The Energy Policy and Conservation Act, as amended (“EPCA”), 1 authorizes the United States Department of Energy (“DOE”) to regulate the energy efficiency of a number of consumer products and certain industrial equipment. (42 U.S.C. 6291-6317) Title III, Part B  2 of EPCA established the Energy Conservation Program for Consumer Products Other Than Automobiles. These products include refrigerators, refrigerator-freezers, and freezers, the subject of this document. (42 U.S.C. 6292(a)(1))

EPCA prescribed energy conservation standards for these products (42 U.S.C. 6295(b)(1)-(2)), and directed DOE to conduct three cycles of rulemakings to determine whether to amend these standards. (42 U.S.C. 6295(b)(3)(A)(i), (b)(3)(B), and (b)(4)) DOE has completed these rulemakings.

EPCA further provides that, not later than 6 years after the issuance of any final rule establishing or amending a standard, DOE must publish either a notification of determination that standards for the product do not need to be amended, or a notice of proposed rulemaking (“NOPR”) including new proposed energy conservation standards (proceeding to a final rule, as appropriate). (42 U.S.C. 6295(m)(1)) Not later than three years after issuance of a final determination not to amend standards, DOE must publish either a notice of determination that standards for the product do not need to be amended, or a NOPR including new proposed energy conservation standards (proceeding to a final rule, as appropriate). (42 U.S.C. 6295(m)(3)(B))

Under EPCA, any new or amended energy conservation standard must be designed to achieve the maximum improvement in energy efficiency that DOE determines is technologically feasible and economically justified. (42 U.S.C. 6295(o)(2)(A)) Furthermore, the new or amended standard must result in a significant conservation of energy. (42 U.S.C. 6295(o)(3)(B))

DOE is publishing this Preliminary Analysis to collect data and information to inform its decision consistent with its obligations under EPCA. 3

DOE must follow specific statutory criteria for prescribing new or amended standards for covered products, including refrigerators, refrigerators, refrigerator-freezers, and freezers. EPCA requires that any new or amended energy conservation standard prescribed by the Secretary of Energy (“Secretary”) be designed to achieve the maximum improvement in energy efficiency (or water efficiency for certain products specified by EPCA) that is technologically feasible and economically justified. (42 U.S.C. 6295(o)(2)(A)) Furthermore, DOE may not adopt any standard that would not result in the significant conservation of energy. (42 U.S.C. 6295(o)(3)) The Secretary may not prescribe an amended or new standard that will not result in significant conservation of energy, or is not technologically feasible or economically justified. ( Id. )

On February 14, 2020, DOE published an update to its procedures, interpretations, and policies for consideration in new or revised energy conservation standards and test procedure, i.e., “Procedures, Interpretations, and Policies for Consideration of New or Revised Energy Conservation Standards and Test Procedures for Consumer Products and Certain Commercial/Industrial Equipment” (see 10 CFR part 430, subpart C, appendix A (“Process Rule,”)). 4 85 FR 8626. In the current Process Rule, DOE applies a significance threshold for energy savings under which DOE employs a two-step approach that considers both an absolute site energy savings threshold and a percentage reduction threshold in the energy use of the covered product (or equipment). See Process Rule, Sec. 6(b).

DOE first evaluates the projected energy savings from a potential maximum technologically feasible (“max-tech”) standard over a 30-year period against a site-based energy savings threshold of 0.3 quad. Process Rule, Sec. 6(b)(2). If the 0.3 quad threshold is not met, DOE then compares the max-tech savings to the total energy usage of the covered product to calculate a percentage reduction in energy usage. Process Rule, Sec. 6(b)(3). If this comparison does not yield a reduction in site energy use of at least 10 percent over a 30-year period, the analysis will end and DOE will propose to determine that no significant energy savings would likely result from setting new or amended standards. Process Rule, Sec. 6(b)(4). If either one of the thresholds is reached, DOE will conduct analyses to ascertain whether a standard can be prescribed that produces the maximum improvement in energy efficiency that is both technologically feasible and economically justified and still constitutes significant energy savings at the level determined to be economically justified. Process Rule, Sec. 6(b)(5). This two-step approach currently serves as the means for enabling DOE to help ensure it avoids setting a standard that “will not result in significant conservation of energy.” (42 U.S.C. 6295(o)(3)(B))

EPCA defines “energy efficiency” as the ratio of the useful output of services from a consumer product to the energy use of such product, measured according to the Federal test procedures. (42 U.S.C. 6291(5), emphasis added ) EPCA defines “energy use” as the quantity of energy directly consumed by a consumer product at point of use, as measured by the Federal test procedures. (42 U.S.C. 6291(4)) Further, EPCA uses a household energy consumption metric as a threshold for setting standards for newly covered products. See 42 U.S.C. 6295(l)(1). See also 42 U.S.C. 6292(b) (authorizing the Secretary to classify a type of consumer product as a covered product provided certain criteria are met). Given this context, DOE relies on site energy as the appropriate metric for evaluating the significance of energy savings.

To determine whether a standard is economically justified, EPCA requires that DOE determine whether the benefits of the standard exceed its burdens by considering, to the greatest extent practicable, the following seven factors:

DOE fulfills these and other applicable requirements by conducting a series of analyses throughout the rulemaking process. Table I.1 shows the individual analyses that are performed to satisfy each of the requirements within EPCA.

Further, EPCA establishes a rebuttable presumption that a standard is economically justified if the Secretary finds that the additional cost to the consumer of purchasing a product complying with an energy conservation standard level will be less than three times the value of the energy savings during the first year that the consumer will receive as a result of the standard, as calculated under the applicable test procedure. (42 U.S.C. 6295(o)(2)(B)(iii))

EPCA also contains what is known as an “anti-backsliding” provision, which prevents the Secretary from prescribing any amended standard that either increases the maximum allowable energy use or decreases the minimum required energy efficiency of a covered product. (42 U.S.C. 6295(o)(1)) Also, the Secretary may not prescribe an amended or new standard if interested persons have established by a preponderance of the evidence that the standard is likely to result in the unavailability in the United States in any covered product type (or class) of performance characteristics (including reliability), features, sizes, capacities, and volumes that are substantially the same as those generally available in the United States. (42 U.S.C. 6295(o)(4))

Additionally, EPCA specifies requirements when promulgating an energy conservation standard for a covered product that has two or more subcategories. DOE must specify a different standard level for a type or class of product that has the same function or intended use, if DOE determines that products within such group: (A) Consume a different kind of energy from that consumed by other covered products within such type (or class); or (B) have a capacity or other performance-related feature which other products within such type (or class) do not have and such feature justifies a higher or lower standard. (42 U.S.C. 6295(q)(1)) In determining whether a performance-related feature justifies a different standard for a group of products, DOE must consider such factors as the utility to the consumer of the feature and other factors DOE deems appropriate. Id. Any rule prescribing such a standard must include an explanation of the basis on which such higher or lower level was established. (42 U.S.C. 6295(q)(2))

Finally, pursuant to the amendments contained in the Energy Independence and Security Act of 2007 (“EISA 2007”), Public Law 110-140, any final rule for new or amended energy conservation standards promulgated after July 1, 2010, is required to address standby mode and off mode energy use. (42 U.S.C. 6295(gg)(3)) Specifically, when DOE adopts a standard for a covered product after that date, it must, if justified by the criteria for adoption of standards under EPCA (42 U.S.C. 6295(o)), incorporate standby mode and off mode energy use into a single standard, or, if that is not feasible, adopt a separate standard for such energy use for that product. (42 U.S.C. 6295(gg)(3)(A)-(B)) DOE's current test procedures for refrigerators, refrigerator-freezers, and freezers measure the energy use of these products during extended time periods that include periods when the compressor and other key components are cycled off. All of the energy these products use during the “off cycles” is already included in the measurements. By measuring the energy use during “off cycles,” the current test procedures already address EPCA's requirement to include standby mode and off mode energy consumption in the overall energy descriptor. As a result, DOE's current energy conservation standards and any amended energy conservation standards would account for such energy use.

Before proposing a standard, DOE seeks public input on the analytical framework, models, and tools that DOE intends to use to evaluate standards for the product at issue and the results of the preliminary analyses DOE performed for the product.

DOE is examining whether to amend the current standards pursuant to its obligations under EPCA. This document announces the availability of the preliminary technical support document (“TSD”), which details the preliminary analyses and summarizes the preliminary results of DOE's analyses. In addition, DOE is announcing a public meeting to solicit feedback from interested parties on its analytical framework, models, and preliminary results.

In a final rule published on September 15, 2011 (“September 2011 Final Rule”), DOE prescribed the current energy conservation standards for refrigerators, refrigerator-freezers, and freezers manufactured on and after September 15, 2014. 76 FR 57516. These standards are set forth in DOE's regulations at 10 CFR part 430, section 32(a) and are repeated in Table II.1.

On November 15, 2019, DOE published a request for information (“RFI”) to collect data and information to help DOE determine whether amended standards for refrigerators, refrigerator-freezers, and freezers would result in a significant amount of additional energy savings and whether those standards would be technologically feasible and economically justified. 84 FR 62470 (“November 2019 RFI”).

Comments received to date as part of the current process have helped DOE identify and resolve issues related to the preliminary analyses. Chapter 2 of the preliminary TSD summarizes and addresses the comments received.

For the products covered in this preliminary analysis, DOE conducted in-depth technical analyses in the following areas: (1) Engineering; (2) markups to determine product price; (3) energy use; (4) life cycle cost (“LCC”) and payback period (“PBP”); and (5) national impacts. The preliminary TSD that presents the methodology and results of each of these analyses is available at www.regulations.gov/docket/EERE-2017-BT-STD-0003.

DOE also conducted, and has included in the preliminary TSD, several other analyses that support the major analyses or are preliminary analyses that will be expanded if DOE determines that a NOPR is warranted to propose amended energy conservation standards. These analyses include: (1) The market and technology assessment; (2) the screening analysis, which contributes to the engineering analysis; and (3) the shipments analysis, which contributes to the LCC and PBP analysis and the national impact analysis (“NIA”). In addition to these analyses, DOE has begun preliminary work on the manufacturer impact analysis and has identified the methods to be used for the consumer subgroup analysis, the emissions analysis, the employment impact analysis, the regulatory impact analysis, and the utility impact analysis. DOE will expand on these analyses in the NOPR should one be issued.

The purpose of the engineering analysis is to establish the relationship between the efficiency and cost of refrigerators, refrigerator-freezers, and freezers. There are two elements to consider in the engineering analysis; the selection of efficiency levels to analyze ( i.e., the “efficiency analysis”) and the determination of product cost at each efficiency level ( i.e., the “cost analysis”). In determining the performance of higher-efficiency products, DOE considers technologies and design option combinations not eliminated by the screening analysis. For each product class, DOE estimates the baseline cost, as well as the incremental cost for the product/equipment at efficiency levels above the baseline. The output of the engineering analysis is a set of cost-efficiency “curves” that are used in downstream analyses ( i.e., the LCC and PBP analyses and the NIA).

See Chapter 5 of the preliminary TSD for additional detail on the engineering analysis.

The markups analysis develops appropriate markups ( e.g., retailer markups, distributor markups, contractor markups) in the distribution chain and sales taxes to convert manufacturer production cost (“MPC”) estimates derived in the engineering analysis to consumer prices, which are then used in the LCC and PBP analysis and in the manufacturer impact analysis. At each step in the distribution channel, companies mark up the price of the product to cover business costs and profit margin.

DOE developed baseline and incremental markups for each actor in the distribution chain. Baseline markups are applied to the price of products with baseline efficiency, while incremental markups are applied to the difference in price between baseline and higher-efficiency models (the incremental cost increase). The incremental markup is typically less than the baseline markup and is designed to maintain similar per-unit operating profit before and after new or amended standards. 5

Chapter 6 of the preliminary TSD provides details on DOE's development of markups for refrigerators, refrigerator-freezers, and freezers.

The purpose of the energy use analysis is to determine the annual energy consumption of refrigerators, refrigerator-freezers, and freezers at different efficiencies in representative U.S. single-family homes, multi-family residences, and commercial buildings, and to assess the energy savings potential of increased efficiencies for these products. The energy use analysis estimates the range of energy use of refrigerators, refrigerator-freezers, and freezers in the field ( i.e., as they are actually used by consumers). The energy use analysis provides the basis for other analyses DOE performed, particularly assessments of the energy savings and the savings in consumer operating costs that could result from adoption of amended or new standards.

Chapter 7 of the preliminary TSD addresses the energy use analysis.

The effect of new or amended energy conservation standards on individual consumers usually involves a reduction in operating cost and an increase in purchase cost. DOE used the following two metrics to measure consumer impacts:

• The LCC is the total consumer expense of an appliance or product over the life of that product, consisting of total installed cost (manufacturer selling price, distribution chain markups, sales tax, and installation costs) plus operating costs (expenses for energy use, maintenance, and repair). To compute the operating costs, DOE discounts future operating costs to the time of purchase and sums them over the lifetime of the product.

• The PBP is the estimated amount of time (in years) it takes consumers to recover the increased purchase cost (including installation) of a more-efficient product through lower operating costs. DOE calculates the PBP by dividing the change in purchase cost at higher efficiency levels by the change in annual operating cost for the year that amended or new standards are assumed to take effect.

Chapter 8 of the preliminary TSD addresses the LCC and PBP analyses.

The NIA estimates the national energy savings (“NES”) and the net present value (“NPV”) of total consumer costs and savings expected to result from amended standards at specific efficiency levels (referred to as candidate standard levels). 6 DOE calculates the NES and NPV for the potential standard levels considered based on projections of annual product shipments, along with the annual energy consumption and total installed cost data from the energy use and LCC analyses. For the present analysis, DOE projected the energy savings, operating cost savings, product costs, and NPV of consumer benefits over the lifetime of refrigerators, refrigerator-freezers, and freezers sold from 2027 through 2056.

DOE evaluates the impacts of new or amended standards by comparing a case without such standards with standards-case projections. The no-new-standards case characterizes energy use and consumer costs for each product class in the absence of new or amended energy conservation standards. For this projection, DOE considers historical trends in efficiency and various forces that are likely to affect the mix of efficiencies over time. DOE compares the no-new-standards case with projections characterizing the market for each product class if DOE adopted new or amended standards at specific energy efficiency levels for that class. For each efficiency level, DOE considers how a given standard would likely affect the market shares of those products with efficiencies greater than the standard.

DOE uses a spreadsheet model to calculate the energy savings and the national consumer costs and savings from each efficiency level. Interested parties can review DOE's analyses by changing various input quantities within the spreadsheet. The NIA spreadsheet model uses typical values (as opposed to probability distributions) as inputs. Critical inputs to this analysis include shipments projections, estimated product lifetimes, product installed costs and operating costs, product annual energy consumption, the base case efficiency projection, and discount rates.

DOE estimates a combined total of 3.34 quads of site energy savings would result at the max-tech efficiency levels for refrigerators, refrigerator-freezers, and freezers. Combined site energy savings at Efficiency Level 1 for all product classes are estimated to be 1.01 quads. Therefore, DOE has determined that the potential available energy savings for refrigerators, refrigerator-freezers, and freezers are more than the 0.3 quads of site energy threshold established by the Process Rule and thus are considered significant under EPCA. (42 U.S.C. 6295(o)(3)(B))

Chapter 10 of the preliminary TSD addresses the NIA.

DOE invites public participation in this process through participation in the webinar and submission of written comments and information. After the webinar and the closing of the comment period, DOE will consider all timely-submitted comments and additional information obtained from interested parties, as well as information obtained through further analyses. Following such consideration, the Department will publish either a determination that the standards for refrigerators, refrigerator-freezers, and freezers need not be amended or a NOPR proposing to amend those standards. The NOPR, should one be issued, would include proposed energy conservation standards for the products covered by that rulemaking, and members of the public would be given an opportunity to submit written and oral comments on the proposed standards.

The time and date for the webinar meeting are listed in the DATES section at the beginning of this document. Webinar registration information, participant instructions, and information about the capabilities available to webinar participants will be published on DOE's website: www.energy.gov/eere/buildings/public-meetings-and-comment-deadlines. Participants are responsible for ensuring their systems are compatible with the webinar software.

Any person who has an interest in the topics addressed in this notice, or who is representative of a group or class of persons that has an interest in these issues, may request an opportunity to make an oral presentation at the webinar. Such persons may submit such request to ApplianceStandardsQuestions@ee.doe.gov. Persons who wish to speak should include with their request a computer file in WordPerfect, Microsoft Word, PDF, or text (ASCII) file format that briefly describes the nature of their interest in this rulemaking and the topics they wish to discuss. Such persons should also provide a daytime telephone number where they can be reached.

Persons requesting to speak should briefly describe the nature of their interest in this rulemaking and provide a telephone number for contact. DOE requests persons selected to make an oral presentation to submit an advance copy of their statements at least two weeks before the webinar. At its discretion, DOE may permit persons who cannot supply an advance copy of their statement to participate, if those persons have made advance alternative arrangements with the Building Technologies Office. As necessary, requests to give an oral presentation should ask for such alternative arrangements.

DOE will designate a DOE official to preside at the webinar and may also use a professional facilitator to aid discussion. The meeting will not be a judicial or evidentiary-type public hearing, but DOE will conduct it in accordance with section 336 of EPCA (42 U.S.C. 6306). A court reporter will be present to record the proceedings and prepare a transcript. DOE reserves the right to schedule the order of presentations and to establish the procedures governing the conduct of the webinar. There shall not be discussion of proprietary information, costs or prices, market share, or other commercial matters regulated by U.S. anti-trust laws. After the webinar and until the end of the comment period, interested parties may submit further comments on the proceedings and any aspect of the rulemaking.

The webinar will be conducted in an informal, conference style. DOE will present summaries of comments received before the webinar, allow time for prepared general statements by participants, and encourage all interested parties to share their views on issues affecting this rulemaking. Each participant will be allowed to make a general statement (within time limits determined by DOE), before the discussion of specific topics. DOE will permit, as time permits, other participants to comment briefly on any general statements.

At the end of all prepared statements on a topic, DOE will permit participants to clarify their statements briefly. Participants should be prepared to answer questions by DOE and by other participants concerning these issues. DOE representatives may also ask questions of participants concerning other matters relevant to this rulemaking. The official conducting the webinar/public meeting will accept additional comments or questions from those attending, as time permits. The presiding official will announce any further procedural rules or modification of the above procedures that may be needed for the proper conduct of the webinar.

A transcript of the webinar will be included in the docket, which can be viewed as described in the Docket section at the beginning of this notice. In addition, any person may buy a copy of the transcript from the transcribing reporter.

DOE invites all interested parties, regardless of whether they participate in the public meeting, to submit in writing by December 29, 2021, comments and information on matters addressed in this notification and on other matters relevant to DOE's consideration of amended energy conservations standards for refrigerators, refrigerator-freezers, and freezers. Interested parties may submit comments, data, and other information using any of the methods described in the ADDRESSES section at the beginning of this document.

Submitting comments via www.regulations.gov. The www.regulations.gov web page will require you to provide your name and contact information. Your contact information will be viewable to DOE Building Technologies staff only. Your contact information will not be publicly viewable except for your first and last names, organization name (if any), and submitter representative name (if any). If your comment is not processed properly because of technical difficulties, DOE will use this information to contact you. If DOE cannot read your comment due to technical difficulties and cannot contact you for clarification, DOE may not be able to consider your comment.

However, your contact information will be publicly viewable if you include it in the comment itself or in any documents attached to your comment. Any information that you do not want to be publicly viewable should not be included in your comment, nor in any document attached to your comment. If this instruction is followed, persons viewing comments will see only first and last names, organization names, correspondence containing comments, and any documents submitted with the comments.

Do not submit to www.regulations.gov. information for which disclosure is restricted by statute, such as trade secrets and commercial or financial information (hereinafter referred to as Confidential Business Information (CBI). Comments submitted through www.regulations.gov cannot be claimed as CBI. Comments received through the website will waive any CBI claims for the information submitted. For information on submitting CBI, see the Confidential Business Information section.

DOE processes submissions made through www.regulations.gov before posting. Normally, comments will be posted within a few days of being submitted. However, if large volumes of comments are being processed simultaneously, your comment may not be viewable for up to several weeks. Please keep the comment tracking number that www.regulations.gov provides after you have successfully uploaded your comment.

Submitting comments via email. Comments and documents submitted via email also will be posted to www.regulations.gov. If you do not want your personal contact information to be publicly viewable, do not include it in your comment or any accompanying documents. Instead, provide your contact information in a cover letter. Include your first and last names, email address, telephone number, and optional mailing address. The cover letter will not be publicly viewable as long as it does not include any comments.

Include contact information each time you submit comments, data, documents, and other information to DOE. No faxes will be accepted.

Comments, data, and other information submitted to DOE electronically should be provided in PDF (preferred), Microsoft Word or Excel, WordPerfect, or text (ASCII) file format. Provide documents that are not secured, that are written in English, and that are free of any defects or viruses. Documents should not contain special characters or any form of encryption and, if possible, they should carry the electronic signature of the author.

Campaign form letters. Please submit campaign form letters by the originating organization in batches of between 50 to 500 form letters per PDF or as one form letter with a list of supporters' names compiled into one or more PDFs. This reduces comment processing and posting time.

Confidential Business Information. Pursuant to 10 CFR 1004.11, any person submitting information that he or she believes to be confidential and exempt by law from public disclosure should submit via email two well-marked copies: One copy of the document marked “confidential” including all the information believed to be confidential, and one copy of the document marked “non-confidential” with the information believed to be confidential deleted. DOE will make its own determination about the confidential status of the information and treat it according to its determination.

It is DOE's policy that all comments may be included in the public docket, without change and as received, including any personal information provided in the comments (except information deemed to be exempt from public disclosure).

The Secretary of Energy has approved publication of this notification of a webinar and availability of preliminary technical support document.

This document of the Department of Energy was signed on October 7, 2021, by Kelly Speakes-Backman, Principal Deputy Assistant Secretary and Acting Assistant Secretary for Energy Efficiency and Renewable Energy, pursuant to delegated authority from the Secretary of Energy. That document with the original signature and date is maintained by DOE. For administrative purposes only, and in compliance with requirements of the Office of the Federal Register, the undersigned DOE Federal Register Liaison Officer has been authorized to sign and submit the document in electronic format for publication, as an official document of the Department of Energy. This administrative process in no way alters the legal effect of this document upon publication in the Federal Register .

Pursuant to 39 U.S.C. 3652(e), the Commission is establishing this proceeding to consider possible improvements to the quality, accuracy, or completeness of data provided by the Postal Service in its annual compliance reports. 1

This is the second such proceeding initiated by the Commission. 2 In the first proceeding, the Commission identified four study areas as near-term priorities for further research. 3 Those four study areas were: The reestimation of volume variability of city carrier street time; the recalculation of the cost elasticity of purchased highway transportation capacity; the recalculation of postmaster cost variability; and the reestimation of product shares of window service costs. 4

Two of the four study areas produced changes to the analytical principles being used by the Postal Service. The first of those changes involved city carrier street time and consisted of an update of the city carrier letter route street time model. 5 The second change involved purchased highway transportation and consisted of an update of the estimated variabilities of purchased highway transportation costs. 6 By the time Docket No. RM2011-3 was closed, two of the study areas (those involving postmaster cost variabilities and window service costs) had produced no changes to existing analytical principles. 7

On May 31, 2017, the Commission established Docket No. PI2017-1 to evaluate the Postal Service's progress in its ongoing efforts to update its city carrier cost models and data collection capabilities. 8 The proceedings in this docket focused on the feasibility of a top-down, single-equation model to improve the Postal Service's variability estimates of city carrier cost drivers. On November 2, 2018, the Commission issued an interim order directing the Postal Service to provide an expanded dataset of city carrier delivery data and to report quarterly on the status of developing the expanded dataset. 9 On February 27, 2020, the Postal Service filed its fifth and final report on the status of its efforts to develop an expanded data set. 10 On March 1, 2021, Docket No. PI2017-1 was closed. 11

While Docket No. PI2017-1 was pending, the Commission considered several Postal Service proposals to change various accepted analytical principles related to city carrier costing:

Docket No. RM2017-8. On December 1, 2017, the Commission approved a Postal Service proposal to establish a procedure for annually updating the estimated proportion of city carrier letter route time spent delivering parcels. 12

Docket No. RM2017-9. On February 6, 2018, the Commission approved a modified version of a Postal Service proposal to update the methodology for dividing accrued city carrier costs between the letter route and special purpose route groups in the In-Office Cost System (IOCS). 13

Docket No. RM2017-13. On December 15, 2017, the Commission approved a Postal Service proposal to change the current City Carrier Cost System methodology for estimating Delivery Point Sequence volume proportions. 14

Docket No. RM2018-5. On January 8, 2019, the Commission approved the use of workhours from the Postal Service's Time and Attendance Collection System (TACS) to develop Sunday and holiday city carrier costs and the use of the Postal Service's Product Tracking and Reporting scan data as a distribution key for Sunday/holiday city carrier costs and the city carrier sampling mode 2 (morning readings in small zones). 15 However, the Commission denied the proposed city carrier supervisor methodology component of Proposal Two because the completeness of the overall city carrier supervisor data would likely not be improved. Order No. 4972 at 26-29. The Commission also denied the city carrier afternoon readings and morning readings in large zones because it was unable to determine the impact of these changes. Id. at 18-23.

Docket No. RM2019-6. On January 14, 2020, the Commission approved, with modifications, a Postal Service proposal to update and improve the methodology for calculating attributable Special Purpose Route (SPR) city carrier costs. 16 This was to be accomplished through “a new study of SPR costs that uses operational carrier data to reflect the current structure of SPR activities.” Id. at 1-2 (footnote omitted).

Docket No. RM2020-7. On July 9, 2020, the Commission approved a Postal Service proposal for updating city carrier regular letter and flat street delivery time variabilities annually to reflect changes in the relative volumes of letter and flat mail. 17

Docket No. RM2020-9. On May 29, 2020, United Parcel Service, Inc. (UPS) filed a petition requesting the Commission to initiate a proceeding to change how the Postal Service determines incremental costs and how it accounts for peak-season costs in its periodic reports. 18 UPS alleges that the Postal Service's current costing models for City Carrier Street Time, SPRs, and Highway Transportation do not fully account for the increase in peak-season costs driven by package shipments. 19 On July 13, 2020, the Commission instituted a proceeding to consider UPS's allegations. 20 That proceeding is pending before the Commission.

Docket No. RM2021-7. On September 30, 2021, the Commission approved a Postal Service proposal to replace the system used to distribute delivery costs for SPRs with a revised system, the Special Purpose Carrier Cost System (SPCCS), which replaces manual sampling with Product Tracking and Reporting (PTR) scan data. 21 The Commission found that the proposal would improve the accuracy of data, reduce data collection costs, and allow the Postal Service to develop separate distribution factors for peak and non-peak periods and to separate estimates by carrier subcategory. Order No. 5991 at 15.

Since the conclusion of Docket No. RM2011-3, the Commission has considered several proposals for changes to the methodology for calculating purchased highway transportation costs:

Docket No. RM2016-12. On June 22, 2017 the Commission accepted, in part, a Postal Service proposal that uses a newly developed econometric model to calculate the variability of purchased highway transportation capacity with respect to volume. 22 The Commission found that, in general, the Transportation Cost System (TRACS) database provides a reliable source for estimating capacity-to-volume variabilities of purchased highway transportation. Order No. 3973 at 12-15. However, the Commission concluded that the TRACS database is not suitable for the proposed variability analysis for Christmas and emergency routes and therefore instructed the Postal Service to continue applying the current assumption regarding proportionality between capacity and volume pending further research. Id. at 16-19.

Docket No. RM2021-1. Subject to a minor modification, the Commission on October 6, 2021, approved the Postal Service's proposed update of econometric estimates of variabilities for specific types of purchased highway transportation as an improvement over estimated variabilities produced by the current methodology. 23 The Commission also urged the Postal Service to econometrically estimate peak-season capacity-to-volume variabilities;  24 to conduct research on distribution keys for peak-season costs;  25 and to address certain mistakes and discrepancies in the Postal Service's initial data analysis. Id. at 39-40.

Docket No. RM2020-2. In this proceeding, the Commission denied a Postal Service request to implement a new model to calculate Postmaster cost variability. 26 The Commission made suggestions as to how this proposal could be improved and possibly accepted in the future. Order No. 5932 at 47-49.

Docket No. RM2011-3. In closing this docket, the Commission determined that it was prudent to delay consideration of this study area until the Postal Service's POStPlan had been fully implemented because it might materially impact the volume variability of window costs. See Order No. 2798. Although POStPlan has been implemented, the Postal Service has taken no further action to investigate Window Service Time or Window Service Costs.

Docket No. RM2020-1. On August 17, 2020, the Commission approved a Postal Service proposal to update inputs into the analysis used for the allocation of facility-related costs to products. 27 Proposal Nine was based on a new Facility Space Usage Study (FSUS) conducted in 2018 and 2019. The prior methodology had relied upon data from a FSUS conducted in 1999 and presented in Docket No. R2005-1. Order No. 5637 at 2.

Docket No. RM2019-12. In this proceeding, the Commission approved a Postal Service proposal to use TACS data to determine the share of costs for supervisors at delivery units on Sundays and holidays and then distribute those costs using the same distribution key used for city carriers delivering packages on Sundays and holidays. 28

Docket No. RM2020-13. In this docket, the Postal Service proposes to establish a new methodology to determine the volume variability factors for the mail processing cost pools representing automated letter and flat sorting operations. 29 This proceeding is currently pending before the Commission.

In Order No. 589, the Commission adopted the approach described in Docket No. RM2008-4 for assuring that appropriate changes or additions would be made to the methods for collecting and reporting data and for analyzing or modeling data to develop the estimates reported to the Commission under section 3652. 30 Under that approach, a strategic rulemaking would consider longer-term data collection and analysis needs and could focus on updating existing data collection systems or analytical studies or establishing new ones. Order No. 104 at 32-33. Additionally, a strategic rulemaking would be exploratory in nature, with potential prehearing conferences and flexible procedures. Id.

In this proceeding, the Commission will once again develop an inventory of data collection and analysis needs, comprehensively evaluate these needs, and devise a plan for meeting these needs, with input from mailers, the interested public, the Postal Service and Commission staff. Id. At a time when the Postal Service remains under considerable financial pressure, it continues to be important to have accurate estimates of product costs in order to understand the net revenue consequences of the rates and discounts that the Postal Service selects.

For a publicly-owned entity like the Postal Service, changes to the level and quality of the business information that guides its operations should be based on understanding among the Postal Service, its stakeholders, and the regulator, about the need for, and the value of the changes. The Commission hopes that the postal community will weigh both the costs and benefits of any proposed changes and provide input on what improvements in data collection and analysis warrant attention in the near term and what improvements would be warranted over a longer time horizon. Of those that are considered to be warranted over the near term, comments are requested concerning which research topics should be given priority, and what time frame should be considered feasible for completing the research.

Interested persons may propose areas of research that they think are needed, and may use the list of possible candidates in this Order as a starting point. In doing so, they should consider the magnitude of the candidate's potential impact on estimated volumes, costs or revenues; the time and expense likely to be required to resolve it; and its potential relevance to determining compliance with the standards of the PAEA or supporting the various studies and reports that the PAEA requires the Commission to prepare.

Following the submission of initial comments, the Commission will select an appropriate time to host a public forum. The public forum will function as a technical conference. Subject matter experts from the Postal Service, interested participants, and Commission staff will have an opportunity to interactively discuss matters, such as feasibility and cost, which would bear on the priority that should be assigned to the various research topics that are in need of further study. Proposed modifications to the list of topics and tentative prioritization of them will be addressed at the forum. Participants at the public forum may also discuss a protocol whereby the Postal Service or outside contractor conducting a study growing out of this proceeding would afford an opportunity for outside review and input at interim stages. Additional technical conferences may be scheduled to discuss a particular research item or set of items in greater depth. The Commission intends to permit interested persons to participate in any technical conference held in this proceeding using a virtual meeting platform.

The Commission will balance the urgency and importance of resolving each issue with the practical considerations of time, cost, and other resource limitations. A schedule with target dates for beginning data collection efforts or completing an initial group of analytical studies will be developed. Formal proposals to change or supplement current analytical principles are expected to grow out of the research completed in response to this proceeding. Such proposals will be vetted as they are now in informal rulemakings devoted to specific detailed changes.

It is ordered:

1. Initial comments are due on or before March 25, 2022.

2. Pursuant to 39 U.S.C. 505, Katalin K. Clendenin is designated as the Public Representative in this proceeding to represent the interests of the general public.

3. The Secretary shall arrange for publication of this order in the Federal Register .

Throughout this document wherever “we,” “us,” or “our” is used, we mean the EPA.

Ozone is a gas that is formed by the reaction of Volatile Organic Compounds (VOC) and Oxides of Nitrogen (NO X ) in the atmosphere in the presence of sunlight. Therefore, an emission inventory for ozone focuses on the emissions of VOC and NO X referred to as ozone precursors. These precursors (VOC and NO X ) are emitted by many types of pollution sources, including point sources such as power plants and industrial emissions sources; on-road and off-road mobile sources (motor vehicles and engines); and smaller residential and commercial sources, such as dry cleaners, auto body shops, and household paints, collectively referred to as nonpoint sources (also called area sources).

On October 1, 2015 the EPA revised both the primary and secondary NAAQS  1 for ozone from concentration level of 0.075 part per million (ppm) to 0.070 ppm to provide increased protection of public health and the environment (80 FR 65296, October 26, 2015). The 2015 8-hour ozone NAAQS retains the same general form and averaging time as the 0.075 ppm NAAQS set in 2008 NAAQS but is set at a more protective level. Specifically, the 2015 8-hour ozone NAAQS is attained when the 3-year average of the annual fourth-highest daily maximum 8-hour average ambient air quality ozone concentrations is less than or equal to 0.07 ppm. 2

On March 9, 2018 (83 FR 10376), the EPA published the Classifications Rule that establishes how the statutory classifications will apply for the 2015 8-hr ozone NAAQS, including the air quality thresholds for each classification category and attainment deadline associated with each classification.

On June 18, 2018, the EPA classified the Sunland Park area in southern Doña Ana County, New Mexico as marginal nonattainment area for 2015 ozone NAAQS with an attainment deadline of August 3, 2021. ( See 83 FR 25776).

An emission inventory of ozone is an estimation of actual emissions of air pollutants that contribute to the formation of ozone in an area. The emissions inventory provides emissions data for a variety of air quality planning tasks, including establishing baseline emission levels for calculating emission reduction targets needed to attain the NAAQS, determining emission inputs for ozone air quality modeling analyses, and tracking emissions over time to determine progress toward meeting Reasonable Further Progress (RFP) requirements.

CAA section 182(a)(1) and 40 CFR 51.1315(b) require states to submit a “base year inventory” for each ozone nonattainment area within two years of the effective date of designation. This inventory must be “a comprehensive, accurate, current inventory of actual emissions from sources of VOC and NO X emitted within the boundaries of the nonattainment area as required by CAA section 182(a)(1)” (40 CFR 51.1300(p), see also CAA section 172(c)(3). In addition, 40 CFR 51.1310(b) requires that the inventory year be selected consistent with the baseline year for the RFP plan, which is usually the most recent calendar year for which a complete triennial emissions inventory is required to be submitted to the EPA under the Air Emissions Reporting Requirements (AAER) (40 CFR part 51, subpart A).

Section 182(a)(3)(B) of the CAA requires states with ozone nonattainment areas to submit revisions to their SIP to require the owner or operator of each major stationary source of NO X or VOC to provide the state with annual statement documenting the actual emissions of NO X and VOC from their sources. For nonattainment areas, air agencies must develop, and include in their SIPs, emission reporting programs for certain VOC and NO X sources in accordance with CAA section 182(a)(3)(B). The required state program defines how air agencies obtain emissions data directly from certain facilities, and these data, along with other information, are then reported to the EPA as part of SIP inventories required under CAA sections 182(a)(1) and 182(a)(3)(A). This state program is generally referred to as an emissions statement regulation, and it outlines how certain facilities must report emissions and facility activity data to an air agency, typically a state agency. Reports submitted to air agencies must be accompanied by “a certification that the information contained” in the report is “accurate to the best knowledge” of the facility. To properly implement the emissions reporting requirements, emissions statement regulations should be coordinated carefully with the data elements that are required by the EPA (requirements at 40 CFR 51.1115 and 40 CFR 51.1315). An air agency must submit the emissions statement regulation required by CAA section 182(a)(3)(B), or a written statement certifying a previously approved regulation, to the EPA as a SIP revision for approval. CAA section 110, in conjunction with 40 CFR 51.102, 51.103 and Appendix V, establishes the procedure for submitting a SIP revision. Under section 182(a)(3)(B)(ii), air agencies may waive the requirement for emission statements for classes or categories of sources with less than 25 ton per year of actual plant-wide NO X or VOC emissions in nonattainment areas, provided the class or category is included in the base year and periodic inventories required under CAA sections 182(a)(1) and 182(a)(3)(A), respectively. 3

On September 10, 2020, New Mexico  4 5 submitted to EPA a SIP revision addressing the 2015 ozone NAAQS emissions inventory and emissions statement requirements for the Sunland Park nonattainment area.

New Mexico Environmental Department (NMED) has developed a 2017 base year emissions inventory for the Sunland Park nonattainment area. The 2017 base year emissions include all point, nonpoint (area), on-road mobile, and non-road mobile source emissions. Table 1 summarizes the 2017 NO X and VOC emissions for the Sunland Park nonattainment area for a typical ozone season day  6 (reflective of the summer period, when the highest ozone concentrations are expected in the ozone nonattainment areas).

Pursuant to section 182(a)(3)(B), states with ozone nonattainment areas must require annual emissions statements from NO X and VOC stationary sources within those nonattainment areas. New Mexico's emissions statement regulation resides in New Mexico's SIP at 20.2.73 New Mexico Administrative Code (NMAC), “Notice of Intent and Emissions Inventory Requirements”, approved by EPA on November 27, 2012 (77 FR 70693). Emission Inventory Requirements, section 20.2.73.300(A) NMAC applies to all stationary sources in an ozone nonattainment area that have a construction permit, filed a notice of intent, or emits more than ten tons per year (tpy) of nitrogen oxides (NO X ) or volatile organic compounds (VOC). Reporting requirements (20.2.73.300(B) NMAC) include annual emissions reports for any major source in ozone nonattainment area with potential to emit more than 100 tpy and any source that has the potential to emit more than 25 tpy of NO X and VOC within the nonattainment area submitted by April 1 of each year or a date set by permit conditions. Sources that emit between 10-25 tpy must keep annual emissions records and provide them in an approved format upon request from the department. Emissions reports must contain all contact and facility information along with a signed certifying statement from the certifying official authorized to attest to the accuracy and validity of the emissions submitted on behalf of the facility as required by New Mexico's regulations (20.2.73.300(C) NMAC). Additional reporting requirements for sources within nonattainment area are included in (20.2.73.300(D) NMAC) include typical daily process rates for the ozone season as determined by NMED. Waiver exemption of emissions reporting requirements are included (20.2.73.300(E) NMAC).

EPA has reviewed the New Mexico SIP revision for consistency with the CAA and regulatory emissions inventory and emissions statement requirements.

For the emission inventory, EPA has reviewed the techniques used by the state of New Mexico to derive and quality assure the emission estimates. EPA has also evaluated whether New Mexico provided the public with the opportunity to review and comment on the development of the emission estimates and whether New Mexico addressed the public comments. A summary of EPA's analysis is provided below. For a full discussion for our evaluation, please see our Technical Support Document (TSD) located in the docket for this action.

New Mexico documented the general procedures used to estimate the emissions for each of the four major source types. The documentation of the emission estimation procedures was adequate for us to determine that New Mexico followed acceptable procedures to estimate the emissions.

New Mexico developed a quality assurance plan and followed this plan during various phases of the emissions estimation and documentation process to quality assure the emissions for completeness and accuracy. These quality assurance procedures are summarized in the documentation describing how the emissions totals were developed. We have determined that the quality assurance procedures followed by New Mexico are adequate and acceptable and that New Mexico has developed inventories of VOC and NO X emissions that are comprehensive and complete.

For the emission statement, New Mexico's EPA approved SIP contains provisions that address the CAA emission statement requirements.

New Mexico notified the public and offered the opportunity for comment and public hearing. A full record of public notices, and written comments received during public comment period as well as states' response to those comments are included in the state's submittal. New Mexico received no request for public hearing. A copy of the New Mexico SIP revision submittal is available online at www.regulations.gov, Docket number EPA-R06-OAR-2020-0167.

We are proposing to approve the New Mexico SIP revision submitted on September 10, 2020 to address the emissions inventory, and emissions statement requirements for the Sunland Park area for the 2015 ozone NAAQS. The emissions inventory we are proposing to approve are listed in Table 1 above. We are proposing to approve the emissions inventory because it contains comprehensive, accurate and current inventory of actual emissions for all relevant sources in accordance with CAA sections 172(c)(3) and 182(a)(1) requirements. We are proposing to approve the New Mexico emission statement because it includes the approved provision addressing CAA emission statement requirement in CAA section 182(a)(3)(B). New Mexico adopted the emission inventories consistent with reasonable public notice and opportunity for a public hearing requirement. As stated above, a TSD which details our evaluation is included in the docket for this action. Our TSD may be accessed online at www.regulations.gov, Docket No. EPA-R06-OAR-2020-0167.

Under the CAA, the Administrator is required to approve a SIP submission that complies with the provisions of the Act and applicable Federal regulations. 42 U.S.C. 7410(k); 40 CFR 52.02(a). Thus, in reviewing SIP submissions, the EPA's role is to approve state choices, provided that they meet the criteria of the CAA. Accordingly, this action merely proposes to approve state law as meeting Federal requirements and does not impose additional requirements beyond those imposed by state law. For that reason, this action:

• Is not a “significant regulatory action” subject to review by the Office of Management and Budget under Executive Orders 12866 (58 FR 51735, October 4, 1993) and 13563 (76 FR 3821, January 21, 2011);

• Does not impose an information collection burden under the provisions of the Paperwork Reduction Act (44 U.S.C. 3501 et seq. );

• Is certified as not having a significant economic impact on a substantial number of small entities under the Regulatory Flexibility Act (5 U.S.C. 601 et seq. );

• Does not contain any unfunded mandate or significantly or uniquely affect small governments, as described in the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4);

• Does not have federalism implications as specified in Executive Order 13132 (64 FR 43255, August 10, 1999);

• Is not an economically significant regulatory action based on health or safety risks subject to Executive Order 13045 (62 FR 19885, April 23, 1997);

• Is not a significant regulatory action subject to Executive Order 13211 (66 FR 28355, May 22, 2001);

• Is not subject to requirements of section 12(d) of the National Technology Transfer and Advancement Act of 1995 (15 U.S.C. 272 note) because application of those requirements would be inconsistent with the CAA; and

• Does not provide EPA with the discretionary authority to address, as appropriate, disproportionate human health or environmental effects, using practicable and legally permissible methods, under Executive Order 12898 (59 FR 7629, February 16, 1994).

In addition, the SIP is not approved to apply on any Indian reservation land or in any other area where EPA or an Indian tribe has demonstrated that a tribe has jurisdiction. In those areas of Indian country, the proposed rule does not have tribal implications and will not impose substantial direct costs on tribal governments or preempt tribal law as specified by Executive Order 13175 (65 FR 67249, November 9, 2000).

This is a summary of the Commission's Notice of Proposed Rulemaking (NPRM) in WC Docket No. 21-341, adopted and released on September 30, 2021. The full text of the document is available on the Commission's website at https://www.fcc.gov/document/fcc-proposes-rules-prevent-sim-swapping-and-port-out-fraud. To request materials in accessible formats for people with disabilities ( e.g., braille, large print, electronic files, audio format, etc.), send an email to FCC504@fcc.gov or call the Consumer & Governmental Affairs Bureau at (202) 418-0530 (voice) or (202) 418-0432 (TTY).

This document contains proposed information collection requirements. The Commission, as part of its continuing effort to reduce paperwork burdens, invites the general public to comment on the information collection requirements contained in this document, as required by the Paperwork Reduction Act of 1995, Public Law 104-13. Public and agency comments are due December 14, 2021.

Comments should address: (a) Whether the proposed collection of information is necessary for the proper performance of the functions of the Commission, including whether the information shall have practical utility; (b) the accuracy of the Commission's burden estimates; (c) ways to enhance the quality, utility, and clarity of the information collected; (d) ways to minimize the burden of the collection of information on the respondents, including the use of automated collection techniques or other forms of information technology; and (e) way to further reduce the information collection burden on small business concerns with fewer than 25 employees. In addition, pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107-198, see 44 U.S.C. 3506(c)(4), we seek specific comment on how we might further reduce the information collection burden for small business concerns with fewer than 25 employees.

1. We believe that our CPNI and number porting rules are ripe for updates that could help prevent SIM swapping and port-out fraud. In this NPRM, we propose to prohibit wireless carriers from effectuating a SIM swap unless the carrier uses a secure method of authenticating its customer. We also propose to amend our CPNI rules to require wireless carriers to develop procedures for responding to failed authentication attempts and to notify customers immediately of any requests for SIM changes. We also seek comment on whether we should impose customer service, training, and transparency requirements specifically focused on preventing SIM swap fraud. We likewise propose to amend our number porting rules to combat port-out fraud while continuing to encourage robust competition through efficient number porting. Finally, we consider whether we should adopt any other changes to our rules to address SIM swap and port-out fraud, including the difficulties encountered by victims of these schemes. We seek comment on our proposals and invite input from stakeholders on how to best tailor the rules to combat this growing, pernicious fraudulent activity.

2. Customer Authentication Requirements for SIM Change Requests. To reduce the incidence of SIM swap fraud, we propose to prohibit carriers from effectuating a SIM swap unless the carrier uses a secure method of authenticating its customer, and to define “SIM” for purposes of these rules as a physical or virtual card contained with a device that stores unique information that can be identified to a specific mobile network. As used in our proposed rules, the term “carrier” includes “any officer, agent, or other person acting for or employed by any common carrier or user, acting within the scope of his employment.” We seek comment on these proposals. Consistent with the recommendations made last year by the Princeton Research team that studied SIM swapping, we propose that use of a pre-established password; a one-time passcode sent via text message to the account phone number or a pre-registered backup number; a one-time passcode sent via email to the email address associated with the account; or a passcode sent using a voice call to the account phone number or a preregistered back-up telephone number would each constitute a secure method of authenticating a customer prior to a SIM change. We seek comment on this proposal and whether it will serve as an effective deterrent to SIM swapping fraud. As used here, a “pre-established password” is a password chosen by the customer for future use to authenticate a customer for access to account information or to make account changes.

3. Are each of these authentication methods secure? Since 2016, the National Institute of Standards and Technology (NIST) has recognized known risks associated with SMS-based authentication, distinguishing “SMS-based authentication from other out-of-band authentications methods due to heightened security risks including `SIM change.' ” In addition, recent media reports call into question the security of using text messages for authentication purposes. For example, a recent investigation found that SMS-based text messages could be easily intercepted and re-routed using a low-cost, online marketing service that helps businesses do SMS marketing and mass messaging. As with SIM swap fraud, once the hacker was able to re-route a target's text messages, the hacker was also able to access other accounts associated with that phone number. Wireless carriers reportedly have mitigated the security vulnerability uncovered in this investigation. Has this vulnerability has been fixed so that it is no longer a threat to customers of any carrier? What rules could we adopt to ensure that authentication using text messages is secure and effective to protect consumers from SIM swap fraud? Or alternatively, should we prohibit carriers from using text messaging, or specifically SMS text messaging, to authenticate customers requesting SIM swaps? What steps could we take to prevent a customer's text messages from being forwarded without authorization? Should we, for example, require companies offering the text forwarding services to call the customer whose texts will be forwarded to confirm consent prior to forwarding? If so, what authority may we rely upon to adopt such a rule? Are such methods effective? What other steps should we take to help secure customers' accounts and text messages?

4. All of the methods of authentication that we propose to include in the requirement to authenticate a wireless customer before allowing for a SIM swap are familiar ones, already used by consumers and companies in various other circumstances. Based on stakeholder experience with these methods of authentication, how burdensome would our proposed authentication requirement be on customers making legitimate SIM change requests? Would they pose particular challenges to customers whose phone associated with their account has been lost, stolen, or destroyed, or customers who are not comfortable with technology, or to customers with disabilities? Should customers be able to opt-in or opt-out of certain methods of authentication?

5. We also invite comment on whether there are other secure methods of authentication that we should allow carriers to use to authenticate their customers in advance of effectuating a SIM change. What practices and safeguards do carriers currently employ to authenticate customers when SIM change requests are made? Have carriers implemented any processes and protections to address SIM swap fraud specifically? If so, have those practices been effective? Do carriers use multi-factor authentication and has it been effective in preventing SIM swap fraud? If so, should we adopt a multi-factor authentication requirement to prevent SIM swap fraud? If we do require multi-factor authentication, is texting sufficiently secure to permit it as an authentication method for use in multi-factor authentication? Are there emerging technologies or authentication methods in development that could potentially be implemented to protect customers from SIM swap fraud? Are there other security measures incorporated into handsets or operating systems that can be used to authenticate or otherwise prevent SIM swap fraud? Could blockchain technologies that store data in a decentralized manner offer additional security when authenticating customers requesting SIM changes? Are there limitations in these technologies, such as security, storage, scalability, and cost that could place a burden on providers and manufacturers of SIMs? What privacy risks are associated with any of these methods or others suggested by commenters? How effective would any of these methods be at deterring SIM swap fraud? As with the methods we have proposed, what challenges do other secure methods of authentication pose to customers and how burdensome would they be on customers making legitimate SIM change requests, particularly those customers who are no longer in possession of their cell phone because it was lost, stolen, or destroyed, or customers who are not comfortable with technology, or customers with disabilities? What are the costs to carriers for any alternative secure authentication methods?

6. If we adopt a specific set of authentication practices that carriers must employ before effectuating a SIM change, how can we account for changes in technology, recognizing that some of these methods may become hackable over time, while additional secure methods of authentication will likely be developed over time? We seek comment on whether instead of requiring specific methods of authentication, we should adopt a flexible standard requiring heightened authentication measures for SIM swap requests. The Commission has previously found that “techniques for fraud vary and tend to become more sophisticated over time” and that carriers “need leeway to engage emerging threats.” The Commission has allowed carriers to determine which specific measures will best enable them to ensure compliance with the requirement that carriers take reasonable measures to discover and protect against fraudulent activity. We observe that to the extent carriers have already implemented or are considering implementing additional protections against SIM swap fraud, we want to ensure that any rules we adopt do not inhibit carriers from using and developing creative and technical solutions to prevent SIM swap fraud or impose unnecessary costs. Would codifying a limited set of methods for authenticating customers in advance of approving SIM swapping requests reduce carriers' flexibility to design effective measures and, in effect, reduce their ability to take aggressive actions to detect and prevent fraudulent practices as they evolve? Could requiring specific methods of authentication provide a “roadmap” to bad actors? What costs would such requirements impose on carriers, particularly smaller carriers?

7. To that end, we seek comment whether we should instead require carriers to comply with the NIST Digital Identity Guidelines, which are updated in response to changes in technology, in lieu of other proposals. The NIST Digital Identity Guidelines are a set of guidelines that provide technical requirements for federal agencies “implementing digital identity services,” focusing on authentication. Would requiring carriers to adopt and comply with these guidelines “future proof” authentication methods? Would these guidelines effectively protect consumers in the context of SIM swap fraud? Are these guidelines generally applicable in the telecommunications context, and do the guidelines provide sufficient flexibility to carriers? Would requiring carriers to comply with the guidelines pose any difficulties for smaller providers, and would the authentication methods recommended in the guidelines pose any particular challenges to customers? We also seek comment on whether there are other definitive government sources that we could consider adopting as appropriate authentication methods.

8. We also seek comment on what would be an appropriate implementation period for wireless carriers to implement any changes to their customer authentication processes. Because of the serious harms associated with SIM swap fraud, we believe that a speedy implementation is appropriate. Are there any barriers to a short implementation timeline and, if so, what are they? What could we do to eliminate or reduce potential obstacles? Will smaller wireless carriers need additional time to implement the requirements we propose?

9. Are there other ways we can strengthen the Commission's customer authentication rules to better protect customers from SIM swap fraud? For example, for online access to CPNI, our rules require a carrier to authenticate a customer “without the use of readily available biographical information[ ] or account information.” Given evidence of the ease with which bad actors can create recent payment or call detail information, we propose to make clear that carriers cannot rely on such information to authenticate customers for online access to CPNI. We invite comment on that proposal.

10. We also seek comment on whether there are other methods of authentication that carriers should be allowed to implement to prevent SIM fraud that originates in retail locations. Our rules currently allow carriers to disclose CPNI to a customer at a carrier's retail location if the customer presents a valid photo ID. We seek comment on whether a government-issued ID alone is sufficient for in-person authentication. How prevalent is in-person fraud using fake IDs as a source of SIM swap fraud? What role can, and should, retail stores play in authentication, particularly in situations where customers do not have access to technology or are not tech savvy? Should customer authentication requirements be the same for SIM changes initiated by telephone, online, or in store?

11. We also invite comment on whether we should amend our rule on passwords and back-up authentication methods for lost or forgotten passwords. Our rules require a carrier to authenticate the customer without the use of readily available biographical information or account information to establish the password. We permit carriers to create a back-up customer authentication method in the event of a lost or forgotten password, but such back-up customer authentication method may not prompt the customer for readily available biographical information or account information. Should we make changes to this requirement? If so, what changes are needed? Do the existing rules create vulnerabilities that should be addressed? Should these requirements be updated to reflect any changes in technology? How would they enhance the protections already provided to consumer passwords?

12. Response to Failed Authentication Attempts. We propose to require wireless carriers to develop procedures for responding to failed authentication attempts, and we seek comment on this proposal. We seek comment on what processes carriers can implement to prevent bad actors from attempting multiple authentication methods while at the same time ensuring that protections do not negatively impact legitimate customer requests. For example, would a requirement that SIM swaps be delayed for 24 hours in the case of multiple failed authentication attempts while notifying the customer via text message and/or email, be effective at protecting customers from fraudulent SIM swaps? If we adopt such a rule, should we specify the number of attempts, and if so, how many attempts should trigger the 24-hour delay? How burdensome would this be for customers, and what costs would this impose on carriers? How long would it take carriers to develop and implement procedures for responding to failed authentication attempts? Would such a requirement have anti-competitive effects?

13. Customer Notification of SIM Change Requests. As part of our effort to protect consumers from fraudulent SIM swapping, we propose to require wireless providers to notify customers immediately of any requests for SIM changes. We seek comment on this proposal. Is it unnecessary if we adopt specific heightened authentication requirements prior to providing a SIM swap? Or will it provide a worthwhile second line of protection against fraudulent SIM swaps?

14. Our CPNI rules currently require carriers to notify customers immediately whenever a password, customer response to a back-up means of authentication for lost or forgotten passwords, online account, or address of record is created or changed. This notification may be through a carrier-originated voicemail or text message to the telephone number of record, or by mail to the address of record, and must not reveal the changed information or be sent to the new account information. As the Commission found with respect to these other types of account changes, we believe that notification of SIM change requests could be an important tool for customers to monitor their account's security, and could help protect customers from bad actors “that might otherwise manage to circumvent [ ]authentication protections” and enable customers “to take appropriate action in the event” of fraudulent activity. Do commenters agree?

15. We also seek comment on how this notification should be provided to customers. We believe that the verification methods provided in our rules for other types of account changes may be insufficient to protect customers from SIM swap fraud because in these situations, the bad actor has taken control of the customer's account and any verification communications sent after the transfer by voicemail or text may be directed to the bad actor rather than to the victim. Moreover, mail to the address of record will likely be too slow to stop the ongoing fraud that may involve financial accounts, social media profiles, and other services. We therefore propose to amend our rules to include notification requirements that would more effectively alert customers to SIM fraud on their accounts and seek comment on what types of notification would be most effective in alerting customers to SIM swap fraud in progress. Would email notification be more effective? Should we retain the option to send such notifications by mail even though this method involves significant delay? Should carriers be required to give customers the option of listing a personal contact ( e.g., a spouse or family member) and then inform that contact that the customer is requesting a SIM swap? What other methods of communication could be used to get timely notification to customers, particularly those customers who are no longer in possession of their device because it has been lost or stolen?

16. In addition to immediate customer notification of requests for SIM swaps, we seek comment on requiring up to a 24-hour delay (or other period of time) for SIM swap requests while notifying the customer via text message, email, through the carrier's app, or other push notification and requesting verification of the request. Once a customer verifies the SIM change request either via text, the carrier's app (if the device is in the customer's possession), an email response, or the customer's online account, the carrier would be free to process the SIM change. If we adopt heightened authentication requirements, is a temporary delay in transferring the account to a new SIM necessary to ensure sufficient time for a customer to receive the notification of activity on the account and take action if the customer has not initiated the changes? Would this requirement be effective in preventing SIM swap fraud? How burdensome would such a delay be for customers? Are there safety implications for customers who legitimately need a new SIM? Could such a delay prevent the customer from completing 911 calls during the waiting period? What costs would this requirement impose on carriers, and how long would it take carriers to develop, test, and implement such a process? Would such a requirement be anti-competitive? Should we consider other approaches to customer notifications of SIM transfers?

17. Customer Service, Training, and Transparency. Additionally, we seek comment on whether we should impose customer service, training, and/or transparency requirements specifically focused on preventing SIM swap fraud. For example, should we require carriers to modify customer record systems so that customer service representatives are unable to access CPNI until after the customer has been properly authenticated? Would this approach be effective in preventing customer service representatives from assisting with authentication through the use of leading questions or other more nefarious employee involvement in SIM swap fraud? Would a requirement for record-keeping of the authentication method used for each customer deter employee involvement in SIM swapping fraud? Are there ways to avoid employee malfeasance, such as requiring two employees to sign off on every SIM change? What burdens would be associated with these possible requirements? Anecdotal evidence suggests that, in some cases, customer service representatives are not trained on procedures to deal with customers who have been victims of SIM swap fraud, and as a result, customers who are already victims have difficulty getting help from their carriers. To address this concern, we seek comment on whether we should impose training requirements for customer service representatives to address SIM swap fraud attempts, complaints, and remediation. What costs would these measures impose on carriers? Is there a way to reduce the burdens of these proposals while still achieving the policy aims? Would these proposals reduce SIM swap fraud or otherwise impact the customer experience? How long would it take wireless carriers to implement any new training requirements? Are there alternative approaches that might be more effective or efficient?

18. We also seek comment on whether we should require wireless providers to offer customers the option to disable SIM changes requested by telephone and/or online access ( i.e., account freezes or locks). We believe that offering these protections would impose minimal burdens on carriers while offering significant protection to customers. Do commenters agree? Whether or not we require wireless providers to offer such services, we also seek comment on whether we should require carriers to provide a transparent, easy-to-understand, yearly notice to customers of the availability of any account protection mechanisms the carrier offers ( e.g., SIM transfer freeze, port request freezes, PINs, etc.). What costs would such notification requirements impose on carriers? We believe that any customer notifications should be brief, use easy-to-understand language, and be delivered in a manner that is least burdensome to customers. We seek comment on what form such notifications could take and how they could be delivered to customers to provide meaningful notice of such services while imposing minimal burden on carriers. Do we need to prescribe a method or methods for customers to unfreeze or unlock their accounts? What methods would be sufficiently secure? Would an unfreeze or unlock be immediate or should there be a waiting period before an unlocked account can be transferred?

19. Accounts with Multiple Lines. We seek comment on how these proposed CPNI rule changes impact wireless accounts with multiple lines, such as shared or family accounts. If we require the customer to provide a one-time passcode for the carrier to execute a SIM change, should each line on the shared or family account have its own passcode? If the account owner elects to freeze the account to protect against unauthorized changes, how can we ensure that another member of the shared or family account remains able to port-out his or her number? Should the freeze option apply only to individual lines and not to entire accounts? Do our proposed rules impact these types of accounts with multiple lines in any other ways?

20. Remediation of SIM Swap Fraud. We seek comment on how we can enable timely resolution of SIM swap fraud to minimize financial and other damage to customers who are victims of SIM swap fraud. How can we encourage and/or ensure that carriers quickly resolve complaints in cases of SIM swap fraud? Should we require carriers to respond to customers and offer redress within a certain time frame? What would be the costs to carriers, and what are the costs to customers if we do not do so? We seek comment on the methods wireless carriers have established to help victims of SIM swap fraud halt an unauthorized SIM swap request or to recover their phone numbers from bad actors.

21. Carriers' Duty to Protect CPNI. We also seek comment on codifying the Commission's expectation that carriers must take affirmative measures to discover and protect against fraudulent activity beyond the measures specifically dictated by our rules and that additional measures ( e.g., self-monitoring) are required to comply with section 222's mandate to protect the confidentiality of customer information. In the 2007 CPNI Order, the Commission codified the requirement that carriers take reasonable measures to discover and protect against unauthorized access to CPNI, and specified that adoption of the rules in that Order does not relieve carriers of their fundamental statutory duty to remain vigilant in their protection of CPNI, nor does it insulate them from enforcement action for unauthorized disclosure of CPNI. The Commission allowed carriers flexibility in how they would satisfy their statutory obligations but expressed an expectation that carriers would take affirmative measures to discover and protect against fraudulent activities beyond what is expressly required by the Commission's rules. We seek comment on whether codifying a requirement to take affirmative measures to discover and protect against fraudulent activities would lead to more effective measures to detect and prevent SIM swap fraud. Has the expectation expressed in 2007 been effective? Would the additional threat of enforcement of a codified rule create additional incentives for carriers to take more aggressive action to detect and prevent fraudulent access to CPNI? We seek comment on whether there are additional requirements needed to ensure that carriers comply with their legal obligations under section 222 to detect and prevent SIM swap fraud.

22. Tracking the Effectiveness of Authentication Measures. We seek comment on what data carriers collect about SIM swap fraud, and whether we should require that carriers track data regarding SIM swap complaints to measure the effectiveness of their customer authentication and account protection measures. What would be the burdens of requiring wireless carriers to internally track customer SIM swap complaints? Do wireless carriers already report this information to the U.S. Secret Service and Federal Bureau of Investigation (FBI) pursuant to the Commission's rules? We also seek comment on whether we should modify our breach reporting rules to require wireless carriers to report SIM swap and port-out fraud to the Commission, and what the costs would be to carriers of doing so, including the timeframe for implementing such a requirement. Should we require carriers to inform the Commission of the authentication measures that they have in place and when those measures change? Would requiring carriers to update the Commission about changes to authentication measures, along with the frequency of customer SIM swap complaints, be sufficient to enable the Commission to evaluate the efficacy of a carrier's authentication measures, or should the Commission require carriers to provide additional information? We also seek comment on how we should ensure carrier compliance with any proposed obligations that we adopt. For example, should we specifically direct the Commission's Enforcement Bureau, or another Bureau or Office, to conduct compliance audits? Are there other audits or models that we should use as guidelines to ensure compliance? We seek comment on the best method to enforce our proposals.

23. Applicability of Customer Authentication Measures. We seek comment on whether any new or revised customer authentication measures we adopt should apply only to wireless carriers and only with respect to SIM swap requests, or whether such expanded authentication requirements would offer benefits for all purposes and with respect to all providers covered by our CPNI rules. Is there anything unique about VoLTE service or the upcoming Voice over New Radio (VoNR) that we need to consider? Further, as the nation's networks migrate from 2G and 3G to 4G and 5G, are there particular technical features that should be taken into consideration regarding authentication requirements? Is the type of phone number takeover that occurs through SIM swap fraud only relevant to mobile phone numbers (due to SIM swaps and text message-based text authentication)? Are there also concerns with respect to account takeovers of interconnected Voice over Internet Protocol (VoIP) services, one-way VoIP services, and landline telephone services? Even if the same concerns are not present (or as strongly present), should we apply any stronger authentication requirements to all providers to protect customers' privacy and to provide uniform rules across all providers? If so, under what legal authority could we extend the proposed authentication requirements to services other than wireless? Is there value to uniformity with other categories of providers? Would costs imposed on these carriers outweigh the limited benefit of these requirements related to non-wireless carriers? Are there any other rules that would need to be aligned for consistency if we make changes to the CPNI rules to address SIM swap fraud? In addition, if limited to wireless providers only, we believe that any new rules we adopt should apply to all providers of wireless services, including resellers. Do commenters agree?

24. We also seek comment on whether any new rules should apply only to certain wireless services, such as pre-paid services. Is SIM swap fraud limited to, or more prevalent with, pre-paid or post-paid wireless accounts? Do wireless resellers (many of which offer pre-paid services) encounter this type of fraud more or less often than facilities-based carriers? We invite comment on whether some or all changes discussed here should apply to all mobile accounts or whether certain changes should be limited to pre-paid or post-paid accounts only. We note that pre-paid plans generally do not require credit checks and therefore subscribers to prepaid plans may be more low-income and economically vulnerable individuals. Would such requirements impose disproportionate burdens on these customers?

25. We also seek comment on the scope of any changes that we may make to the CPNI rules to address SIM swap fraud. Specifically, should any new rules be narrowly tailored to deal only with SIM swap fraud, or should they be broader to ensure that they cover the evolving state of fraud on wireless customers? Outside of the account takeover context, are there benefits to providing expanded authentication requirements before providing access to CPNI to someone claiming to be a carrier's customer? We seek comment on whether any heightened authentication measures required (or prohibited) should apply for access to all CPNI, or only in cases where SIM change requests are being made.

26. In addition, we seek comment on the impact that our proposed rules could have on smaller carriers. Would the proposed requirements impose additional burdens on smaller carriers? Would they face different costs than larger carriers in implementing the new requirements, if adopted? Would smaller carriers need more time to comply with new authentication rules? Do they face other obstacles that we have not considered here?

27. We believe that we have authority to adopt the proposed rules discussed in this section pursuant to our authority under sections 4, 201, 222, 303, and 332 of the Act, and we seek comment on this conclusion. Do we have additional sources of authority on which we may rely here? To the extent that we have not already done so, we also solicit input on the relative costs and benefits of our proposals to amend the CPNI rules to address SIM swap fraud. How many legitimate SIM swap requests do carriers receive yearly, and what are customers' most common reasons for requesting a legitimate SIM swap? Is there any evidence concerning the degree to which authentication measures limit legitimate SIM swaps, or the degree to which they successfully prevent fraud? We ask commenters for input on how any of these proposals could positively or negatively affect the customer experience and whether they foresee any unintended consequences from the changes we propose here.

28. We next seek comment on proposals to strengthen our number porting rules to protect customers from unauthorized ports and port-out fraud. One reason that number porting can be used to subvert two-factor authentication may be the relative ease with which carriers fulfill port order requests from other carriers. We note that though the Act makes it unlawful for any telecommunications carrier to “submit or execute a change in a subscriber's selection of a provider of telephone exchange service . . . except in accordance with such verification procedures as the Commission shall prescribe,” the Commission's slamming rules implementing this provision do not currently apply to wireless carriers. As a result, wireless subscribers are not afforded the same protections as wireline customers when their service is switched to another carrier without their authorization. The Commission has, in the past, been concerned that adding “additional steps for the customer would also add a layer of frustration and complexity to the number porting process, with anticompetitive effects.” While the Commission remains committed to “facilitat[ing] greater competition among telephony providers by allowing customers to respond to price and service changes . . . , ” we seek comment below on what additional measures we can adopt to protect customers from port-out fraud.

29. Notification of Wireless Port Requests and Customer Authentication Processes. We propose to require wireless carriers to provide notification to customers through text message or other push notification to the customer's device whenever a port-out request is made to ensure that customers may take action in the event of an unauthorized port request, and seek comment on our proposal. For example, Verizon sends its customers a text message letting the customer know that a port-out request has been initiated. When the request is completed, Verizon will send the customer an email stating that the port to the new service was successful. AT&T may also “send customers a text message to help protect them from illegal porting. This notification will not prevent or delay the customer's request. It just adds a simple step to better protect against fraud.” We believe that requiring customer notice of port requests could be a minimally intrusive protective measure that could be automated to minimize delays while providing significant protections for customers. Do commenters agree? Do other carriers currently notify their customers of port-out requests? What would be the costs for carriers to implement such a requirement, particularly for smaller carriers? How much time would carriers need to implement such a requirement? Would requiring notification of port requests to customers harm competition? Is there a particular method of notification that is most effective? For this and other potential rules that may require text messages and/or push notifications, should we define the scope of permissible text messages or other push notifications and, if so, what definition or definitions should we use?

30. We also seek comment on whether a port request notification requirement is sufficient to protect customers from port-out fraud, or whether we should also require customer verification or acknowledgement of the text message or push notification through a simple Yes/No response mechanism. Would a customer port verification requirement unreasonably hinder the porting process, and could it be used anticompetitively by carriers? Should we require that customers respond within a certain amount of time before the carrier can execute the port? We recognize that some customers may not frequently check their text messages or push notifications, which could lead to a delay if we require the customer to verify the port. Should we require carriers to send follow-up messages to the customer via email or a phone call? What other processes have wireless carriers adopted to protect customers from port-out fraud, and have they been effective in reducing port-out fraud?

31. As discussed above, the National Institute of Standards and Technology and recent media reports call into question the security of using text messages for authentication purposes. Is notification and/or verification of a port request via text message a secure means of authenticating the validity of a customer's wireless port request? Should we instead require an automated notification call and verification response through a voice call or other method, such as email or carrier app? What methods would ensure that customers who have voice-and-text-only service, or whose devices are incapable of accessing a carrier's app or website, are not hindered in their porting choices? Are there any barriers for smaller carriers implementing any of these changes to protect customers' accounts from port-out fraud?

32. We seek comment whether we should require customers' existing wireless carriers to authenticate a customer's wireless port request through means other than the fields used to validate simple port requests. Are the benefits of potentially protecting customers from port-out fraud outweighed by the potential harms to competition from delaying or impeding customers' valid wireless number port requests? We seek comment on the processes that wireless carriers, including MVNO providers, resellers, and smaller carriers, currently use to authenticate customer port-out requests, and whether those methods are effective in preventing port-out fraud. According to CTIA, “[w]ireless providers are constantly improving internal processes to stay ahead of . . . bad actors, while protecting the rights of legitimate customers to transfer their phone number to a new device or wireless provider,” including “[s]ending one-time passcodes via text message or email to the account phone number or the email associated with the account when changes are requested . . . .” Verizon will not allow its customers to transfer their number to a different carrier unless that customer first requests a Number Transfer Pin. When a Verizon customer requests a port from its new service provider, the customer must present the Verizon account number and Number Transfer Pin in order to authenticate the request. AT&T customers can create a unique passcode that in most cases the customer is required to provide “before any significant changes can be made including porting through another carrier,” and starting September 30, 2021, will require customers to request a Number Transfer PIN to transfer their number to another service provider, which will replace the account passcode customers currently use. T-Mobile assigns each of its customer accounts a 6-15 digit PIN that must be provided whenever an individual requests to port-out the phone number associated with that account. Have such port-out PINs been effective at protecting customers from port-out fraud? Have carriers noticed any effect from adopting port-out PINs or other additional security measures on their customers' likelihood of switching carriers? Is there any evidence indicating how security measures affect porting frequency? Should we require wireless carriers to authenticate customers for wireless port requests under the same standard as we require carriers to authenticate customers for SIM change requests, recognizing that in the porting context, the Act sets forth competing goals of protecting customer information and promoting competition through local number porting? What would be the benefits and costs of doing so?

33. We seek comment on any other technical or innovative solutions for customer authentication for port requests that carriers could implement to reduce port-out fraud. For example, are there technologies developed out of the Mobile Authentication task force, a collaboration among the three major U.S. wireless carriers, that could be easily implemented into the port authentication process? ZenKey, which was developed under the auspices of the Mobile Authentication task force, “collects and shares device and account data with your wireless carrier . . . [to] easily and more securely authenticate, sign up, and sign in,” and “uses multi-factor authentication, including unique network signals, to not only verify a user's device but also allow verification that the user is who they say they are.” Could carriers use similar technology to authenticate wireless customer port requests? What would be the costs of doing so and what are the challenges to implementation, including customer privacy and consent implications? What other technologies exist that carriers could use to quickly and effectively authenticate wireless port requests to reduce port-out fraud? As the nation's networks migrate from 2G and 3G to 4G and 5G, are there particular technical features that should be taken into consideration for protecting customers from port-out fraud?

34. We seek comment on whether we should require all carriers to implement any of the additional authentication processes for wireless port requests some providers have already developed and implemented. Is there value in uniformity? Would it reduce consumer confusion if we mandate the same authentication requirements on all wireless port-out requests regardless of the providers involved? Would that potential reduction in consumer confusion outweigh the benefits of enabling carriers to create innovative procedures to protect against port-out fraud attempts as they evolve? Would requiring specific additional customer authentication procedures, as opposed to simply making it clear that carriers are responsible for preventing port-out fraud, provide a roadmap to bad actors? Should we instead require carriers to develop heightened customer authentication procedures like those already initiated by the three nationwide wireless carriers, but provide flexibility to the individual carriers to create and employ what works best for their service? Should we require different authentication procedures for pre-paid wireless account port-out requests than we do for post-paid wireless account port-out requests? We also seek comment on what implementation period the wireless industry would need to implement any additional validation requirements and processes we adopt.

35. We seek comment on how additional port authentication requirements would affect the timing of simple wireless-to-wireless ports. Would allowing additional authentication procedures cause unreasonable delay to the wireless porting process or cause harm to competition? In adopting any additional customer authentication requirements, we want to ensure that we leave carriers in a position to innovate and address new problems as they arise. Relatedly, we seek comment on whether it is necessary to codify a simple wireless-to-wireless porting interval to ensure that any new port authentication requirements do not lead to delay in the current porting process. The wireless industry has voluntarily established an industry standard of two and one-half hours for simple wireless-to-wireless ports. Should we codify this interval in our rules?

36. Port-Freeze Offerings. We propose to require all wireless providers, including resellers, to offer customers the option to place a “port-freeze” on their accounts at no cost to the customer to help deter port-out fraud. We observe that our rules currently permit local exchange carriers (LECs) to offer their customers the ability to “prevent[ ] a change in a subscriber's preferred carrier selection unless the subscriber gives the carrier from whom the freeze was requested his or her express consent.” Should we require wireless providers to offer a similar option, and would making this option available to wireless customers deter wireless port-out fraud? Verizon offers customers the option to lock their number, blocking all port-out requests unless the account owner turns off the Number Lock feature through the Verizon mobile app, on Verizon's website, or by calling customer service. Do other wireless carriers currently offer a similar feature? Has this feature, and others like it, been successful at deterring port-out fraud? What costs would offering this feature impose on carriers? How can we make sure that customers are easily notified of this feature? Would a one-time notice for existing customers, and notice at the time service is started, be effective at notifying customers? How often should carriers provide this notice to customers? What method would be least burdensome on carriers while also notifying all customers, including those that do not access their accounts through online services or carrier apps, of the availability of this feature? Local exchange carriers who offer their customers the “preferred carrier freeze” option must follow specific requirements regarding the solicitation and imposition of this option. Should we extend similar requirements to wireless carriers? If we impose these requirements, would the benefits gained by deterring port-out fraud outweigh the costs of this measure? What happens when a customer locks his or her account but is unable to recall the information necessary to unlock their account? Should there be a back-up authentication method available? Are there other methods wireless carriers use to prevent unauthorized port requests that we should consider requiring?

37. Wireless Port Validation Fields. We also propose to codify the types of information carriers must use to validate simple wireless-to-wireless port requests. Pursuant to the Commission's 2007 LNP Four Fields Declaratory Ruling, the wireless industry agreed to use three fields of customer-provided information—telephone number, account number, and ZIP code—plus a passcode field (if customer-initiated) to validate requests for simple wireless-to-wireless ports. We propose to codify this requirement in our rules for simple wireless-to-wireless ports, just as we have codified field requirements for simple wireline and intermodal ports. We preliminarily believe that standardizing the fields necessary to complete a simple wireless-to-wireless port will allow for quicker and more efficient porting, and we seek comment on this view. We propose adopting the existing fields because we are cognizant that imposing new or different customer-required information fields could complicate the porting process, from both the carrier and customer perspectives, and we seek comment on this view. We seek comment whether codifying the existing fields used for validating simple wireless ports, in combination with immediate customer notification of port-requests and the offering and advertisement of port-freeze options as we propose, would help to protect customers from port-out fraud. Do such measures appropriately balance the competitive benefits of rapid porting with protecting customers' accounts from fraud?

38. Are there additional fields of customer-provided information we should require for validation of wireless-to-wireless ports to minimize port-out fraud, while ensuring the continued rapid execution of valid port-out requests? If we require additional fields of customer-provided information for only wireless-to-wireless simple ports, will that cause unnecessary complications for the telecommunications industry as a whole? Will it impose additional costs on wireless carriers that would reduce competition in the telecommunications marketplace? We seek comment on whether requiring carriers to implement changes to the wireless port validation requirements would significantly impair the customer's ability to perform a legitimate port-out request. Would requiring carriers to implement additional customer-provided fields for wireless port requests stifle the ability of customers to switch carriers while retaining their phone number or keep customers locked into contracts with their current service providers? Would customers still be able to respond to price and service changes in a quick and efficient manner? Finally, we propose to make clear that any customer validation requirements apply to both facilities-based wireless carriers and resellers of wireless service and we seek comment on that proposal.

39. We seek comment on whether we should require carriers to implement a customer-initiated passcode field for all wireless number port requests, or whether it should remain optional. While AT&T, Verizon, and T-Mobile offer this option, it is unclear if all customers are required to participate. What would be the burden on customers and carriers, particularly smaller carriers, were we to mandate passcode fields for wireless number port requests? Could it harm competition and cause customer frustration if a customer has either not set up a passcode or does not know how to set up a passcode? Should we require carriers to make a customer- initiated passcode optional on an opt-out rather than opt-in basis? What steps could carriers take to make it least burdensome on customers to establish an account passcode for wireless number porting purposes? We also seek comment on how we can ensure that a customer can make a legitimate port request if he forgets his passcode.

40. Remediating Port-Out Fraud. We seek comment on how we can ensure timely resolution of unauthorized port-out requests to minimize financial and other damage to customers who are victims of such fraud. What information do wireless carriers currently collect about port-out fraud? Are wireless carriers already tracking instances of customer complaints regarding this issue? Should we require that carriers use this information to measure the effectiveness of their customer authentication and account protection measures? How can we encourage and/or ensure that carriers coordinate and work together to quickly resolve complaints in cases of port-out fraud? Should we require carriers to respond to customers who allege they are victims of port-out fraud and to offer redress to such customers within a certain time frame? What would be the costs to carriers, and what are the costs to customers if we do not do so? We seek comment on the methods wireless carriers have established to help victims of port-out fraud stop an unauthorized port-out request or to recover their phone numbers from bad actors.

41. Accounts With Multiple Lines. We seek comment on how the proposed changes to our LNP rules impact wireless accounts with multiple lines, such as shared or family accounts. If we require the customer to provide a one-time passcode for the carrier to execute the port, should each line on the shared or family account have its own passcode? If the account owner elects to freeze the account to protect against unauthorized changes, how can we ensure that another member of the shared or family account remains able to port-out their number? Should the port-freeze option apply only to individual lines and not to entire accounts? Do our proposed rules impact these types of accounts with multiple lines in any other ways?

42. Role of Administrator. We also seek comment on whether the Local Number Portability Administrator (LNPA) can play a role in thwarting port-out fraud by serving as an authorized neutral third-party to verify customer identification prior to authorizing a port-out request. The LNPA operates the Number Portability Administration Center (NPAC), which “is the system that supports the implementation of LNP and is used to facilitate number porting in the United States. The LNPA, through the NPAC, currently works with a customer's new service provider to create a number port and sends a notification to the old service provider, once the existing service provider validates and confirms the subscriber's information. What information regarding port requests does the NPAC retain? Is there additional information regarding port requests the NPAC should retain to help prevent port-out fraud? What records could be helpful if provided to customers who have been victims of unauthorized port-out fraud? Through what means and under what conditions, if any, should wireless providers permit their customers to access NPAC data regarding port requests that pertain to the customer's telephone number? Are there additional obligations that we should direct or encourage North American Portability Management, LLC, which oversees the LNPA contract, to impose on the LNPA to safeguard against port-out fraud?

43. As discussed above, the Number Portability Industry Forum has created “Best Practices” for porting between and within telephony carriers. Best Practice 73 (Unauthorized Port Flow) specifically addresses carrier processes for responding to unauthorized ports, including fraudulent ports, which are ports “which occurred as the result of an intentional act of fraud, theft, and/or misrepresentation.” We seek comment on the extent to which wireless providers have adopted Best Practice 73. If wireless carriers have adopted Best Practice 73, is it effective in addressing port-out fraud? Are there changes we can make to the process flow to better protect customers? If wireless carriers have not implemented Best Practice 73, we seek comment on other methods they use to investigate potentially fraudulent ports and how they restore service to the customer. Should we require mobile carriers to adopt Best Practice 73 to help speed resolution of fraudulent port complaints? We also seek comment on what role the North American Numbering Council (NANC) can play in establishing updated best practices to protect customers from port-out fraud and in reaching industry consensus.

44. Partial Porting Fraud. We seek comment on whether the proposals on which we seek comment above would also be effective against partial porting fraud, where the bad actor changes the consumer's carrier for delivery of SMS messages without changing their primary carrier. Would our proposed customer notification and authentication rule prevent routing of SMS messages through an alternate provider without customer notification? Would a port freeze prevent changing the delivery provider and destination of SMS messages? If not, what changes to the proposed rules would be required to ensure they also apply to partial porting fraud? What additional measures would be necessary to prevent partial porting fraud in addition to the fraud that may occur when a wireless provider completely ports a consumer's mobile service?

45. Impact on Smaller Carriers. We seek comment on the impact the LNP rule changes that we discuss above could have on smaller carriers. Would these new requirements impose undue burdens on smaller carriers? Would smaller carriers face different costs from larger carriers in implementing the new requirements, if adopted? Would smaller carriers need more time to comply with revised number porting rules? Do they face other obstacles that we have not considered here?

46. Legal Authority. Finally, we seek comment on our legal authority to adopt the possible rules discussed in this section. We propose to rely on authority derived from sections 4, 201, 251(b)(2), 251(e), 303, and 332 of the Act to implement the proposed changes to our number porting rules to address port-out fraud, and seek comment on our proposal. Are there additional sources of authority on which the Commission can rely to implement these proposals? Should we extend any of the LNP rules on which we seek comment to any entities other than wireless carriers, such as landline carriers or VoIP providers? If so, we propose concluding that we have authority to do so pursuant to section 251(e), and we seek comment on this view. We also seek comment on whether we should update the references to “CMRS” in the Commission's number porting rules to reflect evolving technology. Finally, we solicit input on the relative costs and benefits of our proposals to amend the LNP rules to address port-out fraud.

47. Finally, we seek comment on any additional rules that would help protect customers from SIM swap or port-out fraud or assist them with resolving problems resulting from such incidents. We are aware that customers sometimes need documentation of the fraud incident to provide to law enforcement, financial institutions, or others to resolve financial fraud or other harms of the incident. A SIM swap or port-out fraud victim may have difficulty obtaining such documentation from the carrier because the carrier may not have processes in place to produce such documentation. To provide support for customers who have become victims, we seek comment on requiring wireless carriers to provide to customers (upon request) documentation of SIM swap or port-out fraud on accounts that the customer may then provide to law enforcement, financial institutions, or others. We seek comment on what information should be included in the documentation provided by carriers. We also seek comment on the potential benefits and projected costs of this proposal, including on smaller providers. Further, we invite input on how the proposed rule would affect the customer experience, either positively or negatively.

48. Next, we seek comment on other measures we can adopt to ensure that customers have easy access to information they need to report SIM swap, port-out, or other fraud. As discussed above, we believe that customer service representatives should be trained on how to assist customers who have been victims of SIM swap or port-out fraud, and carriers should have procedures in place for a response. Identity theft, including SIM swap fraud, can cause intense anxiety for victims and must be addressed in a timely manner to prevent financial losses and exposure of personal information. Thus, in addition to providing documentation, we believe that it should be easy for a customer to get access to appropriate carrier resources that can help mitigate the significant harms caused by SIM swap or port-out fraud. As such, we seek comment on whether we should adopt rules addressing how wireless carriers deal with customers once they have become victims of SIM swapping and port-out fraud. What procedures do carriers have in place to assist customers in these circumstances and are these procedures effective? What additional steps can carriers take to recover the account and stop the ongoing fraudulent activity? How can carriers ensure that customers have easy access to the information they need to report SIM swap fraud? Should we require wireless carriers to establish a dedicated point or method of contact that is easily accessible by customers and is made available on the carrier's website so that customers can get timely assistance from their carriers? Or, given the time-sensitive nature of most fraud, would it make sense to require carriers to have a dedicated and publicized fraud hotline that customers can call directly in the case of suspected fraud? What costs would such a requirement impose on carriers, and how long would it take for carriers to implement? Are any of the Commission's existing rules obstacles to helping customers recover following a SIM swap or port-out fraud incident?

49. We seek comment on whether there are other customer protections we could adopt to address the problems associated with SIM swap and port-out fraud. For example, should the Commission require wireless carriers to enable “fraud alerts” on accounts and publicize these services to customers? Such fraud alerts could trigger additional protections when changes are requested on the accounts. Would such a requirement be effective at deterring SIM swap and port-out fraud? Would it have any unintended consequences for customers? What would such a requirement cost? Are there any other consumer protections that would be effective in combatting SIM swap and port-out fraud and, if so, how would they operate? What would be their relative costs and benefits? For example, we understand that in other countries, carriers and financial institutions share information about SIM transfers to limit damages to consumers resulting from incidents of SIM swap fraud. As discussed above, section 222 strictly limits carriers' ability to share a customer's CPNI without the customer's consent. Can we, and should we, encourage carriers to establish a mechanism based on express customer consent that would enable a financial institution to determine whether a SIM transfer had been recently completed to help protect customers from the financial harms of SIM swap and port-out fraud? If so, should we require or encourage carriers to ask for customer permission upon set up of accounts (and to send out one-time notice to all existing customers asking if they want to permit this)? Should such a rule require retention of the record of this permission for some designated period of time? Should carriers be permitted to charge a fee for this service either to the wireless customer or to the financial institution? Are there other types of institutions that might need access to the same type of information to prevent fraud? Should our rules expressly permit or prohibit this type of service? What are the potential risks and benefits to consumers? We seek comment on how we can ensure that customers are able to take advantage of third-party fraud services to protect against SIM swap and port-out fraud.

50. We tentatively conclude that our broad Title III authority would support imposing additional consumer protection obligations such as those discussed in this section on wireless carriers. We also seek comment on whether authority derived from sections 4, 201, 222, 251, 303, and 332 would support such additional consumer protection measures. Should we extend any new consumer protection requirements to interconnected VoIP services, one-way VoIP services, or landline services? If so, pursuant to what legal authority would the Commission adopt such rules? We invite commenters to discuss the relative costs and benefits of these proposals and any foreseeable unintended consequences of the measures we discuss.

51. We seek comment on whether there are standards-setting bodies, industry organizations, or consumer groups that could evaluate this issue to augment our understanding and present possible solutions. For example, could the Alliance for Telecommunications Industry Solutions (ATIS) provide technical expertise that would be useful in determining the best course of action by the Commission to protect customers from SIM swap or port-out fraud? Could relevant trade associations work to develop industry consensus solutions to the problem?

52. Digital Equity and Inclusion. Finally, the Commission, as part of its continuing effort to advance digital equity for all, including people of color, persons with disabilities, persons who live in rural or Tribal areas, and others who are or have been historically underserved, marginalized, or adversely affected by persistent poverty or inequality, invites comment on any equity-related considerations and benefits (if any) that may be associated with the proposals and issues discussed herein. Specifically, we seek comment on how our proposals may promote or inhibit advances in diversity, equity, inclusion, and accessibility, as well the scope of the Commission's relevant legal authority. The term “equity” is used here consistent with Executive Order 13985 as the consistent and systematic fair, just, and impartial treatment of all individuals, including individuals who belong to underserved communities that have been denied such treatment, such as Black, Latino, and Indigenous and Native American persons, Asian Americans and Pacific Islanders and other persons of color; members of religious minorities; lesbian, gay, bisexual, transgender, and queer (LGBTQ+) persons; persons with disabilities; persons who live in rural areas; and persons otherwise adversely affected by persistent poverty or inequality. See Exec. Order No. 13985, 86 FR 7009, Executive Order on Advancing Racial Equity and Support for Underserved Communities Through the Federal Government (January 20, 2021).

53. As required by the Regulatory Flexibility Act of 1980, as amended (RFA), the Commission has prepared this Initial Regulatory Flexibility Analysis (IRFA) of the possible significant economic impact on a substantial number of small entities by the policies and rules proposed in the Notice of Proposed Rulemaking (NPRM). Written comments are requested on this IRFA. Comments must be identified as responses to the IRFA and must be filed by the deadlines for comments on the NPRM provided on the first page of the item. The Commission will send a copy of the NPRM, including this IRFA, to the Chief Counsel for Advocacy of the Small Business Administration (SBA). In addition, the NPRM and IRFA (or summaries thereof) will be published in the Federal Register .

54. This item focuses developing protections to address SIM swapping and port-out fraud. In SIM swapping, the bad actor targets a consumer's subscriber identity module (SIM) and convinces the victim's wireless carrier to transfer the victim's service from the original device (and that device's SIM) to a cell phone in the bad actor's possession. A consumer's wireless phone number is associated with the SIM in that consumer's cell phone; by “swapping” the SIM associated with a phone number, the bad actor can take control of a consumer's cell phone account. In “port-out fraud,” the bad actor, posing as the victim, opens an account with a carrier other than the victim's current carrier. The bad actor then arranges for the victim's phone number to be transferred to (or “ported out”) to the account with the new carrier controlled by the bad actor.

55. We have received numerous consumer complaints from people who have suffered significant distress, inconvenience, and financial harm as a result of SIM swapping and port-out fraud. Today, we take aim at these scams, with the goal of foreclosing these opportunistic ways in which bad actors take over consumers' cell phone accounts. Section 222 of the Communications Act of 1934, as amended (the “Act”), and our Customer Proprietary Network Information (CPNI) rules, which govern the use, disclosure, and protection of sensitive customer information to which a telecommunications carrier has access, require carriers to take reasonable measures to discover and protect against attempts to gain unauthorized access to customers' private information. Our Local Number Portability (LNP) rules govern the porting of telephone numbers from one carrier to another. Yet, it appears that neither our CPNI rules nor our LNP rules are adequately protecting consumers against SIM swap and port-out fraud. We, therefore, propose to amend our CPNI and LNP rules to require carriers to adopt secure methods of authenticating a customer before redirecting a customer's phone number to a new device or carrier. We also propose to require providers to immediately notify customers whenever a SIM change or port request is made on customers' accounts, and we seek comment on other ways to protect consumers from SIM swapping and port-out fraud.

56. The legal basis for any action that may be taken pursuant to this NPRM is contained in sections 1, 4(i), 4(j), 201, 222, 251, 303(r), and 332 of the Communications Act of 1934, as amended, 47 U.S.C. 151, 154, 201, 222, 251, 303(r), 332.

57. The RFA directs agencies to provide a description of, and, where feasible, an estimate of the number of small entities that may be affected by the proposed rules and policies, if adopted. The RFA generally defines the term “small entity” as having the same meaning as the terms “small business,” “small organization,” and “small governmental jurisdiction.” In addition, the term “small business” has the same meaning as the term “small business concern” under the Small Business Act. A “small business concern” is one which: (1) Is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the SBA.

58. Small Businesses, Small Organizations, Small Governmental Jurisdictions. Our actions, over time, may affect small entities that are not easily categorized at present. We therefore describe here, at the outset, three broad groups of small entities that could be directly affected herein. First, while there are industry specific size standards for small businesses that are used in the regulatory flexibility analysis, according to data from the Small Business Administration's (SBA) Office of Advocacy, in general a small business is an independent business having fewer than 500 employees. These types of small businesses represent 99.9 percent of all businesses in the United States, which translates to 30.7 million businesses.

59. Next, the type of small entity described as a “small organization” is generally “any not-for-profit enterprise which is independently owned and operated and is not dominant in its field.” The Internal Revenue Service (IRS) uses a revenue benchmark of $50,000 or less to delineate its annual electronic filing requirements for small exempt organizations. Nationwide, for tax year 2018, there were approximately 571,709 small exempt organizations in the U.S. reporting revenues of $50,000 or less according to the registration and tax data for exempt organizations available from the IRS.

60. Finally, the small entity described as a “small governmental jurisdiction” is defined generally as “governments of cities, counties, towns, townships, villages, school districts, or special districts, with a population of less than fifty thousand.” U.S. Census Bureau data from the 2017 Census of Governments indicate that there were 90,075 local governmental jurisdictions consisting of general purpose governments and special purpose governments in the United States. Of this number there were 36,931 general purpose governments (county, municipal and town or township) with populations of less than 50,000 and 12,040 special purpose governments—independent school districts with enrollment populations of less than 50,000.

61. Wired Telecommunications Carriers. The U.S. Census Bureau defines this industry as “establishments primarily engaged in operating and/or providing access to transmission facilities and infrastructure that they own and/or lease for the transmission of voice, data, text, sound, and video using wired communications networks. Transmission facilities may be based on a single technology or a combination of technologies. Establishments in this industry use the wired telecommunications network facilities that they operate to provide a variety of services, such as wired telephony services, including VoIP services, wired (cable) audio and video programming distribution, and wired broadband internet services. By exception, establishments providing satellite television distribution services using facilities and infrastructure that they operate are included in this industry.” The SBA has developed a small business size standard for Wired Telecommunications Carriers, which consists of all such companies having 1,500 or fewer employees. U.S. Census Bureau data for 2012 show that there were 3,117 firms that operated that year. Of this total, 3,083 operated with fewer than 1,000 employees. Thus, under this size standard, the majority of firms in this industry can be considered small.

62. Local Exchange Carriers (LECs). Neither the Commission nor the SBA has developed a size standard for small businesses specifically applicable to local exchange services. The closest applicable NAICS Code category is Wired Telecommunications Carriers. Under the applicable SBA size standard, such a business is small if it has 1,500 or fewer employees. U.S. Census Bureau data for 2012 show that there were 3,117 firms that operated for the entire year. Of that total, 3,083 operated with fewer than 1,000 employees. Thus under this category and the associated size standard, the Commission estimates that the majority of local exchange carriers are small entities.

63. Incumbent Local Exchange Carriers (LECs). Neither the Commission nor the SBA has developed a small business size standard specifically for incumbent local exchange services. The closest applicable NAICS Code category is Wired Telecommunications Carriers. Under the applicable SBA size standard, such a business is small if it has 1,500 or fewer employees. U.S. Census Bureau data for 2012 indicate that 3,117 firms operated the entire year. Of this total, 3,083 operated with fewer than 1,000 employees. Consequently, the Commission estimates that most providers of incumbent local exchange service are small businesses that may be affected by our actions. According to Commission data, one thousand three hundred and seven (1,307) Incumbent Local Exchange Carriers reported that they were incumbent local exchange service providers. Of this total, an estimated 1,006 have 1,500 or fewer employees. Thus, using the SBA's size standard the majority of incumbent LECs can be considered small entities.

64. Interexchange Carriers (IXCs). Neither the Commission nor the SBA has developed a small business size standard specifically for Interexchange Carriers. The closest applicable NAICS Code category is Wired Telecommunications Carriers. The applicable size standard under SBA rules is that such a business is small if it has 1,500 or fewer employees. U.S. Census Bureau data for 2012 indicate that 3,117 firms operated for the entire year. Of that number, 3,083 operated with fewer than 1,000 employees. According to internally developed Commission data, 359 companies reported that their primary telecommunications service activity was the provision of interexchange services. Of this total, an estimated 317 have 1,500 or fewer employees. Consequently, the Commission estimates that the majority of interexchange service providers are small entities.

65. Competitive Local Exchange Carriers (Competitive LECs). Competitive Access Providers (CAPs), Shared-Tenant Service Providers, and Other Local Service Providers. Neither the Commission nor the SBA has developed a small business size standard specifically for these service providers. The appropriate NAICS Code category is Wired Telecommunications Carriers and under that size standard, such a business is small if it has 1,500 or fewer employees. U.S. Census Bureau data for 2012 indicate that 3,117 firms operated during that year. Of that number, 3,083 operated with fewer than 1,000 employees. Based on these data, the Commission concludes that the majority of Competitive LECS, CAPs, Shared-Tenant Service Providers, and Other Local Service Providers, are small entities. According to Commission data, 1,442 carriers reported that they were engaged in the provision of either competitive local exchange services or competitive access provider services. Of these 1,442 carriers, an estimated 1,256 have 1,500 or fewer employees. In addition, 17 carriers have reported that they are Shared-Tenant Service Providers, and all 17 are estimated to have 1,500 or fewer employees. Also, 72 carriers have reported that they are Other Local Service Providers. Of this total, 70 have 1,500 or fewer employees. Consequently, based on internally researched FCC data, the Commission estimates that most providers of competitive local exchange service, competitive access providers, Shared-Tenant Service Providers, and Other Local Service Providers are small entities.

66. Local Resellers. The SBA has not developed a small business size standard specifically for Local Resellers. The closest NAICS Code Category is Telecommunications Resellers. The Telecommunications Resellers industry comprises establishments engaged in purchasing access and network capacity from owners and operators of telecommunications networks and reselling wired and wireless telecommunications services (except satellite) to businesses and households. Establishments in this industry resell telecommunications; they do not operate transmission facilities and infrastructure. MVNOs are included in this industry. The SBA has developed a small business size standard for the category of Telecommunications Resellers. Under that size standard, such a business is small if it has 1,500 or fewer employees. 2012 U.S. Census Bureau data show that 1,341 firms provided resale services during that year. Of that number, 1,341 operated with fewer than 1,000 employees. Thus, under this category and the associated small business size standard, the majority of these resellers can be considered small entities. According to Commission data, 881 carriers have reported that they are engaged in the provision of toll resale services. Of this total, an estimated 857 have 1,500 or fewer employees. Consequently, the Commission estimates that the majority of local resellers are small entities.

67. Toll Resellers. The Commission has not developed a definition for Toll Resellers. The closest NAICS Code Category is Telecommunications Resellers. The Telecommunications Resellers industry comprises establishments engaged in purchasing access and network capacity from owners and operators of telecommunications networks and reselling wired and wireless telecommunications services (except satellite) to businesses and households. Establishments in this industry resell telecommunications; they do not operate transmission facilities and infrastructure. MVNOs are included in this industry. The SBA has developed a small business size standard for the category of Telecommunications Resellers. Under that size standard, such a business is small if it has 1,500 or fewer employees. 2012 U.S. Census Bureau data show that 1,341 firms provided resale services during that year. Of that number, 1,341 operated with fewer than 1,000 employees. Thus, under this category and the associated small business size standard, the majority of these resellers can be considered small entities. According to Commission data, 881 carriers have reported that they are engaged in the provision of toll resale services. Of this total, an estimated 857 have 1,500 or fewer employees. Consequently, the Commission estimates that the majority of toll resellers are small entities.

68. Wireless Telecommunications Carriers (except Satellite). This industry comprises establishments engaged in operating and maintaining switching and transmission facilities to provide communications via the airwaves. Establishments in this industry have spectrum licenses and provide services using that spectrum, such as cellular services, paging services, wireless internet access, and wireless video services. The appropriate size standard under SBA rules is that such a business is small if it has 1,500 or fewer employees. For this industry, U.S. Census Bureau data for 2012 show that there were 967 firms that operated for the entire year. Of this total, 955 firms employed fewer than 1,000 employees and 12 firms employed of 1000 employees or more. Thus under this category and the associated size standard, the Commission estimates that the majority of Wireless Telecommunications Carriers (except Satellite) are small entities.

69. The Commission's own data—available in its Universal Licensing System—indicate that, as of August 31, 2018 there are 265 Cellular licensees that will be affected by our actions. The Commission does not know how many of these licensees are small, as the Commission does not collect that information for these types of entities. Similarly, according to internally developed Commission data, 413 carriers reported that they were engaged in the provision of wireless telephony, including cellular service, Personal Communications Service (PCS), and Specialized Mobile Radio (SMR) Telephony services. Of this total, an estimated 261 have 1,500 or fewer employees, and 152 have more than 1,500 employees. Thus, using available data, we estimate that the majority of wireless firms can be considered small.

70. Satellite Telecommunications. This category comprises firms “primarily engaged in providing telecommunications services to other establishments in the telecommunications and broadcasting industries by forwarding and receiving communications signals via a system of satellites or reselling satellite telecommunications.” Satellite telecommunications service providers include satellite and earth station operators. The category has a small business size standard of $35 million or less in average annual receipts, under SBA rules. For this category, U.S. Census Bureau data for 2012 show that there were a total of 333 firms that operated for the entire year. Of this total, 299 firms had annual receipts of less than $25 million. Consequently, we estimate that the majority of satellite telecommunications providers are small entities.

71. All Other Telecommunications. The “All Other Telecommunications” category is comprised of establishments primarily engaged in providing specialized telecommunications services, such as satellite tracking, communications telemetry, and radar station operation. This industry also includes establishments primarily engaged in providing satellite terminal stations and associated facilities connected with one or more terrestrial systems and capable of transmitting telecommunications to, and receiving telecommunications from, satellite systems. Establishments providing internet services or voice over internet protocol (VoIP) services via client-supplied telecommunications connections are also included in this industry. The SBA has developed a small business size standard for “All Other Telecommunications,” which consists of all such firms with annual receipts of $35 million or less. For this category, U.S. Census Bureau data for 2012 show that there were 1,442 firms that operated for the entire year. Of those firms, a total of 1,400 had annual receipts less than $25 million and 15 firms had annual receipts of $25 million to $49,999,999. Thus, the Commission estimates that the majority of “All Other Telecommunications” firms potentially affected by our action can be considered small.

72. internet Service Providers (Broadband). Broadband internet service providers include wired ( e.g., cable, DSL) and VoIP service providers using their own operated wired telecommunications infrastructure fall in the category of Wired Telecommunication Carriers. Wired Telecommunications Carriers are comprised of establishments primarily engaged in operating and/or providing access to transmission facilities and infrastructure that they own and/or lease for the transmission of voice, data, text, sound, and video using wired telecommunications networks. Transmission facilities may be based on a single technology or a combination of technologies. The SBA size standard for this category classifies a business as small if it has 1,500 or fewer employees. U.S. Census Bureau data for 2012 show that there were 3,117 firms that operated that year. Of this total, 3,083 operated with fewer than 1,000 employees. Consequently, under this size standard the majority of firms in this industry can be considered small.

73. In this NPRM, we propose to prohibit wireless carriers from effectuating a SIM swap unless the carrier uses a secure method of authenticating its customer. We also propose to amend our CPNI rules to require wireless carriers to develop procedures for responding to failed authentication attempts and to notify customers immediately of any requests for SIM changes. We also seek comment on whether we should impose customer service, training, and transparency requirements specifically focused on preventing SIM swap fraud. We likewise propose to amend our number porting rules to combat port-out fraud while continuing to encourage robust competition through efficient number porting. Specifically, the Commission also proposes to amend the LNP rules to require carriers to send customers a text message or push notification whenever a porting request is made; to require carriers to allow customers the option to freeze their accounts to prevent any unauthorized port-out requests; and to codify the data fields wireless carriers must use to validate a port request. Finally, we also seek comment whether we should adopt any other changes to our rules to address SIM swap and port-out fraud, including the difficulties encountered by victims of these schemes.

74. Should the Commission decide to modify existing rules or adopt new rules to protect customers from SIM swap or porting-out fraud, such action could potentially result in increased, reduced, or otherwise modified recordkeeping, reporting, or other compliance requirements for affected providers of service. We seek comment on the effect of any proposals on small entities. Entities, especially small businesses, are encouraged to quantify the costs and benefits of any reporting, recordkeeping, or compliance requirement that may be established in this proceeding.

75. The RFA requires an agency to describe any significant, specifically small business, alternatives that it has considered in reaching its proposed approach, which may include the following four alternatives (among others): “(1) the establishment of differing compliance or reporting requirements or timetables that take into account the resources available to small entities; (2) the clarification, consolidation, or simplification of compliance and reporting requirements under the rule for such small entities; (3) the use of performance rather than design standards; and (4) an exemption from coverage of the rule, or any part thereof, for such small entities.”

76. In this NPRM, we seek comment whether the Commission should modify its CPNI or LNP rules to protect customers from SIM swap and port-out fraud, and, if so, whether our proposals would be effective to do so. In this NPRM, we seek comment on the impact that any proposed rules could have on smaller carriers. We also seek comment on the benefits and burdens, especially the burdens on small entities, of adopting any new or revised rules regarding the customer authentication and porting process. Specifically, we seek comment whether the proposed requirements would impose additional burdens on smaller carriers; whether smaller carriers would face different costs than larger carriers in implementing the new requirements, if adopted; whether smaller carriers would need more time to comply with any new or modified authentication or port-out rules; and whether smaller providers face other obstacles that we have not considered here. The Commission expects to consider the economic impact on small entities, as identified in comments filed in response to the NPRM, in reaching its final conclusions and taking action in this proceeding.

77. None.

78. Ex Parte Rules. This proceeding shall be treated as a “permit-but-disclose” proceeding in accordance with the Commission's ex parte rules. Persons making ex parte presentations must file a copy of any written presentation or a memorandum summarizing any oral presentation within two business days after the presentation (unless a different deadline applicable to the Sunshine period applies). Persons making oral ex parte presentations are reminded that memoranda summarizing the presentation must (1) list all persons attending or otherwise participating in the meeting at which the ex parte presentation was made, and (2) summarize all data presented and arguments made during the presentation. If the presentation consisted in whole or in part of the presentation of data or arguments already reflected in the presenter's written comments, memoranda or other filings in the proceeding, the presenter may provide citations to such data or arguments in his or her prior comments, memoranda, or other filings (specifying the relevant page and/or paragraph numbers where such data or arguments can be found) in lieu of summarizing them in the memorandum. Documents shown or given to Commission staff during ex parte meetings are deemed to be written ex parte presentations and must be filed consistent with Rule 1.1206(b). In proceedings governed by Rule 1.49(f) or for which the Commission has made available a method of electronic filing, written ex parte presentations and memoranda summarizing oral ex parte presentations, and all attachments thereto, must be filed through the electronic comment filing system available for that proceeding, and must be filed in their native format ( e.g., .doc, .xml, .ppt, searchable .pdf). Participants in this proceeding should familiarize themselves with the Commission's ex parte rules.

79. Initial Regulatory Flexibility Analysis. Pursuant to the Regulatory Flexibility Act (RFA), the Commission has prepared an Initial Regulatory Flexibility Analysis (IRFA) of the possible significant economic impact on small entities of the policies and actions considered in this NPRM. Written public comments are requested on this IRFA. Comments must be identified as responses to the IRFA and must be filed by the deadlines for comments on the NPRM. The Commission's Consumer and Governmental Affairs Bureau, Reference Information Center, will send a copy of the NPRM, including the IRFA, to the Chief Counsel for Advocacy of the Small Business Administration.

80. Paperwork Reduction Act of 1995 Analysis. This document contains proposed new or modified information collection requirements. The Commission, as part of its continuing effort to reduce paperwork burdens, invites the general public and the Office of Management and Budget (OMB) to comment on the information collection requirements contained in this document, as required by the Paperwork Reduction Act of 1995, Public Law 104-13. In addition, pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107-198, we seek specific comment on how we might further reduce the information collection burden for small business concerns with fewer than 25 employees.

81. Accordingly, it is ordered that, pursuant to the authority contained in sections 1, 4, 201, 222, 251, 303(r), and 332 of the Communications Act of 1934, as amended, 47 U.S.C. 151, 154, 201, 222, 251, 303(r), and 332, this Notice of Proposed Rulemaking in WC Docket No. 21-341 is adopted .

82. It is further ordered that the Commission's Consumer and Governmental Affairs Bureau, Reference Information Center, shall send a copy of this Notice of Proposed Rulemaking, including the Initial Regulatory Flexibility Analysis, to the Chief Counsel for Advocacy of the Small Business Administration.

For the reasons discussed in the preamble, the Federal Communications Commission proposes to amend 47 CFR parts 52 and 64 as follows:

The revisions and addition read as follows:

On May 20, 2021, President Biden signed Executive Order (E.O.) 14030, Climate-Related Financial Risk (May 25, 2021, 86 FR 27967). The E.O. recognizes that the intensifying impacts of climate change present a set of growing risks to financial assets, companies, communities, and workers. The Federal Government itself is exposed to these same risks. The failure to appropriately and adequately account for these risks threatens the financial and operational effectiveness of the Federal Government and its ability to meet the needs of its citizens.

The E.O. states that the Federal Government should lead by example by appropriately prioritizing Federal investments and conducting prudent fiscal management. One critical lever is ensuring that the Federal Government manages climate-related financial risk within its own procurement activity, while also leveraging its scale as the Nation's largest spender to speed the adoption of key assessment, disclosure, and mitigation measures across the private sector. To that end, section 5(b)(ii) of the E.O. directed the Federal Acquisition Regulatory Council, in consultation with the Chair of the Council on Environmental Quality and the heads of other agencies as appropriate, to consider amending the FAR to ensure that major Federal agency procurements minimize the risk of climate change, including requiring the social cost of greenhouse gas emissions to be considered in procurement decisions and, where appropriate and feasible, giving preference to bids and proposals from suppliers with a lower social cost of greenhouse gas emissions.

As stated in section 5(a) of E.O. 13990, Protecting Public Health and the Environment and Restoring Science to Tackle the Climate Crisis, the “social cost” is an estimate of the monetized damages associated with incremental increases in greenhouse gas emissions (January 25, 2021, 86 FR 7037). Interim estimates on the social cost of carbon, methane, and nitrous oxide under E.O. 13990 were published in February 2021 and are available at https://www.whitehouse.gov/wp-content/uploads/2021/02/TechnicalSupportDocument_SocialCostofCarbonMethaneNitrousOxide.pdf. Recommendations from the Interagency Working Group on the Social Cost of Greenhouse Gases established under E.O. 13990 on considering the social cost of carbon, methane, and nitrous oxide in procurement will also be considered in development of a proposed rule under this FAR case.

Current FAR coverage of greenhouse gas emissions is primarily in subpart 23.8 and the associated clauses in part 52, with definitions at 2.101 and 23.001. FAR Case 2021-015, Disclosure of Greenhouse Gas Emissions and Climate-Related Financial Risk, implements section 5(b)(i) of the E.O.; that paragraph requires consideration of a FAR amendment to require major Federal suppliers to publicly disclose greenhouse gas emissions and climate-related financial risk and to set science-based reduction targets.

DoD, GSA, and NASA welcome general input from the public on a potential amendment to the FAR to accomplish the stated objectives. Respondents are encouraged to offer their feedback on the following questions:

(a) How can greenhouse gas emissions, including the social cost of greenhouse gases, best be qualitatively and quantitatively considered in Federal procurement decisions, both domestic and overseas? How might this vary across different sectors?

(b) What are usable and respected methodologies for measuring the greenhouse gases emissions over the lifecycle of the products procured or leased, or of the services performed?

(c) How can procurement and program officials of major Federal agency procurements better incorporate and mitigate climate-related financial risk? How else might the Federal Government consider and minimize climate-related financial risks through procurement decisions, both domestic and overseas?

(d) How would (or how does) your organization provide greenhouse gas emission data for proposals and/or contract performance?

(e) How might the Federal Government best standardize greenhouse gas emission reporting methods? How might the Government verify greenhouse gas emissions reporting?

(f) How might the Federal Government give preference to bids and proposals from suppliers, both domestic and overseas, to achieve reductions in greenhouse gas emissions or reduce the social cost of greenhouse gas emissions most effectively?