Curie LOA (EXECUTED)

PETITION submitted by DHS

Letter of Assurances

2019-09-19

This document pretains to SCL-LIC-20181008-00034 for License on a Submarine Cable Landing filing.

IBFS_SCLLIC2018100800034_1912783

GU Holdings Inc. 1600 Amphitheatre Parkway Mountain View, CA 94043 650-253-0000 main google.com September 18, 2019 Assistant Secretary for Border, Immigration and Trade Office of Policy Mail Stop 0445 U.S. Department of Homeland Security 2707 Martin Luther King Jr. Ave SE Washington, D.C. 20528-0445 IP-FCC@hq.dhs.gov Dear Sir: This Letter of Assurances (“LOA”) sets forth the commitments made by GU Holdings Inc. (“GU Holdings”) (the “Licensee”) to the U.S. Department of Homeland Security (“DHS”) to address national security, law enforcement, and public safety concerns raised with regard to an application filed by the Licensee with the Federal Communications Commission (“FCC”) for a license to land and operate within the United States a private fiber-optic submarine cable network 1 connecting Los Angeles, California and Valparaiso, Chile (the “Curie System”). The Licensee has agreed to provide this LOA to DHS, and the Licensee understands that DHS will petition the FCC to condition the requested authorization on compliance with this LOA. For purposes of this LOA: A. “Domestic Communications” means: (a) Wire Communications or Electronic Communications (whether stored or not) from one U.S. location to another U.S. location and (b) the U.S. portion of a Wire Communication or Electronic Communication (whether stored or not) that originates or terminates in the United States. B. “Domestic Communications Infrastructure” or “DCI” means: (a) any portion of the Curie System that physically is located in the United States, up to the submarine line terminating equipment, including (if any) transmission, switching, bridging, and routing equipment, and any associated software (with the exception of commercial-off-the-shelf (“COTS”) software used for common business functions, e.g., Microsoft Office) used by or on behalf of the Licensee to provide, process, direct, control, supervise, or manage Domestic Communications; and (b) Network Operations Center (“NOC”) facilities, as defined in Section D below. 1 FCC File Number SCL-LIC-20181008-00034, Application for Cable Landing License.

Letter of Assurances Page 2 C. “Electronic Communication” has the meaning given it in 18 U.S.C. § 2510(12). D. “Network Operations Center” or “NOC” means the locations and facilities designated as such by the Licensee for purposes of performing network management, monitoring, maintenance, or other operational functions for the Curie System. E. “Principal Equipment” means the primary electronic components of the Curie System, which comprises the Domestic Communications Infrastructure and Wet Infrastructure. Principal Equipment includes, but is not limited to: network element servers; routers; switches; repeaters; submarine line terminal equipment (“SLTE”); system supervisory equipment (“SSE”); signal modulators and amplifiers; power feed equipment (“PFE”); tilt and shape equalizer units (“TEQ/SEQ”); optical distribution frames (“ODF”); branching units (“BU”); synchronous optical network (“SONET”); synchronous digital hierarchy (“SDH”); wave division multiplexing (“WDM”), dense wave division multiplexing (“DWDM”); coarse wave division multiplexing (“CWDM”); or optical carrier network (“OCx”) equipment, as applicable; all embedded software for the equipment; and any non-embedded software used for monitoring, administration, or provisioning of the Curie System (with the exception of COTS software used for common business functions, e.g., Microsoft Office). F. “Screened Personnel” has the meaning given it in Section 11 below. G. “Wet Infrastructure” means hardware components installed and residing on the undersea portion of the Curie System, including fiber optic cables, repeaters, branching units, and routers (if any). Wet Infrastructure includes all the components used to define the topology of the undersea portion of the Curie System. H. “Wire Communication” has the meaning given it in 18 U.S.C. § 2510(1). The Licensee undertakes to comply with the following commitments: 1. Security Point of Contact Licensee agrees to maintain a Security Point of Contact (“Security POC”) for purposes of this LOA. The Security POC will be a U.S. citizen residing in the United States and will maintain an active U.S. Government security clearance at the “Secret” level or higher. The POC will possess the appropriate authority, reporting lines, independence, skills and resources to effectuate compliance with the terms of this LOA. The Licensee agrees to nominate a proposed POC within thirty (30) business days of the execution of this LOA. The Licensee understands that the POC will be subject to DHS review and non-objection and may be subject to a background check at the sole discretion of DHS. The Security POC will be available twenty-four (24) hours per day, seven (7) days per week, regarding any national security, law enforcement, or public safety concerns that

Letter of Assurances Page 3 DHS may raise with respect to the Curie System. Upon request by DHS, the Security POC will make himself/herself available in person within the United States at a mutually agreeable date and location, including in a classified setting as determined necessary. The Security POC will be responsible for receiving and promptly effectuating any lawful inquiries or requests for information, and the Licensee will ensure that the Security POC has sufficient authority to effectuate compliance with obligations set forth in this LOA. The Licensee will notify DHS of any proposed change to the Security POC at least ten (10) business days in advance of such proposed change. Any proposed Security POC will be subject to DHS review and non-objection and may be subject to a background check at the sole discretion of DHS. 2. Cable Curie System Information Within sixty (60) business days of the execution of this LOA, and, thereafter, within fifteen (15) business days upon DHS request, the Licensee agrees to make available the following Curie System Information: (a) Network management information, as follows: (1) a network map that includes physical and logical topology; (2) network and telecommunications architecture descriptions and associated descriptions of interconnection points and controlled gateways to the DCI and Wet Infrastructure; (3) network operational plans, processes, and procedures; (4) locations and functions of any NOCs, data centers, and main distribution facilities; (5) organizational chart, to include specific reference to the names and positions of senior officials responsible for operations of the Curie System; and (6) descriptions of interfaces and connections to the Curie System for service offload, disaster recovery, or administrative functions; (b) A complete and current list of all contracts held by the Licensee or its designee(s) for the maintenance and security of the Curie System; and (c) A Business Continuity management & Disaster recovery Plan for the Principal Equipment and the Wet Infrastructure for the Curie System. 3. Operational Requirements With respect to the operation of the Curie System, the Licensee agrees as follows: (a) The Licensee will have the ability to promptly and effectively interrupt, in whole or in part, traffic to and from the United States on the Curie System by disabling or disconnecting circuits at the U.S. cable landing station or at other locations within the United States;

Letter of Assurances Page 4 (b) The Licensee will configure all necessary systems to ensure the NOC can suspend or interrupt the optical carrier signal or all of the Curie System within the DCI. 4. Principal Equipment List Within thirty (30) business days of the execution of this LOA, the Licensee agrees to provide DHS with a list to include: (a) A complete and current list of all Principal Equipment, including: (1) a description of each item and the functions supported, (2) each item’s manufacturer, and (3) the model and/or version number of any hardware or software; and (b) Any vendors, contractors, or subcontractors involved in providing, installing, operating, managing, repairing, or maintaining the Principal Equipment. Objections to the Principal Equipment List will be handled pursuant to Section 8. At the sole discretion of DHS, the Licensee agrees to supplement in writing the foregoing definition of Principal Equipment to address subsequent technological developments with submarine systems. 5. Modifications to Existing Principal Equipment The Licensee agrees to provide DHS at least fifteen (15) business days’ advance notice prior to performing any maintenance, repair, or replacement that would result in any modification to the quantum, function, configuration, operation, or location of existing Principal Equipment for the Curie System or testing thereof. With any such notice, Licensee may request that DHS waive the notice obligation of this Section 5 for substantially similar modifications in the future. The Licensee may not comply with the advance notice requirement for any maintenance, repair, or replacement that is undertaken in response to an unforeseen or uncontrollable event and that is necessary to ensure the continued operability of the Curie System; however, in such circumstances, the Licensee agrees to provide advance notice to DHS of the modification, if practicable, and, if impracticable, the Licensee agrees to provide notice within ten (10) business days after the modification of the Principal Equipment, providing a detailed description of the equipment replaced and the circumstances surrounding the need to replace the Principal Equipment without prior notice. The Licensee may continue to utilize any Principal Equipment repaired or replaced pursuant to the process outlined in this Section, provided DHS does not object pursuant to Section 8.

Letter of Assurances Page 5 6. Change in Vendors, Contractors, or Subcontractors for Principal Equipment The Licensee agrees to provide at least thirty (30) business days’ advance notice prior to modifying the list of vendors, contractors, or subcontractors involved in providing, installing, operating, managing, repairing, or maintaining the Principal Equipment. In addition, the Licensee agrees to provide at least thirty (30) business days’ advance notice prior to changing the service offerings or support from a previously-listed vendor, contractor, subcontractor (i.e., where a previously-listed provider will be offering support in a previously unidentified way). Objections to any new vendor, contractor, or subcontractor for the Principal Equipment or the proposed service offerings thereof will be handled pursuant to Section 8. 7. Equipment Testing The Licensee agrees to provide at least thirty (30) business days’ advance notice prior to initiating the testing of any new Principal Equipment connected to DCI or Wet Infrastructure of the Curie System by any vendor not already on the approved Principal Equipment List. Objections to any testing proposed pursuant to this Section will be handled pursuant to Section 8. 8. Objection Resolution DHS will notify the Licensee of any objection, including the basis for DHS’s objection, to a notice submitted pursuant to Sections 4, 5, 6 or 7 above within forty-five (45) business days of receipt of such notice, or as otherwise agreed to by the Licensee and DHS. DHS will endeavor to provide such approval within 45-days; however, if such approval is not provided timely, after consultation and agreement, the parties can determine a reasonable timeframe for DHS to grant approval. In the event of such an objection, the Licensee will not expand the existing deployment or enhance the capabilities of any Principal Equipment to which DHS has objected, and the Licensee agrees to meet, confer and otherwise attempt in good faith to resolve DHS’ objection. Until the objection (if any) is resolved, the Licensee will not upgrade, install, replace, test or service any objectionable Principal Equipment without written authorization from DHS. 9. Measures to Prevent Improper Use and Unauthorized Access The Licensee agrees to take practicable measures to prevent unauthorized access to the Curie System and to prevent any unlawful use or disclosure of information carried on the same, which measures the Licensee shall include in the policies that it develops and implements pursuant to this LOA. For purposes of this Section, such “practicable measures,” at a minimum, include effectuating compliance with all applicable U.S. laws and regulations governing cybersecurity, information security, and privacy and will be

Letter of Assurances Page 6 measures consistent with best practices and guidelines, such as but not limited to the Cybersecurity Framework of the National Institute of Standards and Technology and 27001 Series standards of the International Organization for Standardization. These measures should also include items such as configuration management, security audits, and system interconnection documentation, as well as contractual safeguards and screening procedures for personnel with logical access to the DCI. The Licensee agrees to take appropriate measures to protect and promote resiliency of the Curie System, including measures to ensure that security patches for systems and applications are up to date. The Licensee agrees to maintain or exceed security standards and best practices utilized within the U.S. telecommunications industry for maintenance of password systems and firewalls, non-destructive access logs, and periodic internal audits of network security and associated network devices. The Licensee agrees to submit a policy regarding logical security measures adopted in accordance with this Section to DHS within sixty (60) business days of the date of execution of this LOA. The Licensee agrees to meet, confer and otherwise attempt in good faith to resolve any concerns DHS may raise about such policy. 10. Physical Security Measures The Licensee agrees to take practicable measures to physically secure the Curie System, including the DCI. The Licensee will screen appropriate personnel in accordance with Section 11 below, and the Licensee will require that all visitors who physically access the DCI are escorted at all times by Screened Personnel, as defined herein. The Licensee agrees to submit a policy setting forth Licensee’s physical security measures to DHS within sixty (60) business days of the date of execution of this LOA. The Licensee agrees to meet, confer and otherwise attempt in good faith to resolve any concerns DHS may raise about such policy. 11. Screening of Personnel The Licensee agrees to implement, either directly or through a vendor or service provider, a process to screen any existing or newly hired Licensee personnel (or any personnel performing under an agreement or arrangement with the Licensee) in, at minimum, the following circumstances: (a) Any person whose position could involve logical access to the DCI; and (b) All personnel charged with securing the DCI. The Licensee’s personnel screening process will be reflected in a written policy and will include background investigations, public criminal records checks, or other analogous

Letter of Assurances Page 7 means to ascertain a person’s trustworthiness. Upon satisfying the requirements set forth in the screening policy, such persons will be considered “Screened Personnel.” The Licensee agrees to submit the screening policy to DHS within sixty (60) business days of the date of execution of this LOA. If DHS notifies the Licensee of any concerns regarding such policies, the Licensee agrees to meet, confer, and otherwise attempt in good faith to resolve such concerns to the satisfaction of DHS. The Licensee agrees to cooperate with any request by DHS to provide additional identifying information regarding Screened Personnel. 12. Reporting Incidents and Breaches The Licensee agrees to report to DHS within 48-hours if they learn of information that reasonably indicates: (a) Unauthorized third-party access to, or disruption or corruption of, the Curie System or any information being carried on the Curie System; (b) Any other unauthorized access to or disclosure of Domestic Communications in violation of federal, state, or local law; or (c) Any material breach of the commitments made in this LOA. The Licensee agrees to make any reports required by this provision in writing to DHS within ten (10) business days of discovery of the relevant conduct. The Licensee agrees to remediate any incidents or breaches reported pursuant to this provision to the satisfaction of DHS. 13. Instruction of Obligations The Licensee agrees to instruct appropriate officers, employees, contractors, and agents as to the Licensee’s obligations under this LOA, including the individuals’ duty to report any violation, and to issue periodic reminders of such obligations. The Licensee agrees to issue initial instructions in writing within sixty (60) business days of the date of execution of this LOA, and updated instructions annually thereafter. The Licensee agrees to submit a copy of such instructions to DHS at the same time. 14. Change in Services to Third Parties The Licensee anticipates utilizing the Curie System (a) for its or its affiliates’ own internal use and (b) for offering wholesale, government and enterprise customers leased, indefeasible rights of use for, or other non-ownership interests of capacity, spectrum or dark fibers on particularized terms and conditions pursuant to individualized negotiations. The Licensee agrees to notify DHS in writing at least thirty (30) business days prior to

Letter of Assurances Page 8 implementing any changes to the nature of these services as offered to non-affiliate third-party customers. The Licensee agrees to provide a detailed description of the proposed change including the terms, conditions, and entities involved in making the change. 15. Change in Control If the Licensee learns of any information that reasonably indicates that any single foreign entity or individual, other than those already identified, has or likely will obtain an ownership interest, whether direct or indirect, in the Licensee or the Curie System above ten (10) percent, or if any foreign entity or individual, singly or in combination with other foreign entities or individuals, has or likely otherwise will gain either: (i) control, as determined in accordance with 47 C.F.R. § 63.09(b); or (ii) de facto or de jure control of the Licensee, the Licensee agrees to provide notice in writing to DHS within ten (10) business days. Notice under this Section will, at a minimum: (a) Identify the entity or individual(s) acquiring control (specifying the name, addresses, and telephone numbers of the entity or individual(s)); (b) Identify the beneficial owners of any such increased or prospective increased ownership interest in the Licensee or the Curie System by the entity or individual(s) (specifying the name, addresses, and telephone numbers of each beneficial owner); and (c) Quantify the amount of ownership interest that the entity or individual(s) has or likely will obtain in the Licensee or the Curie System and, if applicable, the basis for their prospective control of the Licensee or the Curie System. 16. Annual Report On the anniversary of the date of this LOA, the Licensee agrees to submit to DHS a report assessing the Licensee’s compliance with the terms of this LOA for the preceding year. The report shall include: (a) The names and contact information of the then-current POC; (b) Cable Curie System Information, as described in Section 2 above, noting any changes during the reporting period; (c) An updated Principal Equipment List containing all information described in Section 4 above, identifying any material modifications during the reporting period; (d) A copy of the then-current policies adopted in accordance with this LOA, including policies for logical security (Section 9), physical security (Section 10),

Letter of Assurances Page 9 personnel screening (Section 11), incident reporting (Section 12), and employee training (Section 13), and a summary of any changes during the reporting period and the reasons therefore; (e) A summary of any events that occurred during the reporting period that will or reasonably could impact the effectiveness of or compliance with this LOA; and (f) A summary of any known acts of noncompliance with the terms of this LOA that occurred during the reporting period, whether inadvertent or intentional, with a discussion of what steps have been or will be taken to prevent such acts from occurring in the future. 17. Audit Option At its sole discretion, but no more frequently than once every calendar year unless the original audit is found by DHS to have been unsatisfactory, DHS may request a third-party audit of the Licensee’s compliance with the terms of this LOA. In connection with the audit: (a) The Licensee agrees to nominate two (2) third-party auditors, subject to the approval of the DHS. If DHS does not object within thirty (30) calendar days, the third-party auditors selected by the Licensee from among the two (2) nominees will be deemed approved by DHS. (b) If DHS objects to the nominated third-party auditors, the Licensee agrees to nominate, within twenty (20) calendar days of such objection, another third-party auditor. If DHS objects to the nominated third-party auditor, the Licensee shall provide to DHS three (3) additional candidates to be considered third-party auditor from which DHS may choose at its discretion. (c) As part of the auditor nomination and approval process, DHS may condition approval of a nominated auditor on Licensee providing information regarding the Licensee’s and nominated auditor’s pre-existing relationship (if any). (d) The Licensee will be solely responsible for any costs associated with any third-party audit carried out pursuant to this Section. DHS, however, shall consider avoidance of unreasonable costs as a factor when exercising its rights under this Section. (e) The Licensee will ensure the selected third-party auditor submits a methodology and proposed scope of audit, both of which will be subject to DHS’ approval. (f) The Licensee will ensure that its complete, executed engagement agreement with the third-party auditor is provided to DHS within five (5) days of execution.

Letter of Assurances Page 10 (g) The third-party auditor will promptly deliver to DHS and Licensee all reports and related information generated or gathered during its review that relate directly to Licensee’s compliance with the terms of this LOA, and shall meet independently with DHS upon request. 18. DHS Consultation and Visitation The Licensee agrees to meet and confer with DHS and to resolve to the satisfaction of DHS any concerns DHS may raise about materials submitted pursuant to this LOA. The Licensee agrees to meet, confer and otherwise attempt in good faith to resolve any national security, law enforcement, or public safety concerns DHS may raise with respect to any matters set forth in this LOA. The Licensee agrees that, upon reasonable advance notice, DHS may visit any part of the DCI to conduct on-site reviews concerning the implementation of the terms of this LOA and the Licensee’s compliance with its terms. Subject to applicable law, during such visits, the Licensee will cooperate with the requests of DHS to make available information, facilities, and personnel to verify compliance with the terms of this LOA. This LOA shall inure to the benefit of, and shall be binding upon, the Licensee and its successors, assigns, subsidiaries, and affiliates. The Licensee agrees that, in the event the commitments set forth in this letter are breached, in addition to any other remedy available at law or equity, DHS may request that the FCC modify, condition, revoke, cancel, terminate, or render null and void any relevant license, permit, or other authorization granted by the FCC with respect to such Licensee or any successors-in-interest. If, after this LOA takes effect, DHS or the Licensee believes that changed circumstances warrant a modification or termination of this LOA (including if DHS determines that the terms of this LOA are inadequate or no longer necessary to address national security, law enforcement, or public safety concerns), the Licensee shall negotiate in good faith with DHS to modify this LOA. Rejection of a proposed modification alone shall not constitute evidence of a failure to negotiate in good faith. Nothing in this LOA is intended to excuse the Licensee from its obligations to comply with any and all applicable legal requirements and obligations, including any and all applicable statutes, regulations, requirements, or orders.

Letter of Assurances Page 11 The Licensee understands that, promptly upon execution of this letter by an authorized representative or attorney for the Licensee, DHS shall notify the FCC that it has no objection to the FCC’s grant of the pending application. For and on behalf of GU Holdings Inc. ______________________________ Austin Schlick, President GU Holdings Inc. 1600 Amphitheatre Parkway Mountain View CA, 94043 United States +1 (202) 346-1219 schlick@google.com


Document Created: 2019-09-19 07:36:55
Document Modified: 2019-09-19 07:36:55
© 2024 FCC.report
This site is not affiliated with or endorsed by the FCC