Guidelines on the essential requirements for network security and integrity and criteria for restriction of access to the network, 9 October 2002



	Guidelines on the essential requirements for network security and integrity and criteria for restriction of access to the network



			A statement issued by the Director General of Telecommunications 9 October 2002 Contents Summary Chapter 1 – Introduction, Background, Legal framework, The new European framework, Scope Chapter 2 – The essential requirements Guidelines Chapter 3 – The Criteria of restriction of network access Annex A – Licence Condition 20 Annex B – Analysis of responses to the consultation Annex C – Glossary Annex D – References Summary S.1 This statement presents the conclusions of a consultation carried out by the Director General of Telecommunications from December 2001 to March 2002 on two draft documents: Guidelines on the essential requirements for network security and integrity (the Guidelines); and Criteria for the restriction of access to and use of the fixed public telephone system on the grounds of network security or integrity (the Criteria). S.2 The Guidelines (see reference 1) concern the interpretation of the network security and integrity provisions of Condition 20 of the Public Telecommunications Operators’ (PTO) Licence. The Criteria (see reference 2) document presents a set of criteria for restriction of access to the network on the grounds of network security and integrity, as cited in the same licence condition. S.3 The Guidelines document is based on the output from the Essential Requirements Task Group (ERTG) of the Network Interoperability Consultative Committee (NICC). The NICC is an industry committee set up to advise the Director General on interoperability issues and to provide guidance to standards bodies on such issues. The Criteria document was also prepared by the ERTG. The ERTG was set up by the NICC in response to Oftel’s July 2000 request for advice on the network security and integrity provisions of Condition 20. The ERTG delivered drafts of the Guidelines and Criteria to the NICC in July 2001 and October 2001 respectively. These documents were accepted by the NICC for onward transmission to Oftel, subject to the understanding that a public consultation on both documents would be carried out. S.4 Oftel would like to take this opportunity to record its thanks to the NICC and in particular the members of the ERTG for their extremely valuable contribution to the production of the draft Guidelines and Criteria. S.5 Prior to consultation on the draft documents, Oftel made some modifications for reasons explained in the consultation document. These modifications particularly related to the addition of the so-called ‘lifeline’ requirements to the draft Guidelines, which included requirements for line-powering of end-user equipment in certain circumstances. S.6 Oftel sought comments on both the draft Guidelines and the draft Criteria. This consultation process was primarily aimed at members of the Industry, however it was also hoped that consumer groups would particularly wish to note the line-powering issue referred to above, and reflected in question four of the consultation. S.7 Oftel received 17 responses from network operators, equipment manufacturers and consumer groups during the consultation period. Three of these responses were confidential. S.8 In general, respondents agreed that it was appropriate for Oftel to publish the Guidelines and Criteria. Some respondents made detailed suggestions for modifications to the text of the Guidelines and Criteria, many of which have been implemented by Oftel. Most respondents also agreed that it was appropriate for Oftel to assume the network operators were using the Criteria as the basis for implementing network access restrictions on the grounds of network security and integrity, if network operators did not identify their own criteria in advance. S.9 A particular concern raised by many respondents was whether or not the annexes describing the telephone emergency service and the so-called ‘lifeline’ requirements should be included in the Guidelines. Oftel considered these arguments in detail, and decided to address these concerns by publishing the description of the telephone emergency service as a separate stand-alone document. Whilst the ‘lifeline’ requirements remain in an annex to the Guidelines, Oftel has re-worded some of the more controversial elements of these requirements to make Oftel’s expectations in this area clearer. S.10 Oftel received a variety of responses to its question about line powering obligations for one and two line telephony. Most network operators considered that these requirements should be relaxed. Most consumer groups were against any relaxation of these requirements as they considered that any change would adversely affect consumers, particularly vulnerable consumers. Several respondents suggested that a wider debate was required. S.11 On balance, Oftel’s view is that no change can be made at the moment to the policy requiring that provision be made for line powering for one and two line telephony services, as this reflects current consumer expectations. Any change would require further and wide-reaching work to identify appropriate alternative protections for consumers. S.12 Having considered comments received during the consultation process, Oftel is now formally adopting and publishing final versions of the Guidelines and Criteria. S.13 At the time of publication, it is clear that the risk environment has changed due to global events, in terms of risk both to commercial interests and to wider public interests. In Oftel’s view, this does not change the guidance contained in these documents, but it will change the degree to which operators will wish to implement security measures. Oftel will continue to give emphasis to network security in general, and to compliance with these Guidelines in particular. S.14 Chapter one of this document sets out the background to this statement, and the relevant requirements of PTO Licence Condition 20. Chapter two explains the changes made to the Guidelines, both before and after the consultation process. Chapter three explains the changes made to the Criteria. The text of Licence Condition 20, an analysis of the responses received during the consultation process and a glossary are contained in annexes to the document. Chapter 1 Introduction *Background* 1.1 'Essential requirements' are so-called because they are non-market requirements that must be delivered in recognition of the important role that telecommunications plays in the wider economic and social well-being of a country. 1.2 There has been an essential requirements condition (now Condition 20) in public telecommunications operators’ licences since July 1998 (see Legal framework below). The licence condition refers to the licensee taking "all reasonably practicable steps to maintain to the greatest extent possible" network security and network integrity. However, these terms are not defined in either the licence condition or in the Revised Voice Telephony Directive 98/10/EC (RVTD) (see reference 3) from which these requirements stem. 1.3 Additionally, the licence condition requires that any restrictions imposed by the licensee on access to the Fixed Public Telephone System on the grounds of network security or network integrity are proportionate, non-discriminatory and based on objective criteria identified in advance. Once again, neither the licence condition nor the RVTD (see reference 3) provides clear statements on who should create these objective criteria. Oftel has noted that no operator has yet published any such criteria. 1.4 Therefore, in the absence of guidance elsewhere, Oftel set up a project to produce and publish guidelines on the network security and integrity requirements in Condition 20, along with criteria for the restriction of network access on the grounds of network integrity or security. Oftel did not take this action because it was aware of major shortfalls in network security, but was doing so simply to address the gap in guidance. Oftel considered that there should be a common understanding between Oftel and the industry of what might represent appropriate measures to protect network security and integrity, and what actions an operator might legitimately take to restrict network access in pursuit of this goal. Oftel also made it clear that Oftel will continue to monitor and investigate compliance to Condition 20, proactively seeking extra information and taking enforcement action if needed, and will ensure the provisions of any new European Directives in this area are taken into account. 1.5 In July 2000, Oftel asked the NICC to advise the Director General on: the publication of guidelines on the network security and integrity essential requirements licence condition; and objective, proportionate, non-discriminatory and industry-agreed criteria for restriction of access to the network on the grounds of network security or network integrity. 1.6 In response to Oftel’s request, the NICC set up the ERTG, which held its first meeting in September 2000. Membership of the ERTG was open to: the Public Network Operators Interest Group (PNO-IG) of the NICC (representing both fixed and mobile public network operators); the Special Systems and Public Equipment Interest Group (SSPE-IG) of the NICC (representing manufacturers of public network exchanges and associated equipment); and interested government departments. 1.7 The ERTG delivered a draft of the Guidelines to the NICC in July 2001 and draft Criteria in October 2001. The NICC approved these documents and forwarded them to Oftel, subject to the proviso that there would be a period of consultation when further comments could be made. 1.8 In December 2001, Oftel launched a public consultation on the draft Guidelines and Criteria. The consultation period ran until March 2002. 1.9 This statement summarises the comments Oftel received during the consultation period, along with Oftel’s response to those comments. The statement also explains the consequential changes that have been made to the text of the Guidelines and Criteria and sets out Oftel’s decision to formally adopt and publish these documents. It is important to note however that the resulting Guidelines and Criteria are not binding on the Director General and do not fetter the Director General’s discretion. 1.10 In this document (and in the Guidelines), the term ‘network security’ is used to refer to protecting the availability of the network and services from threats due to the inherent reliability of the network, and its vulnerability to hazards such as weather, natural disaster and malicious acts 1.11 ‘Network integrity’ concerns threats to the normal operation of the network that enter via the network itself, and also those that are introduced from outside sources such as customers or other networks. Examples of such threats include electrical conditions, signalling and traffic loads. *Legal framework* 1.12 Article 13 of the RVTD (see reference 3) identifies five ‘essential requirements’ that apply to all fixed public telephone networks and fixed public telephone services: the first essential requirement in the RVTD (see reference 3) is the security of network operations. The RVTD (see reference 3) requires that Member States take all necessary steps to ensure the availability of fixed public telephone networks and services in the event of catastrophic network breakdown or force majeure such as earthquake, flood and fire; the second essential requirement in the RVTD (see reference 3) is the maintenance of network integrity. The RVTD (see reference 3) requires that Member States take all necessary steps to ensure that the integrity of the fixed public telephone network is maintained; the RVTD (see reference 3) also states that National Regulatory Authorities must ensure than any restrictions on access to and use of the fixed public telephone network on the grounds of network security or integrity are non-discriminatory and based on objective criteria identified in advance; and the remaining three essential requirements identified in the RVTD (see reference 3) (which relate to interoperability of services, protection of data and effective use of the frequency spectrum) are beyond the scope of this statement. 1.13 The RVTD (see reference 3) was transposed into UK law by the RVTD Regulations (see reference 4), and thence into Licence Condition 20 of the PTO licence. In particular, the relevant licence conditions for the purposes of this statement are: Condition 20.3, which requires the licensee to take "all reasonably practicable steps" to maintain availability in the event of catastrophic network failure or force majeure (eg fire, earthquake or flood); Condition 20.4, which requires the licensee to take "all reasonably practicable steps" to maintain integrity against malfunctions caused by electrical conditions, signalling protocols or traffic loads; and Conditions 20.5 and 20.6, which relate to restrictions on access to the network on grounds of network security or integrity. 1.14 The full text of Condition 20 of the PTO licence can be found at annex A. *The new European framework* 1.15 Article 23 of the new European Universal Service Directive 2002/22/EC (see reference 5) places broadly similar obligations on Member States in relation to network security and integrity as the existing RVTD (see reference 3) obligations. Although the title of the article implies that it only relates to network integrity, it is clear from the content of the article that both network security and integrity are covered. The Commission has recently shown renewed interest in these areas. It is likely therefore that much of the content of the Guidelines will continue to be appropriate under the new regulatory framework. However, the new Directives will not be implemented in the UK until mid-2003. In order to avoid delaying publication of guidance on network integrity and security, Oftel has decided that the Guidelines and Criteria should be published now under the existing regulatory framework. *Scope* 1.16 This statement relates to the essential requirements for network security and integrity only, and to criteria for restricting network access on the grounds of network security and integrity. The other essential requirements (relating to interoperability, data protection and effective use of the frequency spectrum) are beyond the scope of this statement. 1.17 Both the Guidelines and the Criteria apply to Fixed Public Telephone Systems and Fixed Publicly Available Telephone Services only and are independent of the technologies used to deliver these services. For the avoidance of doubt, these could include IP or other packet-based systems if used to deliver Fixed Publicly Available Telephone Services. The terms Fixed Public Telephone System and Fixed Publicly Available Telephone Service are defined in the PTO licence. 1.18 The guidance in these documents is not intended to define the requirements that may be placed on operators by government in times of a national emergency or in order to protect national security. This is the responsibility of other government departments, principally the Cabinet Office, and queries on these requirements should be addressed to them. Chapter 2 – The essential requirements guidelines 2.1 The final version of the Guidelines referred to in this chapter is available on Oftel’s website from www.oftel.gov.uk/publications/ind_guidelines/index.htm. 2.2 The ERTG’s Draft Guidelines on the essential requirements for network security and integrity were accepted by the NICC in July 2001, subject to the understanding that there would be an opportunity for further comments during a period of consultation. 2.3 Oftel made some changes to the Draft Guidelines after they were accepted by the NICC – these are set out in Oftel’s consultation document (see www.oftel.gov.uk/publications/ind_guidelines/esre1201.htm). 2.4 In Oftel’s consultation on the Guidelines and Criteria, Oftel asked: whether it was appropriate for Oftel to publish Guidelines on the essential requirements for network security and integrity; whether stakeholders had any comments on the draft Guidelines; and whether stakeholders had any comments in particular on the line powering requirement for one or two line telephony as described in the draft Guidelines. 2.5 Most respondents agreed that it was appropriate for Oftel to publish the Guidelines. Detailed and helpful comments on the text of the Guidelines were received. Oftel has therefore decided to formally adopt the Guidelines having made modifications to the text as set out below. 2.6 A number of respondents expressed reservations about the inclusion of annexes on lifeline requirements and the telephone emergency services in the Guidelines, and these respondents felt the annexes mixed obligations and recommendations, and did not have sufficient visibility as annexes to another document. Oftel has made some changes to the text of the Guidelines (see below) that it hopes will go some way towards addressing these concerns. 2.7 In relation to the line-powering requirement for one- and two-line telephony described in the Guidelines, the views of respondents were divided. Most network operators considered that these requirements should be relaxed. They pointed out the adverse impact on costs of having to provide power back-up in network equipment sited on the customer’s premises, the increasing availability of alternative access methods such as mobile phones and the apparently arbitrary distinction between one and two line telephony and multi-line telephony. Most consumer groups were against any relaxation of these requirements as it would adversely affect consumers, particularly vulnerable consumers who might be more likely to make emergency calls in the event of mains power failure. Several respondents suggested that a wider debate was required, and that Oftel’s consultation on the Guidelines and Criteria may not have given this issue sufficient visibility. 2.8 On balance, Oftel’s view is that no change can be made at the moment to the policy requiring that provision be made for line powering for one and two line telephony services, as this reflects current consumer expectations. Any change would require further and wide-reaching work to identify appropriate alternative protections for consumers. 2.9 The comments received on the Guidelines, and Oftel’s response to these comments, are set out in more detail in annex B of this statement. In the light of these comments, Oftel has made several changes to the Guidelines before adopting them formally. 2.10 Oftel has added two paragraphs to the introductory text of the Guidelines to indicate that they do not define requirements in times of national emergency, and they should not be used to specify contractual obligations between network operators and their customers. 2.11 For clarity, the full text of Licence Conditions 20.3 and 20.4 has been added to the introductory section of the Guidelines. 2.12 Oftel has noted the interdependency between physical separation, re-routing and redundancy in delivering availability in the section on physical security. 2.13 Oftel has referred to the need for more general Operations and Maintenance (O&M) procedures between interconnected operators in the section on network management. 2.14 Oftel has reiterated its view that effective accounting management is an essential part of network security in the section on network management. 2.15 Oftel has referred to the possibility of radio signal ingress in the section on abnormal electrical conditions. 2.16 Oftel has modified the text on screening in the section on inappropriate use of signalling protocols to make it clear that interconnect screening and policing are the main forms of screening that Oftel would expect network operators to consider. Oftel has modified certain other parts of the section on inappropriate use of signalling protocols to avoid making the guidance too detailed. 2.17 Oftel has included explanations of effective and non-effective calls in the section on excessive traffic loads, and clarified that the implementation of a Congestion Control Process in accordance with the relevant NICC documents is a specific requirement, rather than a general principle of network traffic management. 2.18 Oftel has removed the annex describing the telephone emergency service from the Guidelines. Oftel has modified the text of this description in several places to correct minor inaccuracies of terminology. Oftel is publishing this description as a separate stand-alone document (available on Oftel’s website at www.oftel.gov.uk/publications/ind_guidelines/index.htm). 2.19 Oftel has maintained the annex on lifeline requirements as part of the Guidelines. However, Oftel has modified the text of this annex in several ways: Oftel has included a definition of ‘lifeline’ and ‘safety of life’ services and corrections have been made to some terminology; a note has been added explaining that specific technologies are only mentioned as illustrative examples, and not because these are the only technologies permitted; a comment relating to the relationship between CLI and location for calls made over VoIP networks has been added; Oftel has clarified that, Oftel does expect network operators to provide access to the ‘safety of life’ numbers listed in the Annex. Oftel has also clarified that if network operators wished to give special attention to calls to these numbers (eg through faster restoration in the event of a fault), and were capable of doing so, Oftel would not regard this as undue discrimination; Oftel has added a further explanatory note regarding minimum line power that must be provided to TE under a loss of mains power condition; and Oftel has slightly relaxed the text on interruption to 999/112 service, and the text now states that such interruptions should be targeted to be less than 24 hours. Chapter 3 – The criteria for restriction of network access 3.1 The final version of the Criteria referred to in this chapter is available on Oftel’s website from www.oftel.gov.uk/publications/ind_guidelines/index.htm. 3.2 The ERTG’s draft Example criteria for the restriction of access to the fixed Public Telephone System were accepted by the NICC in July 2001, subject to the understanding that there would be an opportunity for further comments during a period of consultation. 3.3 Oftel made one change to the draft Example criteria after they were accepted by the NICC – this is explained in Oftel’s consultation document at www.oftel.gov.uk/publications/ind_guidelines/esre1201.htm. 3.4 As was pointed out earlier in this statement, these criteria are referred to in Licence Condition 20, which in turn gives effect to the relevant part of the RVTD (see reference 3). In keeping with the aim of proportionality in regulatory obligations and consistent with Oftel’s strategy of appropriate regulation, Oftel believes the Criteria strikes a reasonable balance between ensuring the aims of the Directive are met whilst ensuring that the limitations to access are kept to those that are strictly necessary. A key factor in achieving this balance has been the close involvement by network operators in developing the Criteria. Given that the operators have to bear any costs of excessive restrictions, Oftel believes the process used to develop the Criteria provides the necessary safeguards that the Criteria are not overly burdensome. 3.5 In Oftel’s consultation on the Guidelines and Criteria, Oftel asked: whether it was appropriate for Oftel to publish Criteria for the restriction of access to and use of the Fixed Public Telephone System on the grounds of network security or integrity; whether stakeholders had any comments on the draft Criteria; and whether stakeholders considered that it was appropriate for Oftel to assume that network operators were using these criteria if network operators did not identify their own criteria in advance. 3.6 In general, respondents either agreed that it was appropriate for Oftel to publish the Criteria or did not respond to this question specifically. Oftel received fewer detailed comments on the text of the Criteria than on the Guidelines but has nevertheless made some changes to the text of the Criteria to address some of the matters of principle raised by respondents. Oftel has therefore decided to formally adopt the Criteria subject to the textual changes set out below. 3.7 Most respondents also either considered that it was appropriate for Oftel to assume that operators were using these criteria as the basis on which to restrict network access if operators did not identify their own criteria in advance, or did not comment. Oftel therefore intends to use the Criteria in this way in the future. 3.8 The comments received on the Criteria, and Oftel’s response to these comments, are set out in more detail in annex B of this statement. In the light of these comments, Oftel has made several changes to the Criteria document before adopting it formally: for clarity, the full text of Licence Conditions 20.5 and 20.6 has been added to the introductory section of the Criteria; a paragraph has been added noting that although the scenarios in the Criteria focus on the PSTN, the principles established in the Criteria apply to Fixed Public Telephone Systems regardless of technology used; a note on the legal status of the Criteria has been added, rather than referring out to similar sections in the Guidelines; and Oftel has included a paragraph acknowledging that appropriate action to restrict network access on the basis of network security and integrity may depend on circumstances not envisaged in the scenarios described in the Criteria. In these cases, Oftel expects network operators to adhere to the principles of proportionality and non-discrimination, and use the scenarios described in the Criteria as a starting point for determining suitable action to take. Annex A – Licence Condition 20 Condition 20 ESSENTIAL REQUIREMENTS AND ESSENTIAL PUBLIC INTERESTS 20.1 The Licensee shall comply with any decision taken in accordance with the procedures referred to in regulation 21(1) of the Revised Voice Telephony Regulations which relates to proceedings to which the Licensee is a party, subject to regulation 21(2). 20.2 The Licensee shall comply with any notice served on it pursuant to regulation 21(6)(a) of the Revised Voice Telephony Regulations. 20.3 The Licensee shall take all reasonably practicable steps to maintain, to the greatest extent possible, the availability of Fixed Public Telephone Systems run by it and Fixed Publicly Available Telephone Services provided by it, having particular regard to the needs of Emergency Organisations, in the event of catastrophic network failure, or in cases of force majeure, such as extreme weather, earthquake, flood, lightning or fire. 20.4 The Licensee shall take all reasonably practicable steps to maintain, to the greatest extent possible, the integrity of Fixed Public Telephone Systems run by the Licensee and Fixed Publicly Available Telephone Services provided by it, having particular regard to the needs of Emergency Organisations; that is to say, protection of the physical and functional operation of such systems and services against malfunctions or failure caused by electrical conditions, signalling protocols or traffic loads conveyed from telecommunication systems connected to the Applicable Systems. 20.5 The Licensee shall ensure that any restrictions imposed by it on access to and use of its Fixed Public Telephone System on grounds of maintenance of network integrity, in order to protect, inter alia, network equipment, software or stored data are kept to the minimum necessary to provide for normal operation of the System. 20.6 The Licensee shall ensure that any restrictions imposed by it on access to and use of its Fixed Public Telephone System on the grounds of network security or network integrity are proportionate, non-discriminatory, and based on objective criteria identified in advance. 20.7 The Licensee shall take all necessary steps in order to maintain so far as practicable the highest level of Fixed Publicly Available Telephone Services provided by it to meet any priorities specified by the Director. 20.8 The Licensee shall not impose any restrictions on the use of any Terminal Equipment relating to Fixed Publicly Available Telephone Services provided by it on the grounds of interoperability of services where such equipment complies with the Terminal Equipment Regulations on the grounds of interoperability of services. 20.9 The Licensee may impose conditions on access to and use of its Fixed Public Telephone System on the grounds of protection of data only in accordance with Relevant Data Protection Legislation. Annex B – Analysis of responses to the consultation Introduction B.1 Oftel launched a public consultation on draft versions of the Guidelines and Criteria on 10 December 2001. The consultation period ran until 11 March 2002, with a further period until 25 March 2002 for comments on comments. B.2 During this time, Oftel received 17 responses, of which three were confidential. Non-confidential responses are available on Oftel’s website at www.oftel.gov.uk/publications/responses/2001/essre1001/index.htm. Oftel received non-confidential responses from: British Telecommunications plc; Bulldog Communications Ltd; Dr Martin Burrage; Cable & Wireless plc; Consumer Communications for England (CCE); Fibrenet; Hearing Concern; Marconi Corporation plc; Mencap; One 2One; Operators Group (on behalf of Cable and Wireless Colt, Easynet, Energis, Global Crossing, Kingston Communications (Hull) plc, Thus, and Your Communications); PhoneAbility; Scottish Advisory Committee on Telecommunications (SACOT); and Telewest Communications plc. B.3 In this annex, Oftel has summarised the non-confidential comments received during the consultation, and has explained Oftel’s view on the points raised. Question 1 Do you agree that it is appropriate for Oftel to publish guidelines on the network security and integrity provisions of Condition 20 of the PTO Licence? *Principle of publication* Comments B.4 Most respondents agreed that it was appropriate for Oftel to publish the Guidelines. B.5 Another respondent accepted that Oftel should publish this guidance, provided it did not exceed the scope of the European framework. The respondent assumed that the Guidelines were being published using the Director’s powers to publish guidance on any licence condition. B.6 A consumer organisation welcomed the publication of the Guidelines, and noted that there was a clear public interest goal (outside the competitive market) to protect (amongst others) vulnerable and disabled consumers who are increasingly relying on the telephone systems for both normal and emergency communications. B.7 A mobile network operator pointed out that if the Guidelines are to be extended to mobile networks then the major differences in design and operations between mobile and fixed networks must be recognised. A collective response from a group of network operators urged Oftel to make the Guidelines applicable to mobile network operators. A consumer organisation suggested that Oftel should address security of Internet access (eg prevention of ‘denial of service’ type attacks) as well as looking at the security of traditional telephone services. Response B.8 Oftel can confirm that Oftel is publishing the Guidelines using the Director’s powers to publish guidance on any licence condition. Oftel can also confirm that Oftel does not consider that the Guidelines exceed the scope of the European framework. B.9 Oftel considers that the legal framework for the essential requirements Guidelines (the Revised Voice Telephony Directive) clearly restricts the scope of the Guidelines to Fixed Public Telephone Systems and Fixed Publicly Available Telephone Services only. Of course, steps to secure the fixed public telephone system will also enhance the security of Internet access services provided by means of dial-up connections using that system. Although at this stage, the scope of the Guidelines is limited to fixed public telephone systems and services, Oftel has actively urged the European Commission to extend the scope of NRA powers in this area to include security of mobile and data networks and services, reflecting their increasing importance to the economic and social health of the nation. Technologies Comment B.10 One respondent asked that a clear distinction be made in the Guidelines between circuit switched and packet switched technologies, as best practice measures might vary between these technologies. Response B.11 Oftel considers that the text of the Guidelines makes it clear that the Guidelines apply to Fixed Public Telephone Systems and Fixed Publicly Available Telephone Services regardless of the technologies used to deliver these services ie the Guidelines are technology neutral. Where specific technologies have been mentioned, these are intended as examples only. Review of publications Comment B.12 One respondent felt that the arrangements for reviewing both the Guidelines and the Criteria should be made explicit in each document. Response B.13 Oftel considers that the introductory text of both documents explain how they will be reviewed and amended if necessary. This would be business as usual for Oftel, in the light of representations from interested parties and experience of their operation. Oftel does not consider it necessary to include more detailed plans for reviewing the documents, as these could easily be rendered irrelevant by future developments. Proportionality Comment B.14 One company commented that the guidance was too detailed, particularly as operators already had commercial incentives to ensure security and integrity of their networks. Therefore the respondent considered that the Guidelines might be disproportionate. The respondent asked for more detail about Oftel’s proposed activity to ensure compliance with the Guidelines. Response B.15 Oftel considers that the Guidelines are proportionate and appropriate, particularly as they were developed with detailed input from industry itself. Although there are obvious commercial incentives on operators to ensure network integrity and security, the standards might vary from one operator to another. One of the purposes of the Guidelines is to ensure that there are certain minimum measures which all network operators should take in the public interest. The text of the Guidelines explains that the Director General will take the Guidelines into account when applying Condition 20, but that the Director General’s discretion cannot be fettered. In Oftel’s view, this gives Oftel sufficient discretion to ensure that the Guidelines are applied in a proportionate manner. It is therefore not possible at this time to give more detailed guidance as to how Oftel would monitor compliance with Condition 20. Applicability to PTOs Comment B.16 The same respondent expressed concern about the scope of Condition 20, and whether Condition 20.1 and 20.2 would apply to only some operators and not all, and therefore whether the subsequent parts of Condition 20 (Condition 20.3 onwards) would apply to only some operators. Response B.17 In respect of the scope of Condition 20, and in particular Condition 20.3 and Condition 20.4, Oftel considers that the text of the Condition does not in any way limit these requirements to a subset of operators, but rather that these requirements apply to all operators in relation to the Fixed Public Telephone Systems run by them. Applicability to end-users Comment B.18 One company was worried that business customers might start to use the Guidelines in tendering for major contracts, and mandate compliance with the Guidelines. This company also pointed out that there could be cases where the techniques in the Guidelines would not necessarily be the most efficient or effective solution, particularly where the traffic was of a sensitive nature. Response B.19 Oftel notes this concern, and has added a very clear sentence to the introductory text of the Guidelines stating that the Guidelines should not be used to specify requirements between network operators and their customers. Oftel has also added a note about the fact that requirements relating to national security and national emergencies would be likely to take precedence over the recommendations contained in the Guidelines and that end users with special operational needs may require further measures to be taken. Question 2 Do you agree that it is appropriate for Oftel to publish criteria for the restriction of network access on the grounds of network security or network integrity? Principle of publication B.20 All respondents either agreed that it was appropriate for Oftel to publish the Criteria or made no comment. *Technologies* Comment B.21 One company asked that examples relevant to packet switching technologies be included. Response B.22 Oftel considers that the Criteria should as far as possible be technology neutral. Oftel acknowledges that the examples given in the Criteria focus on the PSTN as this is where disputes are most likely to arise, but the text of the Criteria does state that the examples are not intended to be exhaustive. Range of scenarios Comment B.23 Whilst agreeing with the publication of the Criteria, one respondent noted that there might be additional circumstances in certain cases not covered by the examples given which would render the Criteria inappropriate. The respondent requested that a clear statement be added that the Criteria were only suggestions and would not necessarily apply in all circumstances. Response B.24 Oftel considers that the text of the draft Criteria clearly set out that the list of scenarios considered in the document was not intended to be definitive or exhaustive (paragraphs four and 17 of the Criteria). However, Oftel has added two sentences to the introductory text of the Criteria to explain that an operator may need to take additional unforeseen circumstances into account when determining the appropriate level of action to take to preserve network security or integrity, but that this action should always be based on the principles of proportionality and non-discrimination. *Local loop unbundling (LLU)* Comment B.25 One company was very keen to see more details included in the Criteria in relation to co-mingling and escorted access for LLU, in order to ensure to ensure that ‘security’ was not used in an anti-competitive manner. Response B.26 It is Oftel’s view that in-depth guidance on aspects of co-mingling and escorted access has been provided elsewhere by Oftel, and that these issues are too specific and detailed for consideration in this document. Payphones Comment B.27 One respondent felt that any restrictions on network access should not reduce the availability of public pay phones with amplification, inductive coupling and text access for the hearing impaired. Response B.28 Oftel recognises the importance of the availability of public pay phones to all consumers, and in particular disabled consumers. Oftel would expect operators to give due consideration to the needs of disabled consumers when implementing any restrictions on network access on the grounds of network security or integrity. Question 3 *What comments do you have on the draft Guidelines on the essential requirements for network security and integrity* presented in this document? Introduction** B.29 Comments on the Guidelines fell into three main areas: comments on the body of the Guidelines; comments on the annex describing the 999/112 telephone emergency service; and comments on the annex on requirements for ‘lifeline’ telephony The body of the Guidelines Enforcement Comment B.30 One company was concerned about whether the Guidelines were binding or not, and whether Oftel would develop a detailed checklist to ensure compliance. This company wished to understand the scope of the Guidelines, whether or not they would apply to operators not offering voice services, and whether they would apply to an operator providing wholesale LLU services to another operator, or the operator using wholesale LLU services to market and supply voice services to the end user. Response B.31 Oftel considers that the Guidelines are sufficiently flexible to acknowledge operators’ own internal procedures, and that the Director General will be able to exercise discretion on a case-by-case basis. Oftel’s compliance activities are likely to be reactive (ie in response to a specific incident or incidents) rather than proactive. As explained in the text of the Introduction to the Guidelines, Condition 20 and therefore the Guidelines apply to Fixed Public Telephone Systems and Fixed Publicly Available Telephone Services provided over those Systems. Telephone Services includes not just voice telephony but also other services such as textphone. The licence condition makes it clear that the obligations fall on the operator running the system – in the past Oftel has interpreted ‘running a system’ to mean having day-to-day management and control of the system and how it is configured. In the example quoted by the respondent, the operator marketing and supplying voice services to the end user using unbundled local loops is likely to have day-to-day management and control of the system, and therefore the obligations in Condition 20 would fall on that operator. Home Office guidance Comment B.32 One respondent suggested that the published Home Office documents on disaster recovery be included in the Guidelines, and felt that further consultation with equipment suppliers could be of benefit. Response B.33 Oftel considers that documents produced by the Home Office on disaster recovery and other related subjects complement the Guidelines, but would point out they could not be enforced under Condition 20. As such, it would not be appropriate to include such documents with the Guidelines themselves. B.34 Representatives of public equipment suppliers were invited to attend the NICC task group that drafted the Guidelines, and several such representatives did join the task group. Given that this was the case, and that equipment suppliers were also able to respond to the public consultation on the Guidelines, Oftel believes that there has been sufficient opportunity for interested equipment suppliers to comment. *Text services* Comments B.35 One consumer organisation suggested that the Guidelines should make reference to the need for special consideration to be given to ensuring the security of text access. The respondent also considered that network operators should collect traffic data from text accessible platforms, as well as the other platforms explicitly mentioned in the Guidelines. B.36 The same respondent suggested that the Guidelines should contain a requirement that network operators have line condition messages in text suitable for text-only users. Response B.37 Oftel notes this suggestion, and points out that in practice, text access services are offered over basic conveyance services. Provided that the conveyance services are being properly managed according to the guidance contained in the Guidelines and the equipment at each end is serviceable, then the text access services should be secured. B.38 Oftel responds to the second point by stating that this already applies to fixed networks through SI 2410/2000 (see reference 6) and does not consider it necessary to mention this explicitly in these Guidelines. Detailed proposals for change Comment B.39 Another respondent made some detailed suggestions for changes to the text of the Guidelines, almost all of which Oftel has implemented. This respondent: a) questioned the apparent focus in the Guidelines on physical separation for achieving quality of service; b) suggested that reference to more general Operations and Maintenance procedures for interconnected operators should be made; c) asked why reference was made to accounting management in the Guidelines; d) asked for clarification about screening; e) suggested that definitions of effective and non-effective calls be given; and f) asked whether there was an obligation to document measures to ensure the priority of 999/112 traffic, or whether this was just a recommendation. Response B.40 Oftel: a) would point out that the Guidelines discuss physical and network security separately, and in the section on network security the Guidelines do address resilience and restoration. However, Oftel has added a sentence to the physical security section in the Guidelines noting that availability is usually delivered by a combination of both physical and network security; b) has modified the text accordingly; c) accepts that effective accounting management, whilst essential to the financial viability of an operator’s business, does not have a direct bearing on ensuring network security. The Guidelines have been amended accordingly; d) has changed the text to indicate the two forms of screening that Oftel considers most important; e) has added an explanation to the document; and f) does consider this an obligation that arises from the text of Conditions 20.3 and 20.4, which refer to the Licensee having ‘particular regard to the needs of emergency organisations’ when considering network security and integrity. Therefore Oftel has not changed this part of the Guidelines. Annex describing the 999/112 telephone emergency service *Inclusion in Guidelines* Comment B.41 Several respondents, whilst supporting the publication of the Guidelines, had detailed comments on the annexes to the Guidelines. Some respondents questioned the appropriateness of including the description of the 999/112 emergency service as an annex to the Guidelines, particularly given that this sort of information was relevant to both fixed and mobile networks. Response B.42 Oftel does not entirely accept this point, as Oftel explicitly stated in this annex that the description of the 999/112 emergency service applied to fixed PTO networks only. However, Oftel acknowledges that wider visibility of this information is important, and has addressed respondents’ concerns by publishing the description of the 999/112 emergency service separately. Mention of LLU operators Comment B.43 One respondent asked why LLU operators were mentioned explicitly in the 999/112 annex, and why the information passed to the emergency organisation needs to contain an indication as to whether the customer is ex-directory. Response B.44 Oftel has modified the text to remove these two references. Annex on requirements for ‘lifeline’ telephony Principle of inclusion Comment B.45 Several respondents did not consider that the annex on requirements for lifeline telephony should be included in the Guidelines as it mixed obligations (which should be in the body of the Guidelines) and recommendations (which should be in a separate document elsewhere). Response B.46 Oftel continues to consider that it is appropriate to set out the lifeline requirements in an annex to the Guidelines. This is because the text of Conditions 20.3 and 20.4 refer to the Licensee’s obligation to have ‘particular regard to the needs of emergency organisations’ when considering network security and integrity. Oftel considers that it is of great use to the industry to have these requirements set out in as clear a way as possible in one place. *Access to specific numbers* Comment B.47 Several respondents queried the obligation in the annex on lifeline telephony to provide access to specific numbers other than directory enquiries, operator services and emergency services for operators without significant market power. One respondent pointed out that this implies an obligation to establish interconnects in a regime which is currently a strictly commercial issue. The ISUP MOU does not include 0800 and 0845 calls as being mandatory interconnect obligations. This respondent also suggested that the list of ‘safety of life’ numbers be placed in an external document for ease of updating. Response B.48 Oftel has modified the text to clarify that Oftel does expect all network operators to provide access to these ‘safety of life’ numbers. If an operator had the capability and wished to give these numbers a different level of service to other numbers (eg faster restoration), this would not be regarded as undue discrimination by Oftel. Oftel considers that the ISUP MOU is not relevant to this issue. European Directives give NRAs the powers to ensure end-to-end connectivity. There may be no ex-ante obligations on operators in relation to ‘safety of life’ numbers at the moment, however operators deliver such connectivity voluntarily. Were this not to be the case, Oftel would consider making such access mandatory in the future. B.49 There are already many documents arising from this consultation, and Oftel does not at this stage see the benefits of creating an additional document to hold this very small quantity of information. The list in the lifeline annex to the Guidelines may be considered to be the definitive list for the time being. Treatment of calls to ‘safety of life’ numbers Comment B.50 Several respondents were concerned that the ‘safety of life’ numbers mentioned in the lifeline annex meant that these numbers had to be treated the same way as 999 calls, which might be technically impossible in some cases. Response B.51 The Guidelines simply state that access to the numbers listed must be provided. There is no statement, either expressed or implied, that calls had to be treated in a similar manner to 999/112 calls. Oftel recognises the special equipment configurations which are applicable to 999/112 calls and the difficulties which would arise were they to be applied to other numbers. Power fail back-up Comment B.52 One company suggested that the requirements for power back-up set out in the annex on lifeline requirements conflicted with the requirements set out in the main body of the Guidelines, which is less prescriptive. Response B.53 Oftel does not consider that there is any conflict between the body of the Guidelines and the Lifeline annex as regards power back-up. The body of the Guidelines addresses the requirements for power back-up to handle the generality of calls, while the Lifeline annex gives more detail as to the power back-up requirements in the context of handling emergency calls. Definitions and terminology B.54 At the request of respondents, Oftel has added definitions of ‘lifeline’ and ‘safety of life’ services to be added to the document. Oftel has also made it clear that where specific technologies are mentioned, these are examples only, and not because these are the only ones permitted. B.55 Some minor changes to the terminology used in some parts of the annex on the requirements for lifeline telephony were suggested. Oftel has implemented these changes, and does not consider that these changes in terminology have materially altered the meaning of the text concerned. Question 4 What comments do you have on the line powering requirement for one- or two- line telephony as described in Annex BC of the draft Guidelines on the essential requirements for network security and integrity? If this requirement were to be relaxed, would it be sufficient as an alternative to warn consumers of the possible impact at the time of installation? Inclusion of line powering in this consultation Comment B.56 Several respondents did not consider that this consultation was the right place to debate line powering requirements, as it was a matter for both Industry and consumers to consider. There were concerns that consumers, manufacturers and network operators may have overlooked this question, as it was embedded in a consultation that primarily focussed on other matters. There were calls for a wider and more visible debate. Response B.57 Oftel notes these concerns, but would point out that Oftel was careful to draw this issue to the attention of consumers and consumer organisations, both in text of the consultation document and by means of proactive contacts with consumer organisations when the consultation document was published. Oftel has had a good selection of comments from consumers, operators and manufacturers. However, as explained below, Oftel’s view remains that no changes can be made at the moment to line powering obligations in the absence of further fundamental work by interested parties to identify alternative methods of meeting consumer expectations in this area. Line powering requirement Comments B.58 In relation to the desirability of a line-powering requirement for one- and two-line telephony, the views of respondents were divided. B.59 Most network operator respondents (and one member of the public) considered that these requirements should be relaxed. The arguments put forward for relaxing this requirement included: provision for power back-up increases the cost of network equipment sited on the customer’s premises, which in turn discourages the adoption of new services, in particular consumer broadband services; the increasing availability and use of alternative means of accessing the telephone emergency service in the event of mains power failure such as mobile phones; and the apparently arbitrary distinction between one- and two- line telephony (which currently requires provision for line powering) and multi-line telephony (which does not), and the fact that this could lead to workarounds that would defeat the spirit of the line powering obligations. B.60 Several respondents suggested a variety of alternative measures for informing consumers about the problems that might arise in certain circumstances if the requirement for line powering for one- and two- line telephony were to be relaxed. These measures included: product labelling; warning consumers at time of sale, order and installation; reminding consumers at suitable intervals of the issue and the need to maintain battery back-up; making uninterruptible power supplies (UPS) available to consumers to purchase on a commercial basis; and Oftel should use the Guidelines to alert consumes to the issues, and encourage the Industry to develop more techniques to allow continued CPE operation in the event of mains power failure. B.61 On the other hand, most consumer groups were strongly against any relaxation of these requirements as it would adversely affect consumers, particularly vulnerable consumers who might be more likely to make emergency calls in the event of mains power failure. These respondents felt that warnings at the time of installation would be insufficient, as the purchaser might not be the end user, and the warning might not be passed on to subsequent owners. B.62 One consumer group suggested that a consumer with DSL service could be advised to use an ordinary analogue telephone in the event of power failure – possibly both at the time of installation and with subsequent reminders. B.63 Another respondent noted that Commission Communication 2000/C369/03 states that ‘Voice on the Internet’ does not lie within the definition of voice telephony, and therefore that the annex on lifeline requirements (including the requirements for line powering) would appear not to apply to ‘Voice on the Internet’. Response B.64 Oftel has made its position clear elsewhere as to when it regards a service to be public voice telephony – see paragraph four of Oftel’s Frequently Asked Questions on this subject (see reference 7). Oftel’s position does not depend on the technology used, but rather on the service itself. A service should be regulated as public voice telephony if any of the following apply: the service is marketed as a substitute for traditional Public Switched Telecommunication Network (PSTN) voice services; or the service appears to the customer to be a substitute for public voice telephony; or the service provides the customer’s sole means of access to the traditional circuit switched PSTN. B.65 Some ‘Voice on the Internet’ services may therefore be public voice telephony and will be regulated as such by Oftel. B.66 Oftel acknowledges that the distinction between one- and two- line telephony and multi-line telephony is to a certain extent arbitrary, but it is an attempt to distinguish residential from business consumers, and reflects current residential consumer expectations based on the historical precedent. It does not appear to Oftel that the cost of battery back-up is slowing the development of broadband services in the UK. Clarification Comment B.67 Another consumer group requested clarification as to whether the power backup requirements referred to failure in line power or domestic power. Response B.68 Oftel can confirm that when the Guidelines discuss power backup for terminal equipment, this refers to steps that may be necessary to allow consumers to access telephone services in the event of local mains (ie domestic) power failure. Use of inappropriate terminal equipment Comments B.69 One respondent was concerned that the network operator might be in breach of line powering obligations if the customer obtained non-compliant equipment. B.70 Another respondent also noted that (for example) a DECT cordless telephone could be a customer's sole telephone instrument. In such a case, there is no obligation on a user of a DECT system to have a traditional telephone in reserve in the event of mains power failure. Response B.71 Oftel can confirm that should the customer obtain equipment that relies on local power (eg a DECT telephone), the network operator would not be considered in breach of its obligation to provide line powering, as long as such line powering was in place for normal POTS and basic rate ISDN equipment. B.72 Oftel also notes that it is true a user can choose to use terminal equipment that will not work in the event of power failure. If, however, he uses terminal equipment which is line powered then he has attempted to mitigate the risks associated with local mains failure. If there is no line powering then this security is lost. Local loop faults Comment B.73 One respondent pointed out that any failure of the local loop would result in loss of access to all services. In such an event, the consumer would be expected to be mobile to a certain extent to seek out alternative means of accessing the telephone emergency service if necessary. Response B.74 Oftel appreciates that local loop faults do occur and that they frequently cause a total loss of access over the area affected. Oftel notes that provision of priority repair to residential customers with disabilities who may not be mobile and who have a bona fide need for urgent repair is already covered through SI 2410/2000 (see reference 6) and therefore does not need explicit mention in these Guidelines. Length of back-up period Comment B.75 One consumer group that responded felt that one hour back-up for exchange equipment would on its own be inadequate, unless this meant that one hour of service can be taken over a period of (say) three days. Response B.76 Oftel notes this concern, but would point out that the one hour back-up requirement relates particularly to network equipment sited at customers’ premises. It was drawn from the former approval requirement of one hour in the seven hour following disconnection of power source. Manufacturers of such equipment have always been at liberty to provide more than the minimum requirement. Exchange equipment would normally have a far greater period of resilience. Conclusion B.77 Oftel welcomes the detailed suggestions made by several respondents as to alternative methods of alerting consumers about this issue, in the event that line powering requirements for one and two line telephone were to be relaxed. Oftel does not consider that the Guidelines themselves would be an appropriate vehicle for doing this, as the final version of the Guidelines is intended for a network operator audience, not for consumers. Oftel would also point out that the provisions of the Radio Equipment & Telecommunications Terminal Equipment Directive (RE&TTED) (see reference 8) prevent the use of mandatory product labelling. B.78 If the requirements for line powering were to be relaxed, further detailed work would clearly be required to determine what would be sufficient warning for consumers, how consumer awareness could be raised and how the costs for doing this could be covered. B.79 On balance, Oftel’s view is that no change can be made at the moment to the policy requiring that provision be made for line powering for one and two line telephony services, as this reflects current consumer expectations. Any change would require further and wide-reaching work to identify appropriate alternative protections for consumers. Question 5 What comments do you have on the draft Criteria for the restriction of access to and use of the fixed Public Telephone System on the grounds of network security or integrity presented in this document? *Principle of publication* Comment B.80 Most respondents supported the Criteria and several had suggestions for reformatting the Criteria to make them clear and easier to use. Response B.81 Oftel has been able to adopt most of these suggestions in the final version of the Criteria without material changes to the substance of the document. Local loop unbundling Comment B.82 Several respondents suggested that more detailed information on the handling of security issues for LLU should be included. Response B.83 Oftel considers that the Criteria are not in any way inconsistent with LLU guidance produced by Oftel separately. However, such separate guidance may address certain detailed issues in more depth than is possible or appropriate in the Criteria, in which case the detailed separate guidance should be referred to in the first instance. Inclusion of relevant text of licence Comment B.84 One respondent suggested that the document would benefit from some re-formatting, such as the inclusion in full of the relevant licence conditions and a note on its legal status (rather than referring out to another document). Response B.85 Oftel has added these to the document. Network management concept Comment B.86 The same respondent suggested that the section Network management concepts be included as an annex rather than in the body of the Criteria. Response B.87 Oftel has not taken up this suggestion as Oftel considers that providing some context and explanations of terminology prior to describing the specific scenarios is useful. Textphone access to emergency services Comment B.88 One consumer group commented that any restriction on access should safeguard access to the 999/112 emergency service for text access users. Response B.89 Text access to the emergency service does not currently use the same routing as normal voice calls and may not be able to be treated the same as voice 999/112 calls. However, the list of ‘safety of life’ numbers in the lifeline telephony annex includes the 18000 access code for this service. Question 6 Do you agree that it is appropriate for Oftel to assume network operators are using these criteria if network operators do not identify their own criteria in advance? Default use of Criteria Comment B.90 The majority of respondents agreed that it would be appropriate for Oftel to assume that network operators were using the Criteria if operators did not identify their own criteria in advance. B.91 Only one respondent did not consider that it would be appropriate for Oftel to make this assumption, but did not give any reasons. Response B.92 Oftel will therefore assume that operators which do not identify their own criteria in advance are using the Criteria as published by Oftel. Trigger limits for implementation Comment B.93 One respondent noted that the trigger levels at which different operators would implement restrictions on network access were not clear, and suggested that Industry-wide standard procedures might be feasible. Response B.94 Oftel considers that the development of traffic management standards across Industry, whilst it would clearly provide greater transparency, is unlikely to be realistic, considering the wide variations in network size and topology between different operators. Such standardisation is clearly beyond the scope of the Guidelines and Criteria, which aim to set out principles to be followed and examples of best practice. Annex C – Glossary Abbreviations CLI – Calling Line Identity DECT – Digital European Cordless Telephone DSL – Digital Subscriber Loop ERTG – Essential Requirements Task Group LLU – Local Loop Unbundling NICC – Network Interoperability Consultative Committee PNO-IG – Public Network Operators Interest Group of the NICC POTS – Plain Old Telephone Service PSTN – Public Switched Telephone Network PTO – Public Telecommunications Operator RE&TTED – Radio Equipment & Telecommunications Terminal Equipment Directive RVTD – Revised Voice Telephony Directive SSPE-IG – Special Systems and Public Equipment Interest Group of the NICC Annex D – References 1.Guidelines on the essential requirements for network security and integrity, Oftel. 2. Criteria for the restriction of access to and use of the Fixed Public Telephone System on the grounds of network security or integrity, Oftel. 3. Directive 98/10/EC of the European Parliament and of The Council of 26 February 1998 on the application of open network provision (ONP) to voice telephony and on universal service for telecommunications in a competitive environment, OJ L 101, 1.4.1999, p.24. 4. Telecommunications (Open Network Provision) (Voice Telephony) Regulations 1998 – SI No 1580/1998, The Stationery Office Limited, London. 5. Directive 2002/22/EC of the European Parliament and of The Council of 7 March 2002 on universal service and users’ rights relating to electronic communications networks and services, OJ L 108, 24.4.2002, p 51. 6.Telecommunications (Services for Disabled Persons) Regulations 2000 – SI 2000 No 2410, The Stationery Office Limited, London. 7. Frequently Asked Questions on the regulation of Voice over Internet Protocol Services, Oftel, www.oftel.gov.uk/publications/internet/2002/voip0402.htm. 8. Directive 1999/5/EC of the European Parliament and of The Council of 9 March 1999 on radio equipment and telecommunications terminal equipment and the mutual recognition of their conformity, OJ L 91, 7.4.1999, p.10.