CyberTelecom Blog: October 2008

Wednesday, October 29, 2008

The New-Old Internet Services Child Explotation Reporting Requirement

Title V is where Sen. McCain's SAFE Act was assimilated into Biden's Protect Act. This language was not part of the Biden bill, and did not go through Congressional hearings. The Center for Democracy and Technology commented on the inclusion of this provision by stating

Among the most problematic provisions in S.519 – which was never publicly debated by any committee–is the outsourcing of significant law enforcement investigative functions to the National Center for Missing & Exploited Children (NCMEC), which as a non-governmental entity operates outside of the core constitutional and legal protections that govern (or should govern) our criminal justice system (such as the 4th Amendment, the Privacy Act, the Freedom of Information Act, etc.). Although NCMEC makes valuable contributions in the child safety arena, the growing trend in Congress to outsource law enforcement functions to a nominally private group—without any serious oversight or procedural protections— takes us down a dangerous path. [CDT]

Before exploring what Title V does, note first that Internet services already have a reporting obligation. In 1998, Congress passed the Child Protection and Sexual Predator Punishment Act which, in part, requires Internet services which become aware of child pornography to report this information to the National Center for Missing and Exploited Children. Note that this does not require Internet services to go out and affirmatively police their systems. It only states that when Internet services gain actual knowledge, then action must be taken. 42 U.S.C. § 13032(e)

Reports can be made to

The Cyber Tip Line
National Center for Missing and Exploited Children
www.cybertipline.com
1-800-843-5678

It's not immediately apparent what is the new McCain SAFE Act Provisions bring to the table, so to elucidate, here is a side-by-side, comparing the new legislation to the old statute (it's a bit of a hack job but the language parallels pretty well. Old language is on the left in Green. New language is on the right; new and different language is highlighted in red) - well it was suppose to be a side-by-side but Glogger is refusing to render it correctly, so let's try a different way - the Cybertelecom website will have this as a side-by-side:

Definitions
- Old Language 42 USC 13032
  - (a) Definitions In this section—
    
    (1) the term “electronic communication service” has the meaning given the term in section 2510 of title 18 ; and
    
    (2) the term “remote computing service” has the meaning given the term in section 2711 of title 18 .
- New Language 18 USC 2258A

Who has the Duty
- Old Language 42 USC 13032
  - (b) Requirements (1) Duty to report.— Whoever, while engaged in providing an electronic communication service or a remote computing service to the public, through a facility or means of interstate or foreign commerce,
- New Language 18 USC 2258A
What triggers the Duty

Old Language 42 USC 13032
- obtains knowledge of facts or circumstances
  
  from which a violation of section 2251 , 2251A , 2252 , 2252A , 2252B , or 2260 of title 18 , involving child pornography (as defined in section 2256 of that title), or a violation of section 1466A of that title, is apparent,
  
  shall, as soon as reasonably possible, . . . . .

New Language 18 USC 2258A
- obtains actual knowledge of any facts or circumstances
  
  described in paragraph (2)
  
  shall, as soon as reasonably possible--
  
  . . . . .
  
  `(2) FACTS OR CIRCUMSTANCES- The facts or circumstances described in this paragraph are any facts or circumstances from which there is an apparent violation of--
  
  `(A) section 2251, 2251A, 2252, 2252A, 2252B, or 2260 that involves child pornography; or
  
  `(B) section 1466A.

Monitoring
- Old Language 42 USC 13032
  - (e) Monitoring not required Nothing in this section may be construed to require a provider of electronic communication services or remote computing services to engage in the monitoring of any user, subscriber, or customer of that provider, or the content of any communication of any such person.
- New Language 18 USC 2258A
  - `(f) Protection of Privacy- Nothing in this section shall be construed to require an electronic communication service provider or a remote computing service provider to--
    
    `(1) monitor any user, subscriber, or customer of that provider;
    
    `(2) monitor the content of any communication of any person described in paragraph (1); or
    
    `(3) affirmatively seek facts or circumstances described in sections (a) and (b).
Duty
- Old Language 42 USC 13032
  - make a report of such facts or circumstances
- New Language 18 USC 2258A
  - `(A) provide. . .
    
    `(B) make a report of such facts or circumstances

To Whom
- Old Language 42 USC 13032
  - to the Cyber Tip Line at the National Center for Missing and Exploited Children,
- New Language 18 USC 2258A
  - to the CyberTipline of the National Center for Missing and Exploited Children, or any successor to the CyberTipline operated by such center,
    
    to the CyberTipline, or any successor to the CyberTipline operated by such center.
What must be reported
- Old Language 42 USC 13032
  - (d) Limitation of information or material required in report A report under subsection (b)(1) of this section may include additional information or material developed by an electronic communication service or remote computing service, except that the Federal Government may not require the production of such information or material in that report.
- New Language 18 USC 2258A
  - the mailing address, telephone number, facsimile number, electronic mail address of, and individual point of contact for, such electronic communication service provider or remote computing service provider; and
    
    . . .
    
    `(b) Contents of Report- To the extent the information is within the custody or control of an electronic communication service provider or a remote computing service provider, the facts and circumstances included in each report under subsection (a)(1) may include the following information:
    
    `(1) INFORMATION ABOUT THE INVOLVED INDIVIDUAL- Information relating to the identity of any individual who appears to have violated a Federal law described in subsection (a)(2), which may, to the extent reasonably practicable, include the electronic mail address, Internet Protocol address, uniform resource locator, or any other identifying information, including self-reported identifying information.
    
    `(2) HISTORICAL REFERENCE- Information relating to when and how a customer or subscriber of an electronic communication service or a remote computing service uploaded, transmitted, or received apparent child pornography or when and how apparent child pornography was reported to, or discovered by the electronic communication service provider or remote computing service provider, including a date and time stamp and time zone.
    
    `(3) GEOGRAPHIC LOCATION INFORMATION-
    
    `(A) IN GENERAL- Information relating to the geographic location of the involved individual or website, which may include the Internet Protocol address or verified billing address, or, if not reasonably available, at least 1 form of geographic identifying information, including area code or zip code.
    
    `(B) INCLUSION- The information described in subparagraph (A) may also include any geographic information provided to the electronic communication service or remote computing service by the customer or subscriber.
    
    `(4) IMAGES OF APPARENT CHILD PORNOGRAPHY- Any image of apparent child pornography relating to the incident such report is regarding.
    
    `(5) COMPLETE COMMUNICATION- The complete communication containing any image of apparent child pornography, including--
    
    `(A) any data or information regarding the transmission of the communication; and
    
    `(B) any images, data, or other digital files contained in, or attached to, the communication.
Disclosure to Law Enforcement
- Old Language 42 USC 13032
  - which shall forward that report to a law enforcement agency or agencies designated by the Attorney General. . . .
    
    (3) In addition to forwarding such reports to those agencies designated in subsection (b)(2) of this section, the National Center for Missing and Exploited Children is authorized to forward any such report to an appropriate official of a state or subdivision of a state for the purpose of enforcing state criminal law.
    
    . . . . .
    
    (f) Conditions of disclosure of information contained within report
    
    (1) In general No law enforcement agency that receives a report under subsection (b)(1) of this section shall disclose any information contained in that report, except that disclosure of such information may be made—
    
    (A) to an attorney for the government for use in the performance of the official duties of the attorney;
    
    (B) to such officers and employees of the law enforcement agency, as may be necessary in the performance of their investigative and recordkeeping functions;
    
    (C) to such other government personnel (including personnel of a State or subdivision of a State) as are determined to be necessary by an attorney for the government to assist the attorney in the performance of the official duties of the attorney in enforcing Federal criminal law; or
    
    (D) where the report discloses a violation of State criminal law, to an appropriate official of a State or subdivision of a State for the purpose of enforcing such State law.
    
    (2) Definitions In this subsection, the terms “attorney for the government” and “State” have the meanings given those terms in Rule 54 of the Federal Rules of Criminal Procedure.
- New Language 18 USC 2258A
  - `(c) Forwarding of Report to Law Enforcement-
    
    `(1) IN GENERAL- The National Center for Missing and Exploited Children shall forward each report made under subsection (a)(1) to any appropriate law enforcement agency designated by the Attorney General under subsection (d)(2).
    
    `(2) STATE AND LOCAL LAW ENFORCEMENT- The National Center for Missing and Exploited Children may forward any report made under subsection (a)(1) to an appropriate law enforcement official of a State or political subdivision of a State for the purpose of enforcing State criminal law.
    
    `(3) FOREIGN LAW ENFORCEMENT-
    
    `(A) IN GENERAL- The National Center for Missing and Exploited Children may forward any report made under subsection (a)(1) to any appropriate foreign law enforcement agency designated by the Attorney General under subsection (d)(3), subject to the conditions established by the Attorney General under subsection (d)(3).
    
    `(B) TRANSMITTAL TO DESIGNATED FEDERAL AGENCIES- If the National Center for Missing and Exploited Children forwards a report to a foreign law enforcement agency under subparagraph (A), the National Center for Missing and Exploited Children shall concurrently provide a copy of the report and the identity of the foreign law enforcement agency to--
    
    `(i) the Attorney General; or
    
    `(ii) the Federal law enforcement agency or agencies designated by the Attorney General under subsection (d)(2).
    
    . . . . .
    
    `(g) Conditions of Disclosure Information Contained Within Report-
    
    `(1) IN GENERAL- Except as provided in paragraph (2), a law enforcement agency that receives a report under subsection (c) shall not disclose any information contained in that report.
    
    `(2) PERMITTED DISCLOSURES BY LAW ENFORCEMENT-
    
    `(A) IN GENERAL- A law enforcement agency may disclose information in a report received under subsection (c)--
    
    `(i) to an attorney for the government for use in the performance of the official duties of that attorney;
    
    `(ii) to such officers and employees of that law enforcement agency, as may be necessary in the performance of their investigative and recordkeeping functions;
    
    `(iii) to such other government personnel (including personnel of a State or subdivision of a State) as are determined to be necessary by an attorney for the government to assist the attorney in the performance of the official duties of the attorney in enforcing Federal criminal law;
    
    `(iv) if the report discloses a violation of State criminal law, to an appropriate official of a State or subdivision of a State for the purpose of enforcing such State law;
    
    `(v) to a defendant in a criminal case or the attorney for that defendant, subject to the terms and limitations under section 3509(m) or a similar State law, to the extent the information relates to a criminal charge pending against that defendant;
    
    `(vi) subject to subparagraph (B), to an electronic communication service provider or remote computing provider if necessary to facilitate response to legal process issued in connection to a criminal investigation, prosecution, or post-conviction remedy relating to that report; and
    
    `(vii) as ordered by a court upon a showing of good cause and pursuant to any protective orders or other conditions that the court may impose.
    
    . . . . .
    
    `(B) LIMITATIONS-
    
    `(i) LIMITATIONS ON FURTHER DISCLOSURE- The electronic communication service provider or remote computing service provider shall be prohibited from disclosing the contents of a report provided under subparagraph (A)(vi) to any person, except as necessary to respond to the legal process.
    
    `(ii) EFFECT- Nothing in subparagraph (A)(vi) authorizes a law enforcement agency to provide child pornography images to an electronic communications service provider or a remote computing service.
    
    `(3) PERMITTED DISCLOSURES BY THE NATIONAL CENTER FOR MISSING AND EXPLOITED CHILDREN- The National Center for Missing and Exploited Children may disclose information received in a report under subsection (a) only--
    
    `(A) to any Federal law enforcement agency designated by the Attorney General under subsection (d)(2);
    
    `(B) to any State, local, or tribal law enforcement agency involved in the investigation of child pornography, child exploitation, kidnapping, or enticement crimes;
    
    `(C) to any foreign law enforcement agency designated by the Attorney General under subsection (d)(3); and
    
    `(D) to an electronic communication service provider or remote computing service provider as described in section 2258C.
Penalty for Failure to Report
- Old Language 42 USC 13032
  - (4) Failure to report.— A provider of electronic communication services or remote computing services described in paragraph (1) who knowingly and willfully fails to make a report under that paragraph shall be fined—
    
    (A) in the case of an initial failure to make a report, not more than $50,000; and
    
    (B) in the case of any second or subsequent failure to make a report, not more than $100,000.
- New Language 18 USC 2258A
  - `(e) Failure To Report- An electronic communication service provider or remote computing service provider that knowingly and willfully fails to make a report required under subsection (a)(1) shall be fined--
    
    `(1) in the case of an initial knowing and willful failure to make a report, not more than $150,000; and
    
    `(2) in the case of any second or subsequent knowing and willful failure to make a report, not more than $300,000.
Designation of Agent
- Old Language 42 USC 13032
  - (2) Designation of agencies.— Not later than 180 days after October 30, 1998, the Attorney General shall designate the law enforcement agency or agencies to which a report shall be forwarded under paragraph (1).
- New Language 18 USC 2258A
  - `(d) Attorney General Responsibilities-
    
    `(1) IN GENERAL- The Attorney General shall enforce this section.
    
    `(2) DESIGNATION OF FEDERAL AGENCIES- The Attorney General shall designate promptly the Federal law enforcement agency or agencies to which a report shall be forwarded under subsection (c)(1).
    
    `(3) DESIGNATION OF FOREIGN AGENCIES- The Attorney General shall promptly--
    
    `(A) in consultation with the Secretary of State, designate the foreign law enforcement agencies to which a report may be forwarded under subsection (c)(3);
    
    `(B) establish the conditions under which such a report may be forwarded to such agencies; and
    
    `(C) develop a process for foreign law enforcement agencies to request assistance from Federal law enforcement agencies in obtaining evidence related to a report referred under subsection (c)(3).
    
    `(4) REPORTING DESIGNATED FOREIGN AGENCIES- The Attorney General shall maintain and make available to the Department of State, the National Center for Missing and Exploited Children, electronic communication service providers, remote computing service providers, the Committee on the Judiciary of the Senate, and the Committee on the Judiciary of the House of Representatives a list of the foreign law enforcement agencies designated under paragraph (3).
    
    `(5) SENSE OF CONGRESS REGARDING DESIGNATION OF FOREIGN AGENCIES- It is the sense of Congress that--
    
    `(A) combating the international manufacturing, possession, and trade in online child pornography requires cooperation with competent, qualified, and appropriately trained foreign law enforcement agencies; and
    
    `(B) the Attorney General, in cooperation with the Secretary of State, should make a substantial effort to expand the list of foreign agencies designated under paragraph (3).
Notification to Internet Service
- Old Language 42 USC 13032
  - n/a
- New Language 18 USC 2258A
  - `(6) NOTIFICATION TO PROVIDERS- If an electronic communication service provider or remote computing service provider notifies the National Center for Missing and Exploited Children that the electronic communication service provider or remote computing service provider is making a report under this section as the result of a request by a foreign law enforcement agency, the National Center for Missing and Exploited Children shall--
    
    `(A) if the Center forwards the report to the requesting foreign law enforcement agency or another agency in the same country designated by the Attorney General under paragraph (3), notify the electronic communication service provider or remote computing service provider of--
    
    `(i) the identity of the foreign law enforcement agency to which the report was forwarded; and
    
    `(ii) the date on which the report was forwarded; or
    
    `(B) notify the electronic communication service provider or remote computing service provider if the Center declines to forward the report because the Center, in consultation with the Attorney General, determines that no law enforcement agency in the foreign country has been designated by the Attorney General under paragraph (3).
Preservation of Records
- Old Language 42 USC 13032
  - n/a
- New Language 18 USC 2258A
  - `(h) Preservation-
    
    `(1) IN GENERAL- For the purposes of this section, the notification to an electronic communication service provider or a remote computing service provider by the CyberTipline of receipt of a report under subsection (a)(1) shall be treated as a request to preserve, as if such request was made pursuant to section 2703(f).
    
    `(2) PRESERVATION OF REPORT- Pursuant to paragraph (1), an electronic communication service provider or a remote computing service shall preserve the contents of the report provided pursuant to subsection (b) for 90 days after such notification by the CyberTipline.
    
    `(3) PRESERVATION OF COMMINGLED IMAGES- Pursuant to paragraph (1), an electronic communication service provider or a remote computing service shall preserve any images, data, or other digital files that are commingled or interspersed among the images of apparent child pornography within a particular communication or user-created folder or directory.
    
    `(4) PROTECTION OF PRESERVED MATERIALS- An electronic communications service or remote computing service preserving materials under this section shall maintain the materials in a secure location and take appropriate steps to limit access by agents or employees of the service to the materials to that access necessary to comply with the requirements of this subsection.
    
    `(5) AUTHORITIES AND DUTIES NOT AFFECTED- Nothing in this section shall be construed as replacing, amending, or otherwise interfering with the authorities and duties under section 2703.

Liability Limitation
- Old Language 42 USC 13032
  - (c) Civil liability No provider or user of an electronic communication service or a remote computing service to the public shall be held liable on account of any action taken in good faith to comply with or pursuant to this section.
- New Language 18 USC 2258A
  - `SEC. 2258B. LIMITED LIABILITY FOR ELECTRONIC COMMUNICATION SERVICE PROVIDERS, REMOTE COMPUTING SERVICE PROVIDERS, OR DOMAIN NAME REGISTRAR.
    
    `(a) In General- Except as provided in subsection (b), a civil claim or criminal charge against an electronic communication service provider, a remote computing service provider, or domain name registrar, including any director, officer, employee, or agent of such electronic communication service provider, remote computing service provider, or domain name registrar arising from the performance of the reporting or preservation responsibilities of such electronic communication service provider, remote computing service provider, or domain name registrar under this section, section 2258A, or section 2258C may not be brought in any Federal or State court.
    
    `(b) Intentional, Reckless, or Other Misconduct- Subsection (a) shall not apply to a claim if the electronic communication service provider, remote computing service provider, or domain name registrar, or a director, officer, employee, or agent of that electronic communication service provider, remote computing service provider, or domain name registrar--
    
    `(1) engaged in intentional misconduct; or
    
    `(2) acted, or failed to act--
    
    `(A) with actual malice;
    
    `(B) with reckless disregard to a substantial risk of causing physical injury without legal justification; or
    
    `(C) for a purpose unrelated to the performance of any responsibility or function under this section, sections 2258A, 2258C, 2702, or 2703.
    
    `(c) Minimizing Access- An electronic communication service provider, a remote computing service provider, and domain name registrar shall--
    
    `(1) minimize the number of employees that are provided access to any image provided under section 2258A or 2258C; and
    
    `(2) ensure that any such image is permanently destroyed, upon a request from a law enforcement agency to destroy the image.

This comparison was necessary because it was not immediately clear what McCain's SAFE Act brings to the table - and after creating the side-by-side, its still not clear (Congress did impose a long desired record retention requirement - See Record Retention).

Why did Congress felt it necessary to create an entirely new law to address this issue? Understand, the new law does not replace the old. BOTH the new law and the old law now are on the books - and one could in theory be found to have violated both statutes and suffer both penalties. And as far as I can tell from the side-by-side, the new SAFE Act is merely an elaboration and tweaking of the old law - at times the language in the two different statutes is all but plagiarized. I really would be interested to hear from those that might have insight on this legislative maneuver.

Second, I know that CDT complains about the new outsourced role of the National Center for Missing & Exploited Children - but as can be seen, the role is not new. The role of the National Center for Missing & Exploited Children is all but identical under both the old and new statutes - receive, aggregate, and forward information to law enforcement. There may or may not be an objection to this outsourcing, but the role of the National Center for Missing & Exploited Children is not new.

In re Implementation of the NET 911 Improvement Act of 2008, REPORT and order WC Docket No. 08-171, (FCC October 21, 2008) [REDACTED]

We thought we might try something new. Agency orders can be long dreary things filled with procedural discussions. Well, what if we redact out all the APA gobbly gook, and boil it down to what was actually decided. We gave it a go with the recent FCC Net 911 Improvement Act Order, and this is what it boiled down to:

In re Implementation of the NET 911 Improvement Act of 2008, REPORT and order WC Docket No. 08-171, (FCC October 21, 2008) [REDACTED]

[1] In this Order, we adopt rules implementing certain key provisions of the New and Emerging Technologies 911 Improvement Act of 2008 (NET 911 Act), which was enacted on July 23, 2008. Specifically, we issue rules that give interconnected VoIP providers rights of access to any and all capabilities necessary to provide 911 and E911 service from entities that own or control those capabilities. We also take steps to ensure that the nation’s E911 network remains secure as an expanded number of entities are granted rights to access this system.

[3] The NET 911 Act explicitly imposes on each interconnected VoIP provider the obligation to provide 911 and E911 service in accordance with Commission existing requirements. The NET 911 Act also grants each interconnected VoIP provider rights with respect to “capabilities” to provide 911 and E911 services. Specifically, section 101 of the NET 911 Act adds a new section 6 to the Wireless 911 Act that states in relevant part:

DUTIES. – It shall be the duty of each IP-enabled voice service provider to provide 9–1–1 service and enhanced 9–1–1 service to its subscribers in accordance with the requirements of the Federal Communications Commission, as in effect on the date of enactment of the New and Emerging Technologies 911 Improvement Act of 2008 and as such requirements may be modified by the Commission from time to time.

PARITY FOR IP-ENABLED VOICE SERVICE PROVIDERS.—An IP-enabled voice service provider that seeks capabilities to provide 9–1–1 and enhanced 9–1–1 service from an entity with ownership or control over such capabilities, to comply with its obligations under subsection (a), shall, for the exclusive purpose of complying with such obligations, have a right of access to such capabilities, including interconnection, to provide 9–1–1 and enhanced 9–1–1 service on the same rates, terms, and conditions that are provided to a provider of commercial mobile service . . . , subject to such regulations as the Commission prescribes under subsection (c).

[7] 911 service generally falls into two categories – basic and enhanced. Basic 911 service delivers 911 calls to an appropriate PSAP or public safety agency without the information regarding the caller’s location or, in some cases, a call back number. E911 service expands basic 911 service by not only delivering 911 calls to an appropriate PSAP, or public safety agency, but also providing the call taker with the caller’s call back number, referred to as Automatic Numbering Identification (ANI), and location information — a capability referred to as Automatic Location Identification (ALI).

[12] Interconnected VoIP E911 Network. Under the Commission’s rules, interconnected VoIP providers must provide E911 service to their customers. Interconnected VoIP service may enable customers to place calls from various geographic locations which may necessitate the use of p-ANI for routing 911 calls. Furthermore, given the state of current technology to determine automatically the location from which an interconnected VoIP call is made, the Commission required providers of interconnected VoIP services to obtain location information, called “Registered Location,” from their customers.

[13] Under the Commission’s rules, interconnected VoIP providers must forward all 911 calls made over their interconnected VoIP service, as well as a call back number and the caller’s Registered Location for each call, to the appropriate PSAP. These calls must be routed through the use of ANI and, if necessary, and similar to wireless carriers, p-ANI, via the dedicated Wireline E911 Network, and the caller’s Registered Location must be available from or through the ALI Database. Interconnected VoIP providers may comply with the Commission’s rules by interconnecting indirectly through a third party such as a competitive LEC, interconnecting directly with the Wireline E911 Network, or through any other solution that allows the provider to offer E911 service.

[24] we issue rules to grant interconnected VoIP providers a right of access to the capabilities CMRS providers use to provide E911 service equal to the access rights made available to CMRS providers.

[25] Second, with respect to any capabilities that are not provided to CMRS providers for their provision of E911 service, we interpret the NET 911 Act as granting interconnected VoIP providers a right of access if the capability is necessary for the interconnected VoIP provider to provide E911 service in compliance with the Commission’s rules.

[27] Typical Capabilities. . . Thus, in a typical local architecture, “capabilities” will include: the Selective Router; the trunk line(s) between the Selective Router and the PSAP(s); the ALI Database; the SR Database; the DBMS, the MSAG; p-ANIs; ESNs; mobile switching center capabilities; mobile positioning center capabilities; shell records; the data circuits connecting these elements; and the network elements, features, processes, and agreements necessary to enable the use of these elements.

[28] Entities with Ownership or Control of Capabilities. We conclude that interconnected VoIP providers are entitled to access to capabilities from any entity that owns or controls such capabilities. . . . We therefore interpret the NET 911 Act to impose obligations of access on each of the entities described in part II.D of this Order, including in typical E911 architectures: incumbent LECs, PSAPs and local authorities, VPCs, CMRS providers, competitive carriers, and the Interim RNA to the extent any of these entities has “ownership or control” over any capabilities to which interconnected VoIP providers have a right of access.

Rates, Terms, and Conditions

[32] We interpret the term “provided” as used in this provision as encompassing not only those capabilities that are actually provisioned to a CMRS provider as well as the rates, terms, and conditions under which they are provisioned, but also those capabilities that are currently offered to a CMRS provider as well as the rates, terms, and conditions under which they are offered. We interpret “provided” broadly to ensure that interconnected VoIP providers are able to access the same capabilities that CMRS providers may access on the same rates, terms, and conditions that are available to CMRS providers.

[33] In addition, if an owner or controller of a capability does not provide a capability to CMRS providers but is required under part III.A above to grant interconnected VoIP providers access to such capability, such access must be provided on the rates, terms, and conditions that would be offered to a CMRS provider.

[34] If an owner or controller of a capability required to be made available does not currently make that capability available to any other entities, the rates, terms and conditions under which that owner or controller must provide access to a requesting interconnected VoIP provider must be reasonable, and should be reached through commercial negotiation. . . . Finally, we emphasize that all rights to capabilities that the NET 911 Act grants to an interconnected VoIP provider are “for the exclusive purpose of complying with . . . its obligations under subsection (a) [i.e. the Commission’s existing E911 rules].”

Technical, Network Security, and Information Privacy Requirements

[37] NENA has developed national VoIP E911 requirements, referred to as NENA’s i2 standard, that are “designed to ensure that VoIP 9-1-1 calls are routed and presented in a wireline equivalent manner.” We believe that any interconnected VoIP provider that is in compliance with this standard already is coordinating its efforts with the other organizational entities responsible for providing E911 service.

[38] We require interconnected VoIP providers to comply with all applicable industry network security standards to the same extent as traditional telecommunications carriers when they access capabilities traditionally used by carriers.

[39] Finally, our rules contemplate that incumbent LECs and other owners or controllers of 911 or E911 infrastructure will acquire information regarding interconnected VoIP providers and their customers for use in the provision of emergency services. We fully expect that these entities will use this information only for the provision of E911 service. To be clear, no entity may use customer information obtained as a result of the provision of 911 or E911 services for marketing purposes. [NOTE: This is similar to the original CPNI rules]

Final Rules

Part 9 of Title 47 of the Code of Federal Regulations is amended to read as follows:

PART 9 – INTERCONNECTED VOICE OVER INTERNET PROTOCOL SERVICES

1. The authority citation for Part 9 is amended to read as follows:

Authority:  47 U.S.C. 151, 154(i)-(j), 251(e), 303(r), and 615a-1 unless otherwise noted.

2. § 9.1 is amended to read as follows.

§ 9.1 Purposes.

The purposes of this part are to set forth the 911 and E911 service requirements and conditions applicable to interconnected Voice over Internet Protocol service providers, and to ensure that those providers have access to any and all 911 and E911 capabilities they need to comply with those 911 and E911 service requirements and conditions.

3. § 9.3 is amended by adding in alphabetical order definitions of “ALI” and “CMRS” to read as follows.

§ 9.3 Definitions.

Automatic Location Information (ALI). Information transmitted while providing E911 service that permits emergency service providers to identify the geographic location of the calling party.

CMRS. Commercial Mobile Radio Service, as defined in § 20.9 of this chapter.

4. § 9.7 is added to read as follows.

§ 9.7  Access to 911 and E911 Service Capabilities.

(a)  Access.  Subject to the other requirements of this part, an owner or controller of a capability that can be used for 911 or E911 service shall make that capability available to a requesting interconnected VoIP provider as set forth in paragraphs (a)(1) and (a)(2) of this section.

(1)  If the owner or controller makes the requested capability available to a CMRS provider, the owner or controller must make that capability available to the interconnected VoIP provider.  An owner or controller makes a capability available to a CMRS provider if the owner or controller offers that capability to any CMRS provider.

(2)  If the owner of controller does not make the requested capability available to a CMRS provider within the meaning of paragraph (a)(1) of this section, the owner or controller must make that capability available to a requesting interconnected VoIP provider only if that capability is necessary to enable the interconnected VoIP provider to provide 911 or E911 service in compliance with the Commission’s rules.

(b)  Rates, Terms, and Conditions.  The rates, terms, and conditions on which a capability is provided to an interconnected VoIP provider under paragraph (a) of this section shall be reasonable.  For purposes of this paragraph, it is evidence that rates, terms, and conditions are reasonable if they are:  (1) the same as the rates, terms, and conditions that are made available to CMRS providers, or (2) in the event such capability is not made available to CMRS providers, the same rates, terms, and conditions that are made available to any telecommunications carrier or other entity for the provision of 911 or E911 service.

(c)  Permissible Use.  An interconnected VoIP provider that obtains access to a capability pursuant to this section may use that capability only for the purpose of providing 911 or E911 service in accordance with the Commission’s rules.

Sunday, October 26, 2008

The Protect Our Children Act of 2008 - Reports and Tasks Forces

Our last post explored how the most powerful person in politics, Obama-Supporter-Oprah rallied the Oprah Nation to get the Biden-McCain Protect Our Children from the SAFE Act passed. In this post, we will explore the workings of the new law (prepared to be bored).

In Washington D.C. when legislators want it to look to the American Public that they are doing something - but they either dont know what to do or they dont want to create a new set of red tape regulations - they either create a task force to study the problem or they require an agency to file a report with Congress. The PROTECT Act does both - several times.

Title I

In Title I, Section 101 requires the Department of Justice to create a National Strategy for Child Exploitation Prevention and Interdiction which will annually file a report with Congress on DOJ's strategy [REPORT COUNT: 1] .

Section 102 requires the formation of the National Internet Crimes Against Children Task Force (ICAC) Program. The ICAC itself already exists. The Juvenile Justice and Delinquency Prevention Act of 1974 authorized and created an ICAC within DOJ, which is described as:

"The Internet Crimes Against Children (ICAC) Task Force Program helps state and local law enforcement agencies develop an effective response to cyber enticement and child pornography cases. This help encompasses forensic and investigative components, training and technical assistance, victim services, and community education. Numerous task forces have been established throughout the nation. " DOJ ICAC Website.

The Section 102 ICAC will consist "of state and local task forces (including at least one ICAC Task Force for each state) to address online enticement of children, child exploitation, and child obscenity and pornography." [CRS Summary] Sections 102 - 107 give details of the work of the new program. The purpose of the ICAC Task Force Program is set forth in Sec. 103:

The ICAC Task Force Program, and each State or local ICAC task force that is part of the national program of task forces, shall be dedicated toward--
(1) increasing the investigative capabilities of State and local law enforcement officers in the detection, investigation, and apprehension of Internet crimes against children offenses or offenders, including technology-facilitated child exploitation offenses;
(2) conducting proactive and reactive Internet crimes against children investigations;
(3) providing training and technical assistance to ICAC task forces and other Federal, State, and local law enforcement agencies in the areas of investigations, forensics, prosecution, community outreach, and capacity-building, using recognized experts to assist in the development and delivery of training programs;
(4) increasing the number of Internet crimes against children offenses being investigated and prosecuted in both Federal and State courts;
(5) creating a multiagency task force response to Internet crimes against children offenses within each State;
(6) participating in the Department of Justice's Project Safe Childhood initiative, the purpose of which is to combat technology-facilitated sexual exploitation crimes against children;
(7) enhancing nationwide responses to Internet crimes against children offenses, including assisting other ICAC task forces, as well as other Federal, State, and local agencies with Internet crimes against children investigations and prosecutions;
(8) developing and delivering Internet crimes against children public awareness and prevention programs; and
(9) participating in such other activities, both proactive and reactive, that will enhance investigations and prosecutions of Internet crimes against children.

$60m is appropriated each year for 5 years for a total of $300m to support title I. Sec. 107. 75% of this appropriation shall be available for grants to the states and local ICACs, which can be used to hire investigators and prosecutors, establish forensic labs, support investigations, conduct education and training programs, and support other related activities. Sec. 106.

DOJ shall Report to Congress within one year on the progress of the ICAC Task Force Program. [REPORT COUNT: 2]

Title II

Title II recognizes the needs to expands DOJ's CSI capabilities by expanding DOJ's computer forensics capacity - and DOJ gets to file an annual report on its expanded computer forensics capacity. [REPORT COUNT: 3] $2m is appropriated for this.

Title III

Title III amends existing child protection and pornography laws to reflect advanced means of image manipulation and depiction. Sec. 301 prohibits the broadcast of live images of child abuse. Sec. 302 expands the definition of "visual depiction," basically, to cover data that has yet to be converted into a visual image. Sec. 303 amends the prohibition against importing child pornography into the United States to include live visual depictions of child pornography. Finally, Section 304 prohibits the modification of an actual visual image of a child into a pornographic picture.'

Note that Congress has attempted to amend the child pornography several times and struggled to compose a Constitutional statute. One of the struggles is that the child pornography laws are a curtailment of First Amendment rights (dont knee jerk-react - think medical text books, think Romeo and Juliet which relates the romantic life of a 13 year old girl, think people's increadibly boring baby pictures - remember, if the material is obscene, it is already illegal under a different statute) which are justified based on the government interest of protecting actual children. In a previous statutory attempt, congress prohibited electronic child pornography, regardless of whether the image was of an actual child. The constitutional problem was, if the government interest was to protect children, and if there were no children involved, then the statutory attempt failed constitutional muster because the means of curtailing child pornography was not narrowly tailored to the government interest. Here, in Sec. 304 we see the interesting move of advancing that government interest of protecting actual children by saying even where there is a non-pornographic picture of an actual child, and that photograph is morphed to become pornography - that's a problem that harms the actual child - regardless of whether the child was involved in the pornography.

Title IV

Title IV asks for another report to Congress. This report will be on the subject of "whether a subject of an online child exploitation investigation poses a high risk of harm to children." DOJ gets $500k to finance the study. [REPORT COUNT: 4]

Title V

Title V is a reporting requirement imposed on Internet Services, the language of which comes from McCain's SAFE Act. We will explore this new legislation in the next post.

Friday, October 10, 2008

Congress Thinks of the Children: S.1738 PROTECT Our Children Act of 2008

In the middle of the country’s ClusterF#@k to the Poor House, Congress took some time out to Think of the Children.

John McCain said on September 24 that he was ~~canceling his appearance on Letterman~~ suspending his campaign in order to respond to the national crisis and that he would not reinstate his campaign until the crisis was properly resolved. Sen. McCain reinstated his campaign on Friday the 26th.

So what National crisis was resolved that let his campaign continue? It couldn’t have been the financial crisis, since I am now using my AIG stock as toilet paper.

No, in the middle of our National Economy going flush with executives squirreling vast sums into executive golden parachutes, the crisis which was resolved was who could take credit for Thinking of the Children.

In 2007, both VP wannabe Joe Biden and Prez wannabe John McCain introduced legislation attempting to combat the ever growing problem of child abuse and child pornography. Joe Biden’s PROTECT Our Children Act had been considered by the Senate Committee on the Judiciary in April 2008, reported out favorably and placed on the Senate calendar in July 2008. It had 60 cosponsors.

S.1738 PROTECT Our Children Act of 2008
Title: A bill to require the Department of Justice to develop and implement a National Strategy Child Exploitation Prevention and Interdiction, to improve the Internet Crimes Against Children Task Force, to increase resources for regional computer forensic labs, and to make other improvements to increase the ability of law enforcement agencies to investigate and prosecute child predators.
Sponsor: Sen Biden, Joseph R., Jr. [DE] (introduced 6/28/2007) Cosponsors (60)
Related Bills: H.R.3845, S.519
Latest Major Action: 10/2/2008 Presented to President.

Sen. McCain’s Securing Adolescents From Exploitation-Online Act (SAFE Act) had never been considered by a committee, had not seen legislative action, and had only 10 cosponsors.

S.519 Safe Act of 2007
Title: A bill to modernize and expand the reporting requirements relating to child pornography, to expand cooperation in combating child pornography, and for other purposes.
Sponsor: Sen McCain, John [AZ] (introduced 2/7/2007) Cosponsors (10)
Related Bills: H.R.876, H.R.3791, S.1738
Latest Major Action: 2/7/2007 Referred to Senate committee. Status: Read twice and referred to the Committee on the Judiciary.

Now all that is nice and most Washington fat-cats know that once the calendar closes in on the elections, nothing gets done – the legislative process comes to a standstill. The candidates get brownie points for showing they care by introducing legislation, even if the legislation is bound for nowhere – you can always blame those unamericans-in-the-other-party for it going nowhere, and get a few more brownie points.

But on September 15th, an event occurred which the candidates could not ignore: Obama-supporter-Oprah came out in favor of VP wannabe Joe Biden’s PROTECT Our Children Act! The Oprah Nation took to the streets in support of Biden’s bill – and within a week McCain had suspended his campaign and scuttled back to Washington D.C.

Upon McCain’s return to Washington, the PROTECT Our Children Act was passed – on the 25th by the Senate, and on the 27th by the House - but this was quite a different PROTECT Our Children Act than the one thrashed about in the Senate Judiciary Hearing many months ago. As the Center for Democracy and Technology notes, “Some in Congress insisted that the core parts of [John McCain’s] S. 519 – the “SAFE Act” – be added to [Biden's] S. 1738 before passage.” Sec. 2 of John McCain’s act, “Reporting Requirements of Electronic Communication Providers and Remote Computing Service Providers,” became Title V of Joe Biden’s Act, “Securing Adolescents from Online Exploitation” (which had as its first section, Sec. 501 Reporting Requirements of Electronic Communication Providers and Remote Computing Service Providers). One day after the Senate voted on the Biden-McCain SAFE PROTECT Act, with the danger averted, McCain reinstated his campaign.

Upon passage:

Sen. Joe Biden stated: “At the same time when the Internet has given children access to the world – it has also given a dangerous world access to our kids,” said Sen. Biden, Chairman of the Senate Judiciary Subcommittee on Crime and Drugs. “Protecting them requires constant vigilance – in our neighborhoods, in our homes and on-line. Finally we have a bill that will give law enforcement the funds and the tools to pull the plug on Internet predators. I urge the President to quickly sign the Protect Our Children Act into law.”
Oprah stated: "Thank you to the 60 senators—Republican and Democrat—who co-sponsored the bill. … All of you proved that the people can really make a difference."
John McCain stated: [a review of the John McCain Senatorial website reviewed no press release or statement]

Meanwhile, back on the Clusterf@#k, the Center of Democracy and Technology all but lamented, "These provisions should – if the bailout leaves any money to actually spend on law enforcement – really help in the fight against child pornography."

Wheel of Morality, turn turn turn, Tell Us the Lesson We Should Learn: Oprah can get legislation passed even in the midst of a fierce political campaign and the worst economic crisis since the Long Depression of 1873 – now that’s political power! That and, even for the noblest cause, the legislative process is nothing short of a sausage factory – be pleased with your bratwurst but don’t look too close at how it was made.

Note One: I aint hereby supporting no candidate – I am sure someone will be offended – but if you read closely (you will bump the screen with your forehead har har) you will see I am making fun of everyone (including you).

Note Two: I aint dissing the noble cause sought after (didn’t I just say that) – but you gotta admit, that’s some sausage factory.

Note Three: Oh yeah, next post we will dig into this fun “We Don’t Regulate the Internet” new law and see what it means for Internet interests.

UPDATE: President Bush reportedly signed the Biden PROTECT Act into law on Monday October 14 . . . without comment or press release.

Pages

Wednesday, October 29, 2008

The New-Old Internet Services Child Explotation Reporting Requirement

In re Implementation of the NET 911 Improvement Act of 2008, REPORT and order WC Docket No. 08-171, (FCC October 21, 2008) [REDACTED]

Rates, Terms, and Conditions

Technical, Network Security, and Information Privacy Requirements

Sunday, October 26, 2008

The Protect Our Children Act of 2008 - Reports and Tasks Forces

Title I

Title II

Title III

Title IV

Friday, October 10, 2008

Congress Thinks of the Children: S.1738 PROTECT Our Children Act of 2008