Cybersecurity Policy Report, Charter to Pay $15M, Adopt Cybersecurity Measures After 911 Outages, (Jul 29, 2024)

By Lynn Stanton

Charter Communications, Inc., has agreed to pay $15 million under a consent decree to settle an investigation by the FCC’s Enforcement Bureau into the company’s failure to notify public safety answering points (PSAPs) and the Commission about three unplanned network outages in February, March, and April of 2023, as well as hundreds of planned, maintenance-related outages last year.

“The failure to notify affected public safety answering points (PSAPs) of an outage impedes the ability of public safety officials to mediate the effects of an outage by notifying the public of alternate ways to contact emergency services. The failure to provide required outage notifications to the Commission through the Network Outage Reporting System (NORS) impairs the Commission’s ability to assess the magnitude of major outages, identify trends, and promote network reliability best practices that can prevent or mitigate future disruptions,” the bureau said in an order adopted today that approved the consent decree and terminated the investigation, FCC, Order In the Matter of Charter Communications, Inc., File EB-SED-23-00035290 (July 29, 2024).

“To settle this matter, Charter admits that it: (1) failed to timely notify more than 1,000 PSAPs of an outage on February 19, 2023 (Outage); (2) failed to meet reporting deadlines for reports in the NORS associated with the Outage, and separate outages on March 31 and April 26, 2023; and (3) failed to meet other NORS reporting deadlines associated with hundreds of planned maintenance outages, all in violation of the Commission’s rules. Charter has agreed to implement a robust compliance plan, including cybersecurity provisions related to compliance with the Commission’s 911 rules, and will pay a $15,000,000 civil penalty,” the order adds.

According to an FCC news release, the compliance plan “includes the first-of-its-kind application of certain cybersecurity measures—including network segmentation and vulnerability mitigation management—related to 911 communications services and network outage reporting. Charter has agreed to maintain and evolve its overall cybersecurity risk management program in accordance with the voluntary National Institute of Standards and Technology (NIST) Cyber Security Framework, and other applicable industry standards and best practices, and applicable state and/or federal laws covering cybersecurity risk management and governance practices.”

The consent decree notes that the Feb. 19, 2023, outage was determined to be the result of “a minor, low and slow Denial of Service (DoS) attack. As a result, Charter experienced an interconnected VoIP telephony service outage that affected approximately four hundred thousand (400,000) residential and commercial interconnected VoIP customers in portions of 41 states and the District of Columbia. Charter was able to restore service in less than four (4) hours. According to the Cybersecurity and Infrastructure Agency (CISA), ‘there is no way to completely avoid becoming a target of a DoS or DDoS attack… .’ Charter maintains that it adheres to CISA’s best practices and the Cybersecurity Framework of the National Institute of Standards and Technology (NIST).”

Charter did not make the required NORS (Network Operating Reporting System) notification until six hours after it was due and failed to contact more than 1,000 PSAPs as required due to a clerical order, the consent decree says.

“As part of the investigation, EB asked Charter to identify and provide detail on other outages that met the NORS reporting threshold. In response, Charter indicated that based on a misunderstanding of the Commission’s rules, hundreds of planned maintenance events may have met the criteria for filing a NORS report but were never submitted. Thereafter, Charter also identified two additional, unplanned outages—which occurred on March 31, 2023, and April 26, 2023—that each met the NORS reporting threshold but Charter failed to report,” it adds.

In a statement, FCC Chairwoman Jessica Rosenworcel said, “A 911 call is likely the most important call a person will ever make. Public safety officials need to be able to inform the public of alternate ways to reach emergency services in the event of an outage. We’ll keep doing our part to hold communications providers accountable and ensure the public has reliable 911 service.”

Enforcement Bureau Chief Loyaan A. Egal said, “The Enforcement Bureau takes any potential violations of the 911 rules extremely seriously, including outage notification requirements. We will continue working to ensure that communications providers abide by these critical public safety rules and to ensure that cybersecurity measures are implemented to provide resiliency to critical infrastructure communications networks and services.”

News: FederalLegislation DataSecurity