (EPA). Consistent with EPA guidelines, the Bureau 
recommends utilizing electronic waste (e-waste) recyclers that are 
certified by either the Responsible Recycling (R2) Standard for 
Electronics Recyclers or the e-Stewards Standard for Responsible 
Recycling and Reuse of Electronic Equipment (e-Stewards). As noted in 
this document, ITAR-registered companies may also hold R2 and e-
Stewards certifications. For example, according to Advanced Technology 
Recycling, as an ITAR-registered disposal company, disposal processes 
are ``carried out . . . at R2 certified and ITAR registered 
facilities.''
    11. The best practices also provide guidance on disposal 
verification documentation. The Bureau recommends providers retain 
shipping or transportation documentation, including detailed 
inventories supported by an affidavit, dates, locations, transportation 
service provider name, and means of transportation. These may be kept 
individually or as part of a larger asset management solution. 
Reimbursement Program participants are encouraged to retain 
documentation, including certificates of media disposition and 
certificates of destruction, that will help participants and the Bureau 
verify compliance with their disposal and verification obligations. 
These recommendations reflect input received from the Rural Wireless 
Association, Teltech Group, and the Competitive Carriers Association on 
the importance of tracking the removal and destruction of covered 
equipment and on clarifying the ``level of detail any documentation 
will need to contain to be compliant.''
    12. In sum, these best practices will help ensure the security of 
sensitive data processed or retained by the covered equipment, 
including network and customer proprietary information, from 
unauthorized access. These best practices will also help participants 
comply with the requirements of Sec.  1.50004(j) of the Commission's 
rules, to ensure that covered communications

[[Page 59306]]

equipment and service that pose an unacceptable risk to the national 
security of the United States or the security and safety of United 
States persons is made inoperable and recycled in an environmentally 
safe manner.
    13. Prospective-Only Guidance. The Rural Wireless Association 
asserts that some of its ``members have already completed the 
destruction of, or are in the process of disposing of,'' covered 
communications equipment. Providers of advanced communications services 
that have already removed and disposed of covered communications 
equipment or services could not have known the best practices provided 
in the released document. Accordingly, the Bureau will take this into 
account when evaluating compliance with Sec.  1.50004(j) for disposal 
occurring prior to the release of these best practices. The Bureau 
expects providers have acted reasonably, however, in carrying out the 
safe and secure disposal of covered communications equipment and have 
retained sufficient documentation to verify the disposal efforts taken. 
To the extent that covered communications equipment is still in a 
provider's custody and not destroyed, providers are encouraged to 
follow the disposal guidance provided herein going forward.
    14. Reimbursement Program Certifications. Additionally, the Bureau, 
on its own motion pursuant to Sec.  1.108 of the Commission's rules, 
hereby reconsiders and revises the certifications contained in the FCC 
Form 5640 Application Request for Funding Allocation and the 
Reimbursement Claim Request. These revised certifications, included in 
the release document, are consistent with the certifications recently 
employed for other funding programs implemented by the Commission and 
will further protect the Reimbursement Program from waste, fraud, and 
abuse.
    15. The Commission directed the Bureau to ``create one or more 
forms to be used by entities to claim reimbursement from the 
Reimbursement Program, to report on their use of money disbursed and 
the status of their construction efforts, and for any other 
Reimbursement Program-related purposes.'' The Commission also delegated 
authority to the Bureau to ``adopt the necessary policies and 
procedures relating to allocations, draw downs, payments, obligations, 
and expenditures of money from the Reimbursement Program to protect 
against waste, fraud, and abuse . . . .'' In the Reimbursement Process 
PN, 86 FR 31464, June 14, 2021, the Bureau sought comment on the 
proposed information fields for FCC Form 5640, including the form 
certifications required by applicants. The Bureau finalized the FCC 
Form 5640 Application Request for Funding Allocation and Reimbursement 
Claim Request in the Finalized Reimbursement Process PN.
    16. The Bureau, on its own motion, now reconsiders and revises 
these FCC Form 5640 certifications. The revised certifications largely 
track the substance of the prior certifications that were derived from 
the Secure Networks Act and the Commission's rules. However, to further 
protect the Reimbursement Program from waste, fraud, and abuse and to 
align the certifications with other recently implemented funding 
programs by the Commission, the Bureau has added additional 
certifications. For example, the Bureau now explicitly requires 
certifying officials to certify that they are authorized to certify on 
behalf of the applicant. The certifying official must also acknowledge 
that any false, fictitious, or fraudulent information or statement, or 
the omission of any material fact on the form or any other documents 
submitted may subject the participant to fine or forfeiture under the 
Communications Act, fine or imprisonment under Title 18 of the United 
States Code, or liability under the False Claims Act. The Bureau also 
requires certifying officials to acknowledge that failure to comply 
with the statute, rules, and orders governing the Reimbursement Program 
could result in civil and criminal prosecution by law enforcement 
authorities. The certifying official must further certify that the 
applicant will not use Reimbursement Program funds for any portion of 
expenses that have been or will be reimbursed by other sources of state 
or federal funding. This certification, in particular, is aimed at 
protecting against the receipt and use of duplicative funding from 
different state and federal sources. Finally, certifying officials will 
also need to certify that no ``kickbacks'' (i.e., money or anything of 
value) were paid or received by the participant from a contractor or 
vendor in connection with the Reimbursement Program. Collectively, the 
revised and added certifications provide additional notice to 
certifying officials and applicants as to potential civil and criminal 
penalties for violating Reimbursement Program requirements and will 
strengthen the Commission's ability to investigate and hold applicants 
accountable for rule violations and fraudulent conduct. The text of the 
revised certifications can be found in Appendix B of the Public Notice, 
https://www.fcc.gov/document/wcb-announces-best-practices-supply-chain-equipment-disposal.
    17. These revised certifications will become effective immediately 
upon publication in the Federal Register, pursuant to section 553(d)(3) 
of the Administrative Procedure Act. The Bureau finds good cause exists 
for an expedited effective date to ensure these certifications can be 
included in the forms necessary for the expeditious opening of the 
Reimbursement Program filing window, which is now scheduled to occur on 
October 29, 2021. An expedited effective date will further assist the 
Commission in speedily addressing the pressing national security 
concerns that prompted the establishment this Reimbursement Program.
    18. Cost Catalog Corrections. Finally, the Bureau corrects cost 
estimates incorrectly identified in the Cost Catalog adopted on August 
3, 2021, in the Finalized Reimbursement Process PN. Since the release 
of the Cost Catalog on August 3, 2021, the Bureau was made aware of a 
few instances where the cost estimate identified in that version of the 
Cost Catalog was listed incorrectly. Specifically, the average cost 
estimate reported for items 2.1.2 and, 2.2.3 was inaccurate given the 
range of cost estimates reported. In addition, the low-end cost range 
for item 5.16.5 was incorrectly listed as $1,7687.17 instead of 
$17,687.17. The average cost estimate for item 5.16.5 is, however, 
correct. Separately, the final version of the Cost Catalog incorrectly 
included a cost estimate for item 5.1.4 regarding ``Participation for 
FCC Rulemaking'' even though the Bureau explicitly called for the 
removal of this item in the Finalized Reimbursement Process PN. 
Accordingly, the Bureau will make these corrections to the Cost Catalog 
and publish a corrected version on the Commission's website.

A. Paperwork Reduction Act of 1995 Analysis

    19. This document does not contain any new information 
collection(s) subject to the Paperwork Reduction Act of 1995 (PRA), 
Public Law 104-13. The Commission has separately sought and obtained 
approval, per the PRA, from the Office of Management and Budget (OMB) 
for the information collection requirements contained in the 2020 
Supply Chain Order from which the rules and obligations discussed 
herein, where applicable, are derived. Therefore, this document does 
not contain any new or modified information collection burden for small

[[Page 59307]]

business concerns with fewer than 25 employees, pursuant to the Small 
Business Paperwork Relief Act of 2002, Public Law 107-198. While the 
revised certifications adopted in this document for the FCC Form 5640 
are exempt from the requirements of the PRA, pursuant to 5 CFR 
1320.3(h)(1), we will update the information on file for OMB Control 
No. 3060-1270 to reflect the revised certifications adopted herein for 
the FCC Form 5640.

B. Congressional Review Act

    20. The Commission has determined, and the Administrator of the 
Office of Information and Regulatory Affairs, Office of Management and 
Budget, concurs, that these modified certification requirements are 
non-major under the Congressional Review Act, 5 U.S.C. 804(2). The 
Bureau will send a copy of this document to Congress and the Government 
Accountability Office pursuant to 5 U.S.C. 801(a)(1)(A).

C. Final Regulatory Flexibility Certification

    The Regulatory Flexibility Act of 1980, as amended (RFA), requires 
that an agency prepare a regulatory flexibility analysis for notice and 
comment rulemakings, unless the agency certifies that ``the rule will 
not, if promulgated, have a significant economic impact on a 
substantial number of small entities.'' The RFA generally defines the 
term ``small entity'' as having the same meaning as the terms ``small 
business,'' ``small organization,'' and ``small governmental 
jurisdiction.'' In addition, the term ``small business'' has the same 
meaning as the term ``small business concerns'' under the Small 
Business Act. A ``small business concern'' is one that: (1) Is 
independently owned and operated; (2) is not dominant in its field of 
operation; and (3) satisfies any additional criteria established by the 
Small Business Administration (SBA). The Commission prepared Initial 
Regulatory Flexibility Analyses (IRFAs) in connection with the 2020 
Supply Chain Declaratory Ruling, 85 FR 47211, August 4, 2020, and 
Second Further Notice of Proposed Rulemaking (FNPRM), 85 FR 48134, 
August 10, 2020, and the 2021 Supply Chain Third FNPRM, 86 FR 15165, 
March 22, 2021. The Commission sought written public comment on the 
proposals in the 2020 Supply Chain Declaratory Ruling and Second FNPRM 
and the 2021 Supply Chain Third FNPRM, including comments on the IRFAs. 
No comments were filed addressing the IRFAs. The Commission included 
Final Regulatory Flexibility Analyses (FRFAs) in connection with the 
2020 Supply Chain Order and the 2021 Supply Chain Order, 86 FR 46995, 
August 23, 2021.
    21. This document provides: (1) Voluntary guidance on complying 
with the Reimbursement Program's disposal and verification 
requirements; (2) revises the certifications associated with the FCC 
Form 5640 application filings; and (3) corrects cost estimates 
identified in the Cost Catalog that were listed incorrectly. These 
actions flow from the proposals set forth in the 2020 Supply Chain 
Declaratory Ruling and Second FNPRM and the 2021 Supply Chain Third 
FNPRM and discussed in the IRFAs accompanying those Notices, and are 
consistent with the requirements established in the 2020 Supply Chain 
Order and the 2021 Supply Chain Order and addressed in the FRFAs 
accompanying those orders. Accordingly, no changes to the earlier 
analyses are required.
    22. The Bureau has determined that the impact on the entities 
affected by the requirements contained in this document will not be 
significant. The effect of these measures is to establish for the 
benefit of those entities, including small entities, the procedures for 
filing an application consistent with existing rules, to participate in 
the Reimbursement Program to obtain funding support to remove from 
their networks, replace, and dispose of communications equipment and 
service considered a national security risk.
    23. Additional Information. For additional information about the 
Reimbursement Program application and filing process, interested 
parties should review the Finalized Reimbursement Process PN and visit 
the Reimbursement Program web page: https://www.fcc.gov/supplychain. 
Questions specific to the Reimbursement Program or application process 
should be directed to the Reimbursement Program Fund Administrator by 
emailing [email protected] or by calling (202) 418-7540 from 9:00 
a.m. ET to 5:00 p.m. ET, Monday through Friday, except for Federal 
holidays. For further information regarding this document, please 
contact [email protected]

Federal Communications Commission.
Cheryl Callahan,
Assistant Chief, Telecommunications Access Policy Division, Wireline 
Competition Bureau.
[FR Doc. 2021-23213 Filed 10-26-21; 8:45 am]
BILLING CODE 6712-01-P