the group: - dragged its feet on resolving SS7 security vulnerabilities - repeatedly ignored input from DHS technical experts - [identified] best practices.. using different filtering systems - [but] pushed.. to rely on voluntary compliance