Secure Internet Routing, 14006-14010 [2022-05121]
Download as PDF
<![CDATA[
lotter on DSK11XQN23PROD with NOTICES1
14006
Federal Register / Vol. 87, No. 48 / Friday, March 11, 2022 / Notices
providers of advanced communications
services. See Public Law 116–260,
Division N-Additional Coronavirus
Response and Relief, Title IX-Broadband
internet Access Service, §§ 901, 906, 134
Stat. 1182 (2020). The Commission has
interpreted the term ‘‘provider of
advanced communications service’’ to
mean ‘‘facilities-based providers,
whether fixed or mobile, with a
broadband connection to end users with
at least 200 kbps in one direction.’’
Second Report and Order, 35 FCC Rcd
at 14332, para. 111. Participation in the
Reimbursement Program is voluntary
but compliance with the new
information collection requirements is
required to obtain Reimbursement
Program support. The Commission
adopted a Third Report and Order on
July 13, 2021, implementing the
amendments to the Secure Networks
Act by the CAA for the Reimbursement
Program. See Protecting Against
National Security Threats to the
Communications Supply Chain Through
FCC Programs, WC Docket No. 18–89,
Third Report and Order, FCC 21–86 (rel.
July 14, 2021) (Third Report and Order).
Separate from the Reimbursement
Program, the Secure Networks Act
requires all providers of advanced
communications service to annually
report, with exception, on whether they
have purchased, rented, leased or
otherwise obtained covered
communications equipment or service
on or after certain dates. 47 U.S.C.
1603(d)(2)(B). The Second Report and
Order adopted a new information
collection requirement to implement
this statutory mandate. See Secure
Networks Act § 5. If the provider
certifies it does not have any covered
equipment and services, then the
provider is not required to subsequently
file an annual report, unless it later
obtains covered equipment and services.
Second Report and Order, 35 FCC Rcd
at 14370, at para. 215.
The Commission therefore propose to
revise this information collection, as
well as Form 5460, to reflect this new
requirement contained in the Public
Notice released by the Bureau on
August 3, 2021. This Public Notice,
among other things, requires providers
participating in the Reimbursement
Program to notify the Commission of
ownership changes using the FCC Form
5640 to ensure the accuracy of
information on file for program
participants when there is a change in
ownership.
VerDate Sep<11>2014
17:10 Mar 10, 2022
Jkt 256001
Federal Communications Commission.
Marlene Dortch,
Secretary, Office of the Secretary.
[FR Doc. 2022–05120 Filed 3–10–22; 8:45 am]
BILLING CODE 6712–01–P
FEDERAL COMMUNICATIONS
COMMISSION
[PS Docket No. 22–90, FCC 22–18; FRS
75229]
Secure Internet Routing
Federal Communications
Commission.
ACTION: Request for comments.
AGENCY:
In this document, the Federal
Communications Commission (FCC or
the Commission) seeks comment on
vulnerabilities threatening the security
and integrity of the Border Gateway
Protocol (BGP), which is central to the
Internet’s global routing system, its
impact on the transmission of data from
email, e-commerce, and bank
transactions to interconnected Voiceover Internet Protocol (VoIP) and 9–1–
1 calls, and how best to address them.
DATES: Comments are due on or before
April 11, 2022; and reply comments are
due on or before May 10, 2022.
ADDRESSES: You may submit comments,
identified by PS Docket No. 22–90, by
any of the following methods:
• Electronic Filers: Comments may be
filed electronically by accessing ECFS at
https://www.fcc.gov/ecfs.
• Paper Filers: Paper filings can be
sent by hand or messenger delivery, by
commercial overnight courier, or by
first-class or overnight U.S. Postal
Service mail.
• People with Disabilities: To request
materials in accessible formats for
people with disabilities (braille, large
print, electronic files, audio format),
send an email to fcc504@fcc.gov or call
the Consumer & Governmental Affairs
Bureau at 202–418–0530 (voice), 202–
418–0432 (tty).
For detailed instructions for
submitting comments and additional
information on this proceeding, see the
SUPPLEMENTARY INFORMATION section of
this document.
FOR FURTHER INFORMATION CONTACT: For
additional information on this
proceeding, contact James Wiley of the
Cybersecurity and Communications
Reliability Division, Public Safety and
Homeland Security Bureau, at
james.wiley@fcc.gov or (202) 418–1678
or Minsoo Kim of the Cybersecurity and
Communications Reliability Division,
Public Safety and Homeland Security
Bureau, at minsoo.kim@fcc.gov or (202)
418–1739.
SUMMARY:
PO 00000
Frm 00046
Fmt 4703
Sfmt 4703
This is a
summary of the Commission’s Notice of
Inquiry, FCC 22–18, released February
28, 2022. The full text of this document
is available at https://www.fcc.gov/
document/fcc-launches-inquiryinternet-routing-vulnerabilities.
Ex Parte Rules. This proceeding shall
be treated as a ‘‘permit-but-disclose’’
proceeding in accordance with the
Commission’s ex parte rules. Although
the rules do not generally require ex
parte presentations to be treated as
‘‘permit but disclose’’ in Notice of
Inquiry proceedings, the Commission
exercises its discretion in this instance,
and finds that the public interest is
served by making ex parte presentations
available to the public, in order to
encourage a robust record. Persons
making ex parte presentations must file
a copy of any written presentation or a
memorandum summarizing any oral
presentation within two business days
after the presentation (unless a different
deadline applicable to the Sunshine
period applies). Persons making oral ex
parte presentations are reminded that
memoranda summarizing the
presentation must (1) list all persons
attending or otherwise participating in
the meeting at which the ex parte
presentation was made, and (2)
summarize all data presented and
arguments made during the
presentation. If the presentation
consisted in whole or in part of the
presentation of data or arguments
already reflected in the presenter’s
written comments, memoranda, or other
filings in the proceeding, the presenter
may provide citations to such data or
arguments in his or her prior comments,
memoranda, or other filings (specifying
the relevant page and/or paragraph
numbers where such data or arguments
can be found) in lieu of summarizing
them in the memorandum. Documents
shown or given to Commission staff
during ex parte meetings are deemed to
be written ex parte presentations and
must be filed consistent with Rule
1.1206(b), 47 CFR 1.1206(b).
Participants in this proceeding should
familiarize themselves with the
Commission’s ex parte rules.
Confidentiality. The Commission
recognizes that some comments could
contain information that the submitter
believes should not be made available to
the general public because of
commercial or national security reasons.
Parties may request that such
information be kept confidential,
identifying the specific information
sought to be kept confidential,
providing the reasons for the request,
and otherwise following the procedures
set forth in section 0.459 of the
SUPPLEMENTARY INFORMATION:
E:\FR\FM\11MRN1.SGM
11MRN1
lotter on DSK11XQN23PROD with NOTICES1
Federal Register / Vol. 87, No. 48 / Friday, March 11, 2022 / Notices
Commission’s rules. If a party requests
confidential treatment of a comment, it
must file an original and one copy of the
confidential version of the comment on
paper, following the procedures below,
and a public version of the filing that
omits only the confidential information
and is otherwise identical to the
confidential version, using either the
electronic filing or the filing-by-paper
procedures below.
Comment Filing Procedures.
Interested parties may file comments
and reply comments on or before the
dates indicated on the first page of this
document. Comments may be filed
using the Commission’s Electronic
Comment Filing System (ECFS) or by
paper. All filings must be addressed to
the Commission’s Secretary, Office of
the Secretary, Federal Communications
Commission.
• Paper Filers: Parties who choose to
file by paper must file an original and
one copy of each filing. Paper filings can
be sent by hand or messenger delivery,
by commercial overnight courier, or by
first-class or overnight U.S. Postal
Service mail. All filings must be
addressed to the Commission’s
Secretary, Office of the Secretary,
Federal Communications Commission.
• Effective March 19, 2020, and until
further notice, the Commission no
longer accepts any hand or messenger
delivered filings. This is a temporary
measure taken to help protect the health
and safety of individuals, and to
mitigate the transmission of COVID–19.
See FCC Announces Closure of FCC
Headquarters Open Window and
Change in Hand-Delivery Policy, Public
Notice, 35 FCC Rcd 2788 (2020), https://
www.fcc.gov/document/fcc-closesheadquarters-open-window-andchanges-hand-delivery-policy.
• Commercial overnight mail (other
than U.S. Postal Service Express Mail
and Priority Mail) must be sent to 9050
Junction Drive, Annapolis Junction, MD
20701.
• U.S. Postal Service first-class,
Express, and Priority mail must be
addressed to 45 L Street NE,
Washington, DC 20554.
Availability of Documents.
Comments, reply comments, and ex
parte submissions will be publicly
available online via ECFS. These
documents will also be available for
public inspection during regular
business hours in the FCC Reference
Information Center, when FCC
Headquarters reopen to the public.
People with Disabilities. To request
materials in accessible formats for
people with disabilities (braille, large
print, electronic files, audio format),
send an email to fcc504@fcc.gov or call
VerDate Sep<11>2014
17:10 Mar 10, 2022
Jkt 256001
the Consumer & Governmental Affairs
Bureau at 202–418–0530 (voice), 202–
418–0432 (tty).
Synopsis
1. The Commission plays an
important role in protecting the security
of America’s communications networks
and critical infrastructure. The
Commission, in tandem with its federal
partners, has urged the communications
sector to defend against cyber threats,
while also taking measures to reinforce
our Nation’s readiness and to strengthen
the cybersecurity of vital
communications services and
infrastructure, especially in light of
Russia’s escalating actions inside of
Ukraine. Today, the Commission builds
on those efforts. With this Notice of
Inquiry (Notice), the Commission seeks
comment on vulnerabilities threatening
the security and integrity of the Border
Gateway Protocol (BGP), which is
central to the internet’s global routing
system, its impact on the transmission
of data from email, e-commerce, and
bank transactions to interconnected
Voice-over Internet Protocol (VoIP) and
9–1–1 calls, and how best to address
them.
2. BGP is the routing protocol used to
exchange reachability information
amongst independently managed
networks on the internet. These
independently managed networks (also
termed ‘‘domains’’) loosely map to one
or more ‘‘Autonomous Systems’’ (so
termed because the administration of
the network is the sole responsibility of
a single, independent entity). BGP’s
initial design, which remains widely
deployed today, does not include
security features to ensure trust in the
information that it is used to exchange.
BGP was designed at a time when the
number of independently managed
networks on the internet was low and
the trust among them was high. As a
result, a bad network actor may
deliberately falsify BGP reachability
information to redirect traffic to itself or
through a specific third-party network,
and prevent that traffic from reaching its
intended recipient. When a bad actor
directs traffic to be dropped in this way,
it is commonly referred to as a
‘‘blackhole.’’ These ‘‘BGP hijacks’’
expose U.S. citizens’ personally
identifiable information, enable theft,
extortion, and state-level espionage, and
disrupt otherwise-secure transactions.
The Commission uses the term ‘‘BGP
hijacking’’ to refer to any deliberate
injection of routing information away
from the optimal (or most secure) route,
including both false route origination
and path interception attacks.
PO 00000
Frm 00047
Fmt 4703
Sfmt 4703
14007
3. Congress created the Commission,
among other reasons, ‘‘for the purpose
of the national defense [and] for the
purpose of promoting safety of life and
property through the use of wire and
radio communications.’’ To obtain
‘‘maximum effectiveness from the use of
radio and wire communications in
connection with the safety of life and
property,’’ the Communications Act of
1934, as amended, directs the
Commission to ‘‘investigate and study
all phases of the problem and the best
methods of obtaining the cooperation
and coordination’’ of such systems.’’
4. The Commission has taken targeted
steps to protect the nation’s
communications infrastructure from
potential security threats. Most recently,
the Commission encouraged
communications companies to review
cybersecurity practices to defend against
threats to critical infrastructure, sought
comment on how the Commission can
leverage its equipment authorization
program to encourage device
manufacturers to consider cybersecurity
standards and guidelines, and acted in
the public interest to deny and revoke
the section 214 authority of certain
carriers to provide telecommunications
service in the United States.
5. Independently managed networks
are essential to the daily functioning of
critical infrastructure such as
transportation, gas and electric power,
water, and financial markets. These
networks can be vulnerable to attack if
they deploy a version of BGP at their
borders that cannot verify the integrity
or authenticity of routing information.
These vulnerabilities have two main
causes: (1) Validating a route’s origin;
and (2) securing and validating the
correct BGP path to a given destination.
BGP’s vulnerabilities allow a network
operator to accidentally or maliciously
misconfigure its BGP routers to falsely
advertise that its network contains the
intended destination for certain internet
traffic, or is on the path to that
destination. By advertising incorrect
routing information, a bad actor could
spread incorrect information to other
networks and cause traffic intended for
the advertised destination to be
misrouted to, or through, the bad actor’s
network. Causing internet traffic to
depart from its most efficient path is
termed ‘‘BGP hijacking.’’ Although BGP
hijacking can occur anywhere on the
global internet, the Commission has an
interest in minimizing or eliminating
opportunities for it within its
jurisdiction because it can potentially
harm U.S. citizens, commerce, and
public safety operations.
6. Russian network operators have
been suspected of exploiting BGP’s
E:\FR\FM\11MRN1.SGM
11MRN1
lotter on DSK11XQN23PROD with NOTICES1
14008
Federal Register / Vol. 87, No. 48 / Friday, March 11, 2022 / Notices
vulnerability to hijacking, including
instances in which traffic has been
redirected through Russia without
explanation. In late 2017, for example,
traffic sent to and from Google,
Facebook, Apple and Microsoft was
briefly routed through an internet
service provider in Russia. That same
year, traffic from a number of financial
institutions, including MasterCard, Visa,
and others was also routed through a
Russian government-controlled
telecommunications company under
‘‘unexplained’’ circumstances.
7. Over the past two decades, internet
stakeholders have developed new
standards, specifications, and best
practice recommendations intended to
address the security risk that BGP poses.
The Internet Engineering Task Force
(IETF), the principal authority
responsible for internet standards, has
finalized several standards to reduce
BGP vulnerabilities, including BGPsec,
an extension to BGP that provides
security for the path through which
reachability information passes. The
National Institute of Standards and
Technology (NIST) has released a
practice guide proposing a method of
validating routes’ origins and
recommendations for resilient exchange
between independently managed
networks. In 2017, the Internet Society
launched Mutually Agreed Norms for
Routing Security (MANRS), an
organizational initiative with
membership including over 700
network operators, Internet Service
Providers, and enterprises, which aims
to reduce or prevent route hijacking and
denial of service attacks by requiring
network operators to implement
available tools and applicable IETF Best
Common Practice standards. MANRS
focuses on improving routing security
by filtering routing advertisements to
include only those likely to be relevant
to the customer BGP router; enabling
source IP address validation for
customer networks; coordinating and
sharing contact information for network
operations center contacts through
regional internet registries, and enabling
routing information to be validated on a
global scale. MANRS offers a tool called
‘‘MANRS Observatory’’ that aggregates
data from trusted sources into a
dashboard to help network operators
improve the security of their networks.
Similarly, the Commission’s
Communications Security, Reliability,
and Interoperability Council (CSRIC)
has reported on best practices and
recommendations to improve the
security of BGP. The roman numerals
following the name of federal advisory
committee, ‘‘CSRIC,’’ enumerate the
VerDate Sep<11>2014
17:10 Mar 10, 2022
Jkt 256001
successive years during which the
Commission has chartered CSRIC to
provide recommendations on selected
topics. CSRIC III recommended that
network operators ensure that BGP
routers’ internet routing registries are
accurate, complete, and up-to-date, and
that network operators use a standardsbased approach for providing
cryptographically secure registries of
internet resources and routing
authorizations, a Resource Public Key
Infrastructure (RPKI). In this
connection, the FCC sought comment on
the implementation and effectiveness of
the CSRIC III recommendations and/or
alternatives that stakeholders have
developed since the time of the CSRIC’s
original work to address these
challenges. CSRIC VI recommended that
network operators support MANRS and
IETF Best Common Practice standards.
Notwithstanding this work, available
information suggests that the voluntary
adoption and deployment of such
measures has been such that many of
the independently managed networks
that comprise the internet remain
vulnerable because they have not taken
advantage of these measures.
8. Scope of Inquiry. In this Notice, the
Commission seeks comment on any
steps that the Commission should
consider taking to help protect and
strengthen the nation’s communications
network and other critical infrastructure
from vulnerabilities posed by BGP, and
how the Commission can best facilitate
the implementation of industry
standards and best practices to mitigate
the potential harms posed by these
vulnerabilities. In order to better
understand the BGP ecosystem, the
Commission seeks comment on the
extent to which Internet Service
Providers, public Internet Exchange
Providers, and providers of
interconnected VoIP service have
deployed BGP routers in their networks.
Do content delivery networks, and
providers of cloud services operate BGP
routers in their networks as well? What
other types of entities operate BGP
routers? The Commission recognizes
that there are entities that do not operate
BGP routers, but that are otherwise well
positioned to support the development
and implementation of BGP security
practices. For example, there are several
regional, national, and local internet
registries that manage the allocation and
registration of internet number
resources, and support RPKIs. As an
example, one such regional internet
registry, the American Registry for
Internet Numbers (ARIN) supports the
roles of a digital certificate authority
and acts as a repository for routing
PO 00000
Frm 00048
Fmt 4703
Sfmt 4703
information and as a validator of RPKI
data. Additionally, the Internet
Corporation for Assigned Names and
Numbers (ICANN), through its affiliate,
Internet Assigned Numbers Authority
(IANA), has responsibility for
coordinating the internet’s unique
identifiers. The Commission seeks
comment on what role these and other
entities, including vendors of BGP
routers or other networking equipment,
have in supporting the development and
implementation of BGP security
practices. What threats to internet
routing should the Commission
consider within the scope of this
inquiry in addition to BGP hijacking?
For example, to what extent could BGP
security measures prevent pervasive
monitoring?
9. Measuring BGP Security. The
Commission seeks comment on whether
industry has defined metrics for
identifying BGP routing security
incidents and for quantifying their
scope and impact. To what extent are
available tools, such as NIST’s RPKI
Monitor, Automatic and Real-Time
dEtection and Mitigation System
(ARTEMIS), BGPstream, BGPMon,
Kentik, and Traceroute, able to rapidly
and accurately detect BGP hijacks or
router misconfigurations? To what
extent do these tools distinguish
malicious routing changes from
accidental ones? Do artificial
intelligence and machine learning tools
promise advancements in this area?
10. Deployment of BGP Security
Measures. The Commission seeks
comment on the security measures that
have been developed and deployed by
industry to secure BGP. In addition to
the measures recommended by CSRIC
III and VI (RPKI, MANRS, and
applicable IETF Best Common Practice
standards), BGPsec, and the NIST
practice guide, what other standards,
specifications, or best practices have
been developed to address potential
attacks that exploit BGP vulnerabilities?
The Commission seeks comment on the
extent to which network operators have
implemented any of the available BGP
security measures developed by
industry. How effective are these
measures in practice? The Commission
seeks comment on how to assess,
measure, demonstrate, or increase the
effectiveness of these security measures.
To the extent that network operators
have not implemented security
measures, the Commission seeks
comment on why such measures have
not been implemented. To the extent
that network operators have
implemented security measures, how
effective have they been at mitigating
E:\FR\FM\11MRN1.SGM
11MRN1
lotter on DSK11XQN23PROD with NOTICES1
Federal Register / Vol. 87, No. 48 / Friday, March 11, 2022 / Notices
the vulnerability? What obstacles have
prevented them from doing so?
11. The Commission seeks comment
on the extent to which RPKI, as
implemented by other regional internet
registries, effectively prevents BGP
hijacking. To what extent do network
operators take advantage of the RPKI
services that regional internet registries
offer by implementing RPKI in their
networks? To what extent, if any, do
network operators’ service level
agreements affect the ability of network
operators to drop traffic that RPKI
deems invalid? How do regional
internet registries maintain the
certificate authority for the RPKIs in a
way that mitigates the risk of a single
point of failure vulnerable to distributed
denial of service attacks? How do
regional internet registries prevent
conflicts among distributed RPKI trust
anchors?
12. The Commission seeks comment
on whether and to what extent network
operators anticipate integrating BGPseccapable routers into their networks. The
specification for the BGPsec extension
to BGP became available in 2017, but it
appears that BGPsec has not been
widely deployed despite BGP’s known
vulnerabilities. Why have network
operators not taken more aggressive
steps to adopt BGPsec? What particular
obstacles or concerns about BGPsec
have slowed their adoption? To what
extent does the introduction of BGPsec
routers potentially introduce
compatibility issues among managed
networks or introduce delays?
13. For network operators that
currently participate in MANRS and
comply with its requirements, including
support for IETF Best Common Practice
standards, the Commission seeks
comment on the efficacy of such
measures for preventing BGP hijacking.
To what extent do the network operators
that participate in MANRS support both
its required and recommended routing
security actions, as well as applicable
IETF Best Common Practice standards
on which those actions are based? To
what extent do network operators
participate in MANRS’ various
programs, including its equipment
vendor program, launched in 2021,
which aims to enable routing security
features on network equipment and
provide support and training guidance
to use them, or take advantage of the
MANRS Observatory.
14. Commission’s Role. Ensuring
continued U.S. leadership requires that
the Commission explores opportunities
to spur trustworthy innovation for more
secure communications and critical
infrastructure. The Commission has
sought to promote the security of U.S.
VerDate Sep<11>2014
17:10 Mar 10, 2022
Jkt 256001
networks and network equipment both
by drawing attention to available
resources and through exercise of its
regulatory authority. Other federal
agencies are engaged in cybersecurity
and specifically BGP security, including
NIST, the Department of Homeland
Security, and the National
Telecommunications and Information
Administration. The Commission seeks
comment on steps the Commission, in
coordination with other federal
agencies, could take to prevent BGP
hijacking or otherwise promote secure
internet routing. The Commission seeks
comment on whether the Commission
has a role in helping U.S. network
operators deploy BGP security
measures. If so, how can the
Commission be most helpful? The
Commission seeks comment on its
authority to promote the security of
internet routing through regulation,
including as it may apply to wireless
and wireline Internet Service Providers,
Internet Exchange Providers,
interconnected VoIP providers,
operators of content delivery networks,
cloud service providers, and other
enterprise and organizational
stakeholders. The Commission seeks
comment on whether regulatory clarity
could help network operators prioritize
investments in the security of their
networks.
15. The Commission seeks comment
on the extent to which other nations’
telecommunications regulators and
multistakeholder organizations have
issued rules, guidance, or otherwise
encouraged network operators, network
security organizations, and equipment
vendors to implement BGP security
measures and on any lessons learned
from those endeavors. The Commission
seeks comment on the extent to which
the effectiveness of BGP security
measures may be related to international
participation and coordination.
16. Costs and Benefits. The
Commission seek comments on the onetime and ongoing costs of implementing
the BGP security measures discussed
herein. What capital and operational
expenditures attend their
implementation? Does the availability of
a protocol for RPKI keep
implementation costs low? Would
network operators need to replace
existing routers to support the BGPsec
extension? Could support be enabled
through a software upgrade, particularly
for routers that are not considered to be
‘‘end-of-life’’? To what extent can
network operators support MANRS’
required and recommended actions by
updating their policies and practices,
and without equipment replacement or
software updates? What costs would
PO 00000
Frm 00049
Fmt 4703
Sfmt 4703
14009
consumer likely experience from BGP
security implementations, such as
higher service costs or speed
reductions?
17. The Commission seeks comment
on whether the Commission should
encourage industry to prioritize the
deployment of BGP security measures
within the networks on which critical
infrastructure and emergency services
rely, as a means of helping industry to
control costs otherwise associated with
a network-wide deployment. Would this
or another phased or gradual
implementation of BGP security
measures be effective and help network
operators to plan for and control
implementation costs?
18. The Commission also seeks
comment on the national security,
economic, and public safety benefits of
more secure internet routing, both
within the U.S. and globally. What
entities are particularly affected by
threats to BGP security? To what extent
would the security measures discussed
herein be effective in mitigating BGP
hijacking? What is the potential impact
of mitigating BGP hijacking on U.S.
national security and the U.S. economy?
Have stakeholders attempted to quantify
the benefits that secure internet routing
could convey by protecting critical
infrastructure, sensitive
communications, and personally
identifiable information? Have
stakeholders attempted to quantify the
benefits of secure internet routing in
terms of the potential loss of Intellectual
Property, communications delays, or
disruptions that BGP’s unmitigated
vulnerability represents? Have
stakeholders attempted to measure or
quantify the extent to which BGP
hijacking poses a threat to life and
property by disrupting 9–1–1 calls
carried by providers of interconnected
VoIP service? What other benefits could
potentially accrue from this inquiry?
19. Digital Equity and Inclusion.
Finally, the Commission, as part of its
continuing effort to advance digital
equity for all, including people of color,
persons with disabilities, persons who
live in rural or Tribal areas, and others
who are or have been historically
underserved, marginalized, or adversely
affected by persistent poverty or
inequality, invites comment on any
equity-related considerations and
benefits (if any) that may be associated
with the proposals and issues discussed
herein. Section 1 of the
Communications Act of 1934 as
amended provides that the FCC
‘‘regulat[es] interstate and foreign
commerce in communication by wire
and radio so as to make [such service]
available, so far as possible, to all the
E:\FR\FM\11MRN1.SGM
11MRN1
14010
Federal Register / Vol. 87, No. 48 / Friday, March 11, 2022 / Notices
people of the United States, without
discrimination on the basis of race,
color, religion, national origin, or sex.’’
The term ‘‘equity’’ is used here
consistent with Executive Order 13985
as the consistent and systematic fair,
just, and impartial treatment of all
individuals, including individuals who
belong to underserved communities that
have been denied such treatment, such
as Black, Latino, and Indigenous and
Native American persons, Asian
Americans and Pacific Islanders and
other persons of color; members of
religious minorities; lesbian, gay,
bisexual, transgender, and queer
(LGBTQ+) persons; persons with
disabilities; persons who live in rural
areas; and persons otherwise adversely
affected by persistent poverty or
inequality. Specifically, the Commission
seeks comment on how its proposals
may promote or inhibit advances in
diversity, equity, inclusion, and
accessibility, as well the scope of the
Commission’s relevant legal authority.
20. Authority for this Notice of
Inquiry may be found in sections 1, 4(i)–
(j), 4(n), 7, and 403 of the
Communications Act of 1934, as
amended, 47 U.S.C. 151, 154(i)–(j),
154(n), 157 and Section 1.430 of the
Commission’s rules, 47 CFR 1.430.
Federal Communications Commission.
Marlene H. Dortch,
Secretary, Office of the Secretary.
[FR Doc. 2022–05121 Filed 3–10–22; 8:45 am]
BILLING CODE 6712–01–P
FEDERAL COMMUNICATIONS
COMMISSION
[FR ID 76259]
SES Performance Review Board
Federal Communications
Commission.
AGENCY:
ACTION:
Notice.
As required by the Civil
Service Reform Act of 1978,
Chairwoman Jessica Rosenworcel has
appointed the following executives to
the Senior Executive Service (SES)
Performance Review Board (PRB):
lotter on DSK11XQN23PROD with NOTICES1
SUMMARY:
Trent Harkrader
Debra Jordan
Holly Saurer
Federal Communications Commission.
Katura Jackson,
Federal Register Liaison Officer.
[FR Doc. 2022–05229 Filed 3–10–22; 8:45 am]
BILLING CODE 6712–01–P
VerDate Sep<11>2014
17:10 Mar 10, 2022
Jkt 256001
FEDERAL COMMUNICATIONS
COMMISSION
[OMB 3060–1298; FR ID 75434]
Information Collection Being Reviewed
by the Federal Communications
Commission Under Delegated
Authority
Federal Communications
Commission.
ACTION: Notice and request for
comments.
AGENCY:
As part of its continuing effort
to reduce paperwork burdens, and as
required by the Paperwork Reduction
Act (PRA) of 1995, the Federal
Communications Commission (FCC or
the Commission) invites the general
public and other Federal agencies to
take this opportunity to comment on the
following information collection.
Comments are requested concerning:
Whether the proposed collection of
information is necessary for the proper
performance of the functions of the
Commission, including whether the
information shall have practical utility;
the accuracy of the Commission’s
burden estimate; ways to enhance the
quality, utility, and clarity of the
information collected; ways to minimize
the burden of the collection of
information on the respondents,
including the use of automated
collection techniques or other forms of
information technology; and ways to
further reduce the information
collection burden on small business
concerns with fewer than 25 employees.
The FCC may not conduct or sponsor a
collection of information unless it
displays a currently valid control
number. No person shall be subject to
any penalty for failing to comply with
a collection of information subject to the
PRA that does not display a valid Office
of Management and Budget (OMB)
control number.
DATES: Written PRA comments should
be submitted on or before May 10, 2022.
If you anticipate that you will be
submitting comments, but find it
difficult to do so within the period of
time allowed by this notice, you should
advise the contact listed below as soon
as possible.
ADDRESSES: Direct all PRA comments to
Nicole Ongele, FCC, via email PRA@
fcc.gov and to nicole.ongele@fcc.gov.
FOR FURTHER INFORMATION CONTACT: For
additional information about the
information collection, contact Nicole
Ongele, (202) 418–2991.
SUPPLEMENTARY INFORMATION:
OMB Control No.: 3060–1298.
SUMMARY:
PO 00000
Frm 00050
Fmt 4703
Sfmt 4703
Title: Volunteer Service Agreement
Form, FCC Form A–384.
Form No.: FCC Form A–384.
Type of Review: Extension of a
currently approved collection.
Respondents: Individuals or
households.
Number of Respondents and
Responses: 140 respondents and 140
responses.
Estimated Time Per Response: 0.25
hours.
Frequency of Response: One-time
reporting requirement.
Obligation to Respond: Mandatory.
The statutory authority to collect this
information derives from 5 U.S.C. 3111,
Acceptance of volunteer service.
Certification of compliance with
COVID–19 vaccine requirements for
Federal workers derives from several
sources, including most recently
Executive Order 13991, Protecting the
Federal Workforce and Requiring MaskWearing; Executive Order 14043,
Requiring Coronavirus Disease 2019
Vaccination for Federal Employees; and
OMB Memorandum M 21–15, COVID–
19 Safe Federal Workplace: Agency
Model Safety Principles (Jan. 24, 2021),
as amended.
Total Annual Burden: 35 hours.
Total Annual Cost: No Cost.
Privacy Act Impact Assessment: Yes.
Records of current and former Federal
employees as defined in 5 U.S.C. 2105,
including volunteers, grantees, and
contract employees on whom the agency
maintains records, are covered by
OPM’s governmentwide System of
Records Notice (SORN) OPM/GOVT–1
General Personnel Records, posted at
https://www.opm.gov/informationmanagement/privacy-policy/sorn/opmsorn-govt-1-general-personnelrecords.pdf. The Privacy Impact
Assessment (PIA) for the Electronic
Official Personnel Folder is posted at
https://www.opm.gov/informationmanagement/privacy-policy/privacypolicy/eopf-pia.pdf.
Nature and Extent of Confidentiality:
As Privacy Act-protected records, these
records are kept confidential and will
not be disclosed except under
applicable Privacy Act exceptions,
including the routine uses identified in
the OPM/GOVT–1 SORN.
Needs and Uses: The Civil Service
Reform Act of 1978 authorized Federal
agencies to establish programs designed
to provide educationally related work
assignments for students in a non-pay
status. The Act provides that heads of
agencies may accept, subject to
regulations issued by the Office of
Personnel Management, volunteer
service for the United States if the
service (1) is performed by a student,
E:\FR\FM\11MRN1.SGM
11MRN1
]]>Agencies
[Federal Register Volume 87, Number 48 (Friday, March 11, 2022)]
[Notices]
[Pages 14006-14010]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-05121]
-----------------------------------------------------------------------
FEDERAL COMMUNICATIONS COMMISSION
[PS Docket No. 22-90, FCC 22-18; FRS 75229]
Secure Internet Routing
AGENCY: Federal Communications Commission.
ACTION: Request for comments.
-----------------------------------------------------------------------
SUMMARY: In this document, the Federal Communications Commission (FCC
or the Commission) seeks comment on vulnerabilities threatening the
security and integrity of the Border Gateway Protocol (BGP), which is
central to the Internet's global routing system, its impact on the
transmission of data from email, e-commerce, and bank transactions to
interconnected Voice-over Internet Protocol (VoIP) and 9-1-1 calls, and
how best to address them.
DATES: Comments are due on or before April 11, 2022; and reply comments
are due on or before May 10, 2022.
ADDRESSES: You may submit comments, identified by PS Docket No. 22-90,
by any of the following methods:
Electronic Filers: Comments may be filed electronically by
accessing ECFS at https://www.fcc.gov/ecfs.
Paper Filers: Paper filings can be sent by hand or
messenger delivery, by commercial overnight courier, or by first-class
or overnight U.S. Postal Service mail.
People with Disabilities: To request materials in
accessible formats for people with disabilities (braille, large print,
electronic files, audio format), send an email to [email protected] or
call the Consumer & Governmental Affairs Bureau at 202-418-0530
(voice), 202-418-0432 (tty).
For detailed instructions for submitting comments and additional
information on this proceeding, see the SUPPLEMENTARY INFORMATION
section of this document.
FOR FURTHER INFORMATION CONTACT: For additional information on this
proceeding, contact James Wiley of the Cybersecurity and Communications
Reliability Division, Public Safety and Homeland Security Bureau, at
[email protected] or (202) 418-1678 or Minsoo Kim of the
Cybersecurity and Communications Reliability Division, Public Safety
and Homeland Security Bureau, at [email protected] or (202) 418-1739.
SUPPLEMENTARY INFORMATION: This is a summary of the Commission's Notice
of Inquiry, FCC 22-18, released February 28, 2022. The full text of
this document is available at https://www.fcc.gov/document/fcc-launches-inquiry-internet-routing-vulnerabilities.
Ex Parte Rules. This proceeding shall be treated as a ``permit-but-
disclose'' proceeding in accordance with the Commission's ex parte
rules. Although the rules do not generally require ex parte
presentations to be treated as ``permit but disclose'' in Notice of
Inquiry proceedings, the Commission exercises its discretion in this
instance, and finds that the public interest is served by making ex
parte presentations available to the public, in order to encourage a
robust record. Persons making ex parte presentations must file a copy
of any written presentation or a memorandum summarizing any oral
presentation within two business days after the presentation (unless a
different deadline applicable to the Sunshine period applies). Persons
making oral ex parte presentations are reminded that memoranda
summarizing the presentation must (1) list all persons attending or
otherwise participating in the meeting at which the ex parte
presentation was made, and (2) summarize all data presented and
arguments made during the presentation. If the presentation consisted
in whole or in part of the presentation of data or arguments already
reflected in the presenter's written comments, memoranda, or other
filings in the proceeding, the presenter may provide citations to such
data or arguments in his or her prior comments, memoranda, or other
filings (specifying the relevant page and/or paragraph numbers where
such data or arguments can be found) in lieu of summarizing them in the
memorandum. Documents shown or given to Commission staff during ex
parte meetings are deemed to be written ex parte presentations and must
be filed consistent with Rule 1.1206(b), 47 CFR 1.1206(b). Participants
in this proceeding should familiarize themselves with the Commission's
ex parte rules.
Confidentiality. The Commission recognizes that some comments could
contain information that the submitter believes should not be made
available to the general public because of commercial or national
security reasons. Parties may request that such information be kept
confidential, identifying the specific information sought to be kept
confidential, providing the reasons for the request, and otherwise
following the procedures set forth in section 0.459 of the
[[Page 14007]]
Commission's rules. If a party requests confidential treatment of a
comment, it must file an original and one copy of the confidential
version of the comment on paper, following the procedures below, and a
public version of the filing that omits only the confidential
information and is otherwise identical to the confidential version,
using either the electronic filing or the filing-by-paper procedures
below.
Comment Filing Procedures. Interested parties may file comments and
reply comments on or before the dates indicated on the first page of
this document. Comments may be filed using the Commission's Electronic
Comment Filing System (ECFS) or by paper. All filings must be addressed
to the Commission's Secretary, Office of the Secretary, Federal
Communications Commission.
Paper Filers: Parties who choose to file by paper must
file an original and one copy of each filing. Paper filings can be sent
by hand or messenger delivery, by commercial overnight courier, or by
first-class or overnight U.S. Postal Service mail. All filings must be
addressed to the Commission's Secretary, Office of the Secretary,
Federal Communications Commission.
Effective March 19, 2020, and until further notice, the
Commission no longer accepts any hand or messenger delivered filings.
This is a temporary measure taken to help protect the health and safety
of individuals, and to mitigate the transmission of COVID-19. See FCC
Announces Closure of FCC Headquarters Open Window and Change in Hand-
Delivery Policy, Public Notice, 35 FCC Rcd 2788 (2020), https://www.fcc.gov/document/fcc-closes-headquarters-open-window-and-changes-hand-delivery-policy.
Commercial overnight mail (other than U.S. Postal Service
Express Mail and Priority Mail) must be sent to 9050 Junction Drive,
Annapolis Junction, MD 20701.
U.S. Postal Service first-class, Express, and Priority
mail must be addressed to 45 L Street NE, Washington, DC 20554.
Availability of Documents. Comments, reply comments, and ex parte
submissions will be publicly available online via ECFS. These documents
will also be available for public inspection during regular business
hours in the FCC Reference Information Center, when FCC Headquarters
reopen to the public.
People with Disabilities. To request materials in accessible
formats for people with disabilities (braille, large print, electronic
files, audio format), send an email to [email protected] or call the
Consumer & Governmental Affairs Bureau at 202-418-0530 (voice), 202-
418-0432 (tty).
Synopsis
1. The Commission plays an important role in protecting the
security of America's communications networks and critical
infrastructure. The Commission, in tandem with its federal partners,
has urged the communications sector to defend against cyber threats,
while also taking measures to reinforce our Nation's readiness and to
strengthen the cybersecurity of vital communications services and
infrastructure, especially in light of Russia's escalating actions
inside of Ukraine. Today, the Commission builds on those efforts. With
this Notice of Inquiry (Notice), the Commission seeks comment on
vulnerabilities threatening the security and integrity of the Border
Gateway Protocol (BGP), which is central to the internet's global
routing system, its impact on the transmission of data from email, e-
commerce, and bank transactions to interconnected Voice-over Internet
Protocol (VoIP) and 9-1-1 calls, and how best to address them.
2. BGP is the routing protocol used to exchange reachability
information amongst independently managed networks on the internet.
These independently managed networks (also termed ``domains'') loosely
map to one or more ``Autonomous Systems'' (so termed because the
administration of the network is the sole responsibility of a single,
independent entity). BGP's initial design, which remains widely
deployed today, does not include security features to ensure trust in
the information that it is used to exchange. BGP was designed at a time
when the number of independently managed networks on the internet was
low and the trust among them was high. As a result, a bad network actor
may deliberately falsify BGP reachability information to redirect
traffic to itself or through a specific third-party network, and
prevent that traffic from reaching its intended recipient. When a bad
actor directs traffic to be dropped in this way, it is commonly
referred to as a ``blackhole.'' These ``BGP hijacks'' expose U.S.
citizens' personally identifiable information, enable theft, extortion,
and state-level espionage, and disrupt otherwise-secure transactions.
The Commission uses the term ``BGP hijacking'' to refer to any
deliberate injection of routing information away from the optimal (or
most secure) route, including both false route origination and path
interception attacks.
3. Congress created the Commission, among other reasons, ``for the
purpose of the national defense [and] for the purpose of promoting
safety of life and property through the use of wire and radio
communications.'' To obtain ``maximum effectiveness from the use of
radio and wire communications in connection with the safety of life and
property,'' the Communications Act of 1934, as amended, directs the
Commission to ``investigate and study all phases of the problem and the
best methods of obtaining the cooperation and coordination'' of such
systems.''
4. The Commission has taken targeted steps to protect the nation's
communications infrastructure from potential security threats. Most
recently, the Commission encouraged communications companies to review
cybersecurity practices to defend against threats to critical
infrastructure, sought comment on how the Commission can leverage its
equipment authorization program to encourage device manufacturers to
consider cybersecurity standards and guidelines, and acted in the
public interest to deny and revoke the section 214 authority of certain
carriers to provide telecommunications service in the United States.
5. Independently managed networks are essential to the daily
functioning of critical infrastructure such as transportation, gas and
electric power, water, and financial markets. These networks can be
vulnerable to attack if they deploy a version of BGP at their borders
that cannot verify the integrity or authenticity of routing
information. These vulnerabilities have two main causes: (1) Validating
a route's origin; and (2) securing and validating the correct BGP path
to a given destination. BGP's vulnerabilities allow a network operator
to accidentally or maliciously misconfigure its BGP routers to falsely
advertise that its network contains the intended destination for
certain internet traffic, or is on the path to that destination. By
advertising incorrect routing information, a bad actor could spread
incorrect information to other networks and cause traffic intended for
the advertised destination to be misrouted to, or through, the bad
actor's network. Causing internet traffic to depart from its most
efficient path is termed ``BGP hijacking.'' Although BGP hijacking can
occur anywhere on the global internet, the Commission has an interest
in minimizing or eliminating opportunities for it within its
jurisdiction because it can potentially harm U.S. citizens, commerce,
and public safety operations.
6. Russian network operators have been suspected of exploiting
BGP's
[[Page 14008]]
vulnerability to hijacking, including instances in which traffic has
been redirected through Russia without explanation. In late 2017, for
example, traffic sent to and from Google, Facebook, Apple and Microsoft
was briefly routed through an internet service provider in Russia. That
same year, traffic from a number of financial institutions, including
MasterCard, Visa, and others was also routed through a Russian
government-controlled telecommunications company under ``unexplained''
circumstances.
7. Over the past two decades, internet stakeholders have developed
new standards, specifications, and best practice recommendations
intended to address the security risk that BGP poses. The Internet
Engineering Task Force (IETF), the principal authority responsible for
internet standards, has finalized several standards to reduce BGP
vulnerabilities, including BGPsec, an extension to BGP that provides
security for the path through which reachability information passes.
The National Institute of Standards and Technology (NIST) has released
a practice guide proposing a method of validating routes' origins and
recommendations for resilient exchange between independently managed
networks. In 2017, the Internet Society launched Mutually Agreed Norms
for Routing Security (MANRS), an organizational initiative with
membership including over 700 network operators, Internet Service
Providers, and enterprises, which aims to reduce or prevent route
hijacking and denial of service attacks by requiring network operators
to implement available tools and applicable IETF Best Common Practice
standards. MANRS focuses on improving routing security by filtering
routing advertisements to include only those likely to be relevant to
the customer BGP router; enabling source IP address validation for
customer networks; coordinating and sharing contact information for
network operations center contacts through regional internet
registries, and enabling routing information to be validated on a
global scale. MANRS offers a tool called ``MANRS Observatory'' that
aggregates data from trusted sources into a dashboard to help network
operators improve the security of their networks. Similarly, the
Commission's Communications Security, Reliability, and Interoperability
Council (CSRIC) has reported on best practices and recommendations to
improve the security of BGP. The roman numerals following the name of
federal advisory committee, ``CSRIC,'' enumerate the successive years
during which the Commission has chartered CSRIC to provide
recommendations on selected topics. CSRIC III recommended that network
operators ensure that BGP routers' internet routing registries are
accurate, complete, and up-to-date, and that network operators use a
standards-based approach for providing cryptographically secure
registries of internet resources and routing authorizations, a Resource
Public Key Infrastructure (RPKI). In this connection, the FCC sought
comment on the implementation and effectiveness of the CSRIC III
recommendations and/or alternatives that stakeholders have developed
since the time of the CSRIC's original work to address these
challenges. CSRIC VI recommended that network operators support MANRS
and IETF Best Common Practice standards. Notwithstanding this work,
available information suggests that the voluntary adoption and
deployment of such measures has been such that many of the
independently managed networks that comprise the internet remain
vulnerable because they have not taken advantage of these measures.
8. Scope of Inquiry. In this Notice, the Commission seeks comment
on any steps that the Commission should consider taking to help protect
and strengthen the nation's communications network and other critical
infrastructure from vulnerabilities posed by BGP, and how the
Commission can best facilitate the implementation of industry standards
and best practices to mitigate the potential harms posed by these
vulnerabilities. In order to better understand the BGP ecosystem, the
Commission seeks comment on the extent to which Internet Service
Providers, public Internet Exchange Providers, and providers of
interconnected VoIP service have deployed BGP routers in their
networks. Do content delivery networks, and providers of cloud services
operate BGP routers in their networks as well? What other types of
entities operate BGP routers? The Commission recognizes that there are
entities that do not operate BGP routers, but that are otherwise well
positioned to support the development and implementation of BGP
security practices. For example, there are several regional, national,
and local internet registries that manage the allocation and
registration of internet number resources, and support RPKIs. As an
example, one such regional internet registry, the American Registry for
Internet Numbers (ARIN) supports the roles of a digital certificate
authority and acts as a repository for routing information and as a
validator of RPKI data. Additionally, the Internet Corporation for
Assigned Names and Numbers (ICANN), through its affiliate, Internet
Assigned Numbers Authority (IANA), has responsibility for coordinating
the internet's unique identifiers. The Commission seeks comment on what
role these and other entities, including vendors of BGP routers or
other networking equipment, have in supporting the development and
implementation of BGP security practices. What threats to internet
routing should the Commission consider within the scope of this inquiry
in addition to BGP hijacking? For example, to what extent could BGP
security measures prevent pervasive monitoring?
9. Measuring BGP Security. The Commission seeks comment on whether
industry has defined metrics for identifying BGP routing security
incidents and for quantifying their scope and impact. To what extent
are available tools, such as NIST's RPKI Monitor, Automatic and Real-
Time dEtection and Mitigation System (ARTEMIS), BGPstream, BGPMon,
Kentik, and Traceroute, able to rapidly and accurately detect BGP
hijacks or router misconfigurations? To what extent do these tools
distinguish malicious routing changes from accidental ones? Do
artificial intelligence and machine learning tools promise advancements
in this area?
10. Deployment of BGP Security Measures. The Commission seeks
comment on the security measures that have been developed and deployed
by industry to secure BGP. In addition to the measures recommended by
CSRIC III and VI (RPKI, MANRS, and applicable IETF Best Common Practice
standards), BGPsec, and the NIST practice guide, what other standards,
specifications, or best practices have been developed to address
potential attacks that exploit BGP vulnerabilities? The Commission
seeks comment on the extent to which network operators have implemented
any of the available BGP security measures developed by industry. How
effective are these measures in practice? The Commission seeks comment
on how to assess, measure, demonstrate, or increase the effectiveness
of these security measures. To the extent that network operators have
not implemented security measures, the Commission seeks comment on why
such measures have not been implemented. To the extent that network
operators have implemented security measures, how effective have they
been at mitigating
[[Page 14009]]
the vulnerability? What obstacles have prevented them from doing so?
11. The Commission seeks comment on the extent to which RPKI, as
implemented by other regional internet registries, effectively prevents
BGP hijacking. To what extent do network operators take advantage of
the RPKI services that regional internet registries offer by
implementing RPKI in their networks? To what extent, if any, do network
operators' service level agreements affect the ability of network
operators to drop traffic that RPKI deems invalid? How do regional
internet registries maintain the certificate authority for the RPKIs in
a way that mitigates the risk of a single point of failure vulnerable
to distributed denial of service attacks? How do regional internet
registries prevent conflicts among distributed RPKI trust anchors?
12. The Commission seeks comment on whether and to what extent
network operators anticipate integrating BGPsec-capable routers into
their networks. The specification for the BGPsec extension to BGP
became available in 2017, but it appears that BGPsec has not been
widely deployed despite BGP's known vulnerabilities. Why have network
operators not taken more aggressive steps to adopt BGPsec? What
particular obstacles or concerns about BGPsec have slowed their
adoption? To what extent does the introduction of BGPsec routers
potentially introduce compatibility issues among managed networks or
introduce delays?
13. For network operators that currently participate in MANRS and
comply with its requirements, including support for IETF Best Common
Practice standards, the Commission seeks comment on the efficacy of
such measures for preventing BGP hijacking. To what extent do the
network operators that participate in MANRS support both its required
and recommended routing security actions, as well as applicable IETF
Best Common Practice standards on which those actions are based? To
what extent do network operators participate in MANRS' various
programs, including its equipment vendor program, launched in 2021,
which aims to enable routing security features on network equipment and
provide support and training guidance to use them, or take advantage of
the MANRS Observatory.
14. Commission's Role. Ensuring continued U.S. leadership requires
that the Commission explores opportunities to spur trustworthy
innovation for more secure communications and critical infrastructure.
The Commission has sought to promote the security of U.S. networks and
network equipment both by drawing attention to available resources and
through exercise of its regulatory authority. Other federal agencies
are engaged in cybersecurity and specifically BGP security, including
NIST, the Department of Homeland Security, and the National
Telecommunications and Information Administration. The Commission seeks
comment on steps the Commission, in coordination with other federal
agencies, could take to prevent BGP hijacking or otherwise promote
secure internet routing. The Commission seeks comment on whether the
Commission has a role in helping U.S. network operators deploy BGP
security measures. If so, how can the Commission be most helpful? The
Commission seeks comment on its authority to promote the security of
internet routing through regulation, including as it may apply to
wireless and wireline Internet Service Providers, Internet Exchange
Providers, interconnected VoIP providers, operators of content delivery
networks, cloud service providers, and other enterprise and
organizational stakeholders. The Commission seeks comment on whether
regulatory clarity could help network operators prioritize investments
in the security of their networks.
15. The Commission seeks comment on the extent to which other
nations' telecommunications regulators and multistakeholder
organizations have issued rules, guidance, or otherwise encouraged
network operators, network security organizations, and equipment
vendors to implement BGP security measures and on any lessons learned
from those endeavors. The Commission seeks comment on the extent to
which the effectiveness of BGP security measures may be related to
international participation and coordination.
16. Costs and Benefits. The Commission seek comments on the one-
time and ongoing costs of implementing the BGP security measures
discussed herein. What capital and operational expenditures attend
their implementation? Does the availability of a protocol for RPKI keep
implementation costs low? Would network operators need to replace
existing routers to support the BGPsec extension? Could support be
enabled through a software upgrade, particularly for routers that are
not considered to be ``end-of-life''? To what extent can network
operators support MANRS' required and recommended actions by updating
their policies and practices, and without equipment replacement or
software updates? What costs would consumer likely experience from BGP
security implementations, such as higher service costs or speed
reductions?
17. The Commission seeks comment on whether the Commission should
encourage industry to prioritize the deployment of BGP security
measures within the networks on which critical infrastructure and
emergency services rely, as a means of helping industry to control
costs otherwise associated with a network-wide deployment. Would this
or another phased or gradual implementation of BGP security measures be
effective and help network operators to plan for and control
implementation costs?
18. The Commission also seeks comment on the national security,
economic, and public safety benefits of more secure internet routing,
both within the U.S. and globally. What entities are particularly
affected by threats to BGP security? To what extent would the security
measures discussed herein be effective in mitigating BGP hijacking?
What is the potential impact of mitigating BGP hijacking on U.S.
national security and the U.S. economy? Have stakeholders attempted to
quantify the benefits that secure internet routing could convey by
protecting critical infrastructure, sensitive communications, and
personally identifiable information? Have stakeholders attempted to
quantify the benefits of secure internet routing in terms of the
potential loss of Intellectual Property, communications delays, or
disruptions that BGP's unmitigated vulnerability represents? Have
stakeholders attempted to measure or quantify the extent to which BGP
hijacking poses a threat to life and property by disrupting 9-1-1 calls
carried by providers of interconnected VoIP service? What other
benefits could potentially accrue from this inquiry?
19. Digital Equity and Inclusion. Finally, the Commission, as part
of its continuing effort to advance digital equity for all, including
people of color, persons with disabilities, persons who live in rural
or Tribal areas, and others who are or have been historically
underserved, marginalized, or adversely affected by persistent poverty
or inequality, invites comment on any equity-related considerations and
benefits (if any) that may be associated with the proposals and issues
discussed herein. Section 1 of the Communications Act of 1934 as
amended provides that the FCC ``regulat[es] interstate and foreign
commerce in communication by wire and radio so as to make [such
service] available, so far as possible, to all the
[[Page 14010]]
people of the United States, without discrimination on the basis of
race, color, religion, national origin, or sex.'' The term ``equity''
is used here consistent with Executive Order 13985 as the consistent
and systematic fair, just, and impartial treatment of all individuals,
including individuals who belong to underserved communities that have
been denied such treatment, such as Black, Latino, and Indigenous and
Native American persons, Asian Americans and Pacific Islanders and
other persons of color; members of religious minorities; lesbian, gay,
bisexual, transgender, and queer (LGBTQ+) persons; persons with
disabilities; persons who live in rural areas; and persons otherwise
adversely affected by persistent poverty or inequality. Specifically,
the Commission seeks comment on how its proposals may promote or
inhibit advances in diversity, equity, inclusion, and accessibility, as
well the scope of the Commission's relevant legal authority.
20. Authority for this Notice of Inquiry may be found in sections
1, 4(i)-(j), 4(n), 7, and 403 of the Communications Act of 1934, as
amended, 47 U.S.C. 151, 154(i)-(j), 154(n), 157 and Section 1.430 of
the Commission's rules, 47 CFR 1.430.
Federal Communications Commission.
Marlene H. Dortch,
Secretary, Office of the Secretary.
[FR Doc. 2022-05121 Filed 3-10-22; 8:45 am]
BILLING CODE 6712-01-P
