◆ SpookStack

Il]. Any Notice Requirement Adopted by the Commission Should Include A Provision Requiring Advance Notice to Law Enforcement and, Where Appropriate, Delayed Notice To The Consumer. The EPIC Petition also suggested that carriers should be required to notify affected customers when there has been an improper disclosure of CPNI.”? In the Notice, the Commission went further and asked for comments regarding “the costs and benefits of routinely notifying customers afler any release of their CPNI.”?? While the Departments strongly support prompt victim notification in the case of security breaches, we believe any rule requiring such notification should also require that carriers first notify law enforcement authorities and, where appropriate, allow law enforcement to request a reasonable delay in notification to the consumer where such notification might harm related law enforcement investigative efforts. In addition, any requirement that customers routinely be notified of disclosures of their CPNI should make clear that it does not alter the rules already established by Congress regarding the circumstances under which a customer must be notified of law enforcement access to customer records. Requiring advance notice to law enforcement of security breaches, together with the option of delaying consumer notification, can serve several important goals. First, anecdotal evidence suggests that many CPNI breaches go unreported to law enforcement. Only by prompt investigation of such breaches can the offenders be identified and punished. Thus, required reporting to law enforcement will deter further breaches of CPNI security. Second, where deemed necessary by law enforcement, a reasonable delay can help preserve evidence critical to the investigation of misappropriation of CPNI. Ifa carrier suffering an intrusion or theft must immediately announce the security breach to 2 See EPIC Petition at 11.