The Federal Communications Commission has adopted a Report and Order and Further Notice of Proposed Rulemaking modernizing its international Section 214 framework. The new rules require international Section 214 applicants and authorization holders to adhere to baseline cybersecurity practices, such as those promulgated by NIST; prohibit the use or addition of certain equipment or services on the FCC’s Covered List; and require authorization holders to commence service within one year of receiving authority. The rules also impose new reporting requirements concerning facilities used for communications crossing the U.S.-Mexico and U.S.-Canada borders, ownership interests at a 5% threshold, and the use or anticipated use of third-party service providers controlled by foreign adversaries.
The FCC also adopted a new one-time information collection to obtain updated baseline information from international Section 214 authorization holders and support an ongoing reporting requirement. In the accompanying FNPRM, the FCC seeks comment on additional security measures, including a proposed presumption against granting international Section 214 authority to certain untrusted entities, additional cybersecurity and physical security certifications, restrictions involving untrusted equipment, services, and capacity-leasing arrangements, enhanced facilities-related information requirements, greater information sharing with federal agencies, and restrictions on access to communications infrastructure by individuals located in foreign adversary countries.
