FCC Clears Telcordia to Become Next LNPA, Denies Neustar Procedural Appeal

The MSA "contains terms and conditions to ensure that effective public safety services and law enforcement and national security operations are supported," said the FCC order approving the contract. It said: the government's interests "are protected by a rigorous audit program that monitors for and ensures compliance, backstopped by robust enforcement tools"; a Telcordia Code of Conduct and Voting Trust Agreement "demonstrate[s] to us that, together with our rules and orders, Telcordia will be an impartial LNPA"; and "Telcordia has effectively engaged in post selection risk reduction activities to address the evolving cybersecurity threat environment.”

“Making local number portability work is expensive," said Commissioner Ajit Pai in a concurring statement. "Over the last three years, our contract with the incumbent LNP administrator, Neustar, has cost consumers $1.4 billion, or $466.4 million a year. In contrast, Telcordia has told the FCC it would do the job for the next seven years for less than $1 billion, or $142.9 million a year." He voiced disappointment that delays had cost the American public savings but "reluctantly" supported moving forward.

O’Rielly partially approved, concurred and dissented. "Based on my concerns about certain language in the contract and order, due to my continued misgivings regarding process, and given the substantial delegations of authority, I must concur in part and dissent in part," he said.

A Neustar spokesperson said; "Today's decision is just another data point in a bizarre and opaque process that continues to give short shrift to important issues involving critical U.S. telecommunications infrastructure. Neustar will continue to fulfill our transition obligations, deliver high-quality NPAC services, and pursue a lawful outcome through our litigation.”

FCC staff and Telcordia agreed in early February the company would rewrite source code for systems it plans to use as LNPA, according to letters the agency recently released in response to our Freedom of Information Act request. The recoding -- which surfaced in late April (see 1604290056) -- was taken to address commission concerns that foreign nationals worked on the code, which the agency said was "inconsistent" with its 2015 order conditionally selecting Ericsson-owned Telcordia (iconectiv) to replace Neustar as LNPA.

The FCC July 13 released various documents in response to our FOIA request seeking communications between the commission and Telcordia/iconectiv/Ericsson and NAPM personnel since Sept. 1. Included are letters between Wireline Bureau Chief Matt DelNero and iconectiv CEO Richard Jacowleff, plus a number of emails. Citing FOIA exemption 5, the FCC said it didn't release an email from NAPM's counsel to commission staff on LNPA code development that would likely "harm the commission's deliberative process" if it were disclosed. "Release of this information would chill deliberations between the Commission and its consultant and impede the candid exchange of ideas," said the letter to us from Ann Stevens, deputy chief of the Wireline Bureau's Competition Policy Division.

NAPM brought to the FCC's attention Oct. 22 "an issue involving non-U.S. citizens' work on the source code," said Kris Monteith, another Wireline Bureau deputy chief, to Harris Wiltshire attorney John Nakahata, Telcordia counsel, in an email on the same day asking to discuss the matter. A Nov. 8 email from Nakahata to Monteith said he had just "learned that in addition the 8 non-US citizens, there are some dual citizens." An agenda for a Nov. 9 meeting between senior FCC staffers and Jacowleff and other Telcordia/iconectiv representatives cited a security issue -- the "use of Non-U.S. Citizens for Work on NPAC/SMS systems" (Number Portability Administration Center/Service Management System) -- and competitive neutrality issues.

DelNero wrote to Jacowleff on Feb. 4 to discuss ongoing negotiations about the FCC's conditional selection of Telcordia as LNPA. DelNero said the March 2015 selection order required all LNPA personnel working on NPAC/SMS be U.S. citizens. The FCC learned from NAPM's counsel that iconectiv may have allowed non-U.S. citizens to work on the development and testing of NPAC/SMS source code and other important functions, such as project management -- a fact the agency later confirmed, he said. FCC staff has met with iconectiv representatives to express its "deep concerns with iconectiv's use of non-U.S. citizens and the timing of that disclosure.”

“After careful review and consultation with our Federal partners, we have determined that iconectiv's proposed remediation of its use of non-U.S. citizens in the development of the NPAC/SMS is inadequate and does not meet the conditions of the Order," DelNero wrote. "Under iconectiv's proposal, as we understand it, the specific source code written by foreign nationals would be rewritten, but other source code concurrently written and to which foreign nationals may have had access would remain in place, as would other aspects, such as testing protocols.”

“We have concluded that a necessary precondition for iconectiv to meet the conditions of the Order with respect to security is to begin entirely anew in its development of the new NPAC/SMS, including with respect to all source code as well as other matters such as testing protocols and systems development," DelNero said. "As made clear by the Order, all personnel working on the new NPAC/SMS must be U.S. citizens and appropriately vetted. It is critical that the new NPAC/SMS ensure the incorporation of security best practices including, importantly, supply chain risk and insider threat management." The FCC expected iconectiv to take the remedial actions at its own expense -- without increasing LNPA costs -- and to devote the resources "to prevent delay of the LNPA transition beyond your currently projected delivery date of 3Q17.”

In response Feb. 8, Jacowleff said iconectiv "will begin entirely anew in its development of the NPAC/SMS," with only U.S. Citizens, "and in accordance with the expectations" DelNero outlined, including regarding costs and timing. "We deeply regret that we have not met your expectations to date," Jacowleff wrote. "We clearly misunderstood the expectations and the post-Order process with respect to security provisions. We had, based on the company's prior governmental experience, erroneously expected some further explication and flexibility in the requirements, and had assumed that those issues would be resolved through the contract negotiation process with the NAPM.”

To accelerate the transition, iconectiv started development work before the March 2015 order and requirements, conducting background checks on all staff, Jacowleff wrote. "To our detriment, however, we did not exclude two non-U.S. citizens who worked on a small fraction of the source code (one of whom's code has already been rewritten), or the small handful of others who did not write source code." (The two foreign nationals were from China and Great Britain, an informed source told us April 29.) Jacowleff said iconectiv was fully committed to meeting the 3Q 2017 delivery date, but noted some factors were outside its control and it needed FCC assistance in various areas, including approval of the MSA. The FCC, Telcordia and NAPM didn't comment Monday on the documents.