Petition to Adopt De

PETITION submitted by US Department of Justice

Petition to Adopt Conditions

2018-08-15

This document pretains to ITC-T/C-20171213-00222 for Transfer of Control on a International Telecommunications filing.

IBFS_ITCTC2017121300222_1494809

Before the FEDERAL COMMUNICATIONS COMMISSION Washington, D.C. 20554 In the Matter of ) ) WC Docket No. 17-356 MagicJack VocalTec Ltd. And B. Riley ) ITC-T/C-20171213-00223 Financial, Inc. Joint Applications for ) ITC-T/C-20171213-00222 Consent to Transfer Control of Domestic ) ITC-T/C-20171213-00221 And International Section 214 Authorizations) PETITION TO ADOPT CONDITIONS TO AUTHORIZATIONS AND LICENSES The U.S. Department of Justice (“USDOJ”), to include its components, the National Security Division (“NSD”) and the Federal Bureau of Investigation (“FBI”), submits this Petition to Adopt Conditions to Authorizations and Licenses (“Petition”), pursuant to Section 1.41 of the Federal Communications Commission (“Commission”) rules.1 Through this Petition, the USDOJ advises the Commission that it has no objection to the Commission approving the authority sought in the above-referenced proceeding, provided that the Commission conditions its approval on the assurance of B. Riley Financial, Inc. (“B. Riley”) to abide by the commitments and undertakings set forth in the August 13, 2018 Declaration and Letter of Agreement (“LOA”), copies of which are attached hereto. The Commission has long recognized that law enforcement, national security, and public safety concerns are part of its public interest analysis, and has accorded deference to the views of other U.S. government agencies with expertise in those areas. See In the Matter of Comsat Corporation d/b/a Comsat Mobile Communications, etc., 16 FCC Rcd 21,661, 21707 ¶ 94 (2001). 1 47 C.F.R. § 1.41.

After discussions with representatives of B. Riley in connection with the above-referenced proceeding, the USDOJ, NSD and FBI have concluded that the additional commitments set forth in the Declaration and LOA will help ensure that the FBI, which has the responsibility of enforcing the law, protecting the national security, and preserving public safety, can proceed appropriately to satisfy those responsibilities. Accordingly, the USDOJ advises the Commission that it has no objection to the Commission granting the application in the above-referenced proceeding, provided that the Commission conditions its consent on compliance with the Declaration and LOA. Respectfully submitted, SANCHITHA JAYARAM Chief, Foreign Investment Review Staff National Security Division United States Department of Justice /S/ David D. Jividen U.S. Department of Justice 3 Constitution Square 175 N St NE, Suite 12-1805 Washington, D.C. 20002 August 15, 2018

DECLARATION I, Kenneth M. Young, President of B. Riley Financial, Inc. (“B. Riley”), provide the following declaration in connection with certain Applications before the Federal Communications Commission (“FCC”) seeking consent to transfer control of YMax Communications Corp., magicJack SMB, Inc., and Broadsmart Global, Inc. (collectively, the “Licensees”) from magicJack VocalTec Ltd. (“MJVT”) to B. Riley (the “Transaction”).1 I am authorized to make the commitments described in this Declaration on behalf of B. Riley. 1. On April 30, 2018, B. Riley filed with the FCC a Supplement to the Applications. 2. As Exhibit A to the Supplement shows, upon closing of the Transaction, B. Riley (a U.S. corporation), will own indirectly 100 percent of and control MJVT (a company formed under the laws of Israel) and the Licensees (each a U.S. corporation). 3. In addition, the Supplement describes an internal corporate reorganization that would remove any foreign ownership from the Licensees’ ownership structure within one (1) day after the closing of the Transaction. 4. B. Riley commits to undertake the reorganization described in the Supplement within one (1) day after the closing of the Transaction. If, however, the reorganization does not occur within three (3) business days after closing (the “Reorganization Period”), the first day of which is counted the day after closing, the attached Letter of Assurances (“LOA”) dated August 13, 2018 from B. Riley to the U.S. Department of Justice (“DOJ”) will automatically take effect on that date. B Riley confirms that it has authority over MJVT following the closing of the Transaction to effectuate and comply with all aspects of the LOA. If the reorganization occurs within the Reorganization Period, the LOA will be considered terminated and/or null and void without going into effect. 5. B. Riley will notify the FCC and the U.S. Department of Justice (“DOJ”) within three (3) business days of the reorganization that it has been completed. In the event the reorganization does not occur within the Reorganization Period, B. Riley will notify the FCC and DOJ within three (3) business days that the LOA has gone into effect. I declare under penalty of perjury that the foregoing is true and correct. Kenneth M. Young President B. Riley Financial, Inc. Executed on: August 13, 2018 1IB Docket Nos. ITC-T/C-20171213-00221, ITC-T/C-20171213-00222, ITC-T/C-20171213-00223, WC Docket No. 17-356.

21255 Burbank Blvd., Ste. 400 Woodland Hills, CA 91367 Tel: (818) 884-3737 www.brileyfin.com August 13, 2018 Assistant Attorney General for National Security United States Department of Justice National Security Division 950 Pennsylvania Avenue, NW Washington, DC 20530 Subject: WC Docket No. 17-356, FCC File Nos. ITC-T/C-20171213-00223, ITC-T/C- 20171213-00222, ITC-T/C-20171213-00221 magicJack VocalTec Ltd. and B Riley Financial, Inc. Joint Applications for Consent to Transfer Control of Domestic and International Section 214 Authorizations Dear Sir/Madam: This Letter of Agreement (“LOA” or “Agreement”) outlines the commitments being made by B. Riley Financial, Inc. (“B. Riley”) to the U.S. Department of Justice (“USDOJ”) in order to address national security, law enforcement, and public safety concerns raised with regard to the above-referenced applications to the Federal Communications Commission (“FCC” or “Commission”) for authority to transfer control of FCC licenses held by subsidiaries of magicJack VocalTec Ltd. (“MJVT”) to B. Riley pursuant to Section 214 of the Communications Act of 1934, as amended, and 47 CFR §§ 63.04(b) and 63.18(e)(1) and (2) of the FCC’s rules the (“Transaction”). B. Riley adopts as true and correct all statements MJVT and B. Riley or their representatives have made to USDOJ, other agencies, and the FCC in the course of the review of the above-referenced applications, and any attachments or supplements thereto, and they B. Riley hereby adopts the facts contained therein as the basis for this LOA. 1. For purposes of this LOA, the following definitions apply: a. “B. Riley” means B. Riley Financial, Inc. or its successors-in-interest. “MJVT” means MagicJack VocalTec Ltd. “Licensees” means any subsidiaries of B. Riley that hold FCC licenses to provide telecommunications services. b. “Access” or “Accessible” means the ability to physically or logically undertake any of the following actions: (a) to read, copy, divert, or otherwise obtain non- public information or technology from or about software, hardware, a database or other system, or a network; (b) to add, edit, delete, reconfigure, provision, or alter information or technology stored on or by software, hardware, a system or network; and (c) to alter the physical or logical state of software, hardware, a system or network. 1

c. “Customer Proprietary Network Information” (CPNI) shall mean as defined in 47 U.S.C. § 222(h)(1). d. “Date of this LOA” shall mean the date on which the Letter of Agreement is executed by B. Riley. e. “Domestic Communications,” as used herein, means: (1) Wire Communications or Electronic Communications (whether stored or not) from one U.S. location to another U.S. location; and (b) the U.S. portion of a Wire Communication or Electronic Communication (whether stored or not) that originates or terminates in the United States. f. “Domestic Communications Infrastructure” means any systems, equipment, hardware, software or applications that capture or control, or transmit the flow of Domestic Communications on behalf of the Licensees, including information technology supporting such networks. g. “Electronic Communication” has the meaning provided in 18 U.S.C. § 2510(12). h. “Electronic Surveillance” means: (a) the interception of wire, oral, or electronic communications as defined in 18 U.S.C. § 2510(1), (2), (4) and (12), respectively, and electronic surveillance as defined in 50 U.S.C. § 1801(f); (b) Access to stored wire or electronic communications, as referred to in 18 U.S.C. § 2701 et seq.; (c) acquisition of dialing, routing, addressing, or signaling information through pen register or trap and trace devices or other devices or features capable of acquiring such information pursuant to law as defined in 18 U.S.C. § 3121 et seq. and 50 U.S.C. § 1841 et seq.; (d) acquisition of location-related information concerning a subscriber or facility; (e) preservation of any of the above information pursuant to 18 U.S.C. § 2703(f); and (f) access to or acquisition, interception, or preservation of, wire, oral, or electronic communications or information as described in (a) through (e) above and comparable state laws. i. “Foreign” means non-United States. j. “Geolocation Data” means any information collected by the Licensees from their customers regarding a customer or the customer’s device location. k. “Government” means any government, or governmental, administrative, or regulatory entity, authority, commission, board, agency, instrumentality, bureau or political subdivision, and any court, tribunal, judicial or arbitral body. l. “Internet Search Information” includes any data collected by the Licensees about their customer’s internet browsing or online purchasing activities through any mechanism permitted by the services offered by the Licensees. 2

m. “Lawful U.S. Process” means U.S. federal, state, or local court orders, subpoenas, warrants, processes, directives, certificates or authorizations, and other orders, legal process, statutory authorizations and certifications for electronic surveillance, physical search and seizure, production of tangible things or access to or disclosure of Domestic Communications, call-associated data, transactional data, subscriber information, or associated records. n. “Network Elements” means a facility, equipment, software, hardware or applications used in the provision of telecommunications services, including features, functions and capabilities that are provided by means of such facility or equipment, including subscriber numbers, databases, signaling systems, and information sufficient for billing, receiving and/or aggregating customer data, and collection or used in the transmission, routing, or other provision of telecommunications services. o. “Network Management Capabilities” means software or applications used to manage or monitor network operations or services. p. “Network Operations Center” means any locations and facilities performing network management, monitoring, accumulation of accounting and usage data, maintenance, user support, or other operational functions for Domestic Communications. q. “Non-U.S. Government” means any government, including an identified representative, agent, component or subdivision thereof, that is not a local, state, or federal government in the United States. r. “Offshoring” means performing obligations of this Agreement through the use of entities and personnel outside of the territorial limits of the United States, whether those entities or personnel are employees of B. Riley or its subsidiaries, or third parties. s. “Outsource” or “Outsourcing” means, with respect to Domestic Communications, supporting the services and operational needs of the Licensees at issue in this LOA through the use of contractors or third parties. t. “Principal Equipment” means any equipment, hardware, software, or applications capable of controlling Domestic Communications, as well as device controllers, signal routing and transfer routers, devices that perform network or element management, fiber optic line termination and multiplexing, core and edge routing, network protection, radio network control, mobility management, or lawful intercept functions, and non-embedded software necessary for the proper monitoring, administration and provisioning of any such equipment. This definition may be modified from time to time by USDOJ as may be necessary due to changes in technology, business model, management, structure of services offered, or governance of the Domestic Communications. u. “Security Incident” means (a) any known breach or suspected breach of the Agreement, including a violation of any Network and Systems Security Plan or use of 3

Outsourced or Offshore service providers or Network equipment (b) any known exploitation or suspected exploitation of a security vulnerability. v. “U.S. Records” means the Licensees’ customer billing records, subscriber information, text, Internet Search Information online purchasing information, or Geolocation Information, CPNI, and any other related information used, processed, or maintained in the ordinary course of business relating to the services offered by the Licensees in the United States, including information subject to disclosure to a U.S. federal or state governmental entity under the procedures specified in 18 U.S.C. § 2703(c) and (d) and 18 U.S.C. § 2709. w. “Wire Communication” has the meaning provided in 18 U.S.C. § 2510(1). 2. B. Riley confirms that the Licensees will comply with all applicable lawful interception statutes, regulations, and requirements, including the Communications Assistance for Law Enforcement Act (“CALEA”), 47 U.S.C. 1001 et seq., and its implementing regulations, as well as comply with all court orders and other Lawful U.S. Process for lawfully authorized Electronic Surveillance. 3. Upon receipt of any Lawful U.S. Process, the Licensees shall place within the territorial boundaries of the United States any and all information requested by the Lawful U.S. Process within the period of time for response specified in the Lawful U.S. Process, or as required by law, and shall thereafter comply with the Lawful U.S. Process. 4. B. Riley agrees to notify USDOJ, at least 30 days in advance, on any change to the Licensees’ current services portfolio or any peering relationships or joint ventures with foreign companies providing data aggregation or reselling services. 5. B. Riley agrees that the Licensees will not, directly or indirectly, disclose or permit disclosure of or Access to U.S. Records or Domestic Communications or any information (including call content and call data) pertaining to a wiretap order, pen/trap and trace order, subpoena, or any other Lawful U.S. Process demand if the purpose of such disclosure or access is to respond to the legal process or request on behalf of a Non-U.S. Government entity without first satisfying all pertinent requirements of U.S. law and obtaining the express written consent of USDOJ, or the authorization of a court of competent jurisdiction in the United States. Any such requests for legal process submitted by a Non-U.S. Government entity to the Licensees shall be referred to USDOJ as soon as possible, but in no event later than five (5) business days after such request or legal process is received by or made known to the Licensees, unless disclosure of the request or legal process would be in violation of U.S. law or an order of a court of competent jurisdiction in the United States. 6. B. Riley agrees that the Licensees will draft: (1) a Cybersecurity Plan that is consistent with the National Institute of Standards and Technology (NIST) Cybersecurity Framework; and (2) a Network Systems Security Plan (“NSSP”), which will be forwarded to USDOJ within 120 days of the Date of this LOA for objection or non-objection. The NSSP shall address, but not be limited to, information security, remote access, physical security, cybersecurity, third-party contractors, Outsourcing and Offshoring, maintenance and retention of 4

system logs, protection of Lawful U.S. Process, protection of U.S. Records obtained by the Licensees from their customers or through the provision of services, and the Licenses’ specific plan regarding new contracts or any amendments any existing contracts with third-party providers of services to require those third parties to notify the Licensees in the event of a breach or loss of U.S. Records within a specified time period after discovery, not to exceed five (5) business days from the date of discovery. 7. B. Riley agrees that the Licensees will require any third-party provider of services to disclose any data breach of any U.S. Records, or any loss of U.S. Records, whether from a data breach or other cause, within 48 hours of the third party discovering the breach or loss. To the extent that the Licensees have current agreements with any third-party providers of services with access to U.S. Records, the Licensees will amend those agreements to require those third parties to make disclosure of breaches or loss of U.S. Records consistent with this paragraph, and shall forward copies of those amended agreements to USDOJ points of contacts listed in paragraph 17 within five (5) business days of executing those amendments. 8. B. Riley agrees that the Licensees will notify the Federal Bureau of Investigation (“FBI”) and U.S. Secret Service within seven (7) days upon learning that a person or entity without authorization, or in exceeding their or its authorization, has intentionally gained access to, used, or disclosed any of their customer’s CPNI or that of a third party used by the Licensees, and shall report the matter to the central reporting facility through the following portal: https://www.cpnireporting.gov/cpni/content/disclaimer.seam 9. B. Riley agree that the Licensees will designate and maintain a U.S. law enforcement point of contact (“LEPOC”) in the United States who will be subject to prior approval by the USDOJ, including the FBI. The LEPOC shall be a U.S. citizen residing in the United States unless USDOJ agrees in writing otherwise, and the LEPOC must be approved by the FBI to receive service Lawful U.S. Process for U.S. Records and, where possible, to assist and support lawful requests for surveillance or production of U.S. Records by U.S. federal, state, and local law enforcement agencies. This LEPOC and his/her contact information will be provided to USDOJ within 30 days from the date B. Riley receives the FCC’s approval of the Transaction. B. Riley also agrees that the Licensees will provide USDOJ at least 30 days prior written notice of any change in the LEPOC, with all such changes subject to the approval of USDOJ, including the FBI. In addition, the Licensees will give USDOJ, including the FBI, at least 30 days prior written notice of any change to the LEPOC, and the Licensees’ nominated replacement shall be subject to USDOJ, including the FBI, review and approval. B. Riley also agrees that the designated LEPOC will have access to all U.S. Records, and, in response to Lawful U.S. Process, will make such records available promptly and, in any event, no later than five (5) business days after receiving such Lawful U.S. Process unless granted an extension by USDOJ. 10. B. Riley agrees that the Licensees will notify USDOJ, including the FBI, at least 30 business days in advance, of any introduction of new Principal Equipment or changes/modification to any of their Principal Equipment, including the names of providers, suppliers, and entities that will perform any maintenance, repair, or replacement that may result in any material modification to their Principal Equipment or systems or software used with or 5

supporting the Principal Equipment. USDOJ shall object or non-object to such new Principal Equipment or change/modification to the Principal Equipment within 30 days of receipt of notice. 11. B. Riley agrees to notify the USDOJ, including the points of contact (POC) listed in paragraph 17 of any breaches of this agreement, as well as any other Security Incidents such as, but not limited to cyber-security incidents, intrusions or breaches of Network Elements. The notification shall take place no later than 15 business days after B. Riley, the Licensees, or any third party providing Outsource or Offshore services to the Licensees discovers the incident, intrusion or breach takes place, or sooner when required by statute or regulations. 12. B. Riley agrees to permit USDOJ requests for site visits and approve all requests to conduct on-site interviews of employees of B. Riley or the Licensees. 13. B. Riley further agrees that the Licensees will provide USDOJ notice at least 30 business days in advance of all Outsourced or Offshore service providers, including but not limited to services provided in relation to:  Network Operations Center(s) (“NOC”);  Network maintenance services;  Customer support services;  Any operation/service that could potentially expose U.S. domestic telecommunications infrastructure, U.S. customer data and records, call detail records (“CDRs”), or CPNI; and  Deployment of any Network Elements, hardware, software, core network equipment, and Network Management Capabilities that are owned, managed, manufactured or controlled by a foreign government or non-public entities. USDOJ shall object or non-object to Outsourced or Offshore service providers, within 30 business days of receipt of notice. 14. B. Riley agrees to provide USDOJ with notice of any changes to the Licensees’ business, including but not limited to corporate structure changes, ownership changes of more than 5 percent, corporate name changes, business model changes such as a change in its services portfolio, corporate headquarter location changes, or business operation location changes within 30 business days in advance of such change. If, after this LOA takes effect, USDOJ believes that changed circumstances warrant a modification of this LOA (including if the USDOJ determines that the terms of this LOA are inadequate or no longer necessary to address national security concerns), then B. Riley shall negotiate in good faith with the USDOJ to modify or terminate this LOA. 15. This LOA shall take effect only if B. Riley does not undertake an internal reorganization that removes any foreign ownership from the Licensees’ ownership structure within 3 business days after the closing of the Transaction, and B. Riley does not notify USDOJ within 3 business days thereof that the reorganization has been completed. The LOA will be considered terminated and/or null and void without going into effect upon receipt of such notice. 6

16. B. Riley agrees to nominate one individual as “Compliance Security Officer” to oversee compliance with the terms of this LOA, who shall be a person at the executive-level of B. Riley or the Licensees, resident in the United States with sufficient experience, and B. Riley shall notify USDOJ of the identity of this nominated individual no later than 30 days after the Date of this LOA. USDOJ will object, or non-object, within 15 business days of the nomination. 17. B. Riley agrees to provide an annual report to USDOJ regarding the company’s compliance with this Agreement, to include:  Certifications that there were no changes to any LOA notification requirement or ownership status (where no changes were reported to USDOJ, including the FBI, during the preceding year);  Certification that the Licensees have been in compliance with CALEA;  Notice(s) regarding the Licensees’ handling of U.S. Records, Domestic Communications, and Lawful U.S. Process (i.e., whether handled properly and in accordance with the assurances contained herein) including list of individuals with access to U.S. CDRs;  Recertification on any changes in the services that the Licensees provide or confirmation that no additional services are being offered;  Notification(s) of any relationships with foreign-owned telecommunications partners, including any peer relationships;  Updated list of the Licensees’ Principal Equipment, vendors and suppliers;  Updated Network and Systems Security Plans and Procedures;  Updated NIST-Compliant Cybersecurity Plan;  Notification(s) of the installation and/or purchase or lease of any foreign- manufactured telecommunication equipment (including, but not limited to, switches, routers, software, hardware);  Report(s) of any occurrences of cyber-security incidences, network and enterprise breaches, and unauthorized access to customer data and information;  A re-identification of the name of and contact information of the LEPOC; and  Notifications regarding any other matter of interest to this LOA. The annual report will be due every 31st day of August of each calendar year, beginning on August 31, 2019, and will be addressed to: Assistant Attorney General for National Security U.S. Department of Justice National Security Division Three Constitution Square, 175 N Street, NE 7

Washington, DC 20002 Attention: FIRS/Team Telecom Staff Courtesy electronic copies of all notices and communications will also be sent to the following or individuals identified in the future to B. Riley by USDOJ: Bermel Paz, USDOJ (at Bermel.Paz@usdoj.gov); David Jividen, USDOJ (at david.jividen2@usdoj.gov), Loyaan Egal, USDOJ (at Loyaan.Egal@usdoj.gov) and FIRS Team (at FIRS-TT@usdoj.gov). 18. B. Riley agrees that in the event that the commitments set forth in this letter are breached, USDOJ may request the FCC to modify, condition, revoke, cancel, terminate, or render null and void any relevant license, permit, or other authorization granted by the FCC to B. Riley, the Licensees, or their successors-in-interest, in addition to any other remedy available at law or equity. Sincerely, ________________________________ Kenneth M. Young President B. Riley Financial, Inc. 8


Document Created: 2018-08-15 16:30:03
Document Modified: 2018-08-15 16:30:03
© 2024 FCC.report
This site is not affiliated with or endorsed by the FCC