[116th Congress Public Law 105] [From the U.S. Government Publishing Office] [[Page 3273]] PALLONE-THUNE TELEPHONE ROBOCALL ABUSE CRIMINAL ENFORCEMENT AND DETERRENCE ACT [[Page 133 STAT. 3274]] Public Law 116-105 116th Congress An Act To deter criminal robocall violations and improve enforcement of section 227(b) of the Communications Act of 1934, and for other purposes. <<NOTE: Dec. 30, 2019 - [S. 151]>> Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled, <<NOTE: Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence Act 47 USC 609 note.>> SECTION 1. SHORT TITLE. This Act may be cited as the ``Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence Act'' or the ``Pallone-Thune TRACED Act''. SEC. 2. <<NOTE: 47 USC 227 note.>> COMMISSION DEFINED. In this Act, the term ``Commission'' means the Federal Communications Commission. SEC. 3. FORFEITURE. (a) In General.--Section 227 of the Communications Act of 1934 (47 U.S.C. 227) is amended-- (1) in subsection (b), by adding at the end the following: ``(4) Civil forfeiture.-- ``(A) In general.--Any person that is determined by the Commission, in accordance with paragraph (3) or (4) of section 503(b), to have violated this subsection shall be liable to the United States for a forfeiture penalty pursuant to section 503(b)(1). Paragraph (5) of section 503(b) shall not apply in the case of a violation of this subsection. A forfeiture penalty under this subparagraph shall be in addition to any other penalty provided for by this Act. The amount of the forfeiture <<NOTE: Determination.>> penalty determined under this subparagraph shall be determined in accordance with subparagraphs (A) through (F) of section 503(b)(2). ``(B) Violation with intent.--Any person that is determined by the Commission, in accordance with paragraph (3) or (4) of section 503(b), to have violated this subsection with the intent to cause such violation shall be liable to the United States for a forfeiture penalty pursuant to section 503(b)(1). Paragraph (5) of section 503(b) shall not apply in the case of a violation of this subsection. A forfeiture penalty under this subparagraph shall be in addition to any other penalty provided for by this Act. The amount of the forfeiture penalty determined under this subparagraph shall be equal to an amount determined in accordance with subparagraphs (A) through (F) of section 503(b)(2) plus an additional penalty not to exceed $10,000. [[Page 133 STAT. 3275]] ``(C) Recovery.--Any forfeiture penalty determined under subparagraph (A) or (B) shall be recoverable under section 504(a). ``(D) Procedure.--No forfeiture liability shall be determined under subparagraph (A) or (B) against any person unless such person receives the notice required by section 503(b)(3) or section 503(b)(4). ``(E) Statute of limitations.--Notwithstanding paragraph (6) of section 503(b), no forfeiture penalty shall be determined or imposed against any person-- ``(i) under subparagraph (A) if the violation charged occurred more than 1 year prior to the date of issuance of the required notice or notice of apparent liability; or ``(ii) under subparagraph (B) if the violation charged occurred more than 4 years prior to the date of issuance of the required notice or notice of apparent liability. ``(F) Rule of construction.--Notwithstanding any law to the contrary, the Commission may not determine or impose a forfeiture penalty on a person under both subparagraphs (A) and (B) based on the same conduct.''; (2) in subsection (e)(5)(A)-- (A) in clause (ii), by adding at the end the following: ``Paragraph (5) of section 503(b) shall not apply in the case of a violation of this subsection.''; and (B) in clause (iv)-- (i) in the heading, by striking ``2-year'' and inserting ``4-year''; and (ii) by striking ``2 years'' and inserting ``4 years''; and (3) by striking subsection (h) and inserting the following: ``(h) Annual Report to Congress on Robocalls and Transmission of Misleading or Inaccurate Caller Identification Information.-- ``(1) Report required.--Not later than 1 year after the date of the enactment of this subsection, and annually thereafter, the Commission, after consultation with the Federal Trade Commission, shall submit to Congress a report regarding enforcement by the Commission of subsections (b), (c), (d), and (e) during the preceding calendar year. ``(2) <<NOTE: Time periods.>> Matters for inclusion.--Each report required by paragraph (1) shall include the following: ``(A) The number of complaints received by the Commission during each of the preceding 5 calendar years, for each of the following categories: ``(i) Complaints alleging that a consumer received a call in violation of subsection (b) or (c). ``(ii) Complaints alleging that a consumer received a call in violation of the standards prescribed under subsection (d). ``(iii) Complaints alleging that a consumer received a call in connection with which misleading or inaccurate caller identification information was transmitted in violation of subsection (e). ``(B) The number of citations issued by the Commission pursuant to section 503(b) during the preceding calendar [[Page 133 STAT. 3276]] year to enforce subsection (d), and details of each such citation. ``(C) The number of notices of apparent liability issued by the Commission pursuant to section 503(b) during the preceding calendar year to enforce subsections (b), (c), (d), and (e), and details of each such notice including any proposed forfeiture amount. ``(D) The number of final orders imposing forfeiture penalties issued pursuant to section 503(b) during the preceding calendar year to enforce such subsections, and details of each such order including the forfeiture imposed. ``(E) The amount of forfeiture penalties or criminal fines collected, during the preceding calendar year, by the Commission or the Attorney General for violations of such subsections, and details of each case in which such a forfeiture penalty or criminal fine was collected. ``(F) <<NOTE: Proposal.>> Proposals for reducing the number of calls made in violation of such subsections. ``(G) <<NOTE: Analysis. Recommenda- tions.>> An analysis of the contribution by providers of interconnected VoIP service and non-interconnected VoIP service that discount high-volume, unlawful, short- duration calls to the total number of calls made in violation of such subsections, and recommendations on how to address such contribution in order to decrease the total number of calls made in violation of such subsections. ``(3) No additional reporting required.--The Commission shall prepare the report required by paragraph (1) without requiring the provision of additional information from providers of telecommunications service or voice service (as defined in section 4(a) of the Pallone-Thune TRACED Act).''. (b) <<NOTE: 47 USC 227 note.>> Applicability.--The amendments made by this section shall not affect any action or proceeding commenced before and pending on the date of the enactment of this Act. (c) <<NOTE: 47 USC 227 note.>> Deadline for Regulations.--The Commission shall prescribe regulations to implement the amendments made by this section not later than 270 days after the date of the enactment of this Act. SEC. 4. <<NOTE: 47 USC 227b.>> CALL AUTHENTICATION. (a) Definitions.--In this section: (1) STIR/SHAKEN authentication framework.--The term ``STIR/ SHAKEN authentication framework'' means the secure telephone identity revisited and signature-based handling of asserted information using tokens standards proposed by the information and communications technology industry. (2) Voice service.--The term ``voice service''-- (A) means any service that is interconnected with the public switched telephone network and that furnishes voice communications to an end user using resources from the North American Numbering Plan or any successor to the North American Numbering Plan adopted by the Commission under section 251(e)(1) of the Communications Act of 1934 (47 U.S.C. 251(e)(1)); and (B) includes-- (i) transmissions from a telephone facsimile machine, computer, or other device to a telephone facsimile machine; and [[Page 133 STAT. 3277]] (ii) without limitation, any service that enables real-time, two-way voice communications, including any service that requires internet protocol-compatible customer premises equipment (commonly known as ``CPE'') and permits out-bound calling, whether or not the service is one-way or two-way voice over internet protocol. (b) Authentication Frameworks.-- (1) <<NOTE: Deadline. Requirements.>> In general.--Subject to paragraphs (2) and (3), and in accordance with paragraph (6), not later than 18 months after the date of the enactment of this Act, the Commission shall-- (A) require a provider of voice service to implement the STIR/SHAKEN authentication framework in the internet protocol networks of the provider of voice service; and (B) require a provider of voice service to take reasonable measures to implement an effective call authentication framework in the non-internet protocol networks of the provider of voice service. (2) <<NOTE: Determination. Deadline.>> Implementation.--The Commission shall not take the action described in paragraph (1) with respect to a provider of voice service if the Commission determines, not later than 12 months after the date of the enactment of this Act, that such provider of voice service-- (A) in internet protocol networks-- (i) has adopted the STIR/SHAKEN authentication framework for calls on the internet protocol networks of the provider of voice service; (ii) has agreed voluntarily to participate with other providers of voice service in the STIR/ SHAKEN authentication framework; (iii) has begun to implement the STIR/SHAKEN authentication framework; and (iv) <<NOTE: Deadline.>> will be capable of fully implementing the STIR/SHAKEN authentication framework not later than 18 months after the date of the enactment of this Act; and (B) in non-internet protocol networks-- (i) has taken reasonable measures to implement an effective call authentication framework; and (ii) will be capable of fully implementing an effective call authentication framework not later than 18 months after the date of the enactment of this Act. (3) Implementation report.--Not later than 12 months after the date of the enactment of this Act, the Commission shall submit to the Committee on Energy and Commerce of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a report on the determination required under paragraph (2), which shall include-- (A) <<NOTE: Analysis.>> an analysis of the extent to which providers of voice service have implemented the call authentication frameworks described in subparagraphs (A) and (B) of paragraph (1), including whether the availability of necessary equipment and equipment upgrades has impacted such implementation; and [[Page 133 STAT. 3278]] (B) <<NOTE: Assessment.>> an assessment of the efficacy of the call authentication frameworks described in subparagraphs (A) and (B) of paragraph (1) in addressing all aspects of call authentication. (4) <<NOTE: Deadline. Time period. Public information.>> Review and revision or replacement.--Not later than 3 years after the date of the enactment of this Act, and every 3 years thereafter, the Commission, after public notice and an opportunity for comment, shall-- (A) <<NOTE: Assessment.>> assess the efficacy of the technologies used for call authentication frameworks implemented under this section; (B) <<NOTE: Determination.>> based on the assessment under subparagraph (A), revise or replace the call authentication frameworks under this section if the Commission determines it is in the public interest to do so; and (C) <<NOTE: Reports.>> submit to the Committee on Energy and Commerce of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a report on the findings of the assessment under subparagraph (A) and on any actions to revise or replace the call authentication frameworks under subparagraph (B). (5) Extension of implementation deadline.-- (A) Burdens and barriers to implementation.--Not later than 12 months after the date of the enactment of this Act, and as appropriate thereafter, the Commission-- (i) <<NOTE: Assessment.>> shall assess any burdens or barriers to the implementation required by paragraph (1), including-- (I) for providers of voice service to the extent the networks of such providers use time-division multiplexing; (II) for small providers of voice service and those in rural areas; and (III) the inability to purchase or upgrade equipment to support the call authentication frameworks under this section, or lack of availability of such equipment; and (ii) in connection with an assessment under clause (i), may, upon a public finding of undue hardship, delay required compliance with the 18- month time period described in paragraph (1), for a reasonable period of time, for a provider or class of providers of voice service, or type of voice calls, as necessary for that provider or class of providers or type of calls to participate in the implementation in order to address the identified burdens and barriers. (B) Delay of compliance required for certain non- internet protocol networks.--Subject to subparagraphs (C) through (F), for any provider or class of providers of voice service, or type of voice calls, only to the extent that such a provider or class of providers of voice service, or type of voice calls, materially relies on a non-internet protocol network for the provision of such service or calls, the Commission shall grant a delay of required compliance under subparagraph (A)(ii) until a call authentication protocol has been developed for calls delivered over non-internet protocol networks and is reasonably available. [[Page 133 STAT. 3279]] (C) Robocall mitigation program.-- (i) Program required.--During the time of a delay of compliance granted under subparagraph (A)(ii), the Commission shall require, pursuant to the authority of the Commission, that any provider subject to such delay shall implement an appropriate robocall mitigation program to prevent unlawful robocalls from originating on the network of the provider. (ii) Additional requirements.--If the consortium registered under section 13(d) identifies a provider of voice service that is subject to a delay of compliance granted under subparagraph (A)(ii) as repeatedly originating large-scale unlawful robocall campaigns, the Commission shall require such provider to take action to ensure that such provider does not continue to originate such calls. (iii) Minimization of burden.--The Commission shall make reasonable efforts to minimize the burden of any robocall mitigation required pursuant to clause (ii), which may include prescribing certain specific roboc [Text truncated for display. Full text available on Congress.gov.]