Congress Enacts the Secure and Trusted Communications Networks Act, Spurring Efforts to Identify, Remove and Replace Covered Telecommunications Equipment and Services
On March 12, 2020, the Secure and Trusted Communications Networks Act entered into force. This legislation is expected to make permanent the Federal Communication Commission’s (FCC’s) ban on the use of Universal Service Fund (USF) dollars for the purchase of equipment made by Huawei and other designated Chinese telecommunications companies deemed to represent a risk to U.S. national security (which we previously discussed here and here). The legislation also expands such prohibitions to all FCC-administered funds. As a result, once the legislation is fully implemented by the FCC, no federal funds or federally administered funds may be used to purchase, lease, rent, obtain or maintain any equipment or services determined by the FCC (in consultation with other federal agencies) to pose national security risks.
The FCC can be expected to publish the details on how it will implement these prohibitions. Once designated, new purchases will be prohibited and any already installed covered equipment must be removed within 60 days. Smaller telecommunications providers (defined by the legislation as those providers with two million or fewer customers) can apply for a reimbursement to offset their costs to remove designated equipment in their installed base.
While the new legislation does not name specific equipment and services companies subject to the new ban, the accompanying congressional committee report specifically identifies Huawei and Zhongxing Telecommunications Equipment Corporation (ZTE) of China. Or as the FCC Chairman Ajit Pai put it, passage of the new legislation “ratifies” and expands the scope of the FCC’s previous “remove and replace” proposal to ban the use of Huawei and ZTE equipment in communications networks funded in part by the FCC’s USF programs.
Parallel FCC Actions
In February 2020, the FCC opened a reporting portal for USF recipient companies that are known as designated Eligible Telecommunications Carriers (ETCs) to “report the extent to which their networks contain or use potentially prohibited equipment or services provided by Huawei [and] ZTE,” as required by its November 2019 USF Order. These reports must be filed by April 22, 2020 and annually thereafter.
The FCC has also published a request for public comments on how the passage of the new legislation relates to or supersedes the FCC’s actions in its November 2019 USF Order. The legislation requires the FCC to designate and publish on its website a list of covered equipment and services by March 11, 2021. The FCC has already stated its position that communications equipment produced by Huawei and ZTE satisfy the first criterion because their telecommunications equipment or services are covered in the John S. McCain National Defense Authorization Act for Fiscal Year 2019. However, as to the legislation’s second requirement that covered telecommunications equipment and services also pose an “unacceptable risk” to U.S. national security, questions remain. It is expected that the FCC will therefore conduct additional analysis concerning whether such equipment and services are capable of (i) “routing or redirecting user data traffic or permitting visibility into any user data or packets that such equipment or service transmits or otherwise handles,” (ii) “causing the network of a provider of advanced communications service to be disrupted remotely,” or (iii) “otherwise posing an unacceptable risk to the national security of the United States or the security and safety of U.S. persons.” Comments on these factors were due on March 27, 2020. Notably, the FCC did not provide for a reply comment period and categorized this proceeding as a restricted proceeding where ex parte communications with the FCC are prohibited. Accordingly, it is doubtful at this time whether there will be additional opportunities for public comment on these issues.
“Remove and Replace” Obligations and Reimbursement Steps
Once the FCC has finalized and published its initial designation, any recipient of funding through an FCC-administered program will have 60 days to ensure that it does not use any of the funds it receives to “purchase, rent, lease,” “obtain” or “maintain” any covered equipment or service. If covered equipment or services “produced or provided” by designated entities are present in its supply chain, a funding recipient must either permanently remove the covered equipment or services or lose its FCC funding.
Small telecommunications providers with less than two million customers can seek reimbursement from a $1 billion fund established by the new legislation. Such providers can use the funds to “permanently remov[e] covered communications equipment or services purchased, rented, leased, or otherwise obtained before” August 14, 2018 (for equipment and services made by designated entities on the FCC initial list) or before the end of the 60-day deadline for any additional entities that the FCC determines pose a threat to U.S. national security. Covered small providers can also use the funds to replace and dispose of the covered communications equipment or services that are removed.
In order to seek reimbursement, applicants should be prepared to engage in substantial pre-application work. For example, applicants must have “developed a plan for . . . the permanent removal and replacement of covered communications equipment or services that are in the communications network . . . and . . . the disposal of the equipment and services.” They also must have developed a specific timeline for the removal, replacement and disposal, and a plan to ensure they “will not purchase, rent, lease, or otherwise obtain covered communications equipment or services” going forward. Finally, applicants must certify that they have developed and tailored their risk management practices consistent with the cybersecurity framework developed by the National Institute of Standards and Technology.
There are also certain procedural steps to access reimbursement that must be met. For example, applicants must “provide to the FCC an initial reimbursement cost estimate at the time of application, with supporting materials substantiating the costs.” The FCC is directed to make a decision on any reimbursement application no later than 90 days after the date of submission, except when circumstances may warrant an extension of the review process by 45 days.
Small telecommunications providers that have received USF funds are to complete the required removal, replacement and disposal of covered communications equipment or services within a year, unless they seek and receive an approval for extension of time from the FCC. Recipients of these funds are also subject to regular audits, reviews and field investigations to ensure FCC funding is not misused in a manner so as to constitute waste, fraud or abuse of the program.
More FCC Rulemaking to Come
Many aspects of this now broader-scope “remove and replace” statutory directive will need to be further developed by the FCC. In addition to developing and publishing the list of covered equipment and services by September 8, 2020, the FCC must adopt an order to implement the prohibition on the use of FCC funding in procuring covered equipment or services. The FCC must also establish procedures for the reimbursement program, such as “a list [or categories] of suggested replacements of both physical and virtual communications equipment, application and management software, and services,” “an application process and related forms and materials,” deadlines to submit required certifications, and specific requirements related to disposal of covered communications equipment and services.
Congressional actions and the FCC’s already ongoing “remove and replace” initiatives demonstrate the federal government’s commitment to incentivize U.S. companies to sever ties with covered equipment and services providers like Huawei and ZTE. They reflect the shared view in Congress and the administration that further mandates were needed to spur action by the private sector while recognizing the importance of reimbursing small providers for their remove and replace costs.
Given the short 60-day timeline after the FCC’s publication of future designation lists and the substantial burden on FCC funding recipients to swiftly identify, plan, remove and replace any designated covered equipment and services, companies that may be affected by the new legislation and FCC implementation should begin preparations and advance planning as soon as possible.