[Senate Report 115-91]
[From the U.S. Government Publishing Office]
Calendar No. 117
115th Congress } { Report
SENATE
1st Session } { 115-91
_______________________________________________________________________
SPOOFING PREVENTION ACT OF 2017
__________
R E P O R T
of the
COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
on
S. 134
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
June 6, 2017.--Ordered to be printed
_________
U.S. GOVERNMENT PUBLISHING OFFICE
69-010 WASHINGTON : 2017
SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
one hundred fifteenth congress
first session
JOHN THUNE, South Dakota, Chairman
ROGER F. WICKER, Mississippi BILL NELSON, Florida
ROY BLUNT, Missouri MARIA CANTWELL, Washington
TED CRUZ, Texas AMY KLOBUCHAR, Minnesota
DEB FISCHER, Nebraska RICHARD BLUMENTHAL, Connecticut
JERRY MORAN, Kansas BRIAN SCHATZ, Hawaii
DAN SULLIVAN, Alaska EDWARD J. MARKEY, Massachusetts
DEAN HELLER, Nevada CORY A. BOOKER, New Jersey
JAMES M. INHOFE, Oklahoma TOM UDALL, New Mexico
MIKE LEE, Utah GARY C. PETERS, Michigan
RON JOHNSON, Wisconsin TAMMY BALDWIN, Wisconsin
SHELLEY MOORE CAPITO, West TAMMY DUCKWORTH, Illinois
Virginia
CORY GARDNER, Colorado MARGARETWOODHASSAN,NewHampshire
TODD C. YOUNG, Indiana CATHERINE CORTEZ MASTO, Nevada
Nick Rossi, Staff Director
Adrian Arnakis, Deputy Staff Director
Jason Van Beek, General Counsel
Kim Lipsky, Democratic Staff Director
Christopher Day, Democratic Deputy Staff Director
Calendar No. 17
115th Congress } { Report
SENATE
1st Session } { 115-91
======================================================================
SPOOFING PREVENTION ACT OF 2017
_______
June 6, 2017.--Ordered to be printed
_______
Mr. Thune, from the Committee on Commerce, Science, and Transportation,
submitted the following
R E P O R T
[To accompany S. 134]
[Including cost estimate of the Congressional Budget Office]
The Committee on Commerce, Science, and Transportation, to
which was referred the bill (S. 134) to expand the prohibition
on misleading or inaccurate caller identification information,
and for other purposes, having considered the same, reports
favorably thereon with an amendment (in the nature of a
substitute) and recommends that the bill (as amended) do pass.
Purpose of the Bill
S. 134 would provide the Federal Communications Commission
(FCC or Commission) with updated authority to address
``spoofing'' in the United States. Specifically, the FCC would
be empowered to combat spoofing originating from international
locations, by text message and by other voice communications
services. It also would direct the FCC, in conjunction with the
Federal Trade Commission (FTC), to assess and make available
resources and measures the public can use to protect themselves
from spoofing.
Background and Needs
As the FCC noted over 5 years ago, ``[i]ncreasingly, bad
actors are altering or manipulating caller ID information--
known as caller ID spoofing--to further a wide variety of
malicious schemes, from identity theft to placing false
emergency calls to SWAT teams. Using spoofing services
accessible through the web or prepaid cards, anyone can
inexpensively mask the origin of a call with fake caller
identification information.''\1\ Although the FCC has
promulgated rules to address spoofing, there has been increased
spoofing coming from outside the United States. In testimony
before the Committee, then-FCC Chairman Tom Wheeler noted that
he had himself been spoofed by a party claiming to be the
Internal Revenue Service: ``This was a U.S. number, but it was
coming from abroad.''\2\ Former FCC Commissioner Jessica
Rosenworcel stated, ``[t]hat fraud has moved offshore. It's now
coming from international locations.''\3\
---------------------------------------------------------------------------
\1\Federal Communications Commission (FCC), ``Consumers Gain New
Protections against Fraudulent Call ID `Spoofing,''' News Release, June
23, 2011, at https://www.fcc.gov/document/consumers-gain-new-
protections-against-fraudulent-caller-id-spoofing.
\2\U.S. Congress, Senate Committee on Commerce, Science, and
Transportation, Oversight of the Federal Communications Commission,
114th Congress, 2nd session, March 2, 2016, S.Hrg 114-607.
\3\Ibid.
---------------------------------------------------------------------------
The increase in fraud committed through spoofing is not
limited to calls originating from overseas. As communications
technologies have evolved, so has spoofing activity. In recent
years, spoofing scams in the United States have used text
messaging services and other alternative voice communications
services. One 2014 survey estimated that spoofing fraud
affected 17.6 million Americans over the 12 months preceding
the survey, with that fraudulent activity costing them $8.6
billion.\4\ That same survey indicated that the actual amount
of fraud was likely higher than these numbers revealed given
the reluctance of many to report that they were victims of
fraud. One story last year recounted the experience of a
Tennessee resident who committed suicide after losing thousands
of dollars to a Jamaican lottery scam perpetrated using caller
ID spoofing.\5\
Congress first addressed the practice of caller ID spoofing
in the Truth in Caller ID Act of 2009 (Public Law 111-331; 124
Stat. 3572).\6\ That Act directed the FCC to prepare a report
making recommendations to Congress on whether additional
legislation is necessary to prohibit the provision of
inaccurate caller identification information in technologies
that are successor or replacement technologies to
telecommunications service or IP-enabled voice service.\7\ The
FCC's report recommended such additional legislation, in
particular with respect to expanding the agency's jurisdiction
to pursue spoofing originating from overseas, as well as
spoofing activity using text messaging services and other voice
communications services not already covered by the law.\8\
Congress has yet to update the Communications Act of 1934 (47
U.S.C. 151 et seq.) in response to those recommendations.
---------------------------------------------------------------------------
\4\Weisbaum, Herb, ``Americans Lost $8.6 billion to Phone Fraud in
last Year, Survey Suggests,'' Today, August 27, 2014, at http://
www.today.com/money/americans-lost-8-6-billion-phone-fraud-last-year-
survey-1D80108259.
\5\Drash, Wayne, ``Driven to Death by Phone Scammers,'' CNN,
October 7, 2015, at http://www.cnn.com/2015/10/07/us/jamaica-lottery-
scam-suicide.
\6\Public Law 111-331; codified at 47 U.S.C. Sec. 227(e).
\7\47 U.S.C. Sec. 227(e)(4).
\8\FCC Report: Caller Identification Information in Successor or
Replacement Technologies, June 22, 2011, at https://apps.fcc.gov/
edocs_public/attachmatch/DA-11-1089A1.pdf.
---------------------------------------------------------------------------
Legislative History
S. 134 was introduced on January 12, 2017, by Senators
Nelson, Fischer, Klobuchar, and Blunt, and was referred to the
Committee on Commerce, Science, and Transportation of the
Senate. On January 24, 2017, the Committee met in open
Executive Session and, by voice vote, ordered S. 134 reported
with an amendment (in the nature of a substitute). The
Committee approved an amendment by Senator Nelson stating that,
except as otherwise provided, a ``text message'' would not
include a message sent over an IP-enabled messaging service to
another user of the same messaging service.
On January 10, 2017, Representatives Meng, Barton, and
Lance introduced H.R. 423, the Anti-Spoofing Act of 2017, a
bill substantially similar to S. 134. On January 23, 2017, the
House of Representatives agreed to that Act by roll call vote,
398 to 5. On January 24, 2017, H.R. 423 was received by the
Senate and referred to the Committee.
S. 134 is substantially similar to legislation previously
reported favorably by the Committee in 2016. In the 114th
Congress, Senators Nelson and Fischer introduced S. 2558, the
Spoofing Prevention Act of 2016. On April 27, 2016, the
Committee held an Executive Session during which S. 2644, the
FCC Reauthorization Act of 2016, was considered. That bill,
containing an amended version of S. 2558, was ordered reported
favorably, by voice vote, with an amendment (in the nature of a
substitute).
A similar bill, H.R. 2669, the Anti-Spoofing Act of 2015,
was introduced in the House of Representatives by
Representatives Meng, Barton, and Lance on June 4, 2015. On
November 14, 2016, H.R. 2669, as amended, was agreed to in the
House of Representatives by a roll call vote, 382 to 5, and was
received by the Senate on November 15, 2016. The House of
Representatives-passed version of H.R. 2669 was substantially
similar to the version of S. 2558 that was passed by the
Committee as part of S. 2644.
Estimated Costs
In accordance with paragraph 11(a) of rule XXVI of the
Standing Rules of the Senate and section 403 of the
Congressional Budget Act of 1974, the Committee provides the
following cost estimate, prepared by the Congressional Budget
Office:
S. 134-Spoofing Prevention Act of 2017
Under current law, the Federal Communications Commission
(FCC) has the authority to levy penalties and criminal fines
against individuals who use fake information about a caller's
identification to defraud or harm another. S. 134 would expand
that authority to include the use of text messages and would
apply the authority to violators outside of the United States
if the recipient is within the United States. The bill also
would direct the FCC to develop consumer education materials
that provide information for consumers on identifying
fraudulent caller activities. Finally, S. 134 would direct the
Government Accountability Office (GAO) to conduct a study on
actions taken by the FCC to combat the provision of inaccurate
caller information and to identify additional steps that could
be taken by the agency.
Based on an analysis of information from the FCC about the
agency's current enforcement capabilities, CBO estimates that
implementing S. 134 would increase the agency's costs by less
than $500,000 to enforce the expanded prohibition and to update
current consumer education materials However, the FCC is
authorized to collect fees sufficient to offset the costs of
its regulatory activities each year; therefore, CBO estimates
that the net effect on discretionary spending would be
negligible, assuming appropriation actions consistent with that
authority. Based on the costs of similar reports conducted by
GAO, CBO estimates that the increased costs to conduct the
required study would be insignificant.
S. 134 would broaden the coverage of current laws relating
to the use of misleading or inaccurate caller identification
information. As a result, the government might be able to
pursue cases that it otherwise would not be able to prosecute.
Because those prosecuted and convicted under S. 134 could be
subject to criminal fines, the federal collections might
increase. Criminal fines are recorded as revenues, deposited in
the Crime Victims Fund, and later spent without further
appropriation action; therefore, pay-as-you-go procedures
apply. CBO expects that any additional revenues and subsequent
direct spending would not be significant because the
legislation would probably affect only a small number of cases.
CBO estimates that enacting S. 134 would not increase net
direct spending or on-budget deficits in any of the four
consecutive 10-year periods beginning in 2028.
S. 134 contains no intergovernmental or private sector
mandates as defined in the Unfunded Mandates Reform Act and
would not affect the budgets of state, local, or tribal
governments.
The CBO staff contact for this estimate is Stephen Rabent.
The estimate was approved by H. Samuel Papenfuss, Deputy
Assistant Director for Budget Analysis.
Regulatory Impact
In accordance with paragraph 11(b) of rule XXVI of the
Standing Rules of the Senate, the Committee provides the
following evaluation of the regulatory impact of the
legislation, as reported:
number of persons covered
The bill would for the first time extend spoofing
prohibitions to persons outside the United States. It also
would expand the categories of services in the United States,
namely text messaging and other voice services as defined by
the bill, subject to spoofing prohibitions. The bill, though,
is not expected to have a significant impact on the number of
types of individuals and businesses regulated in the United
States, as nearly all offerors of such services already are
regulated under the Communications Act of 1934.
economic impact
By reducing consumer harms related to misleading or
inaccurate caller identification information, the bill is
expected to have a positive economic impact.
privacy
The bill is not expected to have an adverse effect on the
personal privacy of any individuals.
paperwork
The Committee does not anticipate an increased paperwork
burden on regulated entities as a result of this bill.
Congressionally Directed Spending
In compliance with paragraph 4(b) of rule XLIV of the
Standing Rules of the Senate, the Committee provides that no
provisions contained in the bill, as reported, meet the
definition of congressionally directed spending items under the
rule.
Section-by-Section Analysis
Section 1. Short title.
This section would provide that this Act may be cited as
the ``Spoofing Prevention Act of 2017.''
Section 2. Definition.
This section would define ``Commission'' to mean the
Federal Communications Commission.
Section 3. Spoofing Prevention.
Section 3(a) would amend section 227(e)(1) of the
Communications Act of 1934 (47 U.S.C. 227(e)(1)) to extend the
current prohibition of misleading or inaccurate caller
identification information to include those acting from outside
the United States if the recipient of the call or text is
within the United States. This section also would provide new
definitions of text messaging and voice services, and would
include both under the prohibition against spoofing. The
section would provide that, except as otherwise provided, a
``text message'' would not include a message sent over an IP-
enabled messaging service to another user of the same messaging
service.
Section 3(a) also would provide a technical amendment to
the heading of section 227(e) of that Act, inserting
``misleading or'' so that the heading would read, ``prohibition
on provision of misleading or inaccurate caller identification
information.'' This mirrors the language of the statute itself.
Finally, section 3(a) would require the FCC to implement
the amendments made by the section not later than 18 months
after the date of enactment of the Act, and would provide that
such regulations be effective 6 months after the Commission
prescribes them.
Section 3(b) would require the Commission, in collaboration
with the FTC, to develop consumer educations materials that
provide information about ways for consumers to identify scams
and other fraudulent activities that rely on the use of
misleading or inaccurate caller identification information; and
existing technologies, if any, that consumers can use to
protect against such scams and other fraudulent activities. The
Commission would be required to include these consumer
education materials on its website and to update the materials
on a regular basis.
Section 3(c) would require the Government Accountability
Office (GAO) to study FCC and FTC actions to combat spoofing
and the additional measures that could be taken to combat such
activity. GAO would be required to submit a report on this
study that includes the following: (1) trends in spoofing
activity; (2) previous and current FCC and FTC enforcement
actions; (3) current efforts by industry groups to develop
technical standards to deter or prevent spoofing and how those
may help combat spoofing; and (4) whether there are additional
actions the FCC, FTC, and Congress should take to combat
spoofing. The Committee is aware of the fact that in 2016 the
FCC convened a Robocall Strike Force to address spoofing and
related issues, and it intends for GAO to review the work done
by that strike force in this report, including making
recommendations based upon the strike force's work. GAO would
be required to submit this report on its findings and
recommendations to the Committee and to the Committee on Energy
and Commerce of the House of Representatives not later than 18
months after the date of enactment of the Act.
Section 3(d) would provide a rule of construction stating
that nothing in the section shall affect or modify the
Commission's authority under the Telephone Consumer Protection
Act of 1991 (Public Law 102-243; 105 Stat. 2394) or the CAN-
SPAM Act of 2003 (15 U.S.C. 7701 et seq.).
Changes in Existing Law
In compliance with paragraph 12 of rule XXVI of the
Standing Rules of the Senate, changes in existing law made by
the bill, as reported, are shown as follows (existing law
proposed to be omitted is enclosed in black brackets, new
material is printed in italic, existing law in which no change
is proposed is shown in roman):
COMMUNICATIONS ACT OF 1934
[47 U.S.C. 151 et seq.]
SEC. 227. RESTRICTIONS ON USE OF TELEPHONE EQUIPMENT.\9\
---------------------------------------------------------------------------
\9\The amendments to this section would take effect on the date
that is 6 months after the date on which the Federal Communications
Commission presecribes regulations.
---------------------------------------------------------------------------
[47 U.S.C. 227]
* * * * * * *
(e) Prohibition on Provision of Misleading or Inaccurate
Caller Identification Information.--
(1) In general.--It shall be unlawful for any person
within the United States, [in connection with any
telecommunications service or IP-enabled voice service]
or any person outside the United States if the
recipient of the call is within the United States, in
connection with any voice service or text messaging
service, to cause any caller identification service to
knowingly transmit misleading or inaccurate caller
identification information with the intent to defraud,
cause harm, or wrongfully obtain anything of value,
unless such transmission is exempted pursuant to
paragraph (3)(B).
(2) Protection for blocking caller identification
information.--Nothing in this subsection may be
construed to prevent or restrict any person from
blocking the capability of any caller identification
service to transmit caller identification information.
(3) Regulations.--
(A) In general.--[Not later than 6 months
after the date of enactment of the Truth in
Caller ID Act of 2009, the Commission] The
Commission shall prescribe regulations to
implement this subsection.
(B) Content of regulations.--
(i) In general.--The regulations
required under subparagraph (A) shall
include such exemptions from the
prohibition under paragraph (1) as the
Commission determines is appropriate.
(ii) Specific exemption for law
enforcement agencies or court orders.--
The regulations required under
subparagraph (A) shall exempt from the
prohibition under paragraph (1)
transmissions in connection with--
(I) any authorized activity
of a law enforcement agency; or
(II) a court order that
specifically authorizes the use
of caller identification
manipulation.
(4) Report.--Not later than 6 months after the
enactment of the Truth in Caller ID Act of 2009, the
Commission shall report to Congress whether additional
legislation is necessary to prohibit the provision of
inaccurate caller identification information in
technologies that are successor or replacement
technologies to telecommunications service or IP-
enabled voice service.
(5) Penalties.--
(A) Civil forfeiture.--
(i) In general.--Any person that is
determined by the Commission, in
accordance with paragraphs (3) and (4)
of section 503(b), to have violated
this subsection shall be liable to the
United States for a forfeiture penalty.
A forfeiture penalty under this
paragraph shall be in addition to any
other penalty provided for by this Act.
The amount of the forfeiture penalty
determined under this paragraph shall
not exceed $10,000 for each violation,
or 3 times that amount for each day of
a continuing violation, except that the
amount assessed for any continuing
violation shall not exceed a total of
$1,000,000 for any single act or
failure to act.
(ii) Recovery.--Any forfeiture
penalty determined under clause (i)
shall be recoverable pursuant to
section 504(a).
(iii) Procedure.--No forfeiture
liability shall be determined under
clause (i) against any person unless
such person receives the notice
required by section 503(b)(3) or
section 503(b)(4).
(iv) 2-year statute of limitations.--
No forfeiture penalty shall be
determined or imposed against any
person under clause (i) if the
violation charged occurred more than 2
years prior to the date of issuance of
the required notice or notice or
apparent liability.
(B) Criminal fine.--Any person who willfully
and knowingly violates this subsection shall
upon conviction thereof be fined not more than
$10,000 for each violation, or 3 times that
amount for each day of a continuing violation,
in lieu of the fine provided by section 501 for
such a violation. This subparagraph does not
supersede the provisions of section 501
relating to imprisonment or the imposition of a
penalty of both fine and imprisonment.
(6) Enforcement by states.--
(A) In general.--The chief legal officer of a
State, or any other State officer authorized by
law to bring actions on behalf of the residents
of a State, may bring a civil action, as parens
patriae, on behalf of the residents of that
State in an appropriate district court of the
United States to enforce this subsection or to
impose the civil penalties for violation of
this subsection, whenever the chief legal
officer or other State officer has reason to
believe that the interests of the residents of
the State have been or are being threatened or
adversely affected by a violation of this
subsection or a regulation under this
subsection.
(B) Notice.--The chief legal officer or other
State officer shall serve written notice on the
Commission of any civil action under
subparagraph (A) prior to initiating such civil
action. The notice shall include a copy of the
complaint to be filed to initiate such civil
action, except that if it is not feasible for
the State to provide such prior notice, the
State shall provide such notice immediately
upon instituting such civil action.
(C) Authority to intervene.--Upon receiving
the notice required by subparagraph (B), the
Commission shall have the right--
(i) to intervene in the action;
(ii) upon so intervening, to be heard
on all matters arising therein; and
(iii) to file petitions for appeal.
(D) Construction.--For purposes of bringing
any civil action under subparagraph (A),
nothing in this paragraph shall prevent the
chief legal officer or other State officer from
exercising the powers conferred on that officer
by the laws of such State to conduct
investigations or to administer oaths or
affirmations or to compel the attendance of
witnesses or the production of documentary and
other evidence.
(E) Venue; service or process.--
(i) Venue.--An action brought under
subparagraph (A) shall be brought in a
district court of the United States
that meets applicable requirements
relating to venue under section 1391 of
title 28, United States Code.
(ii) Service of process.--In an
action brought under subparagraph (A)--
(I) process may be served
without regard to the
territorial limits of the
district or of the State in
which the action is instituted;
and
(II) a person who
participated in an alleged
violation that is being
litigated in the civil action
may be joined in the civil
action without regard to the
residence of the person.
(7) Effect on other laws.--This subsection does not
prohibit any lawfully authorized investigative,
protective, or intelligence activity of a law
enforcement agency of the United States, a State, or a
political subdivision of a State, or of an intelligence
agency of the United States.
(8) Definitions.--For purposes of this subsection:
(A) Caller identification information.--The
term ``caller identification information''
means information provided by a caller
identification service regarding the telephone
number of, or other information regarding the
origination of, a call made using a
[telecommunications service or IP-enabled voice
service] voice service or a text message sent
using a text messaging service.
(B) Caller identification service.--The term
``caller identification service'' means any
service or device designed to provide the user
of the service or device with the telephone
number of, or other information regarding the
origination of, a call made using a
[telecommunications service or IP-enabled voice
service] voice service or a text message sent
using a text messaging service. Such term
includes automatic number identification
services.
[(C) IP-enabled voice service.--The term
``IP-enabled voice service'' has the meaning
given that term by section 9.3 of the
Commission's regulations (47 C.F.R. 9.3), as
those regulations may be amended by the
Commission from time to time.]
(C) Text message.--The term ``text
message''--
(i) means a message consisting of
text, images, sounds, or other
information that is transmitted from or
received by a device that is identified
as the transmitting or receiving device
by means of a 10-digit telephone
number;
(ii) includes a short message service
(commonly referred to as `SMS')
message, and a multimedia message
service (commonly referred to as `MMS')
message; and
(iii) does not include--
(I) a real-time, two-way
voice or video communication;
or
(II) a message sent over an
IP-enabled messaging service to
another user of the same
messaging service, except a
message described in clause
(ii).
(D) Text messaging service.--The term ``text
messaging service'' means a service that
enables the transmission or receipt of a text
message, including a service provided as part
of or in connection with a voice service.
(E) Voice service.--The term ``voice
service''--
(i) means any service that furnishes
voice communications to an end user
using resources from the North American
Numbering Plan or any successor to the
North American Numbering Plan adopted
by the Commission under section
251(e)(1); and
(ii) includes transmissions from a
telephone facsimile machine, computer,
or other device to a telephone
facsimile machine.
(9) Limitation.--Notwithstanding any other provision
of this section, subsection (f) shall not apply to this
subsection or to the regulations under this subsection.
* * * * * * *