Call authentication

In this section: The term “STIR/SHAKEN authentication framework” means the secure telephone identity revisited and signature-based handling of asserted information using tokens standards proposed by the information and communications technology industry. The term “voice service”— includes— Subject to paragraphs (2) and (3), and in accordance with paragraph (6), not later than 18 months after December 30, 2019, the Commission shall— The Commission shall not take the action described in paragraph (1) with respect to a provider of voice service if the Commission determines, not later than 12 months after December 30, 2019, that such provider of voice service— in internet protocol networks— in non-internet protocol networks— Not later than 12 months after December 30, 2019, the Commission shall submit to the Committee on Energy and Commerce of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a report on the determination required under paragraph (2), which shall include— Not later than 3 years after December 30, 2019, and every 3 years thereafter, the Commission, after public notice and an opportunity for comment, shall— Not later than 12 months after December 30, 2019, and as appropriate thereafter, the Commission— shall assess any burdens or barriers to the implementation required by paragraph (1), including— Subject to subparagraphs (C) through (F), for any provider or class of providers of voice service, or type of voice calls, only to the extent that such a provider or class of providers of voice service, or type of voice calls, materially relies on a non-internet protocol network for the provision of such service or calls, the Commission shall grant a delay of required compliance under subparagraph (A)(ii) until a call authentication protocol has been developed for calls delivered over non-internet protocol networks and is reasonably available. During the time of a delay of compliance granted under subparagraph (A)(ii), the Commission shall require, pursuant to the authority of the Commission, that any provider subject to such delay shall implement an appropriate robocall mitigation program to prevent unlawful robocalls from originating on the network of the provider. If the consortium registered under section 13(d) identifies a provider of voice service that is subject to a delay of compliance granted under subparagraph (A)(ii) as repeatedly originating large-scale unlawful robocall campaigns, the Commission shall require such provider to take action to ensure that such provider does not continue to originate such calls. The Commission shall make reasonable efforts to minimize the burden of any robocall mitigation required pursuant to clause (ii), which may include prescribing certain specific robocall mitigation practices for providers of voice service that have repeatedly originated large-scale unlawful robocall campaigns. The Commission shall take reasonable measures to address any issues in an assessment under subparagraph (A)(i) and enable as promptly as reasonable full participation of all classes of providers of voice service and types of voice calls to receive the highest level of trust. Such measures shall include, without limitation, as appropriate, limiting or terminating a delay of compliance granted to a provider under subparagraph (B) if the Commission determines in such assessment that the provider is not making reasonable efforts to develop the call authentication protocol described in such subparagraph. The Commission shall identify, in consultation with small providers of voice service and those in rural areas, alternative effective methodologies to protect customers from unauthenticated calls during any delay of compliance granted under subparagraph (A)(ii). Not less frequently than annually after the first delay of compliance is granted under subparagraph (A)(ii), the Commission— shall issue a public notice with regard to whether such delay of compliance remains necessary, including— The Commission shall prohibit providers of voice service from adding any additional line item charges to consumer or small business customer subscribers for the effective call authentication technology required under paragraph (1). Not later than 12 months after December 30, 2019, the Commission shall issue best practices that providers of voice service may use as part of the implementation of effective call authentication frameworks under paragraph (1) to take steps to ensure the calling party is accurately identified. Consistent with the regulations prescribed under subsection (j) of section 227 of this title, as added by section 10, the Commission shall, not later than 1 year after December 30, 2019, promulgate rules— In establishing the safe harbor under paragraph (1), consistent with the regulations prescribed under subsection (j) of section 227 of this title, as added by section 10, the Commission shall consider limiting the liability of a provider of voice service based on the extent to which the provider of voice service— Nothing in this section shall preclude the Commission from initiating a rulemaking pursuant to its existing statutory authority.