Cybersecurity Policy Report, FCC Sets Up Schools, Libraries Cybersecurity Pilot Program, (Jun 6, 2024)

By Jeff Williams

Over the dissents of the agency's two Republican Commissioners based on concerns about statutory authority, the FCC today adopted a report and order in WC docket 23-234 establishing a three-year $200 million pilot program to support cybersecurity for schools and libraries.

Pointing to the costs and complexities of trying to protect against and respond to cyber attacks, FCC Chairwoman Jessica Rosenworcel said during a Commission meeting that the “vulnerabilities in the networks that we use in our nation’s schools and libraries are real—and growing.”

While others at the federal, state, and local level are also addressing the “multi-faceted problem” of cybersecurity for schools and libraries, “we can use our authority at the Commission to start asking the right questions” about what equipment and services will provide the best solutions, she said.

During a subsequent press conference, Ms. Rosenworcel said that the FCC has the statutory authority to, “from time to time, evolve” its universal service programs to “reflect the changing state of communications.”

The Commission is updating its policies to reflect that “security is a bigger part of every network provider’s management of communications today,” she said. "And so we are updating our policies to reflect that, but we’re doing it in a thoughtful manner. It’s measured. It’s a three-year pilot program, limited to $200 million, and it is modeled off the Connected Care pilot program that [Commissioner Brendan Carr] championed here just a few years ago.”

During the meeting, Mr. Carr said that while he “fully” agrees with Ms. Rosenworcel regarding the need to address school and library cybersecurity, he disagrees that the Commission has the statutory authority to implement the pilot program.

Mr. Carr noted he has dissented for similar reasons to other recent FCC actions related to E-rate, including providing support for Wi-Fi on school buses (TR Daily, Oct. 19, 2023).

During a later press conference, Mr. Carr said that “[f]undamentally, I think the FCC is starting to unmoor its E-rate decisions from the text of the statute passed by Congress.”

Mr. Carr credited the pilot program report and order for being “closer to the statute” than other decisions, but he added: “I ultimately couldn’t get to a place where I was comfortable signing on to that type of interpretation of the statute.”

Commissioner Nathan Simington called the school and library cybersecurity a “highly laudable use of E-rate funds,” but said that he is “concerned that the authority we cite in the item does not support the move we make today.”

Commissioner Geoffrey Starks said that the pilot program will provide the FCC with the “information necessary to analyze whether, and how, the Commission should update our E-rate program to help our schools and libraries help themselves against the ongoing cyberthreat” they face.

Commissioner Anna Gomez said that “in the same way we need to be intentional about ensuring our physical school buildings are safe, we must also be intentional to ensure that the digital infrastructure is safe and secure, as well.”

Ms. Gomez also praised the inclusion in the item of language to provide “targeted resources and support for under-resourced schools and libraries that have less cybersecurity expertise.”

During a presentation at the meeting, Joe Schlingbaum, an attorney-adviser in the Wireline Competition Bureau’s Telecommunications Access Policy Division, said that in addition to the overall $200 million funding cap, the report and order establishes per-school and per-library budgets to “promote a broad distribution of funds and to provide selected participants with predictable funding amounts.”

He said that the item also lists the types of services and products that are eligible for support, including advanced and next-generation firewalls; endpoint protection; identity protection and authentication; and monitoring, detection and response.

Along with appointing the Universal Service Administrative Co. to oversee the pilot, the report and order details the goals of the pilot program, including “improving the security and protection of E-rate funded broadband networks and data, measuring the effectiveness of pilot-funded cybersecurity services and equipment, and evaluating how to leverage other federal resources to address school and library cybersecurity threats,” Mr. Schlingbaum said.

The FCC also adopted data collection requirements to “evaluate progress towards these goals,” he said.

In a press release, the Schools, Health & Libraries Broadband Coalition said the pilot program “represents a significant step forward in safeguarding student information and protecting school and library networks from cyber-attacks.”

News: DataSecurity