G/TBT/N/BRA/1452

10 October 2022(22-7589)

Page: 1/2

Committee on Technical Barriers to Trade

Original: English

NOTIFICATION
The following notification is being circulated in accordance with Article 10.6
1.

Notifying Member: BRAZIL
If applicable, name of local government involved (Article 3.2 and 7.2):

2.

Agency responsible:
National Telecommunications Agency - ANATEL
Name and address (including telephone and fax numbers, email and website
addresses, if available) of agency or authority designated to handle comments
regarding the notification shall be indicated if different from above:
National Institute of Metrology, Quality and Technology (INMETRO)
Telephone: +(55) 21 2145.3817
Email: barreirastecnicas@inmetro.gov.br
Web-site: www.inmetro.gov.br/barreirastecnicas

3.

Notified under Article 2.9.2 [X], 2.10.1 [ ], 5.6.2 [ ], 5.7.1 [ ], 3.2 [ ], 7.2 [ ],other:

4.

Products covered (HS or CCCN where applicable, otherwise national tariffheading. ICS numbers may be provided in addition, where applicable): Electricalmachinery and equipment and parts thereof; sound recorders and reproducers, televisionimage and sound recorders and reproducers, and parts and accessories of such articles(HS code(s): 85); TELECOMMUNICATIONS. AUDIO AND VIDEO ENGINEERING (ICScode(s): 33)

5.

Title, number of pages and language(s) of the notified document: PublicConsultation 65, 5 September 2022. ; (5 page(s), in Portuguese)

6.

Description of content: Public Consultation proposal to establish mandatory
cybersecurity minimum requirements for conformity assessment of CPE (Customer
Premises Equipment) to mitigate vulnerabilities.
Comments can be made at:https://apps.anatel.gov.br/ParticipaAnatel/Home.aspx
Selecting Public consultation No 65

7.

Objective and rationale, including the nature of urgent problems whereapplicable: Definition of minimum cybersecurity requirements for conformity
assessment of CPE (Customer Premises Equipment) equipment.
CPE equipment distributed in the national market has the default authentication
configuration vulnerability. This vulnerability, which consists in the factory configurationof authentication passwords that are the same among all equipment units produced,
allows malicious agents to easily access the equipment configuration environment via theinternet and take control of those CPEs that have not had their default passwords
changed. Such intrusions can result in the compromise of information (personal, banking,G/TBT/N/BRA/1452-2etc.) of users of telecommunications services, in addition to allowing such CPEs to be usedas vectors in denial of service attacks or other types of cyber-attacks.; Quality
requirements
8.

Relevant documents:01) Brazilian Official Gazette 191, on 6 October 2022, section 1, page 23 02) SEI process
number 53500.032306/2022-74
https://www.in.gov.br/web/dou/-/consulta-publica-n-65-de-5-de-setembro-de-2022434397246
https://sei.anatel.gov.br/sei/modulos/pesquisa/md_pesq_processo_exibir.php?exIsiWoP
bTSMJNP15y_TiUpWIfXjgqaCcxbh3o0V5ttS0uQqIkRDNDdsrlbDPN0z9DjOh_HT6NYS_BYkN5mlMZtXL3SEft4AIIAXscgoy_nnFif4_hcUv336YEbAenU

9.

Proposed date of adoption: To be determined
Proposed date of entry into force: To be determined

10.

Final date for comments: 4 December 2022

11.

Texts available from: National enquiry point [ ] or address, telephone and fax
numbers and email and website addresses, if available, of other body:
National Telecommunications Agency – ANATEL
Telephone: +(55) 61 2312.2318
Telefax: +(55) 61 2312.2949
Email: certificacao@anatel.gov.br
Commentsshould
be
sent
to
the
Brazilian
TBT
Enquiry(barreirastecnicas@inmetro.gov.br) and copied to certificacao@anatel.gov.br

Point

https://apps.anatel.gov.br/ParticipaAnatel/VisualizarTextoConsulta.aspx?TelaDeOrigem=2&ConsultaId=10076