""" Generate the FCC CPNI Annual Certification Letter — Wireless (CMRS) variant. Tailors the CPNI certification for a Commercial Mobile Radio Service provider that operates its own radio / core network. Key variant differences: * Customer approval for CPNI use is frequently obtained through handset-based (one-tap) mechanisms, in addition to traditional opt-in. * CPNI scope includes roaming records, eSIM provisioning / transfer records, and device-level location data. * Mobile location information is treated as CPNI and subject to heightened consent safeguards consistent with the 2020 LocationSmart Consent Decree (DA 20-299) and the 2024 Notice of Apparent Liability against the Tier-1 carriers (FCC 24-40) addressing unauthorized location-data sharing. """ from __future__ import annotations import logging from datetime import datetime from pathlib import Path from typing import Optional LOG = logging.getLogger("document_gen.cpni_wireless") try: from docx import Document from docx.shared import Pt, Inches, RGBColor from docx.enum.text import WD_ALIGN_PARAGRAPH except ImportError: LOG.warning("python-docx not installed — CPNI Wireless generation unavailable") Document = None # type: ignore[assignment,misc] _NAVY = RGBColor(0x1A, 0x27, 0x44) if Document else None VARIANT_ID = "wireless" VARIANT_LABEL = "Wireless (CMRS) — Facilities" MAX_FORFEITURE_PER_VIOLATION = "$251,322" MAX_FORFEITURE_CAP = "$2,513,215" def _sp(p, after=6, before=0): p.paragraph_format.space_after = Pt(after) if before: p.paragraph_format.space_before = Pt(before) def _h(doc, text): p = doc.add_paragraph(); r = p.add_run(text) r.font.size = Pt(12); r.bold = True; r.font.color.rgb = _NAVY _sp(p, after=4, before=8) def _b(doc, text, bold=False, size=10): p = doc.add_paragraph(); p.alignment = WD_ALIGN_PARAGRAPH.LEFT r = p.add_run(text); r.font.size = Pt(size); r.bold = bold _sp(p, after=6) def _cb(doc, text, checked=True): mark = "\u2611" if checked else "\u2610" p = doc.add_paragraph() r = p.add_run(f" {mark} {text}"); r.font.size = Pt(10) _sp(p, after=3) def generate_cpni_wireless( output_path: str, entity_name: str, frn: str = "", filer_id_499: str = "", officer_name: str = "", officer_title: str = "Chief Executive Officer", complaints_count: int = 0, complaints_description: str = "", has_data_broker_inquiries: bool = False, data_broker_description: str = "", reporting_year: int = 0, address_street: str = "", address_city: str = "", address_state: str = "", address_zip: str = "", contact_email: str = "", contact_phone: str = "", breaches: list[dict] | None = None, **_: dict, ) -> Optional[str]: if Document is None: LOG.error("python-docx not installed") return None if reporting_year == 0: reporting_year = datetime.now().year - 1 breaches = breaches or [] doc = Document() for s in doc.sections: s.top_margin = Inches(1); s.bottom_margin = Inches(1) s.left_margin = Inches(1.25); s.right_margin = Inches(1.25) today = datetime.now().strftime("%B %d, %Y") signer = officer_name or "Authorized Officer" title = officer_title or "Officer" tp = doc.add_paragraph(); tp.alignment = WD_ALIGN_PARAGRAPH.CENTER t = tp.add_run("CPNI Annual Certification Letter") t.font.size = Pt(14); t.bold = True; t.font.color.rgb = _NAVY _sp(tp, after=2) sp = doc.add_paragraph(); sp.alignment = WD_ALIGN_PARAGRAPH.CENTER s = sp.add_run( f"Wireless (CMRS) Facilities \u2014 47 CFR \u00a7 64.2009 " f"\u2014 Calendar Year {reporting_year}" ) s.font.size = Pt(10); s.font.color.rgb = RGBColor(0x55, 0x55, 0x55) _sp(sp, after=8) _h(doc, "1. Provider Information") lines = [f"Company Name: {entity_name}", f"Variant: {VARIANT_LABEL}"] if frn: lines.append(f"FCC Registration Number (FRN): {frn}") if filer_id_499: lines.append(f"FCC Form 499 Filer ID: {filer_id_499}") addr = ", ".join(filter(None, [address_street, address_city])) if address_state or address_zip: addr += f", {address_state} {address_zip}".strip() if addr.strip(", "): lines.append(f"Address: {addr.strip(', ')}") if contact_phone: lines.append(f"Telephone: {contact_phone}") if contact_email: lines.append(f"Email: {contact_email}") lines.append(f"Certifying Officer: {signer}, {title}") lines.append(f"Date of Filing: {today}") lines.append(f"Filing Deadline: March 2, {reporting_year + 1}") _b(doc, "\n".join(lines)) _h(doc, "2. Officer Statement of Personal Knowledge") _b(doc, ( f"I, {signer}, {title} of {entity_name}, state that I have personal " f"knowledge of the matters certified herein, including procedures " f"governing device-level location data, roaming records, SIM / eSIM " f"provisioning, and handset-based customer consent flows. I have " f"reviewed operating procedures and supervisory logs covering the " f"reporting period." )) _h(doc, "3. Certification of Compliance") _b(doc, ( f"Pursuant to 47 CFR \u00a7 64.2009(e), {entity_name} hereby submits " f"its annual certification of compliance with the CPNI rules at " f"47 CFR \u00a7\u00a7 64.2001 through 64.2011 for the period " f"January 1, {reporting_year} through December 31, {reporting_year}." )) _h(doc, "4. How Our Procedures Ensure Compliance") _b(doc, ( f"As a Commercial Mobile Radio Service (CMRS) provider, " f"{entity_name}'s CPNI holdings include call detail records, " f"roaming records, SIM/eSIM provisioning and transfer logs, and " f"device-level location data. Specific procedures include:" )) _cb(doc, ( "Customer authentication for CPNI disclosures in response to a " "customer-initiated contact uses a pre-established password, or " "in-app / on-device verification (biometric or PIN) tied to the " "authenticated subscriber identity (47 CFR \u00a7 64.2010)." )) _cb(doc, ( "Customer approval for CPNI use beyond the scope of the subscribed " "service may be obtained through traditional opt-in (written / oral) " "OR through a secure one-tap in-app consent flow that meets the " "FCC's 'knowing consent' standard under 47 CFR \u00a7 64.2007. " "Consents are timestamped and retained." )) _cb(doc, ( "Location data consent. Consistent with the 2020 LocationSmart " "Consent Decree (DA 20-299) and the 2024 NAL addressing unauthorized " "third-party location disclosure, {entity_name} treats device " "location data as CPNI and requires separate, express consent for " "disclosure to any third party. A chain-of-consent audit is " "performed for each location-data aggregator relationship." ).replace("{entity_name}", entity_name)) _cb(doc, ( "SIM / eSIM transfer (port-out / device-swap) requires multi-factor " "authentication plus customer notification to the address of record " "prior to completion \u2014 implementing the anti-SIM-swap rules " "codified at 47 CFR \u00a7 64.2010(f)\u2013(g)." )) _cb(doc, ( "Roaming records are protected with the same safeguards as home-" "network CDRs; access is logged to the named individual and " "reviewed quarterly by the CPNI Protection Officer." )) _cb(doc, ( "Access logs are retained for at least two years; certification " "records for five years; access is reviewed at least quarterly." )) _cb(doc, ( "Annual CPNI training is mandatory for all personnel with CPNI " "access; breach notification procedures comply with 47 CFR " "\u00a7 64.2011 as amended by FCC 23-111." )) _h(doc, "5. Customer Complaints") if complaints_count == 0: _b(doc, ( f"{entity_name} has NOT received any customer complaints during " f"the reporting period concerning the unauthorized release or " f"use of CPNI (including unauthorized location-data " f"disclosures). Zero (0) complaints were logged." )) else: desc = complaints_description or "Each complaint was investigated and resolved." _b(doc, ( f"{entity_name} HAS received {complaints_count} customer " f"complaint{'s' if complaints_count != 1 else ''} during the " f"reporting period. {desc}" )) _h(doc, "6. Data Broker Inquiries and Pretexting") if not has_data_broker_inquiries: _b(doc, ( f"{entity_name} has NOT received any inquiries, communications, " f"or attempts by data brokers or other unauthorized parties " f"seeking the unauthorized release of CPNI or device location " f"data." )) else: desc = data_broker_description or "Each was refused, documented, and escalated." _b(doc, ( f"{entity_name} HAS received data broker or pretexting-style " f"inquiries during the reporting period. {desc}" )) _h(doc, "7. Breach Log Summary") if not breaches: _b(doc, ( f"{entity_name} experienced no CPNI breaches during the " f"reporting period. No 47 CFR \u00a7 64.2011 notifications were " f"required." )) else: _b(doc, ( f"{entity_name} experienced {len(breaches)} CPNI breach" f"{'es' if len(breaches) != 1 else ''} during the reporting " f"period; each was reported within 7 business days." )) _h(doc, "8. Penalties, Truthfulness, and Perjury Acknowledgment") _b(doc, ( f"{entity_name} and the undersigned acknowledge that CPNI rule " f"violations may subject the carrier to forfeitures up to " f"{MAX_FORFEITURE_PER_VIOLATION} per violation and up to " f"{MAX_FORFEITURE_CAP} for any single act or failure to act." )) _b(doc, ( "Pursuant to 47 CFR \u00a7 1.17, the undersigned represents that no " "material factual information has been withheld and all statements " "are truthful, accurate, and complete." )) _b(doc, ( "Willful false statements are punishable under Title 18, U.S.C. " "\u00a7 1001, and by forfeiture under 47 U.S.C. \u00a7 503." )) _h(doc, "9. Signature of Certifying Officer") _b(doc, ( "I declare under penalty of perjury under the laws of the United " "States of America that the foregoing is true and correct." )) p = doc.add_paragraph(); _sp(p, after=0) sig = doc.add_paragraph(); sig.add_run("_" * 45).font.size = Pt(10); _sp(sig, after=2) nm = doc.add_paragraph(); nr = nm.add_run(signer); nr.bold = True nr.font.size = Pt(10); _sp(nm, after=2) tpp = doc.add_paragraph(); tpp.add_run(f"{title}, {entity_name}").font.size = Pt(10) _sp(tpp, after=2) dp = doc.add_paragraph(); dp.add_run(f"Date: {today}").font.size = Pt(10) _sp(dp, after=2) out = Path(output_path) out.parent.mkdir(parents=True, exist_ok=True) doc.save(str(out)) LOG.info("CPNI Wireless certification letter generated: %s", out) return str(out)