Trump's Plan Is To Gut All FCC Consumer Protection Powers

from the utterly-Comcastic dept

Trump's telecom advisors have made it abundantly clear the incoming administration intends to gut net neutrality, roll back most consumer broadband protections, and defund and defang the FCC as a broadband consumer watchdog. While deregulation works in some sectors, history makes it abundantly clear that blindly deregulating the broken telecom market only makes the problem worse. Just ask Michael Powell, the former deregulatory-focused FCC boss turned top cable lobbyist, whose blanket deregulatory tenure at the agency helped forge the "Comcast experience" most modern consumers enjoy today.

It shouldn't be all that surprising then that leaked details on the incoming FCC's transition plan confirms that gutting of the FCC as consumer watchdog is precisely what Trump's team has in mind. Of his advisory team can't just call this spade a spade, given consumers would realize an unchecked Comcast, AT&T, Charter and Verizon spells significant trouble for their wallets... and peace of mind. As such, Trump's advisors intend to dress up what they have planned as an act of ultra-efficiency and reform:

"That approach would be to restructure FCC bureaus to better reflect the convergence of the digital age as a first step, and, eventually, move functions deemed "duplicative," like, say, competition and consumer protection, to other agencies, particularly the Federal Trade Commission.

While some have described the plan as one to eliminate the FCC, and certainly many if not most of its functions could be reapportioned, landing team members Jeff Eisenach and Rosyln Layton have argued that what remains would be "a more coherent and streamlined" agency that "would more effectively serve the goals of consumers, competitors, and Congress."

It's worth noting that it's not "some" people that are saying the goal is to neuter the FCC -- that's what Trump's own advisors and most of the GOP are saying. And sure, the FCC will be more "efficient" in the way that a car stripped and sold off for parts needs less maintenance and fewer oil changes, but the pretense that this has anything to do with helping consumers should be utterly transparent to anybody familiar with America's pay-to-play legislature and the kind of "dollar per hollar" industry-tied think tankers that currently have Trump's ear.

In telecom you'll very often see ISP lobbyists and executives urging that the FCC's consumer protection duties be offloaded entirely to the FTC. That's because they know full well the FTC is already under-staffed, under-funded, and ill-equipped to pick up this additional workload, and most consumer issues would be guaranteed to fall through the cracks. The goal isn't more efficient regulation and better, more streamlined regulators: the goal is no oversight whatsoever of some of the least competitive companies in America and one of the most loathed industries in America. All else is pretense.

Of course we could just ask real consumer advocates like Public Knowledge lawyer Harold Feld. Feld has spent the lion's share of his life defending consumers from companies like Comcast, and tells Ars Technica that Trump's plan is effectively an all out war on telecom consumer protections:

"Harold Feld, senior VP of consumer advocacy group Public Knowledge, called this plan "a declaration of war on the most basic principles of universal service, consumer protection, competition, and public safety that have been the bipartisan core of the Communications Act for the last 80+ years." Feld argued that this proposal would "poison the well for any serious effort to update the Communications Act." Feld also worries about the impact on rural areas, which are given special protections in the Communications Act, he told Ars today.

Feld said that the FCC itself has "considerable latitude" to limit its own enforcement actions "and to use rulemakings and forbearances to strip itself of authority," but it still has to meet the requirements of the federal Administrative Procedures Act. Moreover, the proposal to shift FCC competition and consumer protection authority to agencies such as the FTC would require the writing of extremely complicated legislation in Congress, he said."

But Congressional legislation is just what the GOP is planning. The GOP has made it repeatedly clear they intend to table a Communications Act rewrite this year that further erodes regulatory authority over the nation's largest cable TV and broadband providers. It's very likely this new bill will not only severely curtail the FCC, but will roll back the agency's Title II reclassification of ISPs -- as well as net neutrality and new broadband privacy rules. All under the pretense of jobs, broadband expansion, and protecting net neutrality.

Of course the way things are going, dismantling the only government agency that has dared stand up to Comcast is going to be portrayed as some kind of "populist" reform, resulting in countless millions cheering against their own best interests as their rights burn down around them. But as consumer TV and broadband bills skyrocket, net neutrality is gutted, consumer privacy concerns get thrown in the toilet, and unchecked industry duopolists truly begin to run amok -- misdirection and bullshit will only go so far in preventing consumers from realizing precisely who'll be to blame.

Filed Under: consumer protection, donald trump, fcc, ftc, privacy

FCC Boss Tom Wheeler Resigns, Signaling The Beginning Of The End For Net Neutrality

from the partisan-patty-cake dept

We've been discussing how FCC Boss Tom Wheeler was stuck between a rock and a hard place with a Trump Presidency looming. While Wheeler's tenure at the FCC doesn't officially end until 2018, under FCC rules he can only stay on as a vanilla Commissioner -- not the agency boss. With the incoming Trump administration and GOP making it very clear they want to gut net neutrality and defang and defund the FCC, Wheeler sticking around would have resulted in a 2-2 partisan deadlock keeping the FCC in a holding pattern -- at least until a new FCC boss is chosen and approved.

But even then, it was only a matter of time before Wheeler found himself stuck in a 3-2 minority, spending a chunk of his retirement years watching as a slow series of 3-2 partisan votes dismantled many of the efforts Wheeler has worked on during his tenure (most notably net neutrality rules, Title II reclassification, and new broadband privacy consumer protections). As a result, Wheeler this week formally announced his resignation from the agency (pdf), taking effect on January 20.

In his last meeting at the FCC today, Wheeler wouldn't comment on Trump's incoming administration, but did issue a farewell warning to those that think gutting the FCC's regulatory oversight of industry giants like AT&T or Comcast ends well for anybody not named AT&T or Comcast:

"The cry for a laissez-faire government that walks away from market oversight is also highly dangerous to consumers and those that operate in the market. And this is especially true in our interconnected world, because eliminating regulation does not mean that there will be no oversight. It only means that the regulation will be provided by other rule makers and other countries who might be incented to make rules that benefit their companies and traditions."

...As much as we would like to retreat to simpler times and simple solutions, the realities of today just don’t give us that luxury,” Wheeler said. “In the 21st Century, the common good is often defined by how we connect, and that is why the FCC is so darned important. Ignoring that reality is bad for consumers and for those who provide services to them."

Wheeler had promised to resign immediately if the GOP committed to reappointing FCC Commissioner Jessica Rosenworcel to a second term. The GOP had been stalling on her confirmation for some time, but refused the offer knowing full well they'd prefer the early partisan advantage.

While many had doubts about Wheeler given his past lobbying for the cable and wireless sectors (which occurred largely when those sectors were in their infancy), he arguably became the most consumer, competition, and innovation-focused FCC Commissioner in the broadband era (which, admittedly isn't saying much). Unlike most Republican and Democratic FCC Commissioners -- who either outright ignored or underplayed the lack of competition in telecom -- Wheeler actively tried to highlight and repair the sector's duopoly dysfunction, be it via net neutrality or attempting (unsuccessfully) to thwart protectionist state laws.

As we've noted countless times, most of these issues have broad, bipartisan consumer support, but are quite intentionally framed as partisan by industry lobbyists and policy folks to help sow division and dissent, stalling substantive progress. Consumers generally approve of things like net neutrality, healthy competitive markets, and not letting companies like Comcast run amok or write awful state legislation that benefits solely itself. But time and time again, meaningful progress gets mired in a game of partisan pattycake, all quite by design.

It's unlikely the incoming administration will work to gut net neutrality, privacy and other broadband protections immediately for fear of activist backlash. Initially, it's more likely they'll simply refuse to enforce them. After that, the challenge will be to gut consumer protections like net neutrality without making it clear that's what they're doing. To accomplish this goal, you'll likely see a Congressional proposal (or Communications Act rewrite) that will pay endless lip service to the poor, competition and net neutrality, while actively working to undermine all of these things under the false banner of populist reform.

Filed Under: consumer protection, fcc, net neutrality, privacy, tom wheeler

FTC Sues 1-800 Contacts For Restricting Competitors From Using Competitive Keyword Advertising

from the contact-lens-fight dept

This is a crosspost from Professor Eric Goldman's website.

For over a decade, I've blogged about 1-800 Contacts' campaign to suppress competitive keyword advertising, including its legislative games (e.g., those times when 1-800 Contacts asked the Utah legislature to ban competitive keyword advertising) and at least 15 lawsuits against competitors costing millions of dollars in legal fees. I've also marveled at its duplicity; 1-800 Contacts historically employed the same competitive keyword advertising practices it subsequently sought to suppress.

Things have been quiet on the 1-800 Contacts front for the past several years, after it suffered a major blow in the 10th Circuit's Lens.com ruling, but sometimes the machinery of justice keeps turning quietly in the background. This week, the FTC sued 1-800 Contacts for antitrust violations. I believe this is the FTC's first foray into keyword advertising issues, and it's left some folks scratching their heads.

The FTC's Allegations

Let's take a closer look at the FTC's allegations. (As you know, pleadings by government entities are usually a mixture of truth, half-truth and fiction). The complaint says 1-800 Contacts has 50% share of the online retail market for contact lenses. Facing emerging competition from lower-priced entrants, starting in 2004, 1-800 Contacts pursued trademark enforcement against advertisers engaged in competitive keyword advertising. 14 advertisers agreed to settlement terms; only Lens.com didn't give in. (The complaint redacts the names of the settling advertisers, but in a supplement to this blog post, I identify many of them). The settlement agreements barred the competitors from bidding on "1-800 Contacts" or variants; and 1-800 Contacts reciprocally agreed not to bid on the competitors' trademarks.

13 agreements also required the competitors to put "1-800 Contacts" on the negative keyword list. Thus, a search for "1-800 Contacts Cheaper Competitors" -- which strongly implies that the consumer sought competitive alternatives to 1-800 Contacts -- would not display these competitors' ads. The FTC provides a screenshot of that search, shown at the right. As you can see, 1-800 Contacts is the only keyword advertiser. However, the top organic result is a link to AllAboutVision.com, which claims to be "an unbiased source of trustworthy information on eye health and vision correction options" and possibly would be a helpful aggregator for consumers. The organic search results also link to some deep pages on 1-800 Contacts' site, none of which consumers would find responsive to the query. While these search results seem a little funky, the search term "1-800 Contacts Cheaper Competitors" is a VERY long-tail query that few, if any, consumers actually tried. The settlement agreements had reciprocal negative keyword obligations for 1-800 Contacts.

The complaint alleges that "1-800 Contacts has aggressively policed the Bidding Agreements, complaining to competitors when the company has suspected a violation, threatening further litigation, and demanding compliance."

1-800 Contacts' campaign to restrict competitive keyword advertising could potentially hurt three different marketplace players: (1) the competitors who are hamstrung in their efforts to reach interested consumers, (2) consumers who suffer from a less competitive market, and (3) search engines whose ad auctions are rendered less efficient (and less profitable) when interested bidders choose not to participate. The complaint recaps some of the harms allegedly caused by 1-800 Contacts' conduct, including:

• distorting the price-setting mechanisms of search engine ad auctions
• degrading the quality of search results pages by keeping them from displaying the most relevant ads to consumers
• preventing truthful non-misleading information from reaching consumers
• suppressing price and service competition among online contact lenses retailers, which causes "at least some consumers to pay higher prices for contact lenses than they would pay absent the agreements, acts, and practices of 1-800 Contacts"
• increasing consumer search costs to purchase contact lenses online

In other words, the FTC sees competitive keyword advertising as contributing to efficient search advertising auctions and, more importantly, improving consumers' choices and fostering vendor competition on price and quality. Viewing competitive keyword advertising as pro-competitive isn't novel, but it's satisfying to see the FTC embrace the view so enthusiastically.

Finally, the complaint enumerates the FTC's wish list of remedies, including:

• banning 1-800 Contacts from entering into contracts with competitors that restrict participation in search engine ad auctions or suppress the dissemination of truthful non-misleading information
• banning 1-800 Contacts from "filing or threatening to file a lawsuit against any contact lens retailer alleging trademark infringement, deceptive advertising, or unfair competition that is based on the use of 1-800 Contacts' trademarks in a search advertising auction. Provided, however, that Respondent shall not be barred from filing or threatening to file a lawsuit challenging any advertising copy where Respondent has a good faith belief that such advertising copy gives rise to a claim of trademark infringement, deceptive advertising, or unfair competition."

While the FTC's focus on keyword advertising is new, its interest in advertising restrictions is not. For example, our Advertising and Marketing Law casebook covers the FTC v. Polygram case from 2003, in which the FTC successfully pursued two competitors' agreements to restrict advertising of old stock in order to prop up a new product release.

Questions Raised

Why Is the FTC Acting Now? The FTC says 1-800 Contacts started its enforcement-and-settlement campaign in 2004. Why is the FTC acting now, a dozen years later?

Normally a complaint like this is instigated by a competitor's complaint, and it would make sense if Lens.com tipped off the FTC about its situation. (In addition to the trademark battle, Lens.com had a parallel antitrust lawsuit against 1-800 Contacts going back years). However, I assume Lens.com would have raised this issue with the FTC a long time ago. After all, Lens.com filed its antitrust lawsuit in 2011. Perhaps the FTC waited to see how that lawsuit would play out before deciding whether or not to intervene. The district court dismissed Lens.com's antitrust complaint in 2014; I then see a notice of appeal to the 10th Circuit but it's murky what happened after that.

Perhaps the FTC is acting now because competitive keyword advertising law has cleared up a lot over the years. As I've mentioned many times, lawsuits over buying competitors' trademarks haven't succeeded in court for about a half-decade; and even lawsuits over the inclusion of a competitor's trademark in the ad copy rarely make much progress in court any more. While I doubt the FTC could have confidently taken a strong stand on the legality of competitive keyword advertising in the aftermath of the Second Circuit's 2009 Rescuecom opinion, the jurisprudential dust has settled a lot since then.

It's also possible that the FTC finally appreciated how restrictions on competitive keyword advertising distort ad auctions. Auctions work really well to set market prices when all of the relevant bidders participate. I could see how the FTC Bureau of Competition folks, steeped in economics doctrine, had their interest piqued when they first learned about agreements among potential auctions bidders not to participate in the ad auction. Perhaps it took a while for the issue to find its way to the right folks.

Will 1-800 Contacts Accept a Big Fight Against the FTC? When the FTC conducts an investigation into a complaint like this and thinks there's a problem, inevitably it discusses settlement options with the investigated company before suing. Therefore, it seems very likely that 1-800 Contacts already refused a settlement offer from the FTC. I can understand why 1-800 Contacts might do so. Presumably, 1-800 Contacts believes that its actions over the past dozen years are justified, and it's willing to throw more money to defend that proposition (and, as discussed below, to try to maintain its above-market prices).

Still, fighting the FTC is a daunting challenge for any company. The FTC always says it's a small agency, but it's still the freaking U.S. government and has more resources than any company it targets. Further, it has an exceptionally strong batting average in litigation, and judges view the FTC as the voice of the consumer -- making it a more sympathetic litigant than a competitor trying to defend its profitable investments in competitive keyword advertising. Furthermore, the FTC has picked a friendly litigation venue. The FTC steered this case into its in-house adjudication process, so the case will be heard before an FTC administrative law judge with appeals going to the FTC Commissioners before this case can be heard in federal court. By keeping this litigation within the FTC, it will take years and lots of money before 1-800 Contacts can tell its story to an adjudicator not employed by the FTC.

I respect companies that have the fortitude and wealth to stand up to the FTC, but I often question their wisdom and logic.

Is Competitive Keyword Advertising Legitimate? The FTC's complaint assumes, but doesn't prove, that competitive keyword advertising is a legally legitimate practice. For example, the FTC alleges (para. 18) that "1-800 Contacts claimed—inaccurately—that the mere fact that a rival's advertisement appeared on the results page in response to a query containing a 1-800 Contacts trademark constituted infringement." I'm sure 1-800 Contacts (and all trademark owners) would love to see the FTC's citations for the "inaccurately" comment. Later (para. 32), the FTC says—again, without any citations—that agreements not to engage in competitive keyword advertising "exceed the scope of any property right that 1-800 Contacts may have in its trademarks, and they are not reasonably necessary to achieve any procompetitive benefit."

Now, as you know, I emphatically agree with this proposition. I've argued for over a decade that competitive keyword advertising is pro-competitive and should be legal; and I've chronicled the systematic failure of trademark owners' anti-keyword advertising lawsuits over the past half-decade. However, I acknowledge that this issue is still being hotly contested in the courts. Indeed, just last week I blogged about a ruling sending a competitive keyword advertising lawsuit (with the trademark used in the ad copy) to a jury because the defendant couldn't convince the judge that it was entitled to summary judgment. So while I wish the state of competitive keyword advertising law was definitively resolved, the FTC's implied factual claim is aggressive.

For those of us a little tired of the decade-long competitive keyword advertising battles, the FTC's move offers some tantalizing prospects. Because the FTC stacked the litigation deck in its favor, we could get some clean and powerful judicial pronouncements about the legitimacy and pro-competitive nature of competitive keyword advertising. Combined with developments like the Texas ethics opinion greenlighting competitive keyword advertising by lawyers, this case could help push the pendulum so decisively in favor of competitive keyword advertising that it permanently ends the debates.

What About Vertical Restrictions on Competitive Keyword Advertising? This case deals with horizontal restrictions between competitors. While those are relatively rare, it's quite common (at least in certain industries) for trademark owners to restrict keyword ad bidding by vertical channel partners such as affiliates and distributors. What implications does this lawsuit have for those vertical restrictions?

Usually, distributors can use manufacturers' trademarks for the goods or services they resell without a trademark license. In contrast, affiliates usually need a trademark license, in which case the trademark owner should be able to put conditions on its trademark license to affiliates. However, trying to impose those same conditions on distributors could be a legal overreach because they didn't need trademark permission at all.

The FTC might be signaling that it's a problem to restrict keyword ads by channel partners who don't need trademark permission in the first place. However, manufacturers have substantial power to control intra-channel conflicts (see, e.g., the modern deference to resale price maintenance), and restrictions on keyword advertising help the trademark owner manage the trademark and prevent channel partners from driving up the owner's cost of doing so. So vertical restrictions on keyword advertising bidding may have better competitive justifications than horizontal restrictions. My guess is that the FTC didn't intend to implicate vertical restrictions; but it probably wouldn't categorically greenlight them either because some vertical restrictions could indeed have anti-competitive effects.

What Does This Mean For Trademark Owners? Trademark owners, PAY ATTENTION. Effectively, the FTC is saying that 1-800 Contacts committed antitrust violations by making overreaching trademark demands. I can't recall when the FTC last implied that trademark overclaiming could create antitrust problems (nothing comes to mind immediately). Among academics, we've frequently discussed how trademark overclaims can hurt competition, so many academics probably think it's about time the FTC moved in that direction. However, if this lawsuit signals that the FTC plans to pay more attention to trademark owner overreaching, that would be a seismic event for the trademark owner community.

Two related notes. First, as I've said before, I think 1-800 Contacts is an exceptionally weak trademark because it's more a phone number than a source identifier. Just like trademark law won't protect [noun].[tld] domain names (when the domain name relates to the noun), "800 [noun]" also should be generic. It creates a lot of friction when we weaponize such highly descriptive terms, and it makes sense for the FTC to pay particular attention to those weapons deployments.

Second, I've observed before that owners of weak descriptive marks tend to be the most litigious and make the most aggressive interpretations of trademark law. They often use litigation to try to overcome the intrinsic shortcomings of the mark; and they are often paranoid about the so-called "policing duty" that makes trademark owners think they will lose the mark if they don't shut down other users of the term. However, the trademark policing "obligation" is often overstated; and the TTAB has expressly said there's no policing obligation against competitive keyword advertising.

Filed Under: antitrust, competition, competitive keyword advertising, consumer protection, ftc, keyword advertising, trademark
Companies: 1-800 contacts

Washington State Sues Comcast For Routinely Ripping Off Its Customers

from the customer-service-is-our-top-priority dept

Washington State has sued Comcast for, well, being Comcast. A new lawsuit filed by the state this week (pdf) accuses the cable giant of 1.8 million violations of Washington state’s Consumer Protection Act (CPA), including misrepresenting the scope of the company's "Service Protection Plan," charging customers improper service call fees and improper credit screening practices. More specifically, the lawsuit states that Comcast misled more than 500,000 Washington State customers by charging them $5 per month for this protection plan, then intentionally hitting them with fees for services the monthly fee should have covered.

As it stands, the company repeatedly sold the plan as being "comprehensive," covering all service calls, including those related to inside wiring, customer-owned equipment connected to Comcast services and "on-site education about products." But when customers called up thinking they'd then get a break from Comcast on service charges, the company would routinely bill customers for all manner of services that should have been covered under the plan:

Comcast’s Customer Guarantee promises: “We won’t charge you for a service visit that results from a Comcast equipment or network problem.” Comcast discloses no limitations on this guarantee. Contrary to this promise, Comcast charged thousands of Washington customers for service calls that resulted from a Comcast equipment or network problem, including issues with Comcast HDMI and component cables, Comcast cable cards, and the installation of drop amplifiers, which fix Comcast signal problems.

Anticipating that Comcast would claim this sort of thing was accidental or the behavior of some rogue support technicians, the AG's office pointed out that billing customers for things that should have been covered under the protection plan was so routine, Comcast had actually created a specific technician code allowing them to sock consumers with charges they never should have been subject to:

"In addition, until approximately June 2015, Comcast provided its technicians with a service call fix code that expressly allowed them “to add service charges to a normally not charged fix code.” In other words, the company created a code for technicians to add charges to a service call that should be provided at no cost."

Of course if you've followed Comcast over the years, this is a relatively minor offense for a company that works tirelessly to take full advantage of the lack of competition, especially in its broadband markets. And while for a decade now Comcast annually informs the press it's doing everything in its power to shore up what's statistically the worst customer service of any company in America, apparently eliminating systemic, routine fraud from the company's repertoire was somehow overlooked until the AG's office became involved last year. Whoops a daisy!

Granted these are the same regulators that routinely approve Comcast's merger requests to grow larger and less competitive, then act shocked after the fact when this time, and time, and time again results in systemic fraud. Washington also is one of 19 states that let ISPs write and pass state protectionist laws hindering municipal broadband competitors. Meanwhile, Washington State AG Bob Ferguson is up for re-election; surely only coincidental as he targets what is probably the easiest, most broadly-hated target in politics: ye olde cable company.

Should Comcast lose the lawsuit, those costs will be immediately passed on to consumers that -- at least if they want a relatively fast broadband connection -- will in most cases have no alternatives to switch to.

Filed Under: broadband, cable tv, consumer protection, washington, washington cpa

As ISPs Push Harder On Usage Caps, House Pushes Bill Preventing The FCC From Doing Anything About It

from the stripping-the-fcc-of-its-power-to-protect-consumers dept

In recent weeks, we've noted how ISPs are now moving beyond broadband usage caps and overage fees, and have begun charging users a $30-$35 premium if they want to avoid usage caps entirely. While the industry often dresses this up as everything from "improved flexibility and choice" to something necessary for the sake of fairness, it is, quite simply, an aggressive rate hike on uncompetitive markets. Users are being socked with dramatic new limits and fees -- simply because most have no real competitors to flee to.

Entirely uncoincidentally, the House is now pushing for new legislation that would hamstring the FCC's ability to regulate broadband rates. The "No Rate Regulation of Broadband Internet Access Act" (pdf) is set to be debated this week in Congress, and would, according to a press release by the Energy and Commerce Committee, prevent the FCC from regulating rates charged for broadband Internet, "just as the administration promised when they reclassified access to the Internet as a utility under Title II of the Communications Act."

Except according to a Medium post by attorney Harold Feld, the bill tries to use a special definition of "rate regulation" to ban the FCC from, well, doing much of anything:

"H.R. 2666’s language would protect broadband providers from any “review” or “enforcement” of their prices, and prevent the FCC from even “declaring” — let alone addressing — any broadband prices or fees as even “unreasonable.” To make this even more clear, the bill prohibits the FCC from reviewing any prices, fees, or overages “regardless of any other provision of law.” That goes way beyond the FCC’s traditional rate setting authority. “Any other provision of law” includes the FCC’s mandate to promote competition and its consumer protection authority."

So basically, the House, at the behest of large ISPs, is looking to further neuter the FCC. Not only so it can't protect consumers from usage caps and price gouging, but to try and derail the FCC's plan to expand consumer broadband privacy protections, or say, open up the cable set top box to additional competition.

It should probably be reiterated that while the FCC says it does have the authority to regulate some rates under Title II and its net neutrality rules (preventing "paid prioritization," for example), the agency so far has shown no interest in really doing so. Whether it's a $300 million national broadband map that fails to show broadband prices (at industry behest), to the agency's continued blind eye to hidden fees, usage caps and zero rating, the FCC has made it abundantly clear that it finds a large amount of the broadband industry's current price gouging just "creative experimentation."

But while the FCC hasn't done much about broadband prices directly, it has tried to shore up competition in the market so prices drop organically, including support for municipal broadband. Between this, the agency's push for privacy rules, and net neutrality, the House has made it abundantly clear it plans to punish the FCC for standing up to giant ISPs like AT&T, Verizon and Comcast. As such, if it isn't a series of pointless, FCC "fact finding" hearings, it's yet another bill like this one that aims to tie the FCC's arms securely behind its back.

As it stands, there remain just two serious ways to roll back net neutrality and the FCC's decision to reclassify ISPs as common carriers under Title II: win the election and gut the FCC and its decision, or win the ongoing lawsuits against the FCC (a ruling on that front is expected soon). The House likely knows this, but is apparently keen to try and earn its telecom campaign contributions by putting on one hell of a taxpayer-funded show.

Filed Under: congress, consumer protection, fcc, fees, isps, rate regulations, regulation, scams

The FCC's Issuing More Fines Than Ever, But Taking Heat For Not Collecting Them

from the words-are-but-wind dept

While nobody expected much of former cable and wireless industry lobbyist turned FCC boss Tom Wheeler, he's actually been doing a relatively good job when it comes to standing up to entrenched broadband duopolists. From passing tougher net neutrality rules to taking aim at state level protectionist broadband law, he's often been on the side of the end user and actual competition. That has included an ocean of fines for fraud that, while wrist slaps for the bigger companies involved, have spearheaded a crack down on the kinds of behavior the FCC spent fifteen years pretending didn't exist.

AT&T has born the brunt of the FCC's fiery new disposition, be it a $100 million fine for lying about throttling, a $100 million fine for milking a subsidy fund reserved for the poor, a $105 million fine for allowing and aiding SMS cramming, or a $18 million settlement for defrauding the IP Relay program for the hearing impaired (noticing a trend at AT&T yet?).

But while the agency has been making a lot of media waves with some major fines over the last few years, it has also been taking criticism for not doing a particularly good job collecting the money owed. The collection process is notoriously slow, thanks in large part to expected company challenges (which have to occur 30 days after the fine is announced). But in some cases, companies that were found to be ripping off the government years ago not only haven't paid a dime, but are still eligible to collect subsidies:

"In announcing some of the proposed Lifeline fines in 2013, the agency trumpeted, “Today's actions constitute the most recent step in the Commission's significant efforts to root out waste, fraud, and abuse in the Lifeline program and preserve the overall integrity of the Universal Service Fund (USF).” But the FCC has yet to officially impose the penalty on those companies -- and several are still deemed eligible to receive FCC reimbursements for phone subsidies, according to data from the Universal Service Administrative Company, which runs Lifeline.

In other words, historically-flimsy wrist slaps are notably more flimsy when there's no actual slap involved. That said, the FCC has responded with a blog post in which it argues it collected 88.6% of the fines levied in 2015, up notably from the 55% collected in 2011, and the 39.2% collected in 2012. So not only are the number of fines being issued up, so is the rate of collection under Wheeler. The FCC also tries to argue that the bad press can sometimes be enough to get companies to change their behavior:

"...a spokesperson said the practice of issuing proposed fines -- technically called notices of apparent liability (NALs) -- is a major tool to protect consumers, even if companies don’t ultimately pay a full penalty. The FCC, which says it normally conducts extensive inquiries before proposing a fine, has seen instances of companies adjusting practices to comply with agency rules after an NAL is filed, said the spokesperson, who declined to be identified, saying the FCC has a policy about not speaking on the record about its enforcement bureau."

Note too that some of the Congressional criticism on this front is ironic posturing. Many of the complaints emerged at a recent series of House hearings designed to publicly scold the FCC for standing up to broadband ISPs on net neutrality, with the end goal of stripping the agency of both funding and authority. Odd, then, that these same folks are concerned the FCC somehow isn't being aggressive enough despite actually in some ways being more aggressive than ever. Still, critics are right to note that while the number of fines the FCC is issuing is higher than ever, the roar of a lion eventually becomes somewhat less imposing when followed by a toothless smile.

Filed Under: consumer protection, fcc, fines
Companies: at&t, verizon

Appeals Court: Yes, The FTC Can Go After Companies That Got Hacked Over Their Weak Security Practices

from the secure-your-sites-kids dept

Way back in 2004, we noted that the FTC went after Tower Records for getting hacked and leaking customer records. At the time, we wondered if this was appropriate. Companies get hacked all the time, even those with good security practices. So, at what point can it be determined if the company is being negligent, or if it's just that those looking to crack their systems are just that good. Well, the FTC had decided that it can draw the line, and for companies that do a particularly egregious job in not protecting user data, it's made it clear that it's going to go after them. A few years back, the FTC went after Wyndham Hotels for failing to secure user data, and Wyndham tried to argue that the FTC had no authority to do so. Last year, a district court sided with the FTC and now the Third Circuit appeals court has upheld that ruling, giving the FTC much more power to crack down on companies who fail to protect user data from leaking.

The ruling doesn't fully answer the question of where can the FTC draw that line, but it certainly suggests that if your security is laughably bad then, absolutely, the FTC can go after you. And, yes, Wyndham's security was laughably bad. From the court ruling:

The company allowed Wyndham-branded hotels to store payment card information in clear readable text.

Wyndham allowed the use of easily guessed passwords to access the property management systems. For example, to gain “remote access to at least one hotel’s system,” which was developed by Micros Systems, Inc., the user ID and password were both “micros.”...

Wyndham failed to use “readily available security measures”—such as firewalls—to “limit access between [the] hotels’ property management systems, . . . corporate network, and the Internet.” ...

Wyndham allowed hotel property management systems to connect to its network without taking appropriate cybersecurity precautions. It did not ensure that the hotels implemented “adequate information security policies and procedures.” ... Also, it knowingly allowed at least one hotel to connect to the Wyndham network with an out-of-date operating system that had not received a security update in over three years. It allowed hotel servers to connect to Wyndham’s network even though “default user IDs and passwords were enabled . . . , which were easily available to hackers through simple Internet searches.” ... And, because it failed to maintain an “adequate[] inventory [of] computers connected to [Wyndham’s] network [to] manage the devices,” it was unable to identify the source of at least one of the cybersecurity attacks.

Wyndham failed to “adequately restrict” the access of third-party vendors to its network and the servers of Wyndham-branded hotels. ... For example, it did not “restrict[] connections to specified IP addresses or grant[] temporary, limited access, as necessary.”

It failed to employ “reasonable measures to detect and prevent unauthorized access” to its computer network or to “conduct security investigations.”

It did not follow “proper incident response procedures.” ... The hackers used similar methods in each attack, and yet Wyndham failed to monitor its network for malware used in the previous intrusions.

So, yeah. This wasn't a situation where determined malicious hackers had to carefully dismantle a security apparatus. There was no security apparatus, basically. The ruling also mentions that the Wyndham website claimed to encrypt credit card data and use firewalls and other things -- none of which it actually did. Oops. And, of course, hackers broke in multiple times and Wyndham did basically nothing.

As noted, on three occasions in 2008 and 2009 hackers accessed Wyndham’s network and the property management systems of Wyndham-branded hotels. In April 2008, hackers first broke into the local network of a hotel in Phoenix, Arizona, which was connected to Wyndham’s network and the Internet. They then used the brute-force method—repeatedly guessing users’ login IDs and passwords—to access an administrator account on Wyndham’s network. This enabled them to obtain consumer data on computers throughout the network. In total, the hackers obtained unencrypted information for over 500,000 accounts, which they sent to a domain in Russia.

In March 2009, hackers attacked again, this time by accessing Wyndham’s network through an administrative account. The FTC claims that Wyndham was unaware of the attack for two months until consumers filed complaints about fraudulent charges. Wyndham then discovered “memory-scraping malware” used in the previous attack on more than thirty hotels’ computer systems.... The FTC asserts that, due to Wyndham’s “failure to monitor [the network] for the malware used in the previous attack, hackers had unauthorized access to [its] network for approximately two months.” ... In this second attack, the hackers obtained unencrypted payment card information for approximately 50,000 consumers from the property management systems of 39 hotels.

Hackers in late 2009 breached Wyndham’s cybersecurity a third time by accessing an administrator account on one of its networks. Because Wyndham “had still not adequately limited access between . . . the Wyndham-branded hotels’ property management systems, [Wyndham’s network], and the Internet,” the hackers had access to the property management servers of multiple hotels.... Wyndham only learned of the intrusion in January 2010 when a credit card company received complaints from cardholders. In this third attack, hackers obtained payment card information for approximately 69,000 customers from the property management systems of 28 hotels.

The FTC alleges that, in total, the hackers obtained payment card information from over 619,000 consumers, which (as noted) resulted in at least $10.6 million in fraud loss. It further states that consumers suffered financial injury through “unreimbursed fraudulent charges, increased costs, and lost access to funds or credit,” ..., and that they “expended time and money resolving fraudulent charges and mitigating subsequent harm.”

And yet, still, Wyndham insisted that the FTC had no mandate to go after them for this rather egregious behavior. The appeals court agrees with the lower court in saying "of course the FTC can go after such behavior." The main question: Is this an "unfair" practice by Wyndham? The company argued that it's not unfair because it's the victim here. The court doesn't buy it.

Wyndham asserts that a business “does not treat its customers in an ‘unfair’ manner when the business itself is victimized by criminals.”... It offers no reasoning or authority for this principle, and we can think of none ourselves.

Also: it's generally not a good thing when a court refers to your legal argument as "a reductio ad aburdum" (i.e., taking something to such an extreme as to be ridiculous).

Finally, Wyndham posits a reductio ad absurdum, arguing that if the FTC’s unfairness authority extends to Wyndham’s conduct, then the FTC also has the authority to “regulate the locks on hotel room doors, . . . to require every store in the land to post an armed guard at the door,” ... and to sue supermarkets that are “sloppy about sweeping up banana peels,” ... The argument is alarmist to say the least. And it invites the tart retort that, were Wyndham a supermarket, leaving so many banana peels all over the place that 619,000 customers fall hardly suggests it should be immune from liability under § 45(a).

Going for a due process move, Wyndham tries to argue that there was not "fair notice" of what kinds of security practices the FTC required. I'm actually marginally sympathetic to this argument. If this is ever amorphous, then that is really challenging for companies who just don't know if their security practices meet the vague non-public standard of "okay" for the FTC. But, if you're running a company -- especially one as large as Wyndham Hotels -- it's not unreasonable to suggest that your tech staff at least understand some basic fundamentals about security, like not using default passwords, encrypting credit card data, and using firewalls. This isn't advanced computer security here. This is pretty basic stuff. Furthermore, the court basically says Wyndham doesn't need specific rules from the FTC, but rather just should know that the law about "unfair" practices exists.

Wyndham is entitled to a relatively low level of statutory notice for several reasons. Subsection 45(a) does not implicate any constitutional rights here.... It is a civil rather than criminal statute.... And statutes regulating economic activity receive a “less strict” test because their “subject matter is often more narrow, and because businesses, which face economic demands to plan behavior carefully, can be expected to consult relevant legislation in advance of action.”

In this context, the relevant legal rule is not “so vague as to be ‘no rule or standard at all.’”... Subsection 45(n) asks whether “the act or practice causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition.” While far from precise, this standard informs parties that the relevant inquiry here is a cost-benefit analysis,... that considers a number of relevant factors, including the probability and expected size of reasonably unavoidable harms to consumers given a certain level of cybersecurity and the costs to consumers that would arise from investment in stronger cybersecurity. We acknowledge there will be borderline cases where it is unclear if a particular company’s conduct falls below the requisite legal threshold. But under a due process analysis a company is not entitled to such precision as would eliminate all close calls.

And, the court notes, Wyndham's behavior here is so egregious that no reasonable person could find it surprising that the FTC went after the company for its [lack of] security practices.

As the FTC points out in its brief, the complaint does not allege that Wyndham used weak firewalls, IP address restrictions, encryption software, and passwords. Rather, it alleges that Wyndham failed to use any firewall at critical network points, did not restrict specific IP addresses at all, did not use any encryption for certain customer files, and did not require some users to change their default or factory-setting passwords at all.

Which leads to the kicker in the following sentence:

Wyndham did not respond to this argument in its reply brief.

Ouch.

The court also notes that maybe Wyndham's response would be more reasonable if the company had only been hacked once. But three times is a bit much:

Wyndham’s as-applied challenge is even weaker given it was hacked not one or two, but three, times. At least after the second attack, it should have been painfully clear to Wyndham that a court could find its conduct failed the cost-benefit analysis.... [C]ertainly after the second time Wyndham was hacked, it was on notice of the possibility that a court could find that its practices fail the cost-benefit analysis.

And thus, while I'm still a little nervous about going after companies who get hacked, it seems in this case, where there appears to be overwhelming evidence of near total gross negligence on the part of Wyndham to secure user data, it does seem reasonable for the FTC to be able to proceed, and now both a district and appeals court agree.

Filed Under: computer security, consumer protection, encryption, ftc, security, unfair, weak security
Companies: wyndham

FCC Commissioner O'Rielly: Nobody Takes Me Seriously After Voting Down Every Consumer-Friendly FCC Policy This Year

from the obstruction-junction dept

FCC Commissioner Michael O'Rielly will never be confused with a consumer advocate or champion of the people. He's voted down nearly every consumer-friendly FCC initiative that has come down the pike, whether that's net neutrality, raising the base definition of broadband to 25 Mbps, or fighting back against state protectionist broadband laws written by ISPs to protect their uncompetitive geographic fiefdoms. O'Rielly most recently made waves by proudly declaring, as an employee of an agency tasked with ensuring timely deployment of broadband to all Americans, that he really didn't think broadband was all that necessary.

Hand in hand with anti-net-neutrality Commissioner Ajit Pai, a former Verizon regulatory lawyer, the two form sort of a knee-jerk, objectionist Commission superhero that opposes everything in its path under the pretense of a deeper, mysteriously undefinable ethos. The dynamic duo have even objected to holding AT&T accountable for ripping off taxpayer money earmarked for the poor.

With that as a backdrop, it was entertaining to see CNET push forth a bit of a puff piece helping O'Rielly portray himself as some sort of unfairly ostracized hero of the Commission, whose insights aren't being taken seriously:

"It takes time and effort to soldier on and make your arguments," he said..."I do the work you'd expect me to do. I read every item. I do my homework. And I make substantive suggestions. But I'm often shot down."

Of course it's actually O'Rielly that's doing the shooting, bravely voting no on nearly every single issue of the day. When AT&T was fined for throttling "unlimited" connections and lying about it, O'Rielly stood up for the little guy, bravely calling the FCC's behavior "Draconian" (Pai, in contrast, compared the FCC's behavior to Kafka). Still, O'Rielly lays the blame at the feet of Wheeler and company:

"O'Rielly and his Republican colleague, Ajit Pai, have opposed all the major Democrat-supported issues that have passed, in large part due to philosophical differences they have with their colleagues across the political aisles on these issues. But O'Rielly said what has truly frustrated him is what he sees as an unwillingness by the FCC leadership to find consensus on any issue.

Partisan patty cake at the Commission is certainly nothing new. Except as we've noted, most people on both sides of the aisle think Wheeler is actually doing a shockingly good job for a former industry lobbyist many expected little from. He's shaken off fifteen years of the status quo, and is actually doing something about the woeful state of broadband competition instead of paying politically-safe lip service to the idea. He also managed to implement real net neutrality protections, an idea that's supported by Democrats and Republicans alike.

It's repeatedly unclear to me how you can be a career obstructionist, then cry when policy and conversation moves on without you. Indeed, O'Rielly tells CNET he's just a hard working fellow who desperately wishes the there was "more receptivity to finding common ground." CNET responds by failing to ask O'Rielly a single difficult question regarding how he aligns this hallucinated persona with his actual anti-consumer and anti-Internet voting record.

Filed Under: broadband, consumer protection, fcc, michael o'rielly