UPDATED 19:12 EST / JANUARY 09 2023


FCC rule would require telcos to notify consumers and agencies of data breaches immediately

The U.S. Federal Communications Commission has proposed a new rule for data breach reporting that would require telecommunications providers to notify consumers and agencies of any data breach immediately.

Under the proposed rule change issued Friday, the existing seven business day rule to inform customers of a breach would be abolished. The new rule will require that all identified data breaches be reported to consumers, the FCC, the Federal Bureau of Investigation and the Secret Service as soon as they are identified unless otherwise directed by federal officials.

According to NextGov, the proposal would also expand the FCC’s definition of a data breach “to include inadvertent access use or disclosures of customer information.” Previously, a data breach needed to be disclosed only when an outside actor gained unauthorized access to sensitive information.

“We propose to revise our definition to define a breach as any instance in which a person, without authorization or exceeding authorization, has gained access to, used, or disclosed [customer proprietary network information],” the Notice of Proposed Rulemaking states.

Having gained the unanimous support of the full commission, the proposed rule change now goes to a review period in which the FCC is seeking comments and will gather further information. In addition, the FCC is asking for comment on whether to require customer breach notices to include specific categories of information to help ensure they contain actionable information useful to the consumer.

“The law requires carriers to protect sensitive consumer information but, given the increase in frequency, sophistication and scale of data leaks, we must update our rules to protect consumers and strengthen reporting requirements,” FCC Chairwoman Jessica Rosenworcel said in a statement. “This new proceeding will take a much-needed, fresh look at our data breach reporting rules to better protect consumers, increase security, and reduce the impact of future breaches.”

Although the proposal sounds positive, security experts are concerned given the wording of the proposal and what will be covered.

“Whether the CIRCIA or the FCC’s newly proposed breach reporting rules, they are blurring the line between an ‘incident’ and a ‘breach,'” Sounil Yu, chief information security officer at cyber asset management company JupiterOne Inc., told SiliconANGLE. “A breach has specific legal meaning and obligations.”

Yu explains that incident handling and reporting have traditionally remained in the CISO’s realm of responsibility and many incidents result in no actual harm and do not constitute a material breach.

“However, if these rules lower that threshold and treat what was merely an ‘incident’ at the same level as a ‘breach’ in the eyes of the law, then legal teams may need to be involved in every incident going forward,” Yu added. “This can significantly hinder the progress of any incident investigation and encumber security teams with additional reporting requirements that do not meaningfully contribute to our collective situational awareness.”

Andrew Barratt, vice president at cybersecurity advisory services provider Coalfire Systems Inc., argues that the requirements “could make it very challenging for telecoms companies to provide meaningful responses to law enforcement and customers or potentially delay making a decision on formally categorizing a security event as a ‘data breach.'”

Image: FCC

A message from John Furrier, co-founder of SiliconANGLE:

Your vote of support is important to us and it helps us keep the content FREE.

One click below supports our mission to provide free, deep, and relevant content.  

Join our community on YouTube

Join the community that includes more than 15,000 #CubeAlumni experts, including Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger, and many more luminaries and experts.

“TheCUBE is an important partner to the industry. You guys really are a part of our events and we really appreciate you coming and I know people appreciate the content you create as well” – Andy Jassy