FCC Issues First Consumer Communications Threat Designation

FCC EB Issues First Ever Consumer Communications Information Services Threat (C-CIST) Designation

The FCC’s Robocall Response Team is a group of FCC staff dedicated to addressing the persistent threat posed by illegal spoofed or scam robocalls. They recently issued the first-ever Consumer Communications Information Services Threat (C-CIST) classification to formally identify threat actors who utilize U.S. communications networks for the most harmful and illegal schemes against consumers.

The FCC’s Enforcement Bureau announced the classification of a group of entities and individuals who persistently create robocall campaigns aimed at defrauding and harming consumers. This classification, known as the Consumer Communications Information Services Threat (C-CIST), provides international anti-robocall partners with a new tool to identify known threats before they slip into U.S. networks.

The C-CIST classification allows the Bureau to formally identify bad actors who repeatedly exploit U.S. communications networks to continue harmful and illegal schemes against consumers. These groups often use multiple companies, complex corporate structures, changing addresses, and other unethical practices to avoid repercussions and continue profiting at consumers’ expense.

Additionally, the C-CIST classification will empower industry stakeholders with critical information to enhance their “Know Your Customer” and “Know Your Upstream Provider” processes.

In a Public Notice, the Bureau designated the group operating under the name “Royal Tiger” as the first C-CIST. Royal Tiger and its associates operate across India, the United Kingdom, the United Arab Emirates, and the United States. Royal Tiger has persistently engaged in transmitting illegal robocall traffic aimed at defrauding consumers, resulting in numerous enforcement actions by the Bureau, the Federal Trade Commission, and other law enforcement partners.

The classification of individuals or entities as C-CIST ensures detection and prevention of further unlawful activities that compromise consumer trust in communication services. This information equips industry stakeholders with crucial insights to strengthen their defenses against harmful traffic, reinforcing consumer protection and privacy.

Threat actors in the communications space are exploiting operations across several jurisdictions by using shell companies, deceitful corporate structures, address changes, and other deceptive tactics to evade detection and enforcement. They increasingly victimize consumers with information harvested from data breaches and cyber intrusions, using “spoofing” technology to appear as trusted phone numbers, and using generative AI voice-cloning technology. These fraudulent and unlawful calls can lead to significant financial loss and destroy trust in critical consumer communications.

The Federal Communications Commission’s (FCC) Enforcement Bureau has introduced the Consumer Communications Information Services Threat (C-CIST) classification to highlight the illegal operations of these actors. This classification will enable state, federal, and international regulatory bodies and law enforcement agencies to detect and take appropriate action against these threats.

Why are these types of actors considered a special kind of threat?

C-CISTs have repeatedly violated robocalling rules and have been the subject of multiple FCC enforcement actions. They often evade accountability by hiding behind shell companies. These actors use information from data breaches and cyber intrusions to target individuals through illegal robocalls and scam text messages.

Why is this kind of threat given a specific name?

To address the consumer harm and privacy risks posed by C-CIST actors, a specific term helps government and industry stakeholders identify and address these actors for enforcement purposes across several jurisdictions.

How was this tool developed?

The Enforcement Bureau, through its authority to enforce the Communications Act of 1934 and FCC rules, aims to protect consumers from malicious communications services. The C-CIST strategy is similar to the Advanced Persistent Threat (APT) labeling approach used to identify and track sophisticated cybercriminals.

What criteria are used to consider a party as a C-CIST?

A party is classified as a C-CIST if their misconduct poses a significant threat to consumer communication services. This label is reserved for particularly bad actors involved in defrauding or harming consumers and businesses.

Will there be a database for this classification?

Enforcement actions, including C-CIST classifications, are publicized on the Enforcement Bureau’s website.

What are the consequences for those named as a C-CIST?

This classification exposes these actors to law enforcement and industry stakeholders. The FCC will use its authority to prevent these actors from harming consumers, which may include cease-and-desist letters, removal from the Robocall Mitigation Database, and forfeiture orders.

Has the Enforcement Bureau coordinated this classification with other entities?

The Enforcement Bureau is coordinating with the DOJ, FTC, state Attorneys General offices, international regulators, and industry stakeholders.

What schemes prompted this new classification?

The classification targets robocallers transmitting particularly harmful traffic. These actors may have been involved in prior enforcement actions and have connections to multiple jurisdictions.

In summary, the FCC’s classification of Royal Tiger and similar entities as C-CIST underscores their significant threat to consumer trust and the integrity of communication services. This classification enhances awareness among regulatory bodies, law enforcement agencies, and industry stakeholders, aiming to lessen the impact of fraudulent robocall operations on consumers and telecommunications networks.