USC - Call authentication

§ 227b. Call authentication

(a) DefinitionsIn this section:

(1) STIR/SHAKEN authentication framework

(2) Voice serviceThe term “voice service”—

(A) means any service that is interconnected with the public switched telephone network and that furnishes voice communications to an end user using resources from the North American Numbering Plan or any successor to the North American Numbering Plan adopted by the Commission under section 251(e)(1) of this title; and

(B) includes—

(i) transmissions from a telephone facsimile machine, computer, or other device to a telephone facsimile machine; and

(ii) without limitation, any service that enables real-time, two-way voice communications, including any service that requires internet protocol-compatible customer premises equipment (commonly known as “CPE”) and permits out-bound calling, whether or not the service is one-way or two-way voice over internet protocol.

(b) Authentication frameworks

(1) In generalSubject to paragraphs (2) and (3), and in accordance with paragraph (6), not later than 18 months after December 30, 2019, the Commission shall—

(A) require a provider of voice service to implement the STIR/SHAKEN authentication framework in the internet protocol networks of the provider of voice service; and

(B) require a provider of voice service to take reasonable measures to implement an effective call authentication framework in the non-internet protocol networks of the provider of voice service.

(2) ImplementationThe Commission shall not take the action described in paragraph (1) with respect to a provider of voice service if the Commission determines, not later than 12 months after December 30, 2019, that such provider of voice service—

(A) in internet protocol networks—

(i) has adopted the STIR/SHAKEN authentication framework for calls on the internet protocol networks of the provider of voice service;

(ii) has agreed voluntarily to participate with other providers of voice service in the STIR/SHAKEN authentication framework;

(iii) has begun to implement the STIR/SHAKEN authentication framework; and

(iv) will be capable of fully implementing the STIR/SHAKEN authentication framework not later than 18 months after December 30, 2019; and

(B) in non-internet protocol networks—

(i) has taken reasonable measures to implement an effective call authentication framework; and

(ii) will be capable of fully implementing an effective call authentication framework not later than 18 months after December 30, 2019.

(3) Implementation reportNot later than 12 months after December 30, 2019, the Commission shall submit to the Committee on Energy and Commerce of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a report on the determination required under paragraph (2), which shall include—

(A) an analysis of the extent to which providers of voice service have implemented the call authentication frameworks described in subparagraphs (A) and (B) of paragraph (1), including whether the availability of necessary equipment and equipment upgrades has impacted such implementation; and

(B) an assessment of the efficacy of the call authentication frameworks described in subparagraphs (A) and (B) of paragraph (1) in addressing all aspects of call authentication.

(4) Review and revision or replacementNot later than 3 years after December 30, 2019, and every 3 years thereafter, the Commission, after public notice and an opportunity for comment, shall—

(A) assess the efficacy of the technologies used for call authentication frameworks implemented under this section;

(B) based on the assessment under subparagraph (A), revise or replace the call authentication frameworks under this section if the Commission determines it is in the public interest to do so; and

(C) submit to the Committee on Energy and Commerce of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a report on the findings of the assessment under subparagraph (A) and on any actions to revise or replace the call authentication frameworks under subparagraph (B).

(5) Extension of implementation deadline

(A) Burdens and barriers to implementationNot later than 12 months after December 30, 2019, and as appropriate thereafter, the Commission—

(i) shall assess any burdens or barriers to the implementation required by paragraph (1), including—(I) for providers of voice service to the extent the networks of such providers use time-division multiplexing;(II) for small providers of voice service and those in rural areas; and(III) the inability to purchase or upgrade equipment to support the call authentication frameworks under this section, or lack of availability of such equipment; and

(ii) in connection with an assessment under clause (i), may, upon a public finding of undue hardship, delay required compliance with the 18-month time period described in paragraph (1), for a reasonable period of time, for a provider or class of providers of voice service, or type of voice calls, as necessary for that provider or class of providers or type of calls to participate in the implementation in order to address the identified burdens and barriers.

(B) Delay of compliance required for certain non-internet protocol networks

(i) Program required

(ii) Additional requirements

(iii) Minimization of burden

(D) Full participation

(E) Alternative methodologies

(F) Revision of delay of complianceNot less frequently than annually after the first delay of compliance is granted under subparagraph (A)(ii), the Commission—

(i) shall consider revising or extending any delay of compliance granted under subparagraph (A)(ii);

(ii) may revise such delay of compliance; and

(iii) shall issue a public notice with regard to whether such delay of compliance remains necessary, including—(I) why such delay of compliance remains necessary; and(II) when the Commission expects to achieve the goal of full participation as described in subparagraph (D).

(6) No additional cost to consumers or small business customers

(7) Accurate identification

(1) In generalConsistent with the regulations prescribed under subsection (j) of section 227 of this title, as added by section 10, the Commission shall, not later than 1 year after December 30, 2019, promulgate rules—

(A) establishing when a provider of voice service may block a voice call based, in whole or in part, on information provided by the call authentication frameworks under subsection (b), with no additional line item charge;

(B) establishing a safe harbor for a provider of voice service from liability for unintended or inadvertent blocking of calls or for the unintended or inadvertent misidentification of the level of trust for individual calls based, in whole or in part, on information provided by the call authentication frameworks under subsection (b);

(C) establishing a process to permit a calling party adversely affected by the information provided by the call authentication frameworks under subsection (b) to verify the authenticity of the calling party’s calls; and

(D) ensuring that calls originating from a provider of voice service in an area where the provider is subject to a delay of compliance with the time period described in subsection (b)(1) are not unreasonably blocked because the calls are not able to be authenticated.

(2) ConsiderationsIn establishing the safe harbor under paragraph (1), consistent with the regulations prescribed under subsection (j) of section 227 of this title, as added by section 10, the Commission shall consider limiting the liability of a provider of voice service based on the extent to which the provider of voice service—

(A) blocks or identifies calls based, in whole or in part, on the information provided by the call authentication frameworks under subsection (b);

(B) implemented procedures based, in whole or in part, on the information provided by the call authentication frameworks under subsection (b); and

(d) Rule of construction

(Pub. L. 116–105, § 4, Dec. 30, 2019, 133 Stat. 3276.)