The Federal Communications Commission hopes to keep consumers safe with new regulations aimed at phone companies
The Federal Communications Commission recently strengthened privacy rules to protect users by forcing phone carriers to make customer data more secure. The new regulations follow new federal legislation to ban pretexting altogether.
The FCC will use several new methods to attempt to keep personal data safe, targeted specifically at phone companies -- land-based, wireless and voice over IP (VOIP).
The first major regulation overhaul will force phone carriers to stop releasing phone records to customers unless the customer calls and provides a password. The only way records can be released without a password is if the records are forwarded either by postal address and/or by calling to confirm with the customer.
"The unauthorized disclosure of consumers' private calling records is a
significant privacy invasion," said Kevin Martin, FCC chairman.
"Compliance with our consumer protection regulations is not optional
for any telephone service provider."
To further protect consumers, phone carriers now are required to inform the customer with any of the following changes -- password, back-up for forgotten passwords, an online customer account or address of record.
The FCC hopes that these additional measures will ensure that customer records and personal information does not go to the wrong parties.
-
Carrier
Authentication Requirements. Carriers
are prohibited from releasing a customer’s phone call records when a customer
calls the carrier except when the customer provides a password. If a customer does not provide a password,
carriers may not release the customer’s phone call records except by sending it
to an address of record or by the carrier calling the customer at the telephone
of record. Carriers are required to
provide mandatory password protection for online account access. Carriers are permitted to provide all customer proprietary network information (CPNI),
including customer phone call records, to customers based on in-store contact
with a valid photo ID.
- Notice
to Customer of Account Changes. Carriers
are required to notify the customer immediately when the following are created
or changed: (1) a password; (2) a back-up for forgotten passwords; (3) an
online account; or (4) the address of record.
- Notice
of Unauthorized Disclosure of CPNI. A notification process is
established for both law enforcement and customers in the event of a CPNI
breach.
-
Joint
Venture and Independent Contractor Use of CPNI.
Consent rules are modified to require carriers to
obtain explicit consent from a customer before disclosing a customer’s CPNI to
a carrier’s joint venture partners or independent contractors for the purposes
of marketing communications-related services to that customer.
- Annual
CPNI Certification. Certification
rules are amended to require
carriers to file with the Commission an annual certification, including an
explanation of any actions taken against data brokers and a summary of all
consumer complaints received in the previous year regarding the unauthorized
release of CPNI.
- CPNI
Regulations Applicable to Providers of Interconnected VoIP Service.
CPNI rules are extended to cover providers of
interconnected voice over Internet Protocol (VoIP) service.
- Business Customers. In
limited circumstances, carriers may bind themselves contractually to
authentication regimes other than those adopted in this Order for services they
provide to their business customers that have a dedicated account
representative and contracts that specifically address the carrier’s protection
of CPNI.
Pretexting once again garnered attention after it was discovered that Hewlett-Packard used pretexting as one of the key ways for the company to spy on employees and journalists. HP revealed that it hired a third-party company which used investigators who pretexted to get access to phone records. The scandal forced several prominent HP board members to resign, with charges being dropped on several executives.
While the FCC approved a handful of changes, the organization turned down a provision that would allow phone carriers to not tell customers of record breaches up to 14 days after the event occurred.
The FCC order ultimately puts the burden of phone pretexting on the shoulders of the telcos. The mandate also bolsters federal involvement in security breaches. Section 64.2011 of the order reads, "As soon as practicable, and in no event
later than seven (7) business days, after reasonable determination of the
breach, the telecommunications carrier shall electronically notify the United
States Secret Service (USSS) and the Federal Bureau of Investigation (FBI)
through a central reporting facility.
The Commission will maintain a link to the reporting facility at http://www.fcc.gov/eb/cpni" rel="nofollow" rel="nofollow."
Even with these strong security measures, phone companies are still not entirely required to notify customers during a breach. Due to this loophole, the mandate has strong criticisms, particularly within the ranks of several FCC commissioners.
"Despite the Order’s conclusion
that customers should have notice of unauthorized disclosure of customer
information, this Order set up a process which can result in the unnecessary
and even indefinite delay of consumer notification without any accountability," states FCC commissioner Jonathan Adelstein.
"If you mod me down, I will become more insightful than you can possibly imagine." -- Slashdot
|
DailyTech Poll
Which web browser do you use on your primary personal machine?
44 Comments
Most Popular ArticlesEasy Fix to Prevent Microsoft From Bricking Xbox 360s HDDs Arrives
November 18, 2009, 6:41 AM
Built Around the Browser, Google's Chrome OS Launches, Reinvents the Operating System
November 19, 2009, 2:40 PM
OCZ Technology Announces 3.5" 1TB Colossus SSDs
November 17, 2009, 6:48 PM
Climategate: Stunning Deception and Misconduct at UK Warming Research Center Revealed
November 20, 2009, 4:00 PM
GM Sheds Light on Volt's Greatest Problems, How it Hopes to Overcome Them
November 18, 2009, 12:19 PM
|