FCC strengthens rules against pretexting

The U.S. Federal Communications Commission (FCC) has prohibited telephone and mobile phone carriers from releasing customer records over the phone without a password in an effort to protect against the practice of pretexting.

The FCC, in rules released Monday, will also require carriers to notify customers immediately when there are changes to their accounts, such as a new password, a new address, or an online account opened.

“The unauthorized disclosure of consumers’ private calling records is a significant privacy invasion,” FCC Chairman Kevin Martin said in a statement. “Compliance with our consumer protection regulations is not optional for any telephone service provider. We need to take whatever actions are necessary to enforce these requirements to secure the privacy of personal and confidential information of American customers.”

The practice of pretexting, gaining a phone customer’s call or account records by pretending to be that customer, has become a major concern of the FCC and the U.S. Congress in the past year. Early in 2006, Congress began looking into call records being sold online, but then in September, Hewlett-Packard announced that it had hired investigators who used pretexting to gain access to reporters’ and board members’ phone records in an effort to find the source of board leaks.

U.S. President George Bush signed a bill creating criminal penalties for pretexting in January. Congress is looking at additional legislation that would give the U.S. Federal Trade Commission (FTC) authority to file lawsuits against pretexters and the people who hire them.

The FCC order also requires carriers to notify customers and law enforcement officials if there’s been an unauthorized disclosure of phone records. Carriers will also be required to obtain “explicit consent” from a customer before disclosing phone records.

Providers of traditional voice services, plus providers of VoIP service, are covered by the new rules.

Commissioner Michael Copps, while approving most of the new rules, objected to a provision that would allow carriers to withhold a records breach from customers for up to 14 days, and even longer if requested by law enforcement officials.

Those rules would “keep victims of these unauthorized disclosures in the dark even longer, perhaps indefinitely,” he said in a statement. “As some have described it, it is akin to not telling victims of a burglary that their home has been broken into because law enforcement needs to continue dusting for fingerprints.”