Wireline Competition Bureau Announces Best Practices for Equipment Disposal and Revises FCC Form 5640 Certifications for the Secure and Trusted Communications Networks Reimbursement Program
| Published date | 27 October 2021 |
| Citation | 86 FR 59304 |
| Record Number | 2021-23213 |
| Section | Rules and Regulations |
| Court | Federal Communications Commission |
Federal Register, Volume 86 Issue 205 (Wednesday, October 27, 2021)
[Federal Register Volume 86, Number 205 (Wednesday, October 27, 2021)]
[Rules and Regulations]
[Pages 59304-59307]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2021-23213]
[[Page 59304]]
=======================================================================
-----------------------------------------------------------------------
FEDERAL COMMUNICATIONS COMMISSION
47 CFR Part 54
[WC Docket No. 18-89; DA 21-1234; FR ID 54036]
Wireline Competition Bureau Announces Best Practices for
Equipment Disposal and Revises FCC Form 5640 Certifications for the
Secure and Trusted Communications Networks Reimbursement Program
AGENCY: Federal Communications Commission.
ACTION: Final action.
-----------------------------------------------------------------------
SUMMARY: In this document, the Wireline Competition Bureau (Bureau)
provides guidance and voluntary best practices regarding the Secure and
Trusted Communications Networks Reimbursement Program (Reimbursement
Program) disposal and verification requirements to assist providers of
advanced communications services participating in the Reimbursement
Program; revises the certification language in the FCC Form 5640, which
participants must submit to request funding allocations and
disbursements from the Reimbursement Program; and makes minor
corrections to the Catalog of Eligible Expenses and Estimated Costs
that is used by Reimbursement Program applicants to assist with
reporting cost estimates for funding allocation requests.
DATES: The guidance and voluntary best practices provided in this
document are applicable beginning October 27, 2021.
FOR FURTHER INFORMATION CONTACT: Christopher Koves, Wireline
Competition Bureau, 202-418-7400 or by emailing [email protected].
SUPPLEMENTARY INFORMATION: This is a summary of the Commission's
document (Public Notice), in WC Docket No. 18-89; DA 21-1234, released
on September 30, 2021. The full text of this document is available at
the following internet address: https://docs.fcc.gov/public/attachments/DA-21-1234A1.pdf. Due to the COVID-19 pandemic, the Federal
Communications Commission's headquarters will be closed to the general
public until further notice. See FCC Announces Closure of FCC
Headquarters Open Window and Change in Hand-Delivery Policy, Public
Notice, DA 20-304 (March 19, 2020), https://www.fcc.gov/document/fcccloses-headquarters-open-window-andchanges-hand-delivery-policy.
1. By this document, the Bureau provides guidance and voluntary
best practices regarding the Secure (Reimbursement Program disposal and
verification requirements to assist providers of advanced
communications services participating in the Reimbursement Program. The
Bureau finds that the best practices set forth in this guidance comply
with the requirements in Sec. 1.50004(j) of the Commission's rules.
Reimbursement Program participants are free to choose alternative
approaches to comply with the Reimbursement Program's disposal and
verification requirements. In such instances, the Commission will
review the specific circumstances to determine whether or not the
alternative approach selected by the provider complies with the
disposal and verification requirements set forth in Sec. 1.50004(j) of
the Commission's rules.
2. Separately, pursuant to Sec. 1.108 of the Commission's rules,
the Bureau reconsiders and revises, on its own motion, the
certifications contained in FCC Form 5640 Application Request for
Funding Allocation and the Reimbursement Claim Request that the Bureau
adopted in the Finalized Reimbursement Process Public Notification
(PN), 86 FR 48521, August 31, 2021. These revised certifications will
further protect the Reimbursement Program against waste, fraud, and
abuse. The Bureau also makes minor corrections to certain cost
estimates incorrectly identified in the Final Catalog of Eligible
Expenses and Estimated Costs (Cost Catalog) adopted in the Finalized
Reimbursement Process PN.
3. Disposal and Verification Obligations. In accordance with the
Secure and Trusted Communications Networks Act of 2019 (Secure Networks
Act), the Commission adopted a rule requiring Reimbursement Program
participants to: (1) ``dispose of the covered communications equipment
and services in a manner to prevent the equipment or service from being
used in the networks of other advanced communications service
providers;'' and (2) ``retain documentation demonstrating compliance
with this requirement.'' The disposal, according to the Commission,
``must result in the destruction of the covered communications
equipment or service, making the covered communications equipment or
service inoperable permanently,'' and participants ``must retain
documentation demonstrating compliance with this requirement.'' The
Commission also specifically prohibited the ``transfer of covered
communications equipment or service to non-U.S. providers in an
operable state that would allow for use of the equipment or service in
another provider's network, foreign or domestic.'' The Commission
expected the Bureau to provide participants with additional guidance
with the disposal and verification process.
4. Best Practices Overview. Based on comments addressing the
disposal process filed in this docket, presentations from entities with
disposal experience, and Bureau staff's review of similar disposal
processes, it identifies certain voluntary ``best practices,'' in the
released document, to help guide participants as they fulfill their
Reimbursement Program disposal and verification obligations. These best
practices include procedures to effectuate equipment removal, data
destruction, media sanitization, storage, transportation, physical
destruction and recycling, and also cover the selection of certified
data sanitization services, equipment destruction services, and
electronic waste (e-waste) recycling services. The best practices
further discuss documentation sufficient to demonstrate compliance,
including the use of detailed equipment inventories, certificates of
media disposition, and certificates of destruction. While the best
practices are voluntary, the Bureau finds that these practices will
help companies meet their disposal obligations efficiently, while also
ensuring the safe and secure removal and disposal of covered
communications equipment and services that pose a national security
threat consistent with the Secure Networks Act and the Commission's
rules.
5. Providers can employ alternative compliance measures, but risk
the Commission subsequently finding that such measures are not in
compliance with Sec. 1.50004(j) of its rules. Non-compliance can
result in the assessment of fines and forfeitures by the Commission and
can also result in additional enforcement actions provided for in Sec.
1.50005 of the Commission's rules, including the repayment of
Reimbursement Program funding. The Commission directed the Office of
Managing Director (OMD), or a third-party identified by OMD, to prepare
a system to conduct audits and field investigations to ensure
Reimbursement Program participants are acting in compliance with the
Commission's rules. These audits and field investigations will include
the inspection of documentation to verify compliance with the disposal
and verification requirements in Sec. 1.50004(j) of the Commission's
rules.
6. Providers participating in the Reimbursement Program are likely
to encounter different categories of
[[Page 59305]]
covered communications equipment and services. These different
categories may pose different security threats based on their
individual capabilities, including processing and/or retaining
sensitive network or customer identifiable information. Therefore, as
part of the best practices, the Bureau identifies recommended practices
for treating covered communications equipment based on the category of
equipment. The Bureau understands that it may be more efficient for a
destruction company to destroy and recycle a large amount of equipment
at once, for example, by destroying all equipment in a box at one time
that may include a combination of the categories of equipment described
in the following, and the Bureau defers to both the provider and the
destruction company as to the most efficient process to achieve the
required disposal obligation.
7. The categories are organized by level of risk, starting with
equipment posing the highest risk, based on whether the equipment
retains or processes data. Category 1 equipment is equipment that
processes and retains data. Category 2 equipment is equipment that
processes but does not retain data. Category 3 equipment is equipment
that does not retain or process data. For category 1 equipment, the
Bureau recommends the provider sanitize any media, followed by physical
destruction and then recycling. For category 2 equipment, the Bureau
recommends physical destruction and then recycling. For category 3
equipment, the Bureau recommends recycling this equipment. The Bureau
will consider category 3 equipment as ``inoperable'' if permanently
dismantled from other communications equipment and services and it is
unable to be reconnected to any other communications equipment.
Reimbursement Program participants are encouraged to retain certain
documentation, based on the categories of covered communications
equipment, including certificates of media disposition and certificates
of destruction, which will help participants and the Bureau verify
compliance with their disposal and verification obligations.
8. Guidance is also provided on selecting certified disposal
services and e-waste recyclers. If using a third party, the Bureau
recommends using a company that provides complete asset management
solutions, from removal to destruction, including transportation and
chain of custody tracking to avoid the potential for misplaced or lost
equipment containing sensitive information. Providers may utilize one
company for the entire disposal and recycling process, or different
companies for different aspects of the disposal and recycling process
based upon the categories of covered communications equipment outlined
in this document. Because the Commission in the 2020 Supply Chain
Order, 86 FR 2904, January 13, 2021, prohibited the transfer of
operable covered communications equipment or service to non-U.S.
providers, the Bureau recommends providers use U.S. disposal companies
that conduct the disposal process on U.S. soil. Equipment is still
considered operable until it is properly disposed.
9. In particular, the Bureau recommends providers use a U.S.
disposal company registered with the U.S. Department of State's
Directorate of Defense Trade Controls pursuant to the International
Traffic in Arms Regulations (ITAR). The Bureau agrees with Advanced
Technology Recycling that ``utilizing ITAR processing guidelines is an
ideal mechanism to ensure sensitive electronics as outlined in the
[Secure Networks Act] are properly disposed of in a manner that
protects national security.'' While the covered communications
equipment may not fall within the scope of ITAR, the Bureau finds that
an ITAR-registered disposal company will likely have the procedures in
place and the facilities necessary to effectively handle the safe and
secure destruction of covered communications equipment, including the
most sensitive equipment. The Bureau finds that, based on the record,
ITAR-registered companies likely can provide complete asset management
services, including tracking equipment, maintaining records, and
documentation and certifying destruction. According to Advanced
Technology Recycling, ``ITAR registered service providers must follow
strict disposal guidelines to ensure scrap materials generated
throughout the disposal process remain on U.S. soil and be processed
exclusively by U.S. persons.'' ITAR-registered companies are required
to maintain records concerning manufacture, acquisition, and
disposition of defense articles, including technical data, subject to
ITAR, and are subject to civil and criminal penalties for violations.
According to Advanced Technology Recycling and Gannon & Scott, ITAR-
registered companies may also hold e-waste recycling or other
certifications and provide media sanitization services, allowing for a
one-stop disposal facility to handle the disposal of different
categories of equipment according to the best practices outlined in the
released document.
10. The Bureau agrees with Teltech Group that through the disposal
process it should ``consider environmental issues'' so that the covered
communications equipment ``do not create environmental problems.''
Accordingly, the Bureau recommends for providers to recycle covered
communications equipment to ensure the secure and environmentally
responsible disposal of equipment as recommended by the Environmental
Protection Agency (EPA). Consistent with EPA guidelines, the Bureau
recommends utilizing electronic waste (e-waste) recyclers that are
certified by either the Responsible Recycling (R2) Standard for
Electronics Recyclers or the e-Stewards Standard for Responsible
Recycling and Reuse of Electronic Equipment (e-Stewards). As noted in
this document, ITAR-registered companies may also hold R2 and e-
Stewards certifications. For example, according to Advanced Technology
Recycling, as an ITAR-registered disposal company, disposal processes
are ``carried out . . . at R2 certified and ITAR registered
facilities.''
11. The best practices also provide guidance on disposal
verification documentation. The Bureau recommends providers retain
shipping or transportation documentation, including detailed
inventories supported by an affidavit, dates, locations, transportation
service provider name, and means of transportation. These may be kept
individually or as part of a larger asset management solution.
Reimbursement Program participants are encouraged to retain
documentation, including certificates of media disposition and
certificates of destruction, that will help participants and the Bureau
verify compliance with their disposal and verification obligations.
These recommendations reflect input received from the Rural Wireless
Association, Teltech Group, and the Competitive Carriers Association on
the importance of tracking the removal and destruction of covered
equipment and on clarifying the ``level of detail any documentation
will need to contain to be compliant.''
12. In sum, these best practices will help ensure the security of
sensitive data processed or retained by the covered equipment,
including network and customer proprietary information, from
unauthorized access. These best practices will also help participants
comply with the requirements of Sec. 1.50004(j) of the Commission's
rules, to ensure that covered communications
[[Page 59306]]
equipment and service that pose an unacceptable risk to the national
security of the United States or the security and safety of United
States persons is made inoperable and recycled in an environmentally
safe manner.
13. Prospective-Only Guidance. The Rural Wireless Association
asserts that some of its ``members have already completed the
destruction of, or are in the process of disposing of,'' covered
communications equipment. Providers of advanced communications services
that have already removed and disposed of covered communications
equipment or services could not have known the best practices provided
in the released document. Accordingly, the Bureau will take this into
account when evaluating compliance with Sec. 1.50004(j) for disposal
occurring prior to the release of these best practices. The Bureau
expects providers have acted reasonably, however, in carrying out the
safe and secure disposal of covered communications equipment and have
retained sufficient documentation to verify the disposal efforts taken.
To the extent that covered communications equipment is still in a
provider's custody and not destroyed, providers are encouraged to
follow the disposal guidance provided herein going forward.
14. Reimbursement Program Certifications. Additionally, the Bureau,
on its own motion pursuant to Sec. 1.108 of the Commission's rules,
hereby reconsiders and revises the certifications contained in the FCC
Form 5640 Application Request for Funding Allocation and the
Reimbursement Claim Request. These revised certifications, included in
the release document, are consistent with the certifications recently
employed for other funding programs implemented by the Commission and
will further protect the Reimbursement Program from waste, fraud, and
abuse.
15. The Commission directed the Bureau to ``create one or more
forms to be used by entities to claim reimbursement from the
Reimbursement Program, to report on their use of money disbursed and
the status of their construction efforts, and for any other
Reimbursement Program-related purposes.'' The Commission also delegated
authority to the Bureau to ``adopt the necessary policies and
procedures relating to allocations, draw downs, payments, obligations,
and expenditures of money from the Reimbursement Program to protect
against waste, fraud, and abuse . . . .'' In the Reimbursement Process
PN, 86 FR 31464, June 14, 2021, the Bureau sought comment on the
proposed information fields for FCC Form 5640, including the form
certifications required by applicants. The Bureau finalized the FCC
Form 5640 Application Request for Funding Allocation and Reimbursement
Claim Request in the Finalized Reimbursement Process PN.
16. The Bureau, on its own motion, now reconsiders and revises
these FCC Form 5640 certifications. The revised certifications largely
track the substance of the prior certifications that were derived from
the Secure Networks Act and the Commission's rules. However, to further
protect the Reimbursement Program from waste, fraud, and abuse and to
align the certifications with other recently implemented funding
programs by the Commission, the Bureau has added additional
certifications. For example, the Bureau now explicitly requires
certifying officials to certify that they are authorized to certify on
behalf of the applicant. The certifying official must also acknowledge
that any false, fictitious, or fraudulent information or statement, or
the omission of any material fact on the form or any other documents
submitted may subject the participant to fine or forfeiture under the
Communications Act, fine or imprisonment under Title 18 of the United
States Code, or liability under the False Claims Act. The Bureau also
requires certifying officials to acknowledge that failure to comply
with the statute, rules, and orders governing the Reimbursement Program
could result in civil and criminal prosecution by law enforcement
authorities. The certifying official must further certify that the
applicant will not use Reimbursement Program funds for any portion of
expenses that have been or will be reimbursed by other sources of state
or federal funding. This certification, in particular, is aimed at
protecting against the receipt and use of duplicative funding from
different state and federal sources. Finally, certifying officials will
also need to certify that no ``kickbacks'' (i.e., money or anything of
value) were paid or received by the participant from a contractor or
vendor in connection with the Reimbursement Program. Collectively, the
revised and added certifications provide additional notice to
certifying officials and applicants as to potential civil and criminal
penalties for violating Reimbursement Program requirements and will
strengthen the Commission's ability to investigate and hold applicants
accountable for rule violations and fraudulent conduct. The text of the
revised certifications can be found in Appendix B of the Public Notice,
https://www.fcc.gov/document/wcb-announces-best-practices-supply-chain-equipment-disposal.
17. These revised certifications will become effective immediately
upon publication in the Federal Register, pursuant to section 553(d)(3)
of the Administrative Procedure Act. The Bureau finds good cause exists
for an expedited effective date to ensure these certifications can be
included in the forms necessary for the expeditious opening of the
Reimbursement Program filing window, which is now scheduled to occur on
October 29, 2021. An expedited effective date will further assist the
Commission in speedily addressing the pressing national security
concerns that prompted the establishment this Reimbursement Program.
18. Cost Catalog Corrections. Finally, the Bureau corrects cost
estimates incorrectly identified in the Cost Catalog adopted on August
3, 2021, in the Finalized Reimbursement Process PN. Since the release
of the Cost Catalog on August 3, 2021, the Bureau was made aware of a
few instances where the cost estimate identified in that version of the
Cost Catalog was listed incorrectly. Specifically, the average cost
estimate reported for items 2.1.2 and, 2.2.3 was inaccurate given the
range of cost estimates reported. In addition, the low-end cost range
for item 5.16.5 was incorrectly listed as $1,7687.17 instead of
$17,687.17. The average cost estimate for item 5.16.5 is, however,
correct. Separately, the final version of the Cost Catalog incorrectly
included a cost estimate for item 5.1.4 regarding ``Participation for
FCC Rulemaking'' even though the Bureau explicitly called for the
removal of this item in the Finalized Reimbursement Process PN.
Accordingly, the Bureau will make these corrections to the Cost Catalog
and publish a corrected version on the Commission's website.
A. Paperwork Reduction Act of 1995 Analysis
19. This document does not contain any new information
collection(s) subject to the Paperwork Reduction Act of 1995 (PRA),
Public Law 104-13. The Commission has separately sought and obtained
approval, per the PRA, from the Office of Management and Budget (OMB)
for the information collection requirements contained in the 2020
Supply Chain Order from which the rules and obligations discussed
herein, where applicable, are derived. Therefore, this document does
not contain any new or modified information collection burden for small
[[Page 59307]]
business concerns with fewer than 25 employees, pursuant to the Small
Business Paperwork Relief Act of 2002, Public Law 107-198. While the
revised certifications adopted in this document for the FCC Form 5640
are exempt from the requirements of the PRA, pursuant to 5 CFR
1320.3(h)(1), we will update the information on file for OMB Control
No. 3060-1270 to reflect the revised certifications adopted herein for
the FCC Form 5640.
B. Congressional Review Act
20. The Commission has determined, and the Administrator of the
Office of Information and Regulatory Affairs, Office of Management and
Budget, concurs, that these modified certification requirements are
non-major under the Congressional Review Act, 5 U.S.C. 804(2). The
Bureau will send a copy of this document to Congress and the Government
Accountability Office pursuant to 5 U.S.C. 801(a)(1)(A).
C. Final Regulatory Flexibility Certification
The Regulatory Flexibility Act of 1980, as amended (RFA), requires
that an agency prepare a regulatory flexibility analysis for notice and
comment rulemakings, unless the agency certifies that ``the rule will
not, if promulgated, have a significant economic impact on a
substantial number of small entities.'' The RFA generally defines the
term ``small entity'' as having the same meaning as the terms ``small
business,'' ``small organization,'' and ``small governmental
jurisdiction.'' In addition, the term ``small business'' has the same
meaning as the term ``small business concerns'' under the Small
Business Act. A ``small business concern'' is one that: (1) Is
independently owned and operated; (2) is not dominant in its field of
operation; and (3) satisfies any additional criteria established by the
Small Business Administration (SBA). The Commission prepared Initial
Regulatory Flexibility Analyses (IRFAs) in connection with the 2020
Supply Chain Declaratory Ruling, 85 FR 47211, August 4, 2020, and
Second Further Notice of Proposed Rulemaking (FNPRM), 85 FR 48134,
August 10, 2020, and the 2021 Supply Chain Third FNPRM, 86 FR 15165,
March 22, 2021. The Commission sought written public comment on the
proposals in the 2020 Supply Chain Declaratory Ruling and Second FNPRM
and the 2021 Supply Chain Third FNPRM, including comments on the IRFAs.
No comments were filed addressing the IRFAs. The Commission included
Final Regulatory Flexibility Analyses (FRFAs) in connection with the
2020 Supply Chain Order and the 2021 Supply Chain Order, 86 FR 46995,
August 23, 2021.
21. This document provides: (1) Voluntary guidance on complying
with the Reimbursement Program's disposal and verification
requirements; (2) revises the certifications associated with the FCC
Form 5640 application filings; and (3) corrects cost estimates
identified in the Cost Catalog that were listed incorrectly. These
actions flow from the proposals set forth in the 2020 Supply Chain
Declaratory Ruling and Second FNPRM and the 2021 Supply Chain Third
FNPRM and discussed in the IRFAs accompanying those Notices, and are
consistent with the requirements established in the 2020 Supply Chain
Order and the 2021 Supply Chain Order and addressed in the FRFAs
accompanying those orders. Accordingly, no changes to the earlier
analyses are required.
22. The Bureau has determined that the impact on the entities
affected by the requirements contained in this document will not be
significant. The effect of these measures is to establish for the
benefit of those entities, including small entities, the procedures for
filing an application consistent with existing rules, to participate in
the Reimbursement Program to obtain funding support to remove from
their networks, replace, and dispose of communications equipment and
service considered a national security risk.
23. Additional Information. For additional information about the
Reimbursement Program application and filing process, interested
parties should review the Finalized Reimbursement Process PN and visit
the Reimbursement Program web page: https://www.fcc.gov/supplychain.
Questions specific to the Reimbursement Program or application process
should be directed to the Reimbursement Program Fund Administrator by
emailing [email protected] or by calling (202) 418-7540 from 9:00
a.m. ET to 5:00 p.m. ET, Monday through Friday, except for Federal
holidays. For further information regarding this document, please
contact [email protected]
Federal Communications Commission.
Cheryl Callahan,
Assistant Chief, Telecommunications Access Policy Division, Wireline
Competition Bureau.
[FR Doc. 2021-23213 Filed 10-26-21; 8:45 am]
BILLING CODE 6712-01-P
