The U.S. Federal Communications Commission has prohibited telephone and mobile phone carriers from releasing customer records over the phone without a password in an effort to protect against the practice of pretexting.

The FCC, in rules released Monday, will also require carriers to notify customers immediately when there are changes to their accounts, such as a new password, a new address or an online account opened.

"The unauthorized disclosure of consumers' private calling records is a significant privacy invasion," FCC Chairman Kevin Martin said in a statement. "Compliance with our consumer protection regulations is not optional for any telephone service provider. We need to take whatever actions are necessary to enforce these requirements to secure the privacy of personal and confidential information of American customers."

The practice of pretexting, gaining a phone customer's call or account records by pretending to be that customer, has become a major concern of the FCC and the U.S. Congress in the past year. Early in 2006, Congress began looking into call records being sold online, but then in September Hewlett-Packard Co. announced that it had hired investigators who used pretexting to gain access to reporters' and board members' phone records in an effort to find the source of board leaks.

U.S. President George Bush signed a bill creating criminal penalties for pretexting in January. Congress is looking at additional legislation that would give the U.S. Federal Trade Commission (FTC) authority to file lawsuits against pretexters and the people who hire them.

The FCC order also requires carriers to notify customers and law enforcement officials if there's been an unauthorized disclosure of phone records. Carriers will also be required to obtain "explicit consent" from a customer before disclosing phone records.

Providers of traditional voice services, plus providers of VOIP (voice over Internet Protocol) service, are covered by the new rules.

Commissioner Michael Copps, while approving most of the new rules, objected to a provision that would allow carriers to withhold a records breach from customers for up to 14 days, and even longer if requested by law enforcement officials.

Those rules would "keep victims of these unauthorized disclosures in the dark even longer, perhaps indefinitely," he said in a statement. "As some have described it, it is akin to not telling victims of a burglary that their home has been broken into because law enforcement needs to continue dusting for fingerprints."

The IDG News Service is a Network World affiliate.

Whitepapers

• Advancing the Economics of Networking
• Enterprise Data Center Network Reference Architecture
• Implementing HA at the Enterprise Data Center Edge to Connect to a Large Number of Branch Offices
• File Integrity Monitoring: Secure Your Virtual and Physical IT Environments
• Boost Productivity While Cutting Costs with Next-generation Collaboration
• Deploying Virtualized NetWare on Linux Whitepaper

View more SECURITY whitepapers

Webcasts

• PoE Plus: Impact on the PoE Market
• Creating a high performance workplace with wireless networking
• Harnessing the power of communications to increase workplace performance
• Making data centers the IT strategic focus
• Protecting assets and employees with IP Video Surveillance
• Stay out of the headlines: Detecting and preventing network intrusions

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• IP address management in 2008 - six things to know
• The self-managed network

View more SECURITY special reports