{"id":28847,"date":"2023-01-10T00:36:04","date_gmt":"2023-01-10T00:36:04","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/10\/fcc-rule-would-require-telcos-to-immediately-notify-consumers-and-agencies-of-data-breaches\/"},"modified":"2023-01-10T00:36:04","modified_gmt":"2023-01-10T00:36:04","slug":"fcc-rule-would-require-telcos-to-immediately-notify-consumers-and-agencies-of-data-breaches","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/10\/fcc-rule-would-require-telcos-to-immediately-notify-consumers-and-agencies-of-data-breaches\/","title":{"rendered":"FCC rule would require telcos to immediately notify consumers and agencies of data breaches"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

The U.S. Federal Communications Commission has proposed a new rule for data breach reporting that would require telecommunications providers to notify consumers and agencies of any data breach immediately.<\/p>\n

Under the proposed rule change<\/a>, the existing seven business day rule to inform customers of a breach would be abolished. The new rule will require that all identified data breaches be reported to consumers, the FCC, the Federal Bureau of Investigation and the Secret Service as soon as they are identified unless otherwise directed by federal officials.<\/p>\n

According to<\/a> NextGov, the proposal would also expand the FCC\u2019s definition of a data breach \u201cto include inadvertent access use or disclosures of customer information.\u201d Previously, a data breach only needed to be disclosed when an outside actor gained unauthorized access to sensitive information.<\/p>\n

\u201cWe propose to revise our definition to define a breach as any instance in which a person, without authorization or exceeding authorization, has gained access to, used, or disclosed [customer proprietary network information],\u201d the Notice of Proposed Rulemaking<\/a> states.<\/p>\n

Having gained the unanimous support of the full commission, the proposed rule change now goes to a review period in which the FCC is seeking comments and will gather further information. In addition, the FCC is asking for comment on whether to require customer breach notices to include specific categories of information to help ensure they contain actionable information useful to the consumer.<\/p>\n

\u201cThe law requires carriers to protect sensitive consumer information but, given the increase in frequency, sophistication and scale of data leaks, we must update our rules to protect consumers and strengthen reporting requirements,\u201d FCC Chairwoman Jessica Rosenworcel said in a statement<\/a>. \u201cThis new proceeding will take a much-needed, fresh look at our data breach reporting rules to better protect consumers, increase security, and reduce the impact of future breaches.\u201d<\/p>\n

While, in theory, the proposal sounds positive, security experts are concerned given the wording of the proposal and what will be covered.<\/p>\n

\u201cWhether the CIRCIA or the FCC\u2019s newly proposed breach reporting rules, they are blurring the line between an \u2018incident\u2019 and a \u2018breach,’\u201d\u00a0Sounil Yu, chief information security officer at cyber asset management company JupiterOne Inc.<\/a>, told SiliconANGLE. \u201cA breach has specific legal meaning and obligations.\u201d<\/p>\n

Yu explains that incident handling and reporting have traditionally remained in the CISO\u2019s realm of responsibility and many incidents result in no actual harm and do not constitute a material breach.<\/p>\n

\u201cHowever, if these rules lower that threshold and treat what was merely an \u2018incident\u2019 at the same level as a \u2018breach\u2019 in the eyes of the law, then legal teams may need to be involved in every incident going forward,\u201d Yu added. \u201cThis can significantly hinder the progress of any incident investigation and encumber security teams with additional reporting requirements that do not meaningfully contribute to our collective situational awareness.\u201d<\/p>\n

Andrew Barratt, vice president at cybersecurity advisory services provider Coalfire Systems Inc.<\/a>, argues that the requirements \u201ccould make it very challenging for telecoms companies to provide meaningful responses to law enforcement and customers or potentially delay making a decision on formally categorizing a security event as a \u2018data breach\u2019.\u201d<\/p>\n

Image: FCC<\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n