# Advanced Methods To Target and Eliminate Unlawful Robocalls; Call Authentication Trust Anchor

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/fr%3A2022-13436

## Record

- **Collection:** Federal Register
- **Document type:** Rule
- **Published:** July 18, 2022
- **Citation:** 87 FR 42916

## Text

FEDERAL COMMUNICATIONS COMMISSION
47 CFR Parts 0 and 64
[CG Docket No. 17-59, WC Docket No. 17-97; FCC 22-37, FR ID 91946]
Advanced Methods To Target and Eliminate Unlawful Robocalls; Call Authentication Trust Anchor

AGENCY:

Federal Communications Commission.

ACTION:

Final rule.

SUMMARY:

In this document, the Federal Communications Commission (Commission or FCC) takes further steps to stem the tide of foreign-originated illegal robocalls by placing new obligations on the gateway providers that are the entry point or foreign calls into the United States by requiring them to play a more active role in the fight.

DATES:

Effective date:
This rule is effective September 16, 2022.

Compliance date:
Compliance with the amendments to 47 CFR 64.1200(n)(1) and (o), 64.6303(b), and 64.6305(b), (c)(2), (d), and (e)(2) and (3), are delayed indefinitely. The Federal Communications Commission will publish a document in the
Federal Register
announcing the compliance dates.

ADDRESSES:

Federal Communications Commission, 45 L Street NE, Washington, DC 20554.

FOR FURTHER INFORMATION CONTACT:

Jonathan Lechter, Competition Policy Division, Wireline Competition Bureau, at (202) 418-0984,
jonathan.lechter@fcc.gov
; or Jerusha Burnett, Attorney Advisor, Consumer Policy Division, Consumer and Governmental Affairs Bureau, at (202) 418-0526,
jerusha.burnett@fcc.gov
.

SUPPLEMENTARY INFORMATION:

This is a summary of the Commission's
Sixth Report and Order
in CG Docket No. 17-59 and
Fifth Report and Order
in WC Docket No. 17-97
Order on Reconsideration
and
Order
in WC Docket No. 17-97 adopted on May 19, 2022 and released on May 20, 2022 (
Gateway Provider Report and Order
). The document is available for download at
https://docs.fcc.gov/public/attachments/FCC-22-37A1.pdf
. Compliance with the amendments to 47 CFR 64.1200(n)(1) and (o), 64.6303(b), and 64.6305(b), (c)(2), and (d), which contain information collection requirements that have not been approved by the Office of Management and Budget (OMB), and the amendments to 47 CFR 64.6305(e)(2) and (3), are delayed indefinitely. The Federal Communications Commission will publish a document in the
Federal Register
announcing the compliance dates.

To request materials in accessible formats for people with disabilities (Braille, large print, electronic files, audio format), send an email to
FCC504@fcc.gov
or call the Consumer & Governmental Affairs Bureau at 202-418-0530 (voice), 202-418-0432 (TTY).

Synopsis

I. Sixth Report and Order and Fifth Report and Order

1. In this document, the Commission takes steps to protect consumers from foreign-originated illegal robocalls. Gateway providers' networks are the key entry point for foreign-originated robocalls, and the authentication and mitigation requirements the Commission adopts will ensure that American consumers are protected. The Commission defines the term “gateway provider,” requires such providers to authenticate all unauthenticated Session Initiation Protocol (SIP) calls in the internet Protocol (IP) portions of their networks, and adopts mitigation requirements specific to such providers, including requirements related to the Robocall Mitigation Database. As explained below, the Commission finds that the benefits of these new requirements, particularly to American consumers deluged by illegal calls originating in other countries, will far outweigh the short-term implementation costs imposed on gateway providers.

A. Need for Action

2.
Current Rules Addressing Foreign-Originated Robocalls Are Insufficient to Stop the Deluge of Illegal Robocalls Originating Abroad
. As proposed, the Commission concludes that consumers will benefit from caller ID authentication and illegal robocall mitigation requirements applied to gateway providers to address the problem of foreign-originated illegal robocalls (86 FR 59084, (Oct. 26, 2021)).

3. Commenters overwhelmingly support additional action to stop the flood of foreign-originated illegal calls. For example, Comcast agrees with the Commission that the current rules “are not sufficient to resolve the problem of foreign-originated illegal robocalls” and that the robocall landscape “warrants consideration of further regulatory efforts targeting gateway providers.” The State attorneys general also support steps to stop the “continued deluge of illegal foreign-based robocalls that use spoofed, U.S.-based phone numbers.”

4. Foreign robocallers use U.S. North American Numbering Plan (NANP) numbers in myriad ways to reach U.S. end users. In some cases, the foreign robocallers utilize spoofed U.S. numbers, while in other cases they have obtained U.S. NANP numbers from providers who have themselves obtained numbers on the secondary market or directly from the North American Numbering Plan Administrator (NANPA).

5. Commenting parties agree that foreign-originated calls are a significant portion, if not the majority, of illegal robocalls. The latest data from the Industry Traceback Group support the conclusion that many providers facilitating illegal robocalls are gateway providers and the upstream foreign originating and intermediate providers from whom they receive foreign-originating calls. Of the 347 providers identified in the Industry Traceback Group's 2021 report as responsible for transmitting illegal robocalls, 111 were gateway providers that brought the traffic into the U.S. network, and 115 were foreign providers originating illegal robocalls. According to the Industry Traceback Group, 10% of all providers that are not responsive to traceback requests constitute 48% of all non-responsive traceback requests. Of that 10%, over two-thirds are foreign providers. Recent action after the release of the
Gateway Provider Further Notice of Proposed Rulemaking (Gateway Provider FNPRM),
86 FR 59084, (Oct. 26, 2021), by the Commission's Enforcement Bureau underscores the need for action against foreign-originated robocalls, including cease-and-desist letters the Enforcement Bureau sent to three companies for transmitting illegal robocalls, “many of which originate overseas.”

6.
Role of Gateway Providers.
The Commission concludes that gateway providers serve as a critical choke-point for reducing the number of illegal robocalls received by American consumers, a conclusion confirmed by the record. Gateway providers can stop illegal calls to customers before they reach terminating providers, or, as the Industry Traceback Group data demonstrates, readily allow such calls into the U.S. market. State attorneys general argue that “in most cases” robocalling fraud results from “foreign actors gaining access to the U.S. phone network through international gateway providers.” State actions against gateway providers following the
Gateway Provider FNPRM
reinforce this conclusion.

B. Scope of Requirements and Definition

7.
Definition of Gateway Provider.
The Commission defines a “gateway provider” as a U.S.-based intermediate provider that receives a call directly from a foreign originating provider or foreign intermediate provider at its U.S.-based facilities before transmitting the call downstream to another U.S.-based provider, a slightly modified version of the definition the Commission proposed in the
Gateway Provider FNPRM
. By “U.S.-based,” the Commission means that the provider has facilities located in the U.S., including a point of presence capable of processing the call. By “receives a call directly” from a provider, the Commission means the foreign provider directly upstream of the gateway provider in the call path sent the call to the gateway provider, with no providers in-between. Commenters support the Commission's proposed definition, with some suggesting minor modifications addressed below.

8. In the
Gateway Provider FNPRM,
the Commission initially proposed to define a gateway provider as “the first U.S.-based intermediate provider in the call path of a foreign-originated call that transmits the call directly to another intermediate provider or a terminating voice service provider in the United States.” The Commission adds “receives a call directly from a foreign originating provider or foreign intermediate provider” and drop “foreign-originated call” from its adopted definition for several reasons. First, as commenters note, a gateway provider may not know the identity or location of the entity that originated the call, but it will know the identity of the immediate upstream provider that sent the call to the gateway provider, including whether that provider has registered as a foreign provider in the Robocall Mitigation Database. (As explained below, the Commission clarifies foreign intermediate providers' traffic will be blocked unless they register in the Robocall Mitigation Database.) The Commission's adopted definition ensures that a provider will be considered a gateway provider for any call it receives directly from a foreign provider that the provider does not itself terminate. Second, the Commission's definition ensures that calls sent on a circuitous path out of and then back into the U.S. will be brought within the regime. In that scenario, the U.S.-based provider acts as a gateway provider at the point in the call path when the foreign provider immediately upstream of the gateway provider sends the call to the gateway provider, even for calls originated within the United States. The Commission agrees with commenters that “U.S.-based facilities” for the purpose of the Commission's definition means that the provider has facilities in the U.S., including, at a minimum, a U.S.-located point of presence.

9. The Commission clarifies that foreign affiliates of a U.S.-based provider or other U.S.-licensed entities that receive traffic in another country and transmit that traffic to another provider to bring across the boundary of the U.S. network are not gateway providers. As proposed, the Commission does not include in the definition providers that also terminate the call because they are then acting as terminating providers and are subject to the existing rules applicable to such providers. In their capacity as terminating providers, these providers have existing obligations to prevent their own end users from receiving illegal robocalls. (A terminating provider is a voice service provider for purposes of section 4 of the TRACED Act and the Commission's caller ID authentication rules. A voice service provider is required to, among other things, verify caller ID information pursuant to STIR/SHAKEN for traffic it terminates, 47 CFR 64.6301(a)(3), and submit a certification to the Robocall Mitigation Database.)

10. Because the TRACED Act defines “voice service” in a manner that excludes intermediate providers, the authentication and Robocall Mitigation Database rules use “voice service provider” in this manner. The Commission's call blocking rules, many of which the Commission adopted prior to adoption of the TRACED Act, use a definition of “voice service provider” that includes intermediate providers. In that context, use of the TRACED Act definition of “voice service” would create inconsistency with the existing rules. To avoid confusion, for purposes of this item, the Commission uses the term “voice service provider” consistent with the TRACED Act definition and where discussing caller ID authentication or the Robocall Mitigation Database. In all other instances, the Commission uses “provider” and specifies the type of provider as appropriate. Unless otherwise specified, the Commission means any provider, regardless of its position in the call path.

11.
Call-by-Call Basis.
Consistent with the proposal in the
Gateway Provider FNPRM,
the Commission adopts the gateway provider classification on a call-by-call basis. That is, a provider is a gateway provider and subject to the rules for gateway providers the Commission adopts in this document only for those calls for which it acts as a gateway provider unless otherwise noted.

12. As the Commission noted in the
Gateway Provider FNPRM,
the Commission took this approach when classifying intermediate and voice service providers with respect to the Commission's caller ID authentication rules. The Commission adopts the call-by-call classification to ensure that gateway providers, due to their key role in the call path, are subject to the requirements. There is record support for this approach. Concluding that the burdens are overstated, the Commission rejects concerns of commenters that assert that the call-by-call classification would not be administratively feasible, and would potentially impose two different sets of regulations on the same set of providers, causing confusion. As the Commission notes, and a number of commenters agree, a gateway provider will know the identity of the immediate upstream provider from which it receives a call. (As explained below, the Commission clarifies foreign intermediate providers' traffic will be blocked unless they register in the Robocall Mitigation Database.) The gateway provider will also know whether that provider has registered as a foreign provider in the Robocall Mitigation Database. The Commission's approach ensures that a gateway provider is subject to the consumer protection requirements it adopts whenever it receives a call directly from a foreign provider.

13. Moreover, a call-by-call approach will have a limited practical burden for several reasons. As an initial matter, several of the obligations the Commission adopts do not require a gateway provider or providers downstream from the gateway provider to determine, in real time, whether or not the relevant provider is acting as a gateway provider for a particular call. First, the 24-hour traceback requirement and know-your-upstream provider requirements do not involve any real-time action on the part of a gateway provider when it receives the call. Second, the obligation to block traffic upon notification by the Commission applies only to those entities identified by the Commission, so that providers need not identify relevant traffic in real-time in the first instance. Third, if a provider acts as a gateway provider for
any
calls, it must submit a robocall mitigation plan to the Robocall Mitigation Database describing how it mitigates calls in its role as a gateway provider
generally
. Fourth, where a downstream provider needs to block

traffic from an upstream provider that has not filed in the Robocall Mitigation Database, it is required to do so if it has reason to believe it is a gateway or voice service provider for
any
calls. Additionally, while gateway providers must undertake call blocking on a call-by-call basis at the time of the call for numbers on a Do Not Originate (DNO) list, all domestic providers in the call path are already permitted to engage in such blocking and can therefore elect to apply such blocking to all calls, rather than simply the calls for which they act as a gateway provider. Similarly, while gateway providers must take “reasonable steps” to mitigate calls received as a gateway provider on a call-by-call basis, the burden of identifying the relevant calls is likely low; gateway providers should know those calls they receive from foreign providers and send downstream to another domestic provider and can apply the appropriate mitigation procedures to those calls. Indeed, several stated that they already do so. At a minimum, to the extent a provider receives a call directly from a provider listed as “foreign” in the Robocall Mitigation Database, it is acting as a gateway provider for that call.

14. The Commission notes that many providers already operate under multiple sets of obligations—for example, as intermediate providers and voice service providers under the Commission's caller ID authentication rules—and no party has indicated why a call-by-call approach for gateway providers would be more burdensome. Moreover, no commenter proposed an alternative approach for imposing unique obligations on gateway providers. (Many commenters assert that the Commission should not impose unique obligations on gateway providers. The Commission addresses that argument in Section I.E.4
infra
.) The Commission thus concludes that the burden on gateway providers to identify the appropriate regulatory regime applicable to a particular call will be limited.

15.
U.S. NANP Numbers.
Consistent with its proposal, the Commission limits the scope of the requirements for gateway providers to those calls that are carrying a U.S. number in the caller ID field. By a “U.S. number,” the Commission means NANP resources that pertain to the United States. The Commission excludes from the scope of its rules those calls that carry a U.S. number in the ANI field but display a foreign number in the caller ID field. Commenters uniformly support this approach, which is consistent with the scope of the prohibition on receiving calls carrying U.S. NANP numbers from foreign voice service providers not listed in the Robocall Mitigation Database. Foreign-originated robocalls are successful to the extent that end users believe they are calls from U.S. customers or businesses, and the Commission therefore concludes it is appropriate to focus its efforts on such calls. (For this reason, the Commission concludes that including “in the caller ID field” within its definition and elsewhere in its newly adopted rules will not encourage a deluge of illegal robocalls using non-US numbers as ZipDX argues.)

16.
No Traffic Carve-Outs.
Finally, the Commission declines to exclude certain types of traffic from the consumer protections it adopts. The Commission therefore rejects iBasis's contention that the Commission should exempt from the rules cellular roaming calls sent from U.S. customers abroad. The Commission also declines, at this time, to draw a distinction between “conversational” and “non-conversational traffic” and to require it to be segregated at the gateway and subject to different levels of regulatory scrutiny. (The Commission notes that it seeks comment on some of these ideas in the accompanying
FNPRM
published elsewhere in this this issue of the
Federal Register
.) The record does not reflect sufficient evidence to justify the utility of these carve-outs, or explain how they could be implemented in an administrable way and in a manner that avoids robocallers gaming whatever call-length definitions the Commission adopts. For example, the Commission is concerned that, if it sets a threshold for conversational traffic at a particular call length, robocallers would find a way to avoid crossing it while continuing to send robocalls. The Commission finds, at this time, that analytics providers, who can and do take call-length patterns into account in determining whether a call is likely to be an illegal robocall, are in the best position to make these sorts of determinations. These entities have the incentive and ability to react quickly to robocallers' shifting tactics and can do so without disclosing to bad actors the specific thresholds on which they rely.

C. Robocall Mitigation Database

17. The Commission adopts its proposal to require gateway providers to submit a certification and mitigation plan to the Robocall Mitigation Database. As explained below, the Commission requires gateway providers to take “reasonable steps” to mitigate robocall traffic regardless of whether they have fully implemented STIR/SHAKEN. Gateway providers' robocall mitigation plans must describe their robocall mitigation practices and state that they are adhering to those practices, regardless of whether they have fully implemented STIR/SHAKEN. The Commission also adopts a modified version of its proposal for downstream domestic providers receiving traffic from gateway providers to block traffic from such a provider if the gateway provider has not submitted a certification in the Robocall Mitigation Database or if the gateway provider has been de-listed from the Robocall Mitigation Database pursuant to enforcement action. The vast majority of commenters supported these proposals.

18.
Gateway Provider Robocall Mitigation Database Filing Obligations.
The Commission concludes that requiring gateway providers to submit a certification to the Robocall Mitigation Database describing their robocall mitigation practices and stating that they are adhering to those practices, in conjunction with the new robocall mitigation obligations the Commission adopt elsewhere in this document, is an appropriate extension of similar obligations that currently apply to other providers. The Commission further concludes that requiring gateway provider certification will encourage compliance and facilitate enforcement efforts and industry cooperation. The record reflects significant support for this action. For example, iBasis, a gateway provider, “believes that it is appropriate to require such a submission” along with a mitigation plan. While INCOMPAS and T-Mobile argue that gateway providers that have implemented STIR/SHAKEN should not have to submit a mitigation plan, the Commission disagrees because of the importance of gateway providers in the call path and its conclusion that STIR/SHAKEN, on its own, will not eliminate illegal robocalls, particularly traffic originating from outside the United States.

19. These rules the Commission adopts require gateway providers to submit the same information to the Robocall Mitigation Database that voice service providers must submit under existing Commission rules, except for the limited areas described below. Specifically, gateway providers must certify to the status of STIR/SHAKEN implementation and robocall mitigation on their networks; submit contact information for a person responsible for addressing robocall mitigation-related issues; and describe in detail their robocall mitigation practices. Gateway providers may make confidential submissions consistent with the

Commission's existing confidentiality rules. (As USTelecom notes, providers may only redact filings to the extent appropriate under the Commission's confidentiality rules.) Gateway providers must also certify that they will comply with traceback requests within 24 hours, unlike the current “reasonable period of time” applicable for voice service providers, or that it has received a waiver of that rule.

20. Consistent with voice service providers' current obligations, the Commission does not require gateway providers to describe their mitigation program in a particular manner, with the exception of clearly explaining how they are complying with the know-your-upstream-provider obligation adopted in this document. The Commission concludes that it and the public will benefit from understanding how each provider chooses to comply with the know-your-upstream provider duty, both because compliance is critical to stopping the illegal carrying or processing of robocalls and because providers may choose to comply with this duty in different ways. (In several legal settlements with gateway providers, the gateway providers were required to comply with extremely detailed, and public, know-your-customer obligations.) As USTelecom argues, “providers' robocall mitigation programs should reflect at least a basic level of vetting of the providers from whom they directly accept traffic—beyond ensuring that they are registered in the [Robocall Mitigation Database].”

21. The Commission also clarifies that, consistent with existing Commission filing requirements in other contexts, all mitigation plans must be submitted in English or with a certified English translation. To remove any ambiguity, the Commission also codifies that requirement with respect to its STIR/SHAKEN rules. Plans that were not submitted in English or with a certified English translation must be updated no later than 10 business days following the effective date of this document, consistent with the Commission's existing requirement for updating information in the Robocall Mitigation Database.

22. The Commission delegates to the Wireline Competition Bureau the authority to specify the form and format of any submissions, and it directs the Wireline Competition Bureau to comply with any requirements under the Paperwork Reduction Act attendant upon such action. This includes whether gateway providers that are also voice service providers may either submit a separate certification and plan as a gateway provider or amend their current certification and any plan. A gateway provider that is also a voice service provider should explain the mitigation steps it undertakes as a gateway provider and the mitigation steps it undertakes as a voice service provider, to the extent those mitigation steps are different for each role. And as with voice service providers, and consistent with the Commission's proposal, the Commission requires gateway providers to update their certifications within ten business days of “any change in the information” submitted, ensuring that the information is kept up to date.

23. The Commission also notes that it may take the same enforcement actions against a gateway provider whose certification is deficient or who fails to meet the standards of its certifications as is the case for voice service providers. This includes, but is not limited to, delisting the gateway provider from the Robocall Mitigation Database. In the
Second Caller ID Authentication Report and Order,
85 FR 73360 (Nov. 17, 2020), the Commission set forth consequences for providers that file a deficient robocall mitigation plan or that “knowingly or negligently” originate illegal robocall campaigns, including removal from the Robocall Mitigation Database. To promote regulatory symmetry and close any loopholes in the Commission's regime, gateway providers will be subject to similar consequences. Specifically, if the Commission find that a certification is deficient, such as if the certification describes an ineffective program, or it determines that a provider knowingly or negligently carries or processes illegal robocalls, it will take appropriate enforcement action. These actions may include, among others, removing a certification from the database after providing notice to the gateway provider and an opportunity to cure the filing, requiring the gateway provider to submit to more specific robocall mitigation requirements, and/or the imposition of a forfeiture. Should the Commission remove a gateway provider from the Robocall Mitigation Database, downstream providers must block that gateway provider's traffic as described below.

24. Gateway providers must submit a certification to the Robocall Mitigation Database by 30 days following publication in the
Federal Register
of notice of approval by OMB of any associated Paperwork Reduction Act (PRA) obligations. (In the
Gateway Provider FNPRM,
the Commission proposed a filing deadline of 30 days after the publication of this document, but that did not account for OMB approval of PRA obligations.) The Commission concludes that the deadline will give providers sufficient time to prepare their submission following notification of OMB approval. If a gateway provider has not fully implemented STIR/SHAKEN by the filing deadline, it must so indicate in its filing. (Below, the Commission requires gateway providers to authenticate unauthenticated SIP traffic pursuant to STIR/SHAKEN by June 30, 2023.) It must then later update the filing within 10 business days of STIR/SHAKEN implementation. (Given the importance of tracking gateway providers' mitigation efforts, the Commission concludes that the benefit of an earlier filing deadline outweighs the burden for some providers to subsequently update their filing with their STIR/SHAKEN compliance status.)

25. The Commission does not at this time adopt a requirement for gateway providers to inform the Commission through an update to the Robocall Mitigation Database filing if the gateway provider is subject to a Commission, law enforcement, or regulatory agency action, investigation, or inquiry due to its robocall mitigation plan being deemed insufficient or problematic, or due to suspected unlawful robocalling or spoofing. Similarly, the Commission does not at this time require all or a subset of Robocall Mitigation Database filers to include additional identifying information. While the Commission concludes that taking these steps may have merit, it finds the record is insufficient to support taking action at this time. Instead, the Commission seeks comment in the accompanying
FNPRM
on imposing these obligations on all domestic providers in the call path.

26. The Commission also does not at this time extend this certification obligation to domestic intermediate providers other than gateway providers or require voice service providers that have already implemented STIR/SHAKEN to meet the “reasonable steps” standard and submit a robocall mitigation plan. However, the Commission seeks comment on doing so in the accompanying
FNPRM
.

27.
Gateway Provider Call Blocking.
The Commission also extends the prohibition on accepting traffic from unlisted voice service providers to gateway providers as proposed. This proposal received significant record support and will close a loophole in the Commission's regime. Under this rule, downstream providers will be prohibited from accepting any traffic from a gateway provider not listed in the Robocall Mitigation Database, either because the provider did not file or their

certification was removed from the Robocall Mitigation Database as part of an enforcement action. The Commission concludes that a gateway provider Robocall Mitigation Database filing requirement and an associated prohibition against accepting traffic from gateway providers not in the Robocall Mitigation Database will ensure regulatory symmetry between voice service providers and gateway providers and underscore the key role gateway providers play in stemming foreign-originated illegal robocalls. Consistent with the Commission's proposal, and the parallel requirement adopted for voice service providers in the
Second Caller ID Authentication Report and Order,
this prohibition will go into effect 90 days following the deadline for gateway providers to submit a certification to the Robocall Mitigation Database.

28. As a result of gateway providers' affirmative obligation to submit a certification in the Robocall Mitigation Database, the Commission concludes that downstream providers will no longer be able to rely upon any gateway provider database registration imported from the intermediate provider registry when making blocking determinations. (Previously, all intermediate providers were imported into the Robocall Mitigation Database from the rural call completion database's Intermediate Provider Registry so that all intermediate providers would be represented therein, giving voice service providers “confidence that any provider not listed in the Robocall Mitigation Database” was not in compliance with the Commission's rules.) In the
Second Caller ID Authentication Report and Order,
the Commission imported intermediate providers into the Robocall Mitigation Database from the intermediate provider registry to ensure that downstream providers did not inadvertently block traffic sent from the intermediate providers' networks. At that time, no intermediate providers were subject to a Robocall Mitigation Database filing or mitigation requirement. To the extent a gateway provider was imported into the Robocall Mitigation Database via the intermediate provider registry, that Robocall Mitigation Database entry is not sufficient to meet the gateway provider's Robocall Mitigation Database filing obligation or to prevent downstream providers from blocking traffic upon the effective date of the obligation for downstream providers to block traffic from gateway providers. Therefore, gateway providers must submit a certification to the Robocall Mitigation Database by 30 days following
Federal Register
publication of OMB approval of the relevant information collection requirements, and the downstream provider must begin blocking traffic within 90 days of that certification deadline if the gateway provider has not submitted a certification to the Robocall Mitigation Database. The Commission delegates to the Wireline Competition Bureau to make the necessary changes to the Robocall Mitigation Database to indicate whether a gateway provider has made an affirmative filing (as opposed to being imported as an intermediate provider) and whether any provider's filing has been de-listed as part of an enforcement action. The Bureau may, pursuant to an enforcement action, remove the record of a providers' filing or clearly mark it in a way so that downstream providers may not rely on it.

29. For the purpose of the downstream providers' call blocking duty, the Commission does not require the downstream provider to determine if a specific call was sent from a provider acting as a voice service provider or gateway provider for that call. Nevertheless, the Commission recognizes that it may not always be possible for the downstream provider to know whether the upstream provider is (1) a voice service provider or gateway provider whose traffic must be blocked if the provider did not make an affirmative certification in the Robocall Mitigation Database and has not been de-listed; or (2) an intermediate provider that is not a gateway provider, whose traffic should not be blocked. The Commission therefore only requires the downstream provider to block calls if they have a reasonable basis to believe that the upstream provider acts,
for some calls,
as a voice service provider or gateway provider and that the provider did not affirmatively file or in the Robocall Mitigation Database or has been de-listed. The Commission notes it is proposing in the
FNPRM
to expand the obligation to submit an affirmative certification to the Robocall Mitigation Database to all domestic intermediate providers. Adoption of that proposal should eliminate any of these implementation concerns. In that case, the downstream provider would simply check to see if the upstream provider affirmatively filed in the Robocall Mitigation Database and has not been de-listed and would block the call if appropriate. Nevertheless, the Commission concludes it must act now with respect to gateway providers to stem the tide of foreign-originated calls.

30.
Bureau Guidance.
The Commission directs the Wireline Competition Bureau to make the necessary changes to the Robocall Mitigation Database portal and provide appropriate filing instructions and training materials consistent with this document. The Commission also directs the Wireline Competition Bureau to release a public notice upon OMB approval of the information collection requirements for filing a certification, setting the deadlines for filing a certification, and for the downstream provider to block traffic from a gateway provider that has not filed a certification in the database. Either in that same or a separate public notice, the Wireline Competition Bureau shall also state when gateway providers may begin filing certifications in the Robocall Mitigation Database.

31. Commenters disagreed whether intermediate providers' imported data should be deleted from the database. Consistent with the Commission's direction to the Wireline Competition Bureau to make the necessary changes to the portal to effectuate the rules, the Commission directs the Bureau to determine how to manage the imported data of gateway providers and to announce its determination as part of its guidance described in the paragraph above.

32.
Public Safety Calls.
In the
Gateway Provider FNPRM,
the Commission clarified that: (1) even if a provider is not listed in the Robocall Mitigation Database, other voice service providers and intermediate providers in the call path must make all reasonable efforts to avoid blocking calls from public safety answering points (PSAPs) and Government outbound emergency numbers; and (2) emergency calls to 911 from originating providers not in the Robocall Mitigation database must not be blocked “under any circumstances.” (These clarifications reflect the Commission's existing requirements.) The Commission now codifies these requirements and applies them as well to the new blocking obligations it adopts in this document. Codifying these clarifications with respect to providers not listed in the Robocall Mitigation Database are consistent with the Commission's action to similarly codify these safeguards in its other blocking rules and will ensure completion of emergency calls is subject to the same safeguards regardless of the rule under which the call would otherwise be blocked. There was record support for this approach. The Commission disagrees with ZipDX that its clarification in the
Gateway Provider FNPRM
and its expansion to gateway providers would not be administratively feasible. Providers have had to comply

with the Commission's public safety exception to blocking for other purposes for several years, and ZipDX does not adequately explain why applying this exception to traffic sent from providers not in the Robocall Mitigation Database now would be different. Additionally, in balancing any implementation concerns against the critical importance of completing emergency calls, the Commission concludes that adopting and expanding the public safety exception is in the public interest.

33. The Commission also sought comment in the
Gateway Provider FNPRM
on whether it should expand these clarifications, including whether it should further define what constitutes “reasonable efforts” to prevent blocking of emergency calls. In light of the limited comments in the record and the uncertain benefits to be gained, the Commission does not take any further action at this time.

D. Authentication

34. To combat foreign-originated robocalls, and to further the long-standing Commission goal and benefits of ubiquitous STIR/SHAKEN authentication, the Commission requires gateway providers, consistent with its proposal, to implement STIR/SHAKEN to authenticate SIP calls that are carrying a U.S. number in the caller ID field. The Commission concludes based on the record that authentication, as well as the additional data sent to downstream providers along with the authentication, will reduce the incentive and ability of foreign providers to send illegal robocalls into the U.S. market, as well as provide downstream intermediate and terminating providers and their call analytics partners with additional data to protect their customers, and therefore will provide a significant benefit. Attestation information will facilitate analytics and promote traceback and enforcement efforts. Speeding traceback efforts is also consistent with the underlying goal of the Commission's 24-hour traceback requirement. The Commission finds those benefits outweigh the implementation costs. Additionally, certain commenters support requiring gateway providers to authenticate calls.

35. As the Commission has previously explained, application of caller ID authentication by intermediate—including gateway—providers “will provide significant benefits in facilitating analytics, blocking, and traceback by offering all parties in the call ecosystem more information.” At the time the Commission reached this conclusion, given the concerns that an authentication requirement on all intermediate providers “was unduly burdensome in some cases,” the Commission determined that intermediate providers could, instead of authenticating unauthenticated calls, “register and participate with the industry traceback consortium as an alternative means of complying with our rules.” Since that time, the Commission imposed on all domestic providers the requirement to respond to all traceback requests from the Commission, law enforcement, or the industry traceback consortium, fully and in a timely manner. Because evidence shows that foreign-originated robocalls are a significant and increasing problem and that the benefits of a gateway authentication requirement outweigh the burdens, the Commission thus adopts a gateway provider authentication obligation to address this problem. The Commission believes gateway provider authentication will address a significant risk to American consumers and enhance their trust in this country's telecommunications network.

36.
Requirement.
To comply with the requirement to authenticate calls, consistent with the Commission's proposal, a gateway provider must authenticate caller ID information for all SIP calls it receives for which the caller ID information has not been authenticated and which it will exchange with another provider as a SIP call. (As noted, the call blocking rules have mooted this choice—all domestic providers now must cooperate with traceback efforts.) A gateway provider can satisfy its authentication requirement if it adheres to the three Alliance for Telecommunications Industry Solutions (ATIS) standards that are the foundation of STIR/SHAKEN—ATIS-1000074, ATIS-1000080, and ATIS-1000084—and all documents referenced therein. Compliance with the most current versions of these standards as of the compliance deadline, including any errata to the standards as of that date or earlier, represents the minimum requirement to satisfy the Commission's rules. (No commenters addressed this proposal.) ATIS and the SIP Forum conceptualized ATIS-1000074 as “provid[ing] a baseline that can evolve over time, incorporating more comprehensive functionality and a broader scope in a backward compatible and forward looking manner.” The Commission intends for its rules to provide this same room for innovation, while maintaining an effective caller ID authentication ecosystem. Gateway providers may incorporate any improvements to these standards or additional standards into their respective STIR/SHAKEN authentication frameworks, so long as any changes or additions maintain the baseline call authentication functionality exemplified by ATIS-1000074, ATIS-1000080, and ATIS-1000084.

37. In addition, in line with the rule applicable to intermediate providers generally and the Commission's proposal, gateway providers have the flexibility in implementing call authentication to assign the level of attestation appropriate to the call based on the call information available to the gateway provider. Gateway providers are not limited to assigning “gateway” (C-level) attestation, and one commenter notes that there are significant benefits to be gained from gateway providers appropriately applying higher attestation levels consistent with the standard. Stakeholders support this approach.

38.
Benefits Outweigh Burdens.
The Commission concludes that the benefits of a gateway provider authentication obligation outweigh the burdens. Record evidence demonstrates that the benefits of gateway provider authentication are significant and are likely to grow over time as more providers are brought within the STIR/SHAKEN regime. Illegal robocalls cost Americans billions of dollars each year. Even minimal deterrence arising from authenticating unauthenticated foreign-originated calls is likely to be highly beneficial. To the extent “gateway providers already exchange traffic in SIP and therefore likely are ready to implement STIR/SHAKEN,” the requirement will have a real, near-term benefit.

39. Those commenters asserting such a requirement will cost significant time and resources to implement do not provide detailed support for their claims. Indeed, to the extent a gateway provider also serves as a voice service provider, it will have already implemented STIR/SHAKEN in at least some portion of its network, likely lowering its compliance costs to meet the requirement the Commission adopts. Given the real and significant benefits to providers and American consumers in the form of billions in savings and increased trust in the voice network that will flow from the reduction in foreign-originated illegal robocalls, the Commission concludes that requiring authentication is in the public interest even if it credits those arguing that there are substantial implementation costs.

40. While gateway providers are likely to authenticate most calls with only C-level attestation at least initially, the

Commission disagrees with those commenters who argue that the benefits of lower attestation levels, along with other information sent along with the attestation, are not worth the asserted cost. While “C-level attestation is not as good as higher-level attestation . . . it is far more valuable, particularly in the case of foreign-originated illegal robocalls, than NO signature.” Terminating providers and their end users directly benefit from gateway provider authentication. As T-Mobile notes, “[r]eceiving
any
level of attestation can help carriers trace where unwanted or illegal calls enter the country so they can follow up and prevent additional traffic from the offending source. The information passed along with the attestation can be valuable for analytics engines, enabling calls to be appropriately labeled or sent to voice mail” before reaching end users. Indeed, the North American Numbering Council (NANC) recently recognized the value of this information. Even if not all analytics providers currently use this information, more could readily do so in the future. And, while the Commission agrees with commenters that gateway provider authentication is not a “silver bullet,” it “will have a significant impact on curtailing illegal robocalls which is critical to restoring trust in the voice network.” It also will make the traceback process more efficient and rapid, consistent with the underlying goal of the Commission's newly adopted 24-hour traceback requirement. Even if foreign-originated calls carrying U.S. numbers constitute a small portion of gateway providers' overall traffic, such traffic represents a disproportionate share of illegal robocall traffic received by such providers, underscoring the importance of authentication. The Commission agrees with USTelecom that the Commission's authentication regime would be harmed if gateway providers improperly sign calls with A-level attestations, but that is not a problem unique to gateway provider authentication—all domestic providers authenticating calls are obligated to provide the appropriate attestation level. Similarly, the Commission disagrees with Verizon that because some gateway providers still have some time division multiplex (TDM) facilities, which fall “out of the scope” of the attestation mandate, the Commission should not require gateway providers to authenticate SIP calls. The Commission continuously has required voice service providers to implement authentication on the IP portions of their networks, as it does for gateway providers here, despite the presence of TDM facilities on their networks subject to a continuing extension.

41. Expanding the scope of providers subject to the STIR/SHAKEN regime will increase the overall benefits of the standard and its future reach. As many parties and the NANC note, STIR/SHAKEN has beneficial network effects, and the more steps the Commission takes to increase its use, the greater the overall benefit for those providers that have already implemented the standard and those providers' customers. (For the same reasons, the Commission does not adopt USTelecom's alternative proposal to only impose a gateway provider authentication obligation on smaller, non-facilities-based providers.) Indeed, the Commission's expansion of the STIR/SHAKEN regime may spur other countries and regulators to also develop and adopt STIR/SHAKEN, further increasing the standards' benefit. (While the i3forum opposes an attestation obligation, it notes that cross-border adoption of STIR/SHAKEN and voluntary agreements can lead to “situations in which [the gateway provider] has access to information that would enable it to provide an A-level or B-level attestation.”) In the interim, gateway provider authentication is the only way to ensure that all foreign-originated calls with U.S. numbers in the caller ID field are authenticated. The Commission acknowledges that at least some of the benefits that will flow from gateway provider authentication are based on its reasoned predictions arising from disputed record evidence. Nevertheless, in adopting its rule, the Commission is persuaded by the available evidence that the benefits will be significant, and the sooner the Commission acts, the sooner the public will obtain these benefits. For these reasons, the Commission disagrees with CTIA-The Wireless Association that it would be “premature” for the Commission to require gateway authentication while foreign regulators consider mandating STIR/SHAKEN or that the Commission should wait for the recommendations of outside third parties, or possible future rule changes, before acting.

42.
Compliance Deadline.
The Commission requires that gateway providers authenticate unauthenticated foreign-originated SIP calls carrying U.S. NANP numbers by June 30, 2023, a longer period than the Commission proposed in the
Gateway Provider FNPRM
. One commenter supported a December 2023 deadline, while others supported either a longer or shorter deadline. The Commission conclude that this deadline appropriately balances the relevant burdens and benefits of implementation; it will give gateway providers less time than the 18 months voice service providers had to implement STIR/SHAKEN, but more time than the shorter deadline of the effective date of the order proposed by the 51 State attorneys general. This deadline also coincides with the extension for STIR/SHAKEN implementation for facilities-based small voice service providers.

43. The Commission also believes that a June 30, 2023, deadline is reasonable because the industry has much more experience with implementation than when the Commission originally required voice service providers to implement STIR/SHAKEN, there is evidence that STIR/SHAKEN implementation costs have dropped since it first adopted the requirement for voice service providers and because the authentication requirement applies only to the IP portions of the gateway providers' networks. Finally, to facilitate uniformity, simplify compliance, and consistent with comments in the record, the Commission does not adopt an earlier deadline for those providers that have, in their role as voice service providers, already implemented STIR/SHAKEN, nor do it adopt a longer deadline for certain providers or classes of provider, or a specific process for the grant of extensions or exemptions from this requirement, with the exception of two extensions regarding token access and non-IP networks described below. (Parties are, of course, free to file a request for waiver. The Commission may grant such requests where the particular facts at issue make strict compliance with the rule at issue inconsistent with the public interest. In considering whether to grant a waiver, the Commission may take into account factors such as hardship, equity, or more effective implementation of overall policy. This extension will be similar to the one already in place for voice service providers.) As noted above, once a gateway provider has fully implemented STIR/SHAKEN, it must update its filing in the Robocall Mitigation Database.

44.
Token Access.
The Commission sought comment on whether the Secure Telephone Identity Governance Authority's (STI-GA) token access policy serves as a barrier for all or a subset of gateway providers from obtaining a token and, if so, what if any actions it should take to address that barrier, but it received limited response. (USTelecom and iconnectiv assert that the policy should not be changed. iBasis argues that the operating company

number (OCN) criteria should be eliminated.) The Commission concludes that the current token access policy will likely not present a material barrier to gateway providers meeting their authentication obligation, and it anticipates that the STI-GA can address any concerns before gateway providers are required to authenticate calls by June 30, 2023. Nevertheless, to ensure that gateway providers are not unfairly penalized, the Commission provides a STIR/SHAKEN extension to gateway providers that are unable to obtain a token due to the STI-GA token access policy. The extension will run until the gateway provider is able to obtain a token as long as the gateway provider “diligently pursues” doing so.

45.
Non-IP Networks and Authentication.
The Commission concludes that gateway providers should have the same duty as voice service providers to either upgrade their non-IP networks to IP and implement STIR/SHAKEN or work with a working group, standards group, or consortium to develop a non-IP caller ID authentication solution. Such an obligation is appropriate in light of gateway providers' key role in serving as the entry point for foreign-originated voice traffic into the U.S. marketplace and the limited burden gateway providers would experience in working with a standards group. No party commented on this issue, and this approach is consistent with those commenters arguing that all domestic providers in the call path should have similar obligations. As with voice service providers, gateway providers that choose to work with a working group are subject to an extension to implement STIR/SHAKEN in the non-IP portions of their networks.

46. The Commission asked in the
Gateway Provider FNPRM
whether it should require gateway providers to adopt a non-IP caller ID authentication solution, an obligation that voice service providers currently do not have. A number of commenters filed specific proposals in the record for authentication on IP and non-IP networks for gateway providers as well as voice service providers. The Commission does not adopt these proposals, in part because many are outside of the scope of the
Gateway Provider FNPRM.
However, the Commission seeks comment on some of these alternatives in the accompanying
FNPRM,
as well as their applicability to all domestic providers in the call path, and do not foreclose the possibility of seeking comment on the remainder of these proposals in a future proposal.

E. Robocall Mitigation

47. The Commission adopts several of its robocall mitigation proposals from the
Gateway Provider FNPRM.
First, the Commission adopts its proposal to require gateway providers to respond to traceback requests within 24 hours, with one modification. Second, it requires gateway providers and the providers immediately downstream from the gateway provider to comply with blocking mandates in certain instances. Third, it requires gateway providers to “know” the provider immediately upstream from the gateway provider. Finally, the Commission adopts a general mitigation standard.

1. 24-Hour Traceback Requirement

48. The Commission adopts its proposal to require gateway providers to fully respond to traceback requests from the Commission, civil and criminal law enforcement, and the industry traceback consortium within 24 hours of receipt of such a request. (To be clear, the 24-hour clock does not start outside of the business hours of the local time for the responding office. Requests received outside of business hours as defined in the Commission's rules are deemed received at 8 a.m. on the next business day. Similarly, if the 24-hour response period would end on a non-business day, either a weekend or a Federal legal holiday, the 24-hour clock does not run for the weekend or holiday in question, and restarts at 12:01 a.m. on the next business day following when the request would otherwise be due. “Business day” for these purposes is Monday through Friday, excluding Federal legal holidays, and “business hours” are 8 a.m. to 5:30 p.m. on a business day, consistent with the definition of office hours in the Commission's rules. By way of example, a request received at 3 p.m. on a Friday will be due at 3 p.m. on the following Monday, assuming that Monday is not a Federal legal holiday. The Commission believes that this clarification resolves concerns raised by some parties about the burden of a strict 24-hour requirement.) This is an enhancement of the Commission's existing rule, which requires all domestic providers, including gateway providers, to respond to traceback requests “fully and in a timely manner.” The Commission takes this step recognizing the critical role that gateway providers play in stopping the deluge of illegal foreign-originated robocalls, which continue to increase despite its previous efforts to stem the tide.

49. The Commission finds that a mandatory 24-hour response requirement best serves to protect consumers from foreign-originated illegal robocalls, which are a prevalent source of illegal robocalls aimed at U.S. consumers. As the Commission has repeatedly made clear, traceback is an essential part of both identifying and stopping illegal calls, and rapid traceback is key to its success. The process used by the Industry Traceback Group, which is the currently designated industry traceback consortium, is semi-automated, allowing the process to continue very quickly when a provider responds to a traceback request. While time is always of the essence in traceback, time is particularly important in the case of foreign-originated calls. In such cases, reaching the origination point of the call may require working with foreign providers and foreign governments, which could significantly increase the total time for the traceback process. As the 51 State AGs have argued, time is of the essence for traceback of foreign-originated calls because law enforcement may need to work with international regulators to obtain information from providers outside of U.S. jurisdiction. As a result, any unnecessary delay increases the risk that this essential information may become impossible to obtain.

50. The Commission therefore disagrees with commenters that do not support its enhanced 24-hour requirement. First, the Commission disagrees with commenters that argue that a stricter requirement is not warranted here. The Commission acknowledges the work industry has done on improving the traceback process, and recognizes that many, if not most, providers that receive traceback requests already respond in under 24 hours. However, the Commission finds that it is important to act aggressively in the international calling context. The gateway provider's response to a traceback request is often the first step in a process where the entity conducting the traceback must work with multiple foreign providers to trace a call back to the originating foreign provider and caller. The longer this process takes, the higher the risk that a foreign provider will no longer have the information necessary to respond—if they are even willing to do so—or that other factors will change, reducing the ability to fully trace the call. Therefore, this process must both begin and be completed as soon as possible. Many, if not most, providers that receive traceback requests are already responding within 24 hours, and the Commission believes this

enhanced obligation presents no additional burden. For providers that do not already meet this standard, the additional burden is justified by the need to quickly obtain this information. The record does not support the contention that this requirement presents a significant burden for providers. (Some commenters did raise specific concerns about this requirement. However, as discussed further below, these comments appear to either misunderstand the current expectations or to misunderstand the scope of the requirement.) The Commission emphasizes again, as it stated in the
Fourth Call Blocking Order,
86 FR 17726 (April 6, 2021), that it generally expects
all
domestic providers to respond to traceback within 24 hours in most instances. The rule the Commission adopts simply makes that expectation a requirement in the gateway context. (While the Commission requires response to all traceback requests within 24 hours, it retains its right to exercise discretion in enforcement or consider limited waivers where a provider that normally responds within the 24-hour time frame has an truly unexpected or unpredictable issue that leads to a delayed response in a particular case or for a short period of time.)

51. The Commission also disagrees with commenters who argue that 24 hours is too short a time frame. (One commenter incorrectly indicated that the “current deadline” is 36 hours, without indicating the source of that figure.) The Commission notes that, in the
Fourth Call Blocking Order,
it made clear that, in most cases, it expects responses within 24 hours under its existing rule. Further, according to a report by the Industry Traceback Group, the average time to complete a single hop in the traceback process is less than one day, with many providers responding in less than 30 minutes. (While the Industry Traceback Group notes that overall response time is reduced by certain providers responding more quickly, it also notes that “[t]racebacks that end with non-responsive providers tend to have slower response times, even in completed hops before the non-responsive provider” and that providers closer to the origination point tend to respond more slowly. Speeding up these responses can only benefit the traceback process.) Many, if not most, providers that receive traceback requests already respond in under 24 hours. The Commission therefore sees no reason to believe that the rule it adopts would unduly burden any gateway providers, nor would the burden of such a requirement outweigh the significant benefits to law enforcement from such a requirement. (Gateway providers for which this requirement poses a unique and significant burden may apply for a waiver of this rule under the “good cause” standard of § 1.3 of the Commission's rules. Under that standard, for example, waivers may be available in the event of sudden unforeseen circumstances that prevent compliance for a limited period or for a limited number of calls. The Commission notes that any applicant for waiver “faces a high hurdle even at the starting gate” and would need to “plead with particularity” the “special circumstances” that warrant a waiver and explain how granting a waiver would serve the public interest.)

52. The Commission makes clear that it does not require the gateway provider to identify the caller or originating provider within this 24-hour response period except in the case where the originating provider is the provider from which the gateway provider received the call. Some commenters appear concerned that this rule would require them to trace a call back to the point of origination, or, at least, through several hops. One commenter points to the “need to obtain information from several other carriers located in foreign countries,” while another mentions the need for “detailed investigations.” The Commission requires the gateway provider to respond with information only about the provider from which it directly received the call. (An appropriate response would include the identity of the upstream provider, as well as, for example, the country, a complete address, contact information for the provider, and a link to that provider's Robocall Mitigation Database filing.)

53. The Commission also encourages gateway providers to determine whether their relationship with upstream providers should change to better facilitate traceback. (For example, a gateway provider may conduct such an investigation as part of compliance with the “know your upstream provider” obligation discussed below, which does not have a 24-hour requirement.) The Commission sees no reason that a gateway provider should not be able to identify the immediate upstream provider from its records and respond to the traceback request without further investigation. In fact, one commenter indicated that it currently automates response to traceback.

54.
Compliance Deadline.
The Commission requires gateway providers to comply with this requirement no later than 30 days after publication of notice of OMB approval under the PRA. This allows gateway providers sufficient time to update their processes and come into compliance with the rule.

2. Mandatory Blocking

55. The Commission adopts some, but not all, of the mandatory blocking proposals it sought comment on in the
Gateway Provider FNPRM.
First, the Commission requires gateway providers to block, rather than simply effectively mitigate, illegal traffic when notified of such traffic by the Commission, and it requires providers immediately downstream from the gateway provider to block all traffic from an identified gateway provider that has failed to meet its blocking obligation upon Commission notification. Second, it requires gateway providers to block calls based on any reasonable DNO list. Third, it declines at this time to require gateway providers to block calls based on reasonable analytics. Finally, the Commission addresses related issues including requests for a safe harbor, as well as transparency and redress.

56. The Commission find that the mandatory blocking requirements it adopts, along with the appropriate procedural safeguards described herein, strike an appropriate balance between the benefit of blocking calls likely to be illegal with the risk of blocking lawful calls. The Commission acknowledges that this represents a shift, at least in part, from the Commission's previous approach of permitting, rather than mandating, blocking. The Commission agrees that “[b]locking calls is a serious and complicated action that must be precisely and judiciously applied to avoid blocking lawful traffic.” However, the Commission disagrees with commenters that argue mandatory blocking requirements are generally inappropriate. The Commission's existing permissive blocking rules are still in effect; it encourages providers to make use of permissive blocking, where available, to protect American consumers from unwanted and illegal calls. The rules the Commission adopts narrowly target the most obvious foreign-originated illegal calls, including those calls that have already been determined to be illegal, and enlist gateway providers into the fight to block these calls before they enter the U.S. telephone network.

a. Blocking Following Commission Notification

57. The Commission adopts two of its proposals from the
Gateway Provider FNPRM.
First, the Commission requires gateway providers to block, rather than

effectively mitigate, illegal traffic when notified of such traffic by the Commission. Second, it requires providers immediately downstream from a gateway provider to block all traffic from the identified provider when notified by the Commission that the gateway provider failed meet its obligation to block illegal traffic. To ensure that gateway providers are afforded sufficient due process prior to downstream providers blocking all traffic from them, the Commission adopts a clear process that allows ample time for the notified gateway provider to remedy the problem and demonstrate that it can be a good actor in the calling ecosystem before the Commission directs downstream providers to begin blocking. This process, laid out in greater detail below, includes the following steps: (1) the Enforcement Bureau shall provide the gateway provider with an initial Notification of Suspected Illegal Traffic; (2) the gateway provider shall be granted time to investigate and act upon that notice; (3) if the gateway provider fails to respond or its response is deemed insufficient, the Enforcement Bureau shall issue an Initial Determination Order, providing a final opportunity for the gateway provider to respond and; (4) if the gateway provider fails to respond or that response is deemed insufficient, the Enforcement Bureau shall issue a Final Determination Order, directing downstream providers to block all traffic from the identified provider.

58.
Gateway Provider Blocking Following Commission Notification of Suspected Illegal Traffic.
The Commission first adopts its proposal to require gateway providers to block, rather than simply effectively mitigate, illegal traffic when notified of such traffic by the Commission. In order to comply with this requirement, gateway providers must block traffic that is substantially similar to the identified traffic on an ongoing basis. As with the existing requirement for providers to take steps to effectively mitigate illegal traffic when notified, the Commission directs the Commission's Enforcement Bureau to identify suspected illegal calls and provide written notice to gateway providers that clearly indicates that the provider must comply with 47 CFR 64.1200(n)(5).

59. The Commission agrees with commenters that this blocking will help protect American consumers by ensuring less illegal traffic reaches their phones. An affirmative obligation for gateway providers to block upon Commission notification ensures greater protection than an “effective mitigation” requirement. This is particularly true because gateway providers, by definition, are intermediate providers and are thus a step removed from the caller, limiting their available effective mitigation options.

60. The Commission therefore disagrees with commenters that urge it to rely on the existing requirement to effectively mitigate this traffic rather than to adopt this enhanced requirement. The Commission also disagrees with providers that a separate set of obligations when acting as a gateway provider complicates or increases the burden of compliance because providers cannot easily determine if they are acting as a gateway provider for a particular call. Here, per the process described below, the Enforcement Bureau makes the initial determination of whether the provider is acting as a gateway provider. (A provider determines whether it is a “gateway provider” on a call-by-call basis. A provider may be a gateway provider for some of the calls in the identified traffic and a non-gateway originating provider, non-gateway intermediate provider, or non-gateway terminating provider for other calls in the identified traffic. If the provider is the gateway provider for any of the calls in the traffic identified in the Notification of Suspected Illegal Traffic, the provider must block all traffic that is substantially similar to the identified traffic, regardless of whether the provider is a gateway provider for any particular call.) If the gateway provider is not directed to comply with 47 CFR 64.1200(n)(5), but rather with 47 CFR 64.1200(n)(2), then that provider will not be in violation of the Commission's rules for effectively mitigating, rather than blocking, illegal traffic, regardless of its position in the call path for a particular call.

61.
Downstream Provider Blocking When Gateway Provider Fails to Comply with Blocking Requirement.
The Commission adopts its proposal requiring providers immediately downstream from a gateway provider to block all traffic from the identified provider when notified by the Commission that the gateway provider failed to block. If the Enforcement Bureau determines a gateway provider fails to satisfy 47 CFR 64.1200(n)(5), it shall publish and release an Initial Determination Order as described below giving the provider a final opportunity to respond to the Enforcement Bureau's initial determination. If the Enforcement Bureau determines that the identified gateway provider continues to violate its obligations, the Enforcement Bureau shall release and publish a Final Determination Order in EB Docket No. 22-174 to direct downstream providers to both block and cease accepting all traffic they receive directly from the identified gateway provider starting 30 days from the release date of the Final Determination Order. (Ignorance of a Final Determination Order's release is not sufficient reason for a downstream provider to fail to block all traffic from the gateway provider unless such Order is not posted in EB 22-174.)

62. The Commission agrees with several commenters that support this requirement and disagree with the lone commenter that objects to this mandate. The Commission finds that this requirement is an appropriate and proportional response where a gateway provider actively and willfully refuses to be a good actor in the calling ecosystem. Blocking all traffic from a particular provider is a dramatic step that will likely also block some lawful traffic but is justified by the need to protect consumers from foreign-originated illegal robocalls. Lawful traffic can then be routed through other gateway providers that comply with the Commission's rules.

63.
Process for Issuing a Notification of Suspected Illegal Traffic.
The Enforcement Bureau shall make an initial determination that the provider is a gateway provider for suspected illegal traffic and notify the provider by issuing a written Notification of Suspected Illegal Traffic. The Notification of Suspected Illegal Traffic shall: (1) identify with as much particularity as possible the suspected illegal traffic; (2) provide the basis for the Enforcement Bureau's reasonable belief that the identified traffic is unlawful (the notice should include any relevant nonconfidential evidence from credible sources such as the industry traceback consortium or law enforcement agencies); (3) cite the statutory or regulatory provisions the suspected illegal traffic appears to violate; and (4) direct the provider receiving the notice that it must comply with § 64.1200(n)(5) of the Commission's rules.

64. The Enforcement Bureau's Notification of Suspected Illegal Traffic shall specify a timeframe of no fewer than 14 days for an identified gateway provider to complete its investigation and report its results. Upon receiving such notice, the gateway provider must promptly investigate the traffic identified in the notice and begin blocking the identified traffic within the timeframe specified in the Notification of Suspected Illegal Traffic unless its investigation determines that the traffic is legal.

65. The Commission makes clear that the requirement to block on an ongoing basis is not tied to the number in the caller ID field or any other single criterion. Instead, the Commission requires the identified provider to block on a continuing basis any traffic that is substantially similar to the identified traffic and provide the Enforcement Bureau with a plan as to how it expects to do so. The Commission does not define “substantially similar traffic” in any detail here because that will be a case-specific determination based on the traffic at issue. The Commission declines to limit the scope of “substantially similar traffic” to only “traffic sent by the upstream entity that was responsible for sending the illegal robocall traffic that triggered the Commission's notification.” While gateway providers may propose such a limitation in the blocking plan they submit to the Enforcement Bureau, the Commission does not find that such a limitation is appropriate in all instances. In particular, such a limitation could make it easy for a bad actor to circumvent blocking by simply routing their traffic through multiple upstream providers. The Commission is also concerned that a detailed definition could allow bad actors to circumvent this blocking by providing a roadmap as to how to avoid detection. Additionally, the Commission notes that each calling campaign will have unique qualities that are better addressed on a case-by-case basis, where the analytics used can be tailored to the particular campaign at issue. The Commission nevertheless encourages gateway providers to consider common indicia of illegal calls such as call duration; call completion ratios; large bursts of calls in a short time frame; neighbor spoofing patterns; and sequential dialing patterns. The Commission makes clear that these are not the only criteria that the gateway provider may consider in developing its plan, and that not all criteria may be relevant in all situations. Gateway providers will have flexibility to determine the correct approach for each particular case, but a gateway provider must provide a detailed plan in its response to the Enforcement Bureau so that the Bureau can assess the plan's sufficiency. If the Enforcement Bureau determines that the plan is insufficient, it shall provide the gateway provider an opportunity to remedy the deficiencies prior to taking further action. The Commission will consider the identified provider to be in compliance with its mandatory blocking rule if it blocks traffic in accordance with its approved plan. However, the Commission makes clear that the Enforcement Bureau may require the identified provider to modify its approved plan if it determines that the identified provider is not blocking substantially similar traffic. Additionally, if the Enforcement Bureau finds, based on the evidence, that the identified provider continues to allow suspected illegal traffic onto the U.S. network, it may proceed to an Initial Determination Order or Final Determination Order, as appropriate. Finally, the Commission adopts a limited safe harbor from liability under the Communications Act or its rules for gateway providers that inadvertently block lawful traffic as part of the requirement to block substantially similar traffic in accordance with the gateway provider's approved plan. While the Commission agrees that a safe harbor for inadvertent over-blocking is warranted, it declines to provide a safe harbor for under-blocking within this rule. A gateway provider that is under-blocking and not fully cooperating with the Enforcement Bureau to address the issue should not be granted protection from liability under the very rule with which it fails to comply.

66.
Gateway Provider Investigation.
Each notified provider must investigate the identified traffic and report the results of its investigation to the Enforcement Bureau in the timeframe specified in the Notification of Suspected Illegal Traffic. If the provider's investigation determines that it served as the gateway provider for the identified traffic, it must block the identified traffic within the timeframe specified in the Notification of Suspected Illegal Traffic (unless its investigation determines that the traffic is not illegal) and include in its report to the Enforcement Bureau: (1) a certification that it is blocking the identified traffic and will continue to do so; and (2) a description of its plan to identify and block substantially similar traffic on an ongoing basis. If the provider's investigation determines that the identified traffic is not illegal, it shall provide an explanation as to why the provider reasonably concluded that the identified traffic is not illegal and what steps it took to reach that conclusion. Absent such a showing, or the Enforcement Bureau determines based on the evidence that the traffic is illegal despite the provider's assertions, the identified traffic will be deemed illegal. If a provider's investigation determines it did not serve as a gateway provider for any of the identified traffic, its report shall provide an explanation as to how it reached that conclusion and, if it is a non-gateway intermediate or terminating provider for the identified traffic, the provider must identify the upstream provider(s) from which it received the identified traffic and, if possible, take lawful steps to mitigate this traffic. (Such steps could include, for example, enforcing contract terms, or blocking the calls from bad actor providers consistent with the safe harbor found in 47 CFR 64.1200(k)(4).) If the notified provider determines that it is the originating provider for the identified traffic, or the traffic otherwise comes from a source that does not have direct access to the U.S. public switched telephone network, the notified provider must comply with 47 CFR 64.1200(n)(2) by effectively mitigating the identified traffic and report to the Enforcement Bureau any steps the provider has taken to effectively mitigate the identified traffic. If the gateway provider determines that the traffic is not illegal, it must inform the Enforcement Bureau and explain its conclusion within the specified timeframe.

67.
Process for Issuing an Initial Determination Order.
If the gateway provider fails to respond to the notice within the specified timeframe, the Enforcement Bureau determines that the response is insufficient, the Enforcement Bureau determines that the gateway provider is continuing to allow substantially similar traffic onto the U.S. network, or the Enforcement Bureau determines based on the evidence that the traffic is illegal despite the provider's assertions, the Enforcement Bureau shall issue an Initial Determination Order to the gateway provider stating its determination that the gateway provider is not in compliance with 47 CFR 64.1200(n)(5). This Initial Determination Order must include the Enforcement Bureau's reasoning for its determination and give the gateway provider a minimum of 14 days to provide a final response prior to the Enforcement Bureau's final determination as to whether the gateway provider is in compliance with 47 CFR 64.1200(n)(5).

68.
Process for Issuing a Final Determination Order.
If the gateway provider does not provide an adequate response to the Initial Determination Order or continues to allow substantially similar traffic onto the U.S. network, or the Enforcement Bureau determines based on the evidence that the traffic is illegal despite the provider's assertions, the Enforcement Bureau shall issue a Final Determination Order. The Enforcement Bureau shall publish the Final Determination Order in EB Docket No. 22-174 to direct downstream providers

to both block and cease accepting all traffic they receive directly from the identified gateway provider starting 14 days from the release date of the Final Determination Order. This Final Determination Order may be adopted up to one year after the release date of the Initial Determination Order and may be based on either an immediate failure to comply with 47 CFR 64.1200(n)(5) or a determination that the gateway provider has failed to meet its ongoing obligation to block substantially similar traffic under that rule.

69. Each Final Determination Order shall state the grounds for the Bureau's determination that the gateway provider has failed to comply with its obligation to block illegal traffic and direct downstream providers to initiate blocking 14 days from the release date of the Final Determination Order. A provider that chooses to initiate blocking sooner than 14 days from the release date may do so consistent with the Commission's existing safe harbor in 47 CFR 64.1200(k)(4).

b. Do-Not-Originate

70. The Commission further requires gateway providers to block calls based on a reasonable DNO list. A “DNO list” is a list of numbers that should never be used to originate calls, and therefore any calls that include a listed number in the caller ID field can be blocked. The Commission declines to mandate the use of a specific list, but allow gateway providers to use any DNO list so long as the list is reasonable. The Commission declines to mandate the use of a specific list, but gateway providers must use at least one DNO list, so long as the list is reasonable. Such a list may include only invalid, unallocated, and unused numbers, as well as numbers for which the subscriber to the number has requested blocking.

71. Reasonable DNO lists may include only the listed categories of numbers described in the preceding paragraph, but the Commission does not require that such DNO lists include all possible covered numbers in order to be reasonable. In particular, the Commission recognizes that unused numbers may be difficult to identify, and that a reasonable list may err on the side of caution. The Commission makes clear, however, that a list so limited in scope that it leaves out obvious numbers that could be included with little effort may be deemed unreasonable.

72. In the
2017 Call Blocking Order,
82 FR 44118 (Sept. 21, 2017), the Commission specifically found that, where the subscriber to the originating number requests blocking, calls purporting to be from that number are “highly likely to be illegal and to violate the Commission's anti-spoofing rule, with the potential to cause harm defraud, or wrongfully obtain something of value.” Spoofing of this sort is particularly damaging as it can be used to foster consumer trust and bolster imposter scams. Therefore, the Commission finds that a reasonable list would need to include, at a minimum, any inbound-only government numbers where the government entity has requested the number be included. It must additionally include private inbound-only numbers that have been used in imposter scams, when a request is made by the private entity assigned such a number. (The current list maintained by the Industry Traceback Group is reasonable. The Commission declines, however, to deem that list “presumptively reasonable” as NCTA-The internet & Television Association suggests. While the Commission agrees that the list, as it currently stands “would advance the Commission's goal of reducing harmful spoofing and imposter scams,” it is concerned that deeming it “presumptively reasonable” does not account for the fact that the list is not under Commission control and could be modified, or no longer updated, at any time without Commission input.) In either scenario, the provider or the third party that manages the DNO list may impose reasonable requirements on including the numbers, such as requiring that the number is currently being spoofed at a substantial volume. (Multiple parties requested this or a similar clarification, to address concerns that some switches may have limits on the total amount of numbers that can be blocked.) Gateway providers, or those managing such a list on behalf of gateway providers, should ensure that entities can reasonably request inclusion on the list.

73. The Commission agrees with commenters that support a DNO mandate. The Commission further agrees with one commenter that urged the Commission to look to existing DNO lists for this purpose. While the Commission do not endorse a specific list, it encourages industry to either make use of existing tools or develop new ones to serve this purpose. Gateway providers may choose the list that works best for their networks so long as that list is reasonable. Because the Commission finds that a single, centralized list is not the correct approach, it declines to develop a “high availability application or online tool” as one commenter suggests. The Commission is concerned that a centralized list could present security concerns and allow bad actors to circumvent blocking by providing a clear list of numbers to avoid spoofing. (In some instances, there is still value in a DNO list even when bad actors know what numbers are included. For example, consumer trust may increase when the caller cannot spoof a known number associated with the caller the bad actor is attempting to impersonate. A non-public list, at a minimum, slows bad actors in their efforts to switch numbers and prevents some calls from reaching consumers.)

74. The Commission disagrees with the commenter that argued the mandate is unnecessary because many providers already use a DNO list to block calls. The Commission recognizes that providers have used DNO lists to reduce the number of illegal calls that reach consumers, and the Commission applauds these industry efforts. The Commission finds that enlisting all gateway providers in this effort will further reduce the risk of illegal calls reaching consumers. There is no legitimate reason for the caller to use numbers that appear on a DNO list. Therefore, these calls, if they reach even a single consumer, cause harm. The Commission also declines to deem gateway providers in compliance with this requirement if they have implemented a reasonable DNO in some parts of their network but not at the gateway. The intent of this rule is to stop foreign-originated illegal calls from entering the U.S. network at all. If these calls are not stopped at the gateway, there is a risk that they will not be blocked at all and will therefore reach consumers.

c. No Analytics-Based Call Blocking Mandate

75. The Commission declines at this time to require gateway providers to block calls that are highly likely to be illegal based on reasonable analytics. The Commission agrees with commenters' concerns regarding mandating such blocking. Additionally, the Commission finds that many of the arguments against mandatory blocking generally, while not persuasive in the context of other rules the Commission adopts, are persuasive in this context. An analytics-based blocking mandate would require the Commission to more strictly define “reasonable analytics” in order for gateway providers to be certain that they are in compliance with a mandatory blocking rule. To do so may be counter-productive and prevent providers from responding to evolving threats. The Commission is also concerned that providing a strict

definition, while certainly valuable to lawful callers, could potentially provide a road map bad actors could use to circumvent blocking. These concerns, coupled with the need for truly robust redress mechanisms for callers when the blocking is not initiated by the consumer and therefore cannot be corrected by the consumer, support the Commission's decision not to require such blocking at this time. (Several commenters, while objecting to a blocking mandate, urged the Commission to extend its safe harbor for blocking based on reasonable analytics to all providers in the call path, either in conjunction with a mandate or as an alternative. Because the Commission does not adopt such a mandate, it declines to reach the question of whether a safe harbor would be a necessary part of such a requirement. At this time, the Commission also declines to consider further extending the safe harbor absent such a mandate, as such an extension would be outside the scope of this document).

d. No Blocking Safe Harbor

76. Except as described above, the Commission declines to adopt a safe harbor for providers that block consistent with the rules the Commission adopts. Several comments addressing safe harbors focused on blocking based on reasonable analytics, and in some cases on extending the Commission's existing safe harbor instead of mandating blocking. The Commission does not adopt a reasonable analytics blocking mandate, and extending the existing safe harbor is outside of the scope of this document. Other comments did support a safe harbor more broadly, without tying the request to reasonable analytics. However, the Commission finds that the rules it adopts remove the need for such a safe harbor. In the case of blocking based on Commission notification, there is no need for a safe harbor where there is a clear Commission directive to block particular traffic directed at an individual provider. Nor is a safe harbor necessary for the downstream provider blocking requirement because the immediate downstream provider is required to block all traffic from the identified provider, regardless of whether that provider is a gateway provider for the particular traffic. There is no judgment call for a provider to make that could require a safe harbor. The Commission declines CTIA's request to establish a safe harbor is necessary for blocking based on a reasonable DNO list. First, providers have been permitted to engage in this type of blocking since 2017, and no commenter has pointed to any liability issues regarding over-blocking in this context. A gateway provider that is concerned about the possibility that they may not be able to keep a list containing unallocated or unused numbers fully up to date is not required to include those numbers on the list; while these numbers may be included, they are not mandatory. Providers that are concerned about possible under-blocking should take steps to ensure they are making use of a reasonable DNO list, and the Commission sees no reason to provide additional protection.

e. Protections for Lawful Calls

77. Consistent with the Commission's existing blocking rules, gateway providers must never block emergency calls to 911 and must make all reasonable efforts to ensure that calls from PSAPs and Government emergency numbers are not blocked. The Commission declines to adopt additional transparency and redress requirements at this time or extend any other existing requirements that would not already apply to the blocking mandates the Commission adopts. The new mandatory blocking rules either require the Commission to direct blocking, in which case the blocking provider is not in a position to provide redress, or target categories of calls that have been permissible to block since 2017. Some commenters expressed concerns about transparency and redress. The Commission recognizes some concerns regarding the potential for lawful calls to be blocked are valid, such as when a provider relies on analytics to make blocking decisions. These concerns do not apply here, however, where blocking is either at the direction of the Commission or based on a reasonable DNO list.

f. Compliance Deadline

78. The Commission requires gateway and downstream providers to comply with the requirements to block upon Commission notification no later than 60 days after publication of this document in the
Federal Register
. Additionally, the Commission requires gateway providers to comply with the DNO blocking requirement no later than 30 days after publication of notice of OMB approval under PRA. The Commission finds that requiring gateway providers to comply with these rules quickly imposes a minimal burden. In the case of blocking upon Commission notification, gateway providers need not make any changes to their processes prior to receipt of such a notification, and the Commission allows time for a gateway provider to comply following that notification. The Commission acknowledges that gateway providers that do not already block based on a DNO list may need to identify or develop such a list in order to comply with that particular requirement. However, the PRA approval process gives providers ample time to do so, and providers may use one of the existing DNO lists to meet this requirement with minimal burden.

3. “Know Your Upstream Provider”

79. The Commission adopts a modified version of its proposal to require gateway providers to “know the customer.” Recognizing the difficulty posed by a requirement for gateway providers to know information about the caller, who is likely not their customer and with whom they have no relationship, the Commission instead requires gateway providers to “know” the immediate upstream foreign provider from which they receive traffic with U.S. numbers in the caller ID field. Specifically, the Commission requires gateway providers to take reasonable and effective steps to ensure that the immediate upstream foreign provider is not using the gateway provider to carry or process a high volume of illegal traffic onto the U.S. network.

80. The record supports deeming the immediate upstream foreign provider as “customer” for these purposes, rather than the caller. Though one commenter favored adopting its original proposal, the Commission agrees with other commenters that it would be difficult, if not impossible, for gateway providers to routinely confirm that a particular caller is authorized to use a U.S. number. By definition, a gateway provider is an intermediate provider and is thus at least one step removed from the caller. By contrast, the gateway provider must have a direct relationship with the upstream foreign provider from which it accepts traffic, which allows the gateway provider to “know” that upstream provider. This approach best balances the benefit of holding gateway providers responsible for calls they allow into the U.S. network with the difficulty of determining information about a caller that may be several hops away from the gateway.

81. The Commission agrees with the commenter that argues that the Commission's existing, flexible approach to know-your-customer requirements, rather than specific mandates, is appropriate in the gateway context. The Commission does not mandate the steps gateway providers must take in order to “know” the upstream foreign provider. Instead, the Commission allows gateway providers

the flexibility to determine the exact measures to take, including whether to adopt contractual provisions with their upstream providers to meet this obligation, and the contours of any such provisions. (The Commission notes that several commenters argued contract terms can be a valuable way of meeting a know-your-customer obligation and mitigating robocalls.) This approach is consistent with the Commission's existing requirement for originating providers to implement effective measures to prevent new and renewing customers from originating illegal calls, and allows each gateway provider to determine the best approach for its network and customers. (For the same reason, the Commission does not require gateway providers to enter into contractual provisions with their upstream provider to meet this know-your-upstream-provider requirement or any other new requirements the Commission adopts. However, gateway providers must explain the steps they have taken to meet their know-your-upstream-provider obligation in their Robocall Mitigation Database certification.) The Commission make clear, however, that gateway providers must take effective steps. If a gateway provider repeatedly allows a high volume of illegal traffic onto the U.S. network, the steps that provider has taken are not effective and must be modified for that provider to be in compliance with the Commission's rules.

82. The Commission recognizes concerns about the effectiveness of such a requirement, since the foreign provider upstream of the gateway may not be the source of the calls. The Commission agrees that the ideal approach would be for any obligation to fall to the originating provider, as in the Commission's existing rules. Unfortunately, in the case of foreign-originated calls, the Commission faces substantial difficulties in enforcing such an obligation on the foreign originating provider. (Due to this jurisdictional issue, the Commission imposes this obligation on the gateway provider as the first U.S.-based provider in the call path.) The Commission recognizes that gateway providers cannot prevent all instances of illegal calls from entering the U.S. network. In particular, a gateway provider's previously effective steps may become unexpectedly ineffective due to changes in factors outside of the gateway provider's control, particularly when the gateway provider is multiple hops from the call originator. (The Commission further acknowledges that, no matter how effective a gateway provider's methods are, some illegal calls may make up a portion of the traffic that it originates onto the U.S. network, and make clear that the fact that some illegal calls evade detection does not necessarily make a gateway provider's methods ineffective. The Commission therefore agrees with parties that asked it to clarify that “occasionally serving as a gateway provider for illegal robocalls, particularly where those illegal calls are an insignificant fraction of that provider's traffic, does not inherently make the provider's practices ineffective.” The Commission declines, however, to adopt the specific language proposed by the INCOMPAS et al. May 6 Ex Parte. The Commission makes clear, however, that a “high volume of illegal traffic” is a relative measure that is determined, in part, by what percentage of the traffic for which the provider is a gateway provider is illegal.) The Commission therefore reiterates that, as with its existing rule, it does not expect perfection. The Commission does require gateway providers to take reasonable steps, and it encourages gateway providers to regularly evaluate and adjust their approach so that they remain reasonable and effective. (Reasonable steps may include, but are not limited to, investigation of the practices of the upstream provider, modification of contracts to allow termination where issues arise, and/or monitoring incoming traffic for issues on an ongoing, proactive, basis.)

83. Because the Commission does not adopt the exact proposal in the
Gateway Provider FNPRM,
it declines to address roaming or adopt a carve-out for emergency calls. (The Commission further address roaming traffic in the accompanying
FNPRM.
) The rule the Commission adopts does not require gateway providers to block calls when they cannot confirm that the caller is authorized to use a particular U.S. number in the caller ID field, and therefore is unlikely to have detrimental effect on roaming or emergency traffic. The Commission also declines to adopt alternative proposals in the record that fall outside the scope of this document, including YouMail's proposal for post-contracting know-your-customer, i3forum's “know your traffic” proposal, or ZipDX's proposal to expand the requirement to cover all high-volume, non-conversational traffic even when such traffic is not foreign originated.

84.
Compliance Deadline.
The Commission requires gateway providers to comply with this rule no later than 180 days after publication of this document in the
Federal Register
. The Commission agrees with the commenter that argued that requiring compliance 30 days after publication may be insufficient for such a requirement. Allowing 180 days after publication ensures that gateway providers have sufficient time to develop effective systems and make any modifications to their networks or practices to implement these measures.

4. General Mitigation Standard

85. In addition to the specific mitigation requirements that the Commission adopts above, it also requires gateway providers to meet a general obligation to mitigate illegal robocalls regardless of whether they have fully implemented STIR/SHAKEN on the IP portions of their network. The Commission takes this step now because of the unique and key role that gateway providers play in the call path. Specifically, the Commission now requires all gateway providers to take “reasonable steps to avoid carrying or processing illegal robocall traffic.” The Commission does not require that the gateway provider take specific steps to meet this standard, in line with the existing requirement for voice service providers. The majority of commenters support the adoption of a general mitigation standard for gateway providers.

86. As with voice service providers subject to the “reasonable steps” standard, gateway providers must also implement a robocall mitigation program and, as explained above, file that plan along with a certification in the Robocall Mitigation Database. The record reflects significant support for adopting, at a minimum, a mitigation duty for gateway providers in addition to requiring them to submit a certification to the Robocall Mitigation Database. The Commission therefore adopts, consistent with its proposal, a mitigation duty for gateway providers that closely tracks the analogous rule for voice service providers. Specifically, a gateway provider's plan is “sufficient if it includes detailed practices that can reasonably be expected to significantly reduce the [carrying or processing] of illegal robocalls.” Moreover, a gateway provider “must comply with the practices” that its plan requires, and its program is insufficient if the gateway provider “knowingly or through negligence [carries or processes calls] for unlawful robocall campaigns.”

87. The Commission requires gateway providers to mitigate traffic under the “reasonable steps” standard even if they have implemented STIR/SHAKEN for several reasons. First, the Commission notes the strong support in the record

for requiring gateway provider mitigation, regardless of their STIR/SHAKEN status, with certain commenters explicitly advocating for both gateway provider authentication and mitigation. Commenters agree that gateway providers are uniquely positioned to stop the entry of robocalls into this country, increasing the importance of strong mitigation.

88. Second, both the current record and the experience since the
Second Caller ID Authentication Report and Order
have shown that while STIR/SHAKEN is an effective tool to stop illegal robocalls, it is not a “silver bullet,” particularly in those cases where a robocaller is using a properly assigned telephone number. Providers, especially gateway providers serving as the entry point to the U.S. marketplace, can and must do more to stop robocalls. This is particularly the case while STIR/SHAKEN mandates by foreign governments and implementation by foreign providers remain limited.

89. Finally, the Commission anticipates that a general mitigation duty applicable to all gateway providers regardless of whether they have implemented STIR/SHAKEN will “provide a valuable backstop” to the other obligations the Commission adopts because call blocking, and traceback based on notice “cannot take the place of the
proactive
dut[y] to mitigate harmful traffic.” For all these reasons, the Commission disagrees with INCOMPAS and T-Mobile that it should not impose mitigation obligations on gateway providers that have implemented STIR/SHAKEN and find that requiring gateway providers that have implemented STIR/SHAKEN to also meet the Commission's “reasonable steps” mitigation standard “would be an efficient use of their resources.” The Commission does not adopt an alternative mitigation standard for gateway providers including a requirement proposed in the
Gateway Provider FNPRM
based on the existing duty for providers to take “affirmative, effective measures to prevent new and renewing customers from using their network to originate illegal calls.” The Commission notes, however, that under the rules it adopts, gateway providers must also comply with the “know-your-upstream-provider standard, and steps a gateway provider takes to meet one standard could meet the other, and
vice versa.

90. The Commission concludes that gateway providers' key role in facilitating the transmission of foreign-originated robocalls to U.S. consumers warrants imposing the “reasonable steps” mitigation duty on these providers without delay. While several commenters argue in the record for adopting more specific and broader duties on all domestic providers, the Commission leaves open for consideration such an expansion in the accompanying
FNPRM.
For example, it does not at this time require gateway providers to take specific actions to meet the “reasonable steps” standard. Nor does it require voice service providers or other intermediate providers to comply with the unique requirements it adopts for gateway providers, including the obligation to meet a general mitigation obligation even if they have fully implemented STIR/SHAKEN. Given the scope of the
Gateway Provider FNPRM
and the limited record evidence submitted regarding specific proposals, the Commission does not take these additional steps at this time.

91.
Compliance Deadline.
The Commission requires gateway providers to comply with the “reasonable steps” standard within 30 days of the effective date of this document. The Commission concludes that this is an appropriate period because the Commission does not mandate specific steps that gateway providers must take to meet this requirement other than submitting a certification to the Robocall Mitigation Database, and many gateway providers are already mitigating illegal call traffic. The compliance date for the requirement to submit a certification and mitigation plan to the Robocall Mitigation Database is 30 days following
Federal Register
notice of OMB approval of the relevant information collection requirements, and the Commission expects providers to refine their “reasonable steps” in light of additional time and marketplace developments prior to submission into the Robocall Mitigation Database.

F. Summary of Cost Benefit Analysis

92. The Commission finds that the benefits of the rules it adopts will greatly outweigh the costs imposed on gateway providers. The Commission sought comment on its belief that the proposed rules, viewed collectively, would account for a large share of the annual $13.5 billion minimum benefit the Commission originally estimated in the
First Caller ID Authentication Report and Order,
85 FR 22029 (April 21, 2020), and
FNPRM,
85 FR 22099 (April 21, 2022), because of the large share of illegal calls originating outside of the United States. While some commenters argue that the individual requirements may not provide substantial benefit taken individually or that there is no benefit to imposing obligations solely on gateway providers, others agree that the requirements the Commission adopts will benefit consumers and the calling ecosystem. The Commission finds that these requirements, taken together, will achieve a large share of the annual $13.5 billion minimum benefit. In addition, the Commission finds that there are many additional, non-quantifiable benefits from these rules, including restoring confidence in the U.S. telephone network and reliable access to the emergency and healthcare communications that save lives, reduce human suffering, and prevent the loss of property.

93. The Commission finds that the costs imposed on gateway providers are, in many instances, minimal and in all cases do not exceed the benefits. For example, a number of gateway providers are already required to implement STIR/SHAKEN in some portions of their networks because they do not solely act as gateway or intermediate providers, but may also serve as originating or terminating providers for some calls. In these cases, the additional burden to implement STIR/SHAKEN where a provider is acting as a gateway provider may be limited and has declined over time. Similarly, requiring gateway providers to block, rather than effectively mitigate, illegal traffic when notified by the Commission does not represent a burden increase, and in some cases may even be a burden decrease by eliminating the need to determine what mitigation is effective in a particular instance. As explained, the Commission disagrees with the burden estimates proffered by some commenters. However, even if the Commission does credit those claims, the expected minimum benefit is, as explained, so large that it will greatly outweigh the expected burden. (Contrary to USTelecom's assertion, the Commission does not take the position that it “can adopt any individual regulation to fight illegal robocalls, no matter the cost or benefit of that particular regulation, as long as the aggregate cost of requirements is less than $13.5 billion.” Rather, the Commission concludes that the requirements it adopts here will result in a “large share” of the $13.5 billion annual projected benefits from eliminating illegal robocalls, and no party has asserted that the purported costs of any or all of these regulations would cost either in one year or over several years a “large share” of $13.5 billion.)

94. Moreover, although the rules the Commission adopts will impose higher short-term costs on gateway providers

for implementation, it finds that they will lead to lower long-term costs. Specifically, the Commission finds that an overall reduction in illegal robocalls will greatly lower network costs for the gateway providers and other domestic service providers by eliminating both the unwanted traffic congestion and labor costs of handling numerous customer complaints, and by enabling those providers to trace calls back to the originator more quickly and efficiently.

G. Legal Authority

95. Consistent with its proposals, the Commission adopts the foregoing obligations pursuant to the legal authority the Commission relied on in prior caller ID authentication and call blocking orders. The Commission notes that no commenter questioned its proposed legal authority. (USTelecom suggests that because C-level attestations are “untethered to the call authentication goal,” the TRACED Act does not provide authority to adopt a gateway provider authentication requirement. But USTelecom's argument is inapposite because the Commission does not rely on the TRACED Act for its authority to impose this obligation, and USTelecom does not assert that the Commission otherwise lacks authority to impose a gateway provider authentication obligation.)

96.
Caller ID Authentication.
The Commission finds authority to impose caller ID authentication obligations on gateway providers under section 251(e) of the Communications Act of 1934 (the Act) and the Truth in Caller ID Act. In the
Second Caller ID Authentication Report and Order,
the Commission found it had the authority to impose caller ID authentication obligations on intermediate providers under these provisions. It reasoned that “[c]alls that transit the networks of intermediate providers with illegally spoofed caller ID are exploiting numbering resources” and so found authority under section 251(e). It found “additional, independent authority under the Truth in Caller ID Act” on the basis that such rules were necessary to “prevent . . . unlawful acts and to protect voice service subscribers from scammers and bad actors,” stressing that intermediate providers “play an integral role in the success of STIR/SHAKEN across the voice network.” While the
Second Caller ID Authentication Report and Order
did not specifically discuss gateway providers, the Commission uses the same legal authority to impose an authentication obligation on gateway providers because it defines gateway providers as a subset of intermediate providers.

97.
Robocall Mitigation and Call Blocking.
The Commission adopts its robocall mitigation and call blocking provisions for gateway providers pursuant to sections 201(b), 202(a), 251(e), the Truth in Caller ID Act, and its ancillary authority, consistent with the authority it invoked to adopt analogous rules.

98. The Commission concludes that section 251(e) and the Truth in Caller ID Act authorizes it to prohibit intermediate providers and voice service providers from accepting traffic from gateway providers that do not appear in the Robocall Mitigation Database. In the
Second Caller ID Authentication Report and Order,
the Commission concluded, “section 251(e) gives us authority to prohibit intermediate providers and voice service providers from accepting traffic from both domestic and foreign voice service providers that do not appear in [the Robocall Mitigation Database],” noting that its “exclusive jurisdiction over numbering policy provides authority to take action to prevent the fraudulent abuse of NANP resources.” The Commission observed that “[i]llegally spoofed calls exploit numbering resources whenever they transit any portion of the voice network—including the networks of intermediate providers” and that “preventing such calls from entering an intermediate provider's or terminating voice service provider's network is designed to protect consumers from illegally spoofed calls.” The Commission found that the Truth in Caller ID Act provided additional authority for its actions to protect voice service subscribers from illegally spoofed calls.

99. The Commission also concludes that sections 201(b), 202(a), and 251(e) of the Act, as well as the Truth in Caller ID Act and its ancillary authority, support the mandatory mitigation and blocking obligations the Commission imposes on gateway providers here. In the
Fourth Call Blocking Order,
the Commission required providers “to take affirmative, effective measures to prevent new and renewing customers from originating illegal calls,” which includes a duty to “know” their customers. Additionally, the Commission required providers, to “take steps to effectively mitigate illegal traffic when notified by the Commission,” which may require blocking when applied to gateway providers. The Commission also adopted traceback obligations.

100. The Commission concluded that it had the authority to adopt these requirements pursuant to sections 201(b), 202(a), and 251(e) of the Act, as well as the Truth in Caller ID Act and its ancillary authority. Sections 201(b) and 202(a) provide the Commission with “broad authority to adopt rules governing just and reasonable practices of common carriers.” Accordingly, the Commission found that the new blocking rules were “clearly within the scope of our section 201(b) and 202(a) authority” and “that it is essential that the rules apply to all voice service providers,” applying its ancillary authority in section 4(i). The Commission also found that section 251(e) and the Truth in Caller ID Act provided the basis “to prescribe rules to prevent the unlawful spoofing of caller ID and abuse of NANP resources by all voice service providers,” a category that includes Voice over internet Protocol (VoIP) providers and, in the context of the Commission's call blocking orders, gateway providers. The Commission concludes that the same authority provides a basis to adopt the mitigation and blocking obligations on gateway providers the Commission adopts in this document to the extent that gateway providers are acting as common carriers.

101. While the Commission concludes that its direct sources of authority provide an ample basis to adopt its proposed rules on all gateway providers, its ancillary authority in section 4(i) provides an independent basis to do so with respect to gateway providers that have not been classified as common carriers. The Commission concludes that the regulations adopted in this document are “reasonably ancillary to the Commission's effective performance of its . . . responsibilities” because gateway providers that interconnect with the public switched telephone network and exchange IP traffic clearly offer “communication by wire and radio.”

102. Requiring gateway providers to comply with the Commission's proposed rules is reasonably ancillary to the Commission's effective performance of its statutory responsibilities under sections 201(b), 202(a), 251(e), and the Truth in Caller ID Act as described above. With respect to sections 201(b) and 202(a), absent application of the Commission's proposed rules to gateway providers that are not classified as common carriers, originators of international robocalls could circumvent its proposed scheme by sending calls only to such gateway providers to reach the U.S. market.

103.
Indirect Effect on Foreign Service Providers.
The Commission confirms its conclusion in the
Gateway Provider FNPRM
that, to the extent any of the rules it adopts have an effect on foreign

service providers, that effect is only indirect and therefore consistent with the Commission's authority, and the Commission finds that it does not conflict with any of its international treaty obligations. (The Commission expressly sought comment on “whether any of our proposed rules would be contrary to any of our international treaty obligations.” No commenter identified any international treaty obligations that would be contravened by the Commission's new requirement, nor is the Commission aware of any.) No commenter argues otherwise. In the
Second Caller ID Authentication Report and Order,
the Commission acknowledged an indirect effect on foreign providers but concluded

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2022-13436. Public record. Not legal advice.