committee will come to order good morning today the committee addresses a problem that faces every american who has a phone the security of the records that show who we call when how long we talk and much more events of the past year have brought this brought to this committee's attention serious problems in the stewardship of personal information and telephone records i want to thank our distinguished panel of witnesses today for coming here to be with us and discuss these matters and to give the snare views on h r nine three six the prevention of fraudulent access to phone records act certain major telecommunications company allegedly turned over detail call records of millions of americans to the national security agency these phone customers were not informed that n s a had their records apparently this may have been done without proper process at least one company found it illegal refused to comply we also learned about pretexting which occurs when a person obtains phone records through fraudulent means apparently some of the largest companies in america such  hewitt packard corp did not see any problems in using this defense deceptive practice one of our witnesses discovered forty web sites that offered the cell phone records to anyone online last congress this subcommittee this committee subcommittee on oversight investigation held several hearings on pretexting abuses and scandals and i want to commend our two friends mistress two pac and mr whitfield for their extraordinary leadership in building a strong record on these matters in a bipartisan manner this committee passed the same legislation and we're discussing today the legislation is bipartisan and i intend to see that it remain so we also commend ranking member barton for his distinguished leadership and for his willingness to work to produce sound legislation unfortunately after the committee report of the bill for some strange reason it mysteriously disappeared from the house floor schedule and the house took no action before the hundred ninth congress adjourned so today we will continue our effort to ensure that call record information held by phone companies remain secure in that regard i'm pleased that we have before us representatives of the federal communications commission the federal trade commission to discuss these matters the f c c is charged with ensuring that phone companies protect our calling records and the f t c has the ability to crack down on fraudulent practices which is pretexting this legislation will provide more specific authority to both the f c c and the c to take appropriate action we need to hear from the c c what they're doing to protect these records every telecommunications company under the communications act has a duty to protect the sensitive personal information of customers given the well publicized breaches of customer privacy with this address whether the statute adequately empowers the f c c to protect those records i am aware that the c had expected to issue new rules governing phone records security by the end of the year we are encouraged that that is so and we encourage the f c c to issue these new rules as quickly as they are able likewise we need to hear from the f c f t c on whether or not they believe they have the authority under existing law to pursue those who engage in pretexting the f t c has been aggressive in using section five of the federal trade communications commission act which prohibits unfair and deceptive acts and practices in interstate commerce to bring in forstmann actions against pretext or last year they testified that more specific prohibitions were needed against pretexting soliciting and selling customer phone records the agency also seeks enhanced authority to impose civil penalties which are also looks forward to the testimony of the other distinguish members of our panel the landline and wireless companies and last but by no means least we will hear important testimony from a victim of pretexting this is not a faceless crime and it is not a crime that has no consequences mr einhorn of the committee thank you for coming before us and i'm sorry indeed about what has happened during your family and i pledge the best efforts of myself in the committee to make this kind of event less likely to happen anywhere else in the interests of fairness the committee will leave the record open forth thirty days and case allied capital wants to submit a statement this measure passed this committee in a bipartisan fashion last congress just as mr burton did last congress so effectively well i will work to address this issue in the same bipartisan manner and as always the committee will conduct the oversight necessary to ensure that the american people are protected in the privacy of their phone records the mature will is that we will follow the usual practices of the committee and we will recognize the members of for three minutes and if the members choose to waive that three minutes opening statement they will be recognized for additional three minutes as the time of the questioning sure recognizes days of that little black rotary phone but the unfortunate reality is that along with great advances in technology there have been great advances in fraud as well over the last year pretexting has garnered the national spotlight nearly a year ago to the day that someone remarkably had daylight savings time today instead of on sunday maybe but but nearly to the day we marked up similar legislation in this committee but hit a few minor bumps along the way and i'm hopeful that we'll have a little more success this this time and consumers will in fact be the better for it on the surface protection seems harmless enough but it is a violation of one's basic rights that can have grave consequences someone with bad intentions and a few bucks can get ahold of almost anyone's cell phone records it's alarming that our cell phone bills a score sheet for our daily lives can follow into the wrong hands with a simple phone call or even a click of a mouse the consequences of firms trying to make a quick buck on the internet are terrifying records can be used to track down someone's location such as a woman in hiding from an abusive partner or a stocker gangs and drug runners have been known to obtain phone records to determin anyone in their group and their gang has been in contact with rival groups or even with the police there's no matter what the motive is no matter how barbaric or innocent the intentions pretexting is wrong and a violation of an individual's basic right to privacy carriers do have a duty to protect their customers and we have a duty to close the loophole once and for all we have a quality piece of bipartisan legislation that will bring an end to this practice once and for all and the nation's one hundred ninety million cell phone users will all be safer for it and while we continue to make great advances in technology one thing that will continue to remain constant the consumer's right to privacy and i yield back my  cornerstone of individual freedom a person's telephone records can disclose some of the most intimate details of a person's life information about who you call when you call how long you were on the phone can reveal a lot about a person their relationships their business dealings to family members their children the public sale of this information can be embarrassing awkward and uncomfortable for a consumer it can be dangerous when it's in the hands of st abusers and others who intend to do harm more troubling in my mind is the fact that last year this committee discovered that pretexting is not solely the province of individual low rent fraudsters who prey on vulnerable citizens and a shocking revelation last september hewlett packard a fortune five hundred company agreed to pay fourteen million dollars penalty for illegal pretexting likewise washington hedge fund manager david einhorn who is testifying here today fell victim to pretexting when a financial services firm hired someone to illegally obtain his phone records and the last congress this committee passed this important bill to ensure that consumer phone records are not for sale in some cyberspace bazaar and to take action to shut down these practices last session's bill however mysteriously disappeared from the house suspension calendar prior to house floor consideration reportedly due to concerns from the intelligence community these concerns implicated the alleged disclosure of phone records by certain telephone companies to the national security agency are others the pretexting bill sudden disappearance represented a case of extraordinary legislative rendition under the telecommunications act telephone companies are legally obligated to safeguard the confidentiality of phone records after the scandals of last year many phone companies certainly responded by tightening internal controls to prevent an authorized disclosure of phone records while the fraudsters may be acting illegally using pretexting the fact that these records are apparently so easily obtained on the internet and elsewhere makes it self evident than forstmann and security needs to be stepped up the f c c has been developing new rules to do just that for several months and we are eager for the commission to pine allies it's action doing so may obviate the need to legislate portions of the bill before us also continue to believe it is important for the commission as an independent regulatory agency for investigate media reports regarding disclosure of consumer phone records by phone companies without legal process and in violation of the communications act this is still trying really as this morning's newspapers in the case there is still a lack of respect for the law a law country that the privacy of americans many of us on this side were sorely disappointed that we could never reach a compromise and had this bill on the floor under suspension perhaps with amendments and got just through i think we all realize no matter what we talk about the stark reality is that there's always going to be con artists and cyber nice to keep us busy and so we've got to pass this bill and we must recognize the importance of securing a protecting personal data from exploitation by fraudsters whether the prefer technique is pretexting hacking or good old fashioned fraud likewise ensuring the public is informed about the need to protect personal data also helped or at the fastest growing criminal enterprise in america which is a den mr chairman our subcommittee that i chaired and now that mr russ chairs are eagerly looking forward to passing this and i think under your leadership mr dingell hopefully we'll have this on the floor in a short order i think it's an issue that's a must restrict to not restrict legitimate marking practices that can benefit consumers but we also might understand it just need to identify and protect the consumers privacy so i look forward to working with you mr chairman obviously mr upton he's chair  sir recognizes the distinguished gentleman from illinois mr rush for three minutes thank you chairman dingell for conducting this hearing and i want to  fraudulent access to phone records act as a hard hitting for deliberative response to this widespread crime most of today's discussion and our hearing will center around specific authority to crack down on pretext or by explicitly declaring the practice of frauds only obtaining or selling customer proprietary network and from information as an unlawful conduct and on all four act the f t c will enforce this provision as a violation of the else the federal trade commission act and is prohibition on  hearings we heard testimony that the commission needed more specific statutory authority to better protect the public tie to one feels this need mr chairman ever returning a member of this vulnerable to pretexting and its devastating effects and h r nine three six will go a long way and addressing this basic consumer protection issue last congress we did our job we re very much time and submit my full statement for the record suffice it to say that we work together on this and last congress and didn't quite get over the finish line i'm proud to be an original sponsor with you and several other members in this congress  pretexting is something that we need to combat as we all know pretexting is pertaining to be someone you're not to get something you shouldn't have to use in a way that's probably wrong so i'm sure on a bipartisan basis we're we can move this bill and move to the floor and move to the senate and put it on the president's desk and strike a blow for individual privacy in this congress and with that i'd go back through thanks thank you very much mr chairman it's my pleasure to join with you and other members of the committee and co sponsoring this measure and i commend the bipartisan process that has produced this bill pretexting was rendered unlawful by action in the last congress but there is an ongoing need to make sure that the integrity of customer proprietary information is protected by local exchange carriers and by the wireless industry that information should never be sold and there should be ongoing steps taken by the carrier to make sure that that information is appropriately safeguarded that's said i think it's also important that we carefully evaluate the exemptions to make sure that none of the provisions about sharing information with third parties would prohibit a normal and effective operation by the telecommunications carrier they need to contract out certain information to third parties including engineers at information technology specialists of various kinds and the ability to do that is absolutely essential to the effect of the functioning of their operations and so i would simply urge the committee to take care as we have this phone records since the development of the internet to our personal information has been more readily available and increasingly easier to obtain and fact there is a growing market for the sale of phone records and records provide detailed information about who and what and when we call and how long we spend on the phone fraudulently obtaining this information is an invasion to our personal private privacy and it cannot be allowed tenure but at the same time we need to provide for equal treatment for all those who collect data as we move forward we should ensure that this bill will not hamper lawful and necessary means to protect our country from foreign terrorism i look forward to hearing from each witness as we address these concerns and i thank you fraudulent statements or representations in order to obtain the personal proprietary information of a consumer pose a serious threats to the privacy of consumers and to the integrity of telecommunications industry and use with one can obtain private information on other thousand nine hundred as a matter of public policy we must ensure that this type of nation cannot be easily bought over the internet we need to pass legislation to make sure that those who are legally purchased c p s are grassley prosecuted but at the same time we need to make sure this bill does not hamstring telecommunications providers c p and i in a responsible manner to better target their consumers for new products or services and ultimately pass savings log them i look forward to this hearing and hearing from the witnesses it is critical that we recognizes the gentleman from pennsylvania mr pitts thank you very much chairman i'm looking forward to hearing what our witnesses have to say this morning ever agrees that pretexting needs to be stopped but we need to do it in a way that does not in a snare and shipment business practices we have a good bill before us and i'll be interested to hear what our witnesses have to say about how we can improve it when the market up i'm also grateful to the sponsors of this bill for including the wireless directory assistance language that i and my friend jared markey worked so hard on over the last two congresses while telephone numbers are not strictly speaking considered customer proprietary network information or alleged telephone numbers are definitely considered personal information by the vast majority of consumers and i expect this language will become law this year and i'm very happy about that this hearing will also be a chance for us to make sure that that part of the bill is written the best way possible and will not have any unintended consequences thank you madam chairman turnout recognizes the distinguished gentleman from texas history of privacy protections going back to the actually bodily legislation and on banking and the last decade and we are concerned about the privacy of our own information whether its banking records or or  our cellphones are hard lines and protection should have passed last time as most of my colleagues said i think there is an issue we're going to have to deal with on the contracting out is i heard my our ranks chair of the energy s committee talk about i would just hope that whatever we do about contracting out would have the same restrictions as a person who is doing the contracting but you know you go back on time so many of the fact that turn out recognize this request and this gentleman from oregon mr weldon for one minute thank you madam chair my looking forward to this hearing and while i supported this legislation last year and certainly participated in the oversight hearings on pretexting i want to make sure that as we move forward that we are doing something that has unintended consequences when it comes to legitimate marketing issues so that consumers can get access to information for offers and things they want to take advantage of and so i'm going to raise a few of those questions i think there have been some points raised since this bill was passed out of this committee last year and sent to the full house which never took it up that need to be addressed to make sure we're doing the right thing which is protecting the rights of consumers not to be ripped off and not to be abused as we witnessed in our hearings  very serious legitimate problems out there that we need to address in doing so let's make sure we don't go overboard so thank you for this hearing and for your work on the oversight committee as well and i look forward to the testimony of our witnesses gentlemen yell gentle lady waves gentleman from new york mr weener thank you madam chair and i look forward to seeing i want to commend the committee for the work they've done last year there are some foundational principles that we should keep in mind one is there has to be a reasonable understanding that consumers expect the information to be shared in this case i think most as mr markey said overwhelming numbers of consumers don't even realize this information is available to be shared and this is not like some other data in our lives that we kind of sense maybe someone else is going to get ahold of and secondly if the administration has concerns about national security concerns about the legislation let's hope this year they confronted in a more forthright fashion rather than in the dark of night simply killing a bill that should have been out of suspension calendar as many of us would agree with a court gets an opportunity to view these concerns i am convinced that they will make the right decisions but simply making these privacy decisions in the dark of night by security officials we've learned over and over again the same ministration can't be trusted with that much authority and i you recognizes herself for one minute last year we had a series of hearings and oversight and investigation subcommittee on pretexting and really what we learned was disturbing your personal data out there for south sale and as we've heard it just takes a few minutes and a little money for someone to get access to your telephone records and other pieces of private information what seems worse to me that there are a number of prominent citizens in this country and lawyers who don't seem to understand that this is at best an asshole in many situations and at worst and probably in many states illegal and that's why we need to clarify the federal law and that's what h r nine thirty six was intended to do last year this committee passed that bill unanimously and somehow between this committee on the house floor night and we never did find it but this year it's a new year it's a new congress and it's going to be a new face for h r nine thirty six i look forward to hearing the witnesses about this bill and most importantly i look being here also what i'd like for these fine witnesses to do for me is a clear fact the issues that the industry has with the bill and to show us how companies use customer proprietary network information to assist them in providing better choices and products to our constituents although consumers enjoy all the new options they have they want to believe that their personal details will not be  and of course i'd like to hear something that makes me feel comfortable in that regard and at the same time we recognize that we do not want to eliminate progress but we also have to be concerned about fraud on that the internet a couple days after christmas two thousand and five so i'm glad to finally be here i want to know the opt in provision of this bill that i think is important to give consumers the right to opt in rather than have to opt out so their records will be protected then let's say specifically give advance approval for their information to be divulged but i think i am interested in looking at how we do that without interfering with the legitimate operational for one minute thank you madam chairwoman i hope that hearings like this will generate enough momentum to actually move the bill through congress this year and i echo my colleagues concerns that pretexting not only violates a person's right to privacy but it's poses a serious risks to people's safety such as some of the private high profile cases that we've heard of victims of domestic violence and stalking and police officers who are doing undercover work furthermore last fall's revelations that the corporate sector has been using pretexting to obtain personal records of employees board members journalists and critics further injected a renewed sense of urgency in addressing this issue imposing penalties on the actions of a pretext or is a certainly a necessary component of stemming the problem but it is not the only one that is why i am particularly pleased that this bill not only makes pretexting to obtain solicit sell or disclose customer proprietary network information illegal but it also gives f t c the enforcement our ad also i meant section two twenty two of the telecommunications act to cover joint venture partners etc i do hope that we will probably get about the task of passing this legislation thank you madam chairwoman chair now i'm pleased to recognize the distinguished gentle lady from wyoming this cuban thank you madam chairman i co sponsored legislation because i have no doubt that it is me takes the right approach in banning the practice of pretexting and giving f c c enforcement authority to halt this practice and i'm looking forward to hearing the commission enforcement efforts today however i do have some concerns regarding how this legislation will affect rural air carriers often important well meaning legislation such as this  affects wirral areas in ways that congress may not have anticipated and i'm very interested in hearing from the panel about how this legislation will impact rural carriers and real customers and i do appreciate the commission's efforts to enforce section two twenty two of the telecommunications act and i believe this bill takes positive test steps to do so however i would not like to see real companies face  attorney general lisa madigan was here at the first hearing we had last session and actually was invited today but her schedule didn't permit have used their general consumer protection and consumer fraud statutes to file lawsuits against the practice but because there was not a clear federal statute outlining this anti consumer practice there were those who still chose to dabble in what they claim was a gray area of the law last year a bill that would allow for criminal penalties for pre pretexting in february two thousand and six there were over forty sites selling others phone records and in the most infamous case to date well let me let me just can't conclude the quick and easy access to phone records raises the question of what phone the gentleman waves are there any other members who wish to make an opening statement i thank the members and i'd like to welcome our panel today of distinguishment this is most especially our for former colleague mr large t who we're delighted to have appear in front of the committee the witnesses are now recognized and we will start with ms lydia carne parnes good morning madam chairman ranking member barton members of the committee i appreciate your invitation to appear today to discuss the privacy and security of consumers telephone records although my written statement is that it can mission my oral testimony and responses to questions reflect my own views and not necessarily those of the commission or any individual commissioner protecting the privacy and security of consumers sensitive personal information is one of the commission's highest priorities and aggressive law enforcement is at the center of our efforts to protect consumers telephone call records from pretexting last for may the commission announced five lawsuits against twelve defendants who obtained and sold consumers telephone records without their knowledge or authorization th practices were unfair precipitated by section five of the f t c act in each of these cases the defendant advertise on its website that it could have tain confidential customer phone records from telecommunications carriers for fees ranging from sixty five to one hundred eighty thousand dollars to date the commission has settled two of these cases obtaining strong permanent injunctions that are the defendants from selling phone records or personal information taken from those records and  the settlements require the defendants to discourage their profits the remaining three cases are still in active litigation these five cases where the culmination of extensive investigations of this industry commission staff surf the internet for companies that offer to sell consumers phone records sent warning letters and identified appropriate targets for investigation and completed undercover purchases of these records the commission worked closely with the federal communications commission in developing these cases we are committed to coordinating our work on this issue as we have done successfully in other areas last month the commission filed a six case against six defendants to the allegedly conducted or directed actual pretexting again the f t c allege that the defendants a painter and sold consumers confidential phone records without their knowledge or consent this case connects the actual pretext ser to the middlemen who sell the records to third parties in addition to alleging with the unauthorized sale a phone records as an unfair practice the f t c is complaint alleges that the defendants in gauging deception by obtaining the records through the use of fraud and misrepresentations these telephone pretexting cases follow a long line of actions against defendants triage with the pretexting a financial records we filed our first financial pretexting case in one thousand nine hundred nine against a company that services and know or should know that their records are obtained through false pretenses second experience the f t c the power to seek civil penalties against violators and third it contains an important exemption from law enforc these provisions would provide the commission with useful additional tools for combat in telephone records pretexting in addition to the phone records act two recently passed statutes will assist in the fight against phone pretexting first in december of two thousand and six congress enacted the usa web act which allows for greater cooperation and information sharing between the commission and its counterparts in other countries the usa flyback will assist the commission in pursuing paid of brokers who are operating outside the united states second congress passed the telephone records and privacy protection act which criminalizes obtaining confidential records by making false statements to a telephone service provider in light of this new law we developing developing criminal law enforcement referrals to our sister agency the department of justice again thank you for the opportunity to testify today we look forward to working with the committee and its staff on this very important issue and i would be happy to answer any questions you may have thank you mr navan thank you good morning madam chairman ranking member barton members of the committee i appreciate the opportunity to speak with you today about the ongoing of the federal communications commission to ensure the privacy of american consumers sensitive telephone call records section two twenty two of the communication facts requires telecommunications carriers to protect the confidentiality of their customers personal information collected in the course of providing telephone service this information is commonly referred to as customer proprietary network information or  and i as you are aware third parties known as data brokers or pretext or have invaded consumers privacy by gaining unauthorized access to this very personal data for profit the commission is taking several steps to curb the authorized disclosures and sale of consumer's personal telephone records specifically f c c chairman martin has proposed in imposing stricter security standards for c p and i for all providers of telephone service including mandatory passwords for accessing customer call records further the commission has investigated and will continue to investigate this on lawful activity and take strong enforcement action to address any violations by telecommunications carriers of their obligations to protect c p n i the commission began its investigation of the data broker problem in late summer two thousand and five in august of two thousand and five the electronic privacy information center or epic father patrician for rule making at the f c c to address the sufficiency of carrier privacy practices in light of the fact that on line data brokers were selling consumers private telephone data in early two thousand and six the commission issued a notice of proposed rule making inviting comment on the epic petition and whether additional commission rules are necessary to strengthen the carrier safeguards for customer's records based on the evidence admitted in its rule making proceeding and gathered in a turn for spent investigation the commission has learned about the method said data brokers routinely use to seek to pain on all parts access to c p and i the commission also has learned of a variety of steps carriers can take to further protect the privacy of customer account information significantly we also recognize the importance of the issue to law enforcement particularly in light of the new telephones record and privacy protection act of two thousand and six which makes  offense the commission has an item for consideration before it which would address these issues are requiring providers to adopt additional safeguards to protect consumers phone records information from authorized access and disclosure the chairman has circulated an order that for example proposes for hidden providers from releasing call detail information except when the customer provides the password or by sending it to undress of record or by calling the customer at the telephone number of records to protect against possible efforts to circumvent these requirements the order proposes to require carriers to notify the custom immediately when information such as passwords or the address of record is created or changed the chairman also proposed a notification process for both law enforcement and customers in the event of a breach see if you know in addition chairman martin proposed to modify our current rules to require providers to obtain affirmative customer consent before disclosing any of that customer's phone record information to a provider's joint venture partner or independent contractor for marketing purposes further in order proposes to extend all c g i obligations to interconnected ois over internet protocol or voice providers these additional privacy should sharply limit prefectures ability to obtain authorized access to c p and i the commission also has used its enforcement authority to help address this problem the commission has issued subpoenas to a number of data brokers seeking information about how companies of pain phone record information and then sold it to visually the commission has investigated telecommunications carriers practices to fulfill section two twenty two's duty to protect consumer information through numerous meetings with the carriers a review of the carrier's annual section two twenty two compliance certifications and through formal letters of inquiries that have been issued to nearly twenty carriers throughout these investigations the commission closely coordinated with the federal trade commission staff in addition the commission has offered its assistance to the state attorneys general in their effort to combat pretexting the commission takes very seriously any breach of consumers privacy as well as carrier statutory duty to protect the customer information that they collect the commission also remains committed to strengthen its rules as warning to help ensure that carriers implement adequate practices to protect their customers privacy as required by the communications that we likewise will continue to coordinate with the federal trade commission state and federal attorneys general and other law enforcement authorities about our findings and work with them in any way we can to take legal action against either brokers and pretexts we look forward to working collaboratively collaboratively with the members of this committee and other members of congress to ensure a consumer's personal phone remains confidential thank you for the opportunity to testify and i would be pleased to respond to your question thank you mr nugent mr rotenberg madam chairman ranking member barton members of the committee thank you so much for the opportunity to testify before you on a very serious problem of pretexting as you may know in the summer of two thousand and five afrikander took an extensive investigation of the problem of pretexting in the united states we found that personal information call detail information was available for sale at more than forty businesses on the internet we filed a petition with the federal trade commission in which we asked the f t c to begin an investigation and because it was so clearly the case that the information that issue concerned personal calling records we petitioned the c to open an investigation and to establish stronger security standards to safeguard the privacy of the call detail information of american telephone consumers we provided very specific recommendations for the f c c the use of passwords the use of encryptions and the use of audit trails that would ensure that when personal information in the possession of the telephone carriers was disclosed it was disclosed for an appropriate per yes and not to a pretext or for a nefarious purpose i recall a year ago at this time having the honor to appear before this committee with the chairman and to discuss our petition and at that expressed support for our recommendations he said that he was going forward and issued the petition in february more than a year ago recommending that stronger security standards be established for telephone record information we filed our comments the telephone industry filed their comments we filed our reply comments and then nothing happened no final rule was ever issued by the f c c you though remarkably as recently as january of this year the commission continued to warn consumers about the ongoing problem of pretexting of personal telephone record information i am here before you today to urge you to ensure that the f c c act on this petition and because they have failed to act on this petition we think it is absolutely vital for the legislation that you are considering no which would establish the security standards by law to go forward the safeguarding of this personal information is absolutely crucial as we have described in our testimony somebody raised the question regarding the legislation that was passed by the congress during the last session which criminalize the active pretexting but it did not deal with the source of the problem and that concerns the information that is collected and maintain the c p and data that's used in the telecommunications sector and that is the information that is being made available to pretax to commit fraud identity and other types of crime that is the information that we need the we believe needs to be protected and i thank you again for the opportunity to be here and of a place to answer your it's been a while scuse me on behalf of c g i i'm pleased to testify on h r nine thirty six on the steps of our listeners she is taking to ensure the safety and security of wireless customers and consumers at the outset i want to be t s member companies take seriously their obligation to protect customer c p i and that since your goal is our goal to in addition to meeting their duties under the section two thousand and two every carrier has a market based interest in seeing the customer records are not disclosed without proper permission carriers employ a broad range of security measures to prevent an authorized access to these records in general the system works well as there are literally hundreds of millions of positive customer service interactions every year and in the last well publicized since instances of pretexting in the legislative and oversight activities that followed in this committee and elsewhere serves as a wake up call for all of us i'm pleased to say that the wireless industry did not wait idly by for someone else to solve the problem in addition to offering our assistance to the committee each of c t r national carriers filed and obtained injunctions to shut down data thieves the carriers also teamed with law enforcement to identify individuals and companies involved fraudulent activities to help but these criminals out of business c g i also supported legislation approved by the hundred ninth congress to criminalize the act of pretexting since the president signed the bill the market for pretexting services has evaporated under the threat of federal prison time in sizable financial penalties the positive effect of the ledge of this legislation cannot be over overstated c t s members have not relied exclusively on the legal process to address pretexting and the past year wireless carriers have adopted a variety of procedures and tools to stop unauthorized access to c p and i as is true in every other facet of the business flexibility and innovation make a difference in the effort to defeat pretax dollars some carriers of focus on process others have chosen to use technology to help solve the problem this variation between carriers is a positive as static practices can become outmoded or avoided by third parties with ill intent c g i and its member companies strongly support additional enhanced security measures that can help to better protect consumers i detail each of these points in my written testimony but let me briefly explain what c t o supports we support giving customers the option of using pass codes to protect account detail we recently support restricting disclosure of customers so security number tax id entire credit card number or billing name and address in response to invalid customer calls we support policies that preclude the release of call detail records via fax or e mail and we support confirmation of the f t c has jurisdiction in this area all c g i supports reasonable measures to enhance the security of c p and i any legislation the committee proposes should be narrowly targeted and responsive only to actual problems carriers must continue to have the flexibility to innovate and compete with this in mind i have several specific observations to offer first c g i members are concerned about any provisions in h r nine thirty six that would require carriers to taint specific customer consent before they can share c p and i with affiliates and joint venture partners that provide marketing and other services to carriers that are otherwise permissible under the law and instances were c t r remember company share c p and i with third parties to aid in marketing billing and customer service efforts they impose strict contractual obligations to protect customer information there are also existing f c c requirements that cover such arrangements limiting the ability of carriers to share c p and i with third parties is burdensome and has no connection with the goal of preventing fraudulent access to phone records we believe that that approach focus on enhanced security rather than introducing additional customer consent mechanisms is the best way to protect c p and from an authorized use second if congress obst act in this area it should do so in the way that promotes uniformity and efficiency we are seeing increased attention being paid to these issues at the state level where at last count thirty four different pieces of legislation related to call records have been introduced this year even when these bills are similar they often contain variances that can make them difficult and costly to implement what is needed is a uniform national policy that properly balances consumer protection and carrier flexibility let me conclude by underscoring the wireless industry's commitment to protecting c p and i i can assure you that we will continue to enhance and improve our safeguards for since the customer information it's already the law it's behalf of the member companies of the united states telecom association i want to thank you for this opportunity to testify on the important issue of safeguarding consumers phone records from fraudulent use by pretax dollars this committee has a long history of working to protect consumers our industry shares your concern for protecting touched him or information protecting privacy is a critical component of our customer care in today's highly competitive marketplace and no industry should take the privacy of its customers like like as our member companies begin offering a variety of new new advanced broadband services we see our reputation for delivering quality service and protecting the privacy of our customers a competitive advantage there is a strong business incentive to protect customer privacy there is an existing legal obligation as well section two twenty two of the communications act provides that telecommunications carriers have a duty to protect the confidentiality of customer proprietary network information this legal obligation is taken very seriously by our member companies we educate and train our customer service employees serve strict security protocols and we tightly define our agreements with marketing firms we believe the best way to address the problem of progeny and access to phone records is through the enforcement of existing laws and the strengthening of penalties on bad actors in this regard we applaud title one of this legislation which would explicitly ban the practice of pretexting and give the federal trade commission authority to enforce this prohibition this provision complements and strengthens the action taken by congress last year and establishing criminal penalties for pretexting we are concerned however that the broad approach taken in title two of the bill will have a number of negative consequences consequences that a tiered of the unintended ones ones that would impact legitimate marketing practices that are in many ways pro consumer consumers benefit when their communications carriers offer them do discount packages and innovative services the information we typically rely upon in pursuing marketing opportunities focuses on purchasing patterns and the types and services that a customer is receiving enables our marketers to identify a customer that might have an interest in receiving need bundle discount that could include call management or call blocking for the features if a customer has subscribed for both voice service and high speed internet access this is a customer that might have an interest in learning about savings that could be obtained by broadening this bundle to include video the provisions proposed in title two  consumer outreach all without addressing any identifiable problem of fraudulent access to phone records we are aware of no evidence to suggest that marketing of services either directly or through joint venture partners has resulted in any abuse of customer proprietary information indeed f c c regulations require that confidentiality agreements be in place before c p and i a shared with joint venture partners or contractors businesses succeed by being responsive to their consuming to their customers as currently drafted however title two would severely impede the ability of our industry to bring to the attention of its customers the opportunity to take advantage of improve services or increase savings and we have been informed that this is not the committee's intent that instead the committee intended to only impose new restrictions on the sharing and disclosure of detailed customer telephone records there is currently an f c c proceeding underway that's considering the same thing if it is in fact the committee's intention to only address this limited call detail information information related to matters such as individual locations to ration time and date of specific customer communications then we would suggest that the bill language should be clarified so that our industry can in to new offering to its customers new services and bundled savings as it doesn't are current affording new protection to detailed customer telephone records our industry also has significant concerns with section two of three which were prescribed burdensome audit trail requirements the last time the f t c looked at this issue the cost of complying was enormous it could range anywhere from twelve dollars to sixty four dollars per line which would clearly be a hardship for many consumers madam chair again thank you for the opportunity to testify  day and we look forward to working constructively with you to provide vent pretexting and identity theft thank you mr mccormick mr einhorn good morning to morning madam chairman and members of the committee and thank you for holding this hearing and i appreciate your sympathy although i did not ask to participate in this hearing i appreciate the invitation to describe my experience as a victim of pretexting my testimony is about a corporation and management team that in attempting to ensure their survival place no limits on the exercise of their power pretexting is a brazen invasion of privacy when a large corporation has its agents spy on private citizens in order to intimidate them and silence criticism that threatens more than just the sanctity of the individual's privacy threatened the freedom of the securities markets for which we take for granted i am the president of green knight capital a long term value oriented investment company one of our long term investments his ally capital our research showed allied suffered from significant accounting and operational efficiencies and greenlight took a short investment position based upon that belief our research indicated that among other things allied misled the public about the value of its investments valuing them at original cost even after the investments go bankrupt we later found its small business lending unit defrauded the a and the u s t a government lending programs costing taxpayers hundreds of millions of dollars in two thousand and two i voiced my concerns about allied at an investment research conference which was part of a charity fundraiser for a pediatric cancer hospital i told the audience why i had sold allied short and pledged to give half of my personal profits on this investment to the children's hospital sponsoring the in response to my speech instead of examining and cleaning up these problems allies attacked me the company conducted a campaign to discredit me attacking my reputation and my motivations but ultimately regulators and prosecutors have begun to see through allied tactics yes you see began an investigation in two thousand and four and later that same year the u s attorney for the district of columbia began a criminal investigation sometime that year her greenberg a respected financial journalist for dow jones who had written critically about allied told me that his phone records had been stolen i subsequently learned a woman unknown to me had called my long distance provider identified herself as my wife provided her social security number and opened an online account to obtain our home telephone records somebody also stole the phone records of other known critics of allied including hedge fund managers a journalist a research analyst an individual investor and a former media relations advisor to greenlight in march two thousand i've i wrote a private letter to allies board of directors asking the board to fully investigate what had happened a week later i received a brushoff response last fall after the hewlett packard chairman admitted to pretexting and later resigned i again asked allied ford to investigate allied responded saying they had found no evidence to support my claim then allied management went on the ostensive yet again on the company's november two thousand and six quarterly earnings conference call chief executive officer william walton spent several minutes attacking my motivations in stating that my concerns about my stolen phone records were quote yet just another example of mr einhorn never received his records in december two thousand and six al i was served with a grand jury subpoena and then their story changed in a press release dated february sixth two thousand and seven allied admitted that agent had stolen not only my home phone records but also greenlights records the press release itself was a model of evasion however and not at all consistent with the disclosure expected of a public company it left unanswered a number of questions who had obtained the records who else's records did they steal who had authorized the theft and for what purpose what did they do with this information and what else did these agents do to gather information about their critics after the hewlett packard pretexting scandal h p immediately apologized to the victims and promised to give the victims a full account but i have not heard from allied nobody has contacted me to apologize or explain who invaded my privacy or for what purpose and conclusion i speak havior strikes at the ethical heart of the securities markets which are based on the free and fair flow of ideas critical and otherwise as a cold reality that companies left to their own devices will rarely divulge the full truth about their problems it is left to others regulators analysts the media and investors like myself to hold companies accountable the free exchange of ideas in our market system depends on the very people who are pretext and in this case there are many valuable voices in the marketplace w choose not to criticize companies for fear of being retaliated against nobody wants their privacy invaded as the committee has noted this very legislation action such as pretexting can lead to harassment and intimidation it can also lead to less information in the marketplace a line must be drawn i support this legislation thank you madam chairman and i'm available to answer any questions you might have thank you very much m recognizes herself for five minutes i'm wondering miss harn if you can tell us what what the position of the department of justice is on this legislation because i know you w closely your agency works closely with the d m j we do work we do work very closely with the department of justice but unfortunately i don't have their position on this legislation and this you know and and are you aware of any objection by any law enforcement agency to this legislation i'm not but a but  honestly we have not at the at the f t c done a kind of review of other federal agencies and whether they have any concerns on this we have worked with the with the committee staff on technical issues and rotenberg also this question what is the status of pretexting in america today have we seen the problem worsening since last year or improving hard it's hard to know exactly what's going on in the industry generally i can tell you what some of our experiences have been investigations the records and i should know we bought the records of the f t c employees with their consent yes absolutely with their consent but we've done that when we get tempted some undercover buys  more recently and and we've been told oh we don't do that anymore or you know we just we simply we can't get that for you so we have some sense that that obtain personal information about others and have you seen any change in the type of information these private investigators are seeking that would be a difficult question to answer but i will say because people sometimes don't understand exactly what the significance of the call detail information is those monthly billing statements that consumers receive from the wireless phone companies in particular that listing them is the type of information that is still very easy to get from the telephone companies by going for example to an online website that's set up to provide that type of information so we are still seeing the availability of the monthly call detail information being made available  einhorn you would have never known anything about the pretexting of your family and business records unless the market watch journalist told you what ally capital was doing is that correct that is correct i would have not had anybody to know and  this was by the way what we also found last year in our investigation that people found out inadvertently that they had been pretext and do you know how many other people had their phone records pretext of by an agent of ally capital beside you in the journalist i believe at least that we've been able to identify at least six individuals and and can you identify for the record who the phone carrier her surrendered your records to  how it was time that the that her social secure already number had been you know provided like what date that happened at where the records were sent in terms of an internet e mail account where they were email cell stolen phone records absolutely i think that that there's really no place for this and i would support all of the efforts that are that are being contemplated to tighten down and eliminate this practice thank you very much t tend to want his phone rang his or her phone records shared without him knowing about it generally speaking i don't think so sir a person who wants to disclose personal information to someone else would typically do that affirmatively to get a bank loan for example you provide a lot of information to the bank so the bank can make a determination but that's a process you would initiate just as a matter of course most normal human beings would rather they know if somebody wants that information so they can make a decision whether to give it to them or not i would yes i think that's correct no i think we have general support for this bill but mr large and mr mccormick their trade groups seem to not lie section two zero two which changes current wall from saying the the the phone company can share that information without letting the individual know unless the individual tells him ahead of time not to share that current law section two a to change is it that mr largest companies trade groups mr mccormick's would have to go to the individual and say may we may we share your information that seems to be the most controversial element in this new bill it would seem if we're trying to protect privacy that changing this from opt out to opt in makes a lot of sense do you agree with the section t two yes i do mr barton and i if i might also say while we are critical of the f c c used to lay out our partition we were nonetheless heartened you may recall the chairman martin when he spoke to this issue at the hearing last year or so that he thought the optimum was important for consumer privacy and i think there would be certainly among consumers recognition right away that the right way to do this is often based on permission i want to give mr large and mr mccormick who are both good friends of mine an opportunity to expand if i understood them correctly in their prepared testimony why they have a problem with section two to you mr bardhan i think that our concerns are fairly narrow and focused but let me give you an example we today look at purchasing patterns so for example if a customer is taking telephone service and internet access as we move into new products and applications like video we would like to be able to go to that customer and offer that customer a promotional offering where we would add in video as part of a bundle package in that regard it would be competing against the cable industry who is going to have video customers and saying we'll add on voice service since you're already a cable customer will offer you a promotional offering to have on voice service in that regard no call detail information is shared with anyone there's no and no nothing other than the knowledge of what kind of package that customer currently has and whether or not that customer would benefit from a broader package and we believe that it's with lead to a competitive in balance if we were unable to approach our customers in that way i don't understand and i've got a little bit of a cold so maybe i'm just not clued in but there's nothing in the bill if it becomes law that prevents anybody from soliciting for new services to people that they have the address the where there is a hard line address and you know a regular email address or phone number or an e mail all this says is if you want to share that person's an individual's information you've got to get their permission before you share i don't see how this bill would produce then what you just said you wanted to do if mr martin if that if that's the intent i think that it would be easy to come up with clarifying language that would that would clarify that we are  and the fact is that many of our companies utilize third parties to offer services just because it's less expensive we can offer that type of discount to our customers so if i the legislation would get in the way of or use of third parties to offer services from our company not anybody else's company but from from our company's perspective then that would be a problem but if you're saying it's not going to get in the way of that then perhaps we say that the five c c commissioners will be appearing before the telecommunications and internet subcommittee on wednesday next week so i certainly hope that the c p s order will be completed by then and it will have been of the phone calls of an individual have been compromised i would support the notion of the immediate notification of anybody who's who's information was compromised in that fashion yes mr einhorn do you think that's a good idea that important that consumers get prompt notification of a media i understand that states that have addressed this issue typically have an exception for notification the commission right now the deputy attorney general sent a letter to the commissioners indicating the department of justice is preference for law enforcement to be notified first before they can have no problem with us but i'm saying advocated for allowing in seven days i don't think the department of justice should me listen to on that issue i think mr einhorn should be listened to and the millions of americans whose information is compromised i think have an ongoing crime being committed against them they should be notified immediately as anyone whose house was burgled it hurt and if you don't want to do that then i think we're going to have a real problem next m consumer in his in his or her own information i think mr markey asked me a question last year at this hearing and i said the same thing yes it is ok thank you for sharing this with comics what percentage of your member companies outsource customer support or billing  exact number would be but we've got to get back to you on that obviously that's a good question we'll shut down a lot of the regional f c c offices but we don't have any have c c offices in india pakistan so what happens with the information out of people issue for example they require a mandatory password to get access to call detail records relating to the security or safeguards the the proposed rules ban the sharing of the c p and i with a joint venture partner or independent contractor without the express consent of the consumer on the issue of transferring the security  under the scope of your commission's investigations into this issue i wonder if you could tell the committee if any specifically rural companies have been investigated or does this seem to be a problem that is most prevalent in large companies with large lists of personal data comment just for a moment on the state of rural carriers privacy protection measures if you're able to right now i know you have you a full plate i would i would actually have to defer to to my colleague at the at the f will cost small and rural carriers unfortunately we do not have an estimate on what it will cost carriers and the answer to your first question i know that the agency has issued  twenty letters of inquiry to various carriers i imagine some of those carriers are smaller carriers given the given the number of large carriers both on the wireless and wireline side i don't know specifically what size of rural carrier the commission has made those inquiries of i know that the the commission is always sensitive as it relates to implementation of its rules in rural areas and intends to give special consideration in the rulemaking that is pen before the commission the rule carriers have pointed out that they have more limited resources and my sense is that the commissioners group will be sensitive to that that's my main concern that possibly that that they'd be included will first of all it's good for you and the first question they do understand correctly that the f t c supports the thrust of this less legislation that use the the civil fine authority of the f t c does not apply in this situation and then whether or not our proposed legislation adequately address of those ne commission the legislation does address those issues what what the commission's concern has been is that you know we as i indicated we have used our section five authority  to go after both actual pretext arrays and those who solicit pretexting the middleman so to speak but we really wanted to make sure that any legislation that was adopted addressed both parts of this of this transaction both the pretext ers who call up the phone companies engaging misrepresentations and get phone records and the middlemen the data brokers who make claims and promise that they can get this information the data brokers in the pretext of may sometimes be the same entity but sometimes they may be separate entities and we we were just concerned but this bill does address both sides of that and we think that that's a very good thing in connection with the commission's  that the commission has already obtained against the company and the second is contact violates a rule that the commission has issued we're able to get civil penalties only when we have engaged in well making authority and while while we do have general rule making authority under the under the federal trade commission act as you know the f t c act is very broad it gives us authority over unfair or deceptive after practices in our affecting commerce and in exchange for the ability to get civil penalties once we did opted a rule congress set very specific procedures that the commission has to go through in in rulemaking and they are very comprehensive it takes a fairly long time for us to engage in what we call magnusson moss who are making the sponsors of that legislation and so actually what's what's happened since model like the very similar to the model used here they've either said that the last shall be enforced by the f t c as if it's a rule or they've given the commission very specific authority to engage in rule making in a particular area congress did that with the telemarketing act with the can spam act with all of the of the factor roles and it's actually been a very successful approach a bundle of services is there a language that that you would have that could clarify that issue so that those types of services which i think the committee would want to see continued with the other protection as it relates to information but that is a legitimate use of information is something that you could supply the committee with yes it is we can get you that kind of information and that is our concern with the legislation  also raise in your testimony michel largent that as we go across the country there's a patchwork of different initiatives on different things i recently the commission has indicated a possible proposal that would move all wireless services and a title one which would give a federal framework if that happens would you support consumer protections why this is part of the federal framework or we're talking about specifically that chairman martin as mentioned this year is just moving the broadband portion of the wireless industry into title one from title two that would put us on the same ground with d s l and cable offerings and broadband over powerline there are already entitle one our services that are being rolled out over wireless are not entitle one so we're kind of competing on level ground we're just trying to get to that level ground does that answer your question and if you put broadband services under title one that w third parties that are being used to doing market and they are based overseas for their pakistan or india are they u s law still a political and enforceable and those situations and that's an issue that the commission is considering as part of the reconsideration of the order that it put out in two thousand and two i believe that the department of justice in some reply comments raised that exact issue the commission hasn't yet resolved it i think it gets into issues of treaty law and international law  that tend not to be the primary subject certainly of my bureau but i know that the commission is studying that that issue and i can also tell you that it's not an issue  that we pass here if a third party is based and in a country like india or pakistan well as you know the commission does not have any jurisdiction over com and they move data outside of the country we would take the position that the entity in the united states is responsible for their own data in terms of looking at data brokers as i mentioned you know kind of smaller businesses that that may be located here or entities that may be outside of the united states we would use the new with our date that that congress gave us in the hundred  for five minutes thank you madam chairman there's a large mr maccormack or any of your companies now selling the information to third parties that you have for on your bali in fact steve you might have been on the committee and we had that battle over the privacy issue and i was told by at that time some former financial institutions that it was such a profit center for them to market that information or two  that you know they were to kill the bill which some had been working for ten years before that and so that takes care of part of the concern and i guess i had the same concern that both the chair module com committee and mr pickering mentioned is enforcement of these privacy restrictions outside the united states and i'm glad the f t c said that you hold responsible the person or the entity here although you don't have enough jurisdiction over common carriers but again i guess we can provide that jurisdiction that would go with that contracting or somewhere else because i know now it's it's a laugh line on late night television if you buy that your computer you bought and your internet service provider you very well may be talking to someone in pakistan or or india or no telling where and they probably have as much private information on your usage as the telephone companies are wireless get permission to share it there's legislation i know put shrimp sions on telephone companies as compared to cable because of the where we're at today and our technology and i know you've been asked for speed and also so telephone service is there a standard that could be set that across to multiple industries what information could be shared is your standard anyone any good not just for the the wireless and the hard line but anybody on the panel is there a standard that could be it could be dealt with where you as a consumer could say yes i'm your customer you can contact me but i don't want you to share it with anyone republican congressman i think that that that kind of a standard would be a very very broad standard i mean in effect it would be a do not call standard because virtually every business in the united states contacts its customers to talk to its customers about the ability to take advantage of new offerings or discounts that it might have available and so that the real focus of the bill though it could be heard in the providing my information that someone else or having access to it so i'm having trouble with you know if i have a contract with a cell phone company you know we get contracts all the time for other you know every six months the commander renew your contract that i think where you're going is right that we don't have any problem saying you know you can't sell customer information to the automobile industry or or an automobile dealer because that's not that's not the way we're using the information anyway we're using it to market more services from our carriers and that's it so and that's what we worry that the legislation may go a step too far and impeding our ability to market our services to our customers and that's what we want to try to protect is the ability to market our services to our customers only we're not talking about we want the ability to market you know a lens or baseballs are ok about support for that but to also try to expand it there were consumers shouldn't have their information shared with someone else is there a you think there was a standard that you as a consumer would feel comfortable with that they could share your information across industries which i think my general view is is that you know who i'm calling for how long at what time and what those people's phone numbers are you know information that really doesn't belong to anybody and really shouldn't be used for any purpose in my mind other than sending the unveiled to tell me how much to pay the phone company and i think we agree on that that you know who i call and whatever ought to be in opt out impact of this kind of legislation if something like that were required in this bill would it would set this industry apart from other industries in for example in health medical records it's and unconstitutional so and but to be fair in those instances did not involve cases where congress had spoken on this issue so we're talking about two different cases were congress is obviously intent to speak on this issue it may not be unconstitutional or found unconstitutional but it could be i think that's an open question and if it did become part of the language of the bill and come into law it would be different in other industries it does sound like  struck down as mr large and described because it was based on the regulation of stock shoot so of course if you have a statute i think that problem goes away and in subsequent cases i should point out other federal appellate courts have upheld similar rules you know as t original question is there a reason for having opt in here where there might not be opt in you know other privacy statutes and i think the answer to that question is the sensitivity of this information that this is the real time data associated with who you are calling when and for how long and that is information that is specifically protected in section two to two of the communications act as a long long history of privacy protection and i think that's the reason you would want  and quickly i just kind of general observations so you know basically where i'm coming from then i'll get into specific questions but the way i view what we do here and i know that we're visiting the same territory is what mr mark establish from the beginning no witness here no witness in previous hearings and those were representatives and c e o s from the telecommunications industry and selves that acknowledge that the property belongs to the customer so let's start off with that basic premise the information the long to the citizen and to the customer as to disparate treatment of that information and the requirements that government may impose is to safeguards and security measures that i believe is basically established by what i think is a hierarchy of information depending on the type of information first and foremost i think it's always going to be medical records and how we arrive at that this is basically human nature and secondly i think you're going to run into telephone records and then thirdly financial records and the fact that we may treat that type of information how we safeguard in the sim and night it there probably is because there is that hierarchy and i think we have to acknowledge that now does it place any particular business certain members of the specific industry at a disadvantage that i think we can dress with in this hierarchy telephone records telecommunications everything's going out there and telecom industry and surely we don't want to do something that does place you in a disadvantage regarding the marketing of your services and such and to expand and to be successful so i are familiar with that now the reason that the legislation red dresses are with you is because you are the gatekeepers and that's the most obvious starting point and we're going to deal with the criminals and the spammers and everybody else and we can do that criminally but i think it still goes back to what mr rotenberg person pointed out is that we really start with the safeguarding measures we probably involves you a yes or no answer except think you can answer this yes or no to the extent that you understand this piece of legislation that we're attempting to pass how did been in place at the time of the einhorn family you know that borders on a then in price would have made any difference well to the extent that you're asking about the operation of title two that really isn't an f t c it's not an area standards can't say with certainty it would have prevented what happened to mr einhorn i think it is clear that of stronger security standards were in place it would have been much more difficult much more difficult for someone to improperly get access to mr horn's family's calling records and this bill would have accomplished as i believe it would of mr large and i would say that the security measures that the companies have enacted since this came to light and that was  about the same time that he had his problems are going a long way to prevent it from happening again i would tell you that the prosecution of the threat of prosecution of pre sensually evaporated the internet solicitation for people to get numbers through pretexting so we've already come a long ways but whether it would actually have addressed companies during the course of the last year and the protocols would directly address the way in which an inbound call under pretext or obtained information our concern under this legislation though is that it also addresses outbound calls there has never been a situation where one of our companies has called a pretext or to give them information this marketing on the outbound those provisions of the bill would do nothing to address the situation  colleague i think we've touched on this issue before but to some confusion at least some of the staff indicate there's confusion but like that asked this question mr norman you first and then ask all of you if you would comment on it   by virtue of the use of mandatory passwords that the person who set up the account would not have been able to do so and number two because the proposed rules from the commission provide for  quick could you would you restrict your question does in your opinion does a bill prohibit the use of detail formation or other information from phone records from the ability to market other products i think that's the open question that we are really concerned about this legislation that if it could possibly be read that way and that's what my staff is trying to understand do we need to change this feels so that you have this electability  is not clear i guess the confusion is whether we can do this and you feel strong enough that in your mind that there is confusion and you can't market information without breaking the law and so we don't want to do that we don't want to hurt the ability to market so i think that's sick that's what we're trying to i think i think clarity of the key word that we would like to see in this bill and so you'd like that if you like to see a change yes ok mr mccormick and absolutely congressman we we see this ambiguity is creating a situation where we are potentially engaged in illegal activity if we use our knowledge about the fact that an individual is a kind a telephone customer and use that knowledge in order to go to that customer on offer them a bundle package of internet access or video or even add on a wireless service we don't think that that was the intent of the committee we understand that the intent of the committee was to protect the kind of information that was taken from mr einhorn but we believe that the bill goes much farther than that and can test prevent these kinds of marketing activities and we are in the early stages here and so we're all listening so this is the time to say specifically yes or no you're saying now the two of you are saying that this bill does make it a little bit dubious whether you can continue marking practice anyone else yes terms of art speak yet is true i think there really are two distinct questions here that need to be clarified first is whether or not a telephone company can communicate with our customers about their service offerings there's nothing in this bill that prevents about an every phone company is free to make available information about related services the second question is whether the companies can take advantage of the call detail information who people are calling what they're doing how they're communicating and use that private information to determine what type of marketing to direct to the customer in my view and i think the view of most american consumers they would have no problem learning about new s service opportunities from their current provider or from a competitor that's obviously a good thing for the consumer and for the marketplace i think the specific concern here which the bill appropriately addresses is that the companies take advantage of access to this detailed information and use that as part of the marketing determination and that's where i think we need a stronger safeguards so would you in your mind then baseball what you said would you change the bill you know i would leave the bill as it is i would leave it with the opt in requirements because if i was going to be use of c p and i information for them for that purpose then i think the customer has the right to say well that's the opt in requirement would nullify the need to change the bailiff has a customer still in control yes that's correct now i guess mr large mr mccormick that's what you say to that well i just think it is a violation of basic marketing principle that's exist in our world today if we've got a company that say has sixty million customers and we want to target the twelve million that we think would be most inclined to want internet service or download music or do whatever that we can i mean there are companies do so many things today from music video television as well as your basic phone service but if we got to a group of twelve million customers out of sixty million that we think are the kind of the heart of the market for accessing whatever service it might be why why would we have to market to sixty million customers when we know that twelve million that's our that's our real that's the heart of our marketing strategy why should we have to market to sixty million when we congress provided for a do not call last if you do not want to be solicited that was an opt out the way we read this legislation is that for our industry alone it would be a do not call unless the customer ops  and so while we want to do is to make sure that our industry is not treated in entirely unique and discriminatory way thank you to the general any for now recognizes the distinguished gentleman from michigan mr stupak for five minutes annually personal knowledge that the company has established operating procedures that are adequate to ensure compliance with privacy regulations and each of the companies certify that they have had adequate procedures yet this appears to be a parade of problem doesn't it indicate that something is slipping through the cracks of the current system it would seem we cannot rely on either the certification requirement or the current f c c rules to adequately protect consumers care to comment on it yes congressman what we have in the pretexting community is that we have very sophisticated law breakers security protocols in the past required the many of the companies were using social security numbers  authentication for c teachers used by our companies are constantly being changed and upgraded in ways to perth prevent protect against the increasing sophistication of pretax dollars so it is a is a continuing battle it's an ongoing  pretext there's no it would have nothing to do with that because pretexting are calls that come in correct and the opt in requirement today says that we can't share the information with anybody requirement has to do with forcing the customer to first say to us you may contact me about offering new services and if i don't give you express authorization beforehand do not call hands sharing information with third parties with regard to this bill the way we read it is that our own companies would not be allowed to market services beyond the fact that that they have the telecom service without o you know when we did the old investigation here the way i remember the summary of it if i will was the record reflected that it was in the words were administration's sloppiness by the carriers and in our investigation we saw this is sort of like the key part of the program so i mean if if the carriers are really sloppy no matter how sophisticated can be but for me sloppy in the way you administer you're going to have this pretexting problem correct can i think that i think that we are in in full agreement with the committee with regard to the need for inbound calls requesting customer proprietary network information particularly call data information be authenticated so that you do not have people who should not be getting that information are getting that information because we don't want to do that is to go on the other side where we're making calls out to our customer to offer them services that maybe offering them greater discounts or savings for those to get swept up there has never been an instance where there's been a problem with pretexting or identity theft on the part of marketing calls from our companies out and what sort of the holdup here i can tell you that first of all it's not a complete ban on the release of code details that it's putting in place the security measures like the use of mandatory passwords i don't want to totally frustrate consumers and their endeavor to get access to the information the chairman circulated the order at the end of last year i know that he has been working actively with his commissioner colleagues to try to build consensus on the item he tends to take a jim and mr market introduced last session the wireless for one privacy act which seeks to keep more or less services from disclosing wireless numbers without the affirmative consent of the consumer and we've heard of prevent fraud and identity theft because they can be cross checked with information on credit and loan applications and we certainly don't want to make it harder to prevent fraud your bureau has a mandate to protect consumers so i would appreciate your thoughts on that kate themselves in ways to prevent the misuse of their own personal information but i would because this is entitle to and it is a part of the de that falls outside the scope of the of the f t c jurisdiction we would have to really go back and look at this and consult with our colleagues at the at the f c c to understand how this would operate and  i understand you're willing to work with us on the clarification regarding marketing services but the phone number is not c p and i recall that really  refers to data about the phone records and the behavior of phone numbers can be cross checked on applications for credit you know and other about this third party sharing of information for marketing or other purposes make sure i understand it just give a hypothetical x y z phone company wants to enter into a joint venture with x p travel company and they want to share databases with the travel company can focus on marketing efforts to see who's traveling who's calling paris and maybe they want to market these people i want to ask mr devon mr large  under what circumstances should the phone company be able to share that information with acme travel company what would happen to happen first or second in that regard in particular mr have a few tell me about the relationship between your proposed rule in this currently as has been discussed the rule that the commission has as relates to joint venture partners is an opt out rule in other words the carriers do not need the express consent by consumers to use the  i to market communications related services so that is that the current state of the commission flaw with the chairman has proposed to do is to change that from an opt out approach to an opt in approach in other words you would need express consent from the consumer to use the c p a to market communications related services so that is specifically what the chairman has proposed in the order in front of rules they would not be allowed to market or be allowed to disclose information to joint venture partners for non communication related services on an opt out approach and would not be allowed to do that so what your proposed rule under consideration now would be to treat non communication services communication services is saying which is you would have to be in up the end before it was allowed is that the current price that's correct i would i would like to get back to you on whether or not the carriers could any information with an allied travel but that the express consent of the customer and that is a matter of practice none of our companies do it any way that that the legislation under consideration would instead say that with regard to any communications related services for example if a local company one of our local companies wanted to offer to its customer a bundle package that included local and long distance we would not be able to contact that customer unless the customer first opted in and allowed us to use the fact that it was a local customer for us to then say you're paying twenty five dollars for local service we're walking a bundle package with long distance for thirty five or  same way our companies are not taking customers names or numbers and marketing them selling them to third parties i don't have any to do with telecommunications we use those to market our services to our own customers only this recovery q discretion this you'd be discriminated against if this is an option and i'm thinking about this so i don't share any position that i have right now but i do want to say that at least i've taken a position that other industries should be adopting for instance i believe you should have to opt in to get my checking account record i lost that battle in the past couple of congresses if i come down on the side different than yours it's not to discriminate against you but through being consistent the course could do what i think most of my constituents want at the moment well i understand you know the desire to to opt in in order to get a checking account records call detail information but we're really talking about here is kind of a kind of like a do not call list and as i said before congress passed a do not call law that was an opt out if you don't want to call you can opt out this would say with regard to our industry alone customers would have to opt in before we were allowed to call our own customers and i don't think that's the in the committee's intent and that's what we'd like to is there any new user any middle ground here where you would not disclose pacific identity of the callers or callie but certain general characteristics if you reach some joint venture marking situation is that possible yeah i think there's a lot of middle ground here i think that all of but the concerns that the committee has about identity theft in pretexting and privacy of customer records are concerns that the that we share and what we want to be able to do to simply be able to work on the fact of why to market new services particularly bundled services in a way that that competes with all of the other businesses out there that are looking for new and innovative ways of offering consumers a package th market to your customers can't you just do this from other data that you would have there is there is a difference in there's a difference between c p n i a customer proprietary network information and call detail information customer proprietary network information is arguably everything about that customer his service package does he take a local service does he take call answering does he take call forwarding does he also take internet access does he take long distance that's different than the call detail information call detail information a fact we don't even keep the call detail information for local calls on long distance calls call detail information is kept only for billing purposes it's the call detail information that sought by pretax dollars that was sought in the case of mr einhorn we understand the desire of the committee to afford additional safeguards to third parties being able to come in and access that call detail information people who should not have access to it but for purposes of our being able to use joint venture partners to go out into market for us and on services like internet access video or even new pricing packages for long distance family five family plans favorite five plans that information for being able to market outward has never been used for pretexting there is not any case whatsoever where there has ever been an inappropriate use of that information that is violating the privacy of an individual for outward marketing purposes i would just add to that not even when third parties were located not in the united states that those third party agreements that they have with the carriers are sacrosanct to those third parties because if they violate them then they're out the door their business is out the door when we had  that wasn't the case was you know and i subcommittee and we had all of the i think we had seventeen people take the fifth one morning and i can't even do the math to figure out what number that would be seventeen times five but i'm very glad that you don't call those in for well let me then so i understand we're we're obviously trying to craft piece of legislation that will in your and your industry moves and changes very fast and our legislation will be there in perpetuity for the rest of my natural lifetime so we want it to of this bill is that correct and i soon you've made those those concerns of a level to the to the appropriate committee staff and mr navan you're not allowed to help in that or at some point will you be able to help us in that they did a commission would be happy to do to help and perhaps have to provide technical assistance on the bill but i just reviewed the bill for purposes of preparing for this hearing and i don't want to simply give my my impression and rather coordinate with the folks at the commission ok but that information or that technical assistance is going to be available to the committee staff and committee members as as we go through the process of marking up  he's gone but i'll try to paraphrase it and i hope i'm accurate or he said shouldn't the company have notified you immediately about for breach of security or the pretexting that occurred how did they know the protecting had occurred i mean these guys just sat in front of us and gave us examples of pretexting they were so clever about how they did stuff how did they know that your information had been delivered to the wrong hands let me i'm glad you came back to that because i wanted to lab rate on the question that was asked before i'm actually a victim of pretexting in two separate circumstances the first relates to my home telephone records where the company happened why we tried to sign up for an online account to pay our bills and it says you can't do that because the account is actually already been opened and then you say well who open the account and then the t t was able to tell us the details of capital put out a press release saying they had things that were purported to be our business records in response to an investigation they were conducting and response to a grand jury subpoena so if they hadn't been asked that by the justice department or by the grand jury to find out whether or not they'd actually taken our records we never wouldn't have known til this day that these records were taken and the same situation that company was that was pret did not call back for verification after what did they open a new account as well even now we don't know how they did it we don't know whether they did this somehow online we don't know if a they bribed an official of the phone company we have no idea what records they have or how they obtain those records or for what you say they need and that is that is still true to this moment because we've gotten no explanation from allied capitalist what they've done so far like capital hadn't issued a press release you would have you wouldn't even in fact know commission investigations are nonpublic is so we would be happy to talk to you thank you in a non public brief thank you the chair wants to thank all of the witnesses today and following up on some questioning by mr burgess i would say we are not in the initial stages of developing this legislation we're in the final throes and if them first of the as witnesses today or other members of the audience wish  to give specific suggestions on development of this legislation the committee would much appreciate those efforts and again i want to thank everybody for coming that hearing is adjourned to meet you