Telnyx: KYUP builds the database the bad actors want

Telnyx filed in WC 17-97 and CG 17-59 on August 10 under a section heading that says the whole argument: “THE PROPOSED KYUP INFORMATION-COLLECTION REQUIREMENTS ARE DISPROPORTIONATE AND RAISE SERIOUS PRIVACY CONCERNS.”

The list it objects to comes from FNPRM ¶20 — beneficial-ownership data including individuals’ names, home addresses, citizenship and a copy of government-issued identification; financial-institution and account information; and a five-year history of any criminal or regulatory investigation involving the provider, its affiliates or their principals. Paragraph 34 sets a four-year minimum retention period.

Telnyx’s core sentence: the FNPRM “would require every voice service provider in the country to build and maintain a database containing the names, home addresses, citizenship, and government-issued identification of individuals with an ownership stake in every upstream counterparty—information that has obvious value to identity thieves and hostile foreign governments and is itself an attractive target for the same bad actors this rule is meant to exclude.”

It says the Commission “briefly acknowledges that ‘some of this information’ may ‘constitute sensitive business or personal information’ and asks what safeguards might be appropriate, but it does not propose any actual data-security standard or any limitation on secondary use.”

This is the second time Telnyx has made this argument this year. It cites its own comments in the know-your-customer proceeding, CG 17-59 and CG 02-278, filed June 24 with replies July 27, and says the KYUP proposals “raise the mirror-image version of that same problem on the upstream-provider side.” There it documented “how massive carrier data breaches affecting tens of millions of subscribers over just the past five years have repeatedly exposed exactly the kind of sensitive personal data the Commission now proposes to require.”

Telnyx maintains relationships with dozens of upstream providers and is itself an upstream provider to many downstream ones, so it would assemble the dossier and also hand it over on each counterparty’s renewal schedule. Across more than 10,000 RMD filers, “the aggregate compliance burden is not the incremental one the Commission assumes.”

The concrete ask is narrow: cut the mandatory list “to the elements that are genuinely indicative of bad-actor status, e.g., RMD status, SPC token status, and the repeated incurrence of tracebacks via the provider’s network, rather than the full 20-plus category list currently proposed.”

On whether the collection would work: “Sophisticated bad-actor providers can and do produce facially complete corporate paperwork, business licenses, and identification documents.”