◆ SpookStack

affected customers and to the public, the persons responsible may be tipped off that law enforcement is investigating their crime. Criminals would then have the opportunity to destroy evidence, change their behavior, and otherwise jeopardize the investigation and avert justice. Indeed, the approach outlined above is the one taken by a variety of proposed legislation currently under consideration by Congress. ** The Commission’s questions regarding routine notification of any access to CPNI, even when no security breach is suspected, raise additional issues.*’ There may be good reasons that a carrier may want to disclose CPNI without notifying its customer, e.g, during the course of a fraud investigation. But if the Commission does decide to go beyond notification of actual security breaches, it should at a minimum make clear that any new requirements do not alter the balance struck by Congress for when law enforcement access to customer records must be disclosed. See 18 U.S.C. 2701 ef seq. Because Congress has already established a structure for customer notification of law enforcement access to customer records, the Commission should exclude disclosure of CPNI to !aw enforcement from any routine notification requirement. IV. Conclusion For the reasons stated herein, the Departments urge the Commission not to adopt rules mandating the destruction of call records and similar CPN, a vitally important investigative resource for protecting public safety and national security. Such a rule would undoubtedly hinder the Departments’ ability to carry out their respective public 33 Notice 4 23. uM See, é.g., Data Accountability and Trust Act, H.R. 4127, 109th Cong. (2005), Personal Data Privacy and Security Act of 2005, 8. 1789, 109th Cong. (2005). 35 Notice ¥ 23.