The T-Mobile Data Breach and Your Basic Primer on CPNI – Part II: How Will the FCC Investigate T-Mo’s Data Breach?

In Part I, I provided all the legal and political background to understand why the Federal Communications Commission’s (FCC’s) investigation into T-Mobile’s data breach impacting about 53 million existing customers, former customers, and folks who applied for credit checks but never have been customers, may be complicated politically. But what are the mechanics of the investigation? How does this actually work? What are the rules, and what remedies or penalties can the FCC impose on T-Mobile?

 

I explore these questions below . . . . .

Continue reading

The T-Mobile Data Breach and Your Basic Primer on CPNI – Part I: The Major Background You Need to Know for This to Make Sense.

T-Mobile announced recently that it experienced a major cybersecurity breach, exposing personal information (including credit card numbers) for at least 53 million customers and former customers. Because T-Mobile is a Title II mobile phone provider, this automatically raises the question of whether T-Mobile violated the FCC’s Customer Proprietary Network Information (CPNI) rules. These rules govern, among other things, the obligation of telecommunications service providers to protect CPNI and how to respond to a data breach when one occurs. The FCC has confirmed it is conducting an investigation into the matter.

 

It’s been a long time since we’ve had to think about CPNI, largely because former FCC Chair Ajit Pai made it abundantly clear that he thought the FCC should not enforce privacy rules. Getting the FCC to crack down on even the most egregious violations – such as selling super accurate geolocation data to bounty hunters was like pulling teeth. But back in the Wheeler days, CPNI was a big deal, with Enforcement Bureau Chief Travis LeBlanc terrorizing incumbents by actually enforcing the law with real fines and stuff (and much to the outrage of Republican Commissioners Ajit Pai and Mike O’Reilly). Given that Jessica Rosenworcel is now running the Commission, and both she and Democratic Commissioner Geoffrey Starks are both strong on consumer protection generally and privacy protection in particular, it seems like a good time to fire up the long disused CPNI neurons with a review of how CPNI works and what might or might not happen in the T-Mo investigation.

 

Before diving in, I want to stress that getting hacked and suffering a data breach is not, in and of itself, proof of a rule violation or cause for any sort of fine or punishment. You can do everything right and still get hacked. But the CPNI rules impose obligations on carriers to take suitable precautions to protect CPNI, as well as obligations on what to do when a carrier discovers a breach. If the FCC finds that T-Mobile acted negligently in its data storage practices, or failed to follow appropriate procedures, it could face a substantial fine in addition to the FCC requiring it to come up with a plan to prevent this sort of hack going forward.

 

Assuming, of course, that the breach involved CPNI at all. One of the fights during the Wheeler FCC involved what I will call the “broad” view of CPNI v. the “narrow” view of CPNI. Needless to say, I am an advocate of the “broad” view, and think that’s a proper reading of the law. But I wouldn’t be providing an accurate primer if I didn’t also cover the “narrow” view advanced by the carriers and Pai and O’Reilly.

 

Because (as usual) actually understanding what is going on and its implications requires a lot of background, I’ve broken this up into 2 parts. Part I gives the basic history and background of CPNI, and why this provides the first test of how the Biden FCC will treat CPNI enforcement. Part II will look at application of the FCC’s rules to the T-Mobile breach and what issues are likely to emerge along the way.

 

More below . . .

Continue reading

Why DoJ’s Win Against H&R Block Is Bad News For AT&T/T-Mo.

The Department of Justice Antitrust Division (DoJ) just won its lawsuit to block H&R Block from acquiring its smaller, “maverick” competitor Tax Act. Even with the actual Order sealed for a month to let parties scrub out the trade secrets, a few important things stand out for why this is good news for DoJ in its lawsuit to block AT&T taking over T-Mo. In sports terms, this is like DoJ having a super strong exhibition season going into the regular season of play. While you still need to play the games to see who wins, anyone facing them ought to be worried.

My major takeaways from what we know so far below . . . .

Continue reading

Will Wall St. Put The Kibosh On The AT&T/T-Mo Takeover Before the DoJ Does?

The more I see AT&T frantically spend money like water and call in every political chip it has to try to pressure the Department of Justice to settle its case, the more I become convinced that it will ultimately be the Wall St. financial community that will finally persuade Randal  Stephenson to give up before AT&T gets to trial. Oh, I expect to see more wild gyrations. There’s perpetual whispers that AT&T will find a dance partner in the form of MetroPCS (the current favorite of the rumor mongers) or Leap or U.S. Cellular (one even occasionally hears Sprint, but that doesn’t even pass the laugh test) and they will publicly announce some big proposed settlement so that AT&T’s political friends and its cadre of honest politicians can howl some more for DoJ to settle. Who knows? We have five months until trial, and AT&T seems infinitely capable of making all sorts of political noise.

But the more I look at it, the more convinced I become that the upper management at AT&T and that of T-Mobile’s parent, Deutsche Telekom (DT), have not really thought through just what kind of a settlement they would now have to offer and how radically different it is from what AT&T expected to offer before DoJ brought suit. A settlement now is far, far more expensive than anything AT&T envisioned and quietly vetted with Wall St. analysts back in March. Back then, AT&T expected to divest from 30-50 midsized markets via a divestiture trust (allowing them to sell licenses at profit-maximizing prices over time), some wussy roaming and deployment conditions that could be easily evaded or ignored. Now, AT&T will need to divest enough to create a “T-Mo Lite,” something that can at least pretend to replace the loss of a national carrier. As I explain below, that becomes so expensive and complicated that even if AT&T can find the financing to make it happen, its stock is likely to tank on the mere announcement of such a deal.

Mind you, I am not saying a settlement is desirable or good policy. I continue to believe that AT&T’s take over of T-Mobile is so thoroughly awful as a mater of both antitrust and telecom policy that no conditions or divestitures can save it. But even discounting my opinion on the matter, there are certain practical realities that make a settlement at this point not merely bad policy, but so expensive and complicated to manage that it is effectively impossible.

If I’m right, the only question is how much shareholder money and political capital AT&T spends lobbying for a settlement that can’t be done for financial reasons before enough officers on the AT&T and DT Boards sit down AT&T CEO Randal Stephenson and DT CEO Rene Obermann and explain to them that the time has come to face reality, renegotiate the break up fee to let DT out early, and cut their loses before AT&T stock starts to tank big time.

I demonstrate why below. Warning, as this is a “show your work” thing, it’s kinda long . . .

Continue reading

Deutsche Telekom Keeps Messing Up “T-Mo Is Doomed Unless AT&T Buys It” Song By Explaining Who Else Could Buy T-Mo

 Two weeks ago, Deutsche Telekom (DT) Chief Technology Officer Olivier Baujard accidentally spoke truth about T-Mobile to an audience of German investment analysts. After running through the usual company talking points about the effort to sell T-Mobile to AT&T (e.g., it will happen, DoJ is just playing hardball with negotiations, etc.), Baujard said at a public presentation at a Paris broadband conference that: “any rational company had a Plan B and that Deutsche Telekom had other opportunities for its U.S. operations should the U.S. Department of Justice succeed in terminating the deal.”

This is vitally important because, after accidentally shooting the “this is the only way to bring 4G to rural America” argument in the foot by accidentally leaking documents proving AT&T could bring 4G to rural America whenever it wants, and T-Mobile killed the ‘this will create jobs’ argument by confirming that it was preparing pink slips for more than 20,000 employees after the acquisition gets approved, the “T-Mobile is a sickly gazelle” argument is about all AT&T and it supporters have left. Unfortunately for AT&T, this is not the first time Deutsche Telekom has screwed up the “sickly gazelle” storyline by revealing inconvenient truths about its other options. And while there is usually a rule in Washington that “we totally ignore what you say to investors when it contradicts your chosen story,” this deal is sufficiently high profile and has sufficient problems that eventually someone may notice if AT&T’s “Sickly Gazelle Chorus” keeps getting thrown off key by Deutsche Telekom’s “We Have Lots of Other Options Counterpoint.”

More below . . . .

Continue reading

What’s At Stake in United Stated v. AT&T, Inc.? The Future of Antitrust. (Part I)

The Department of Justice (DoJ) Antitrust Division challenge to the AT&T/T-Mo deal, United States v. AT&T, Inc., in addition to being a huge deal for us in the telecom world, is probably the single most important merger review case for the next ten years. In two ways, this has become a battle about the future of antitrust enforcement and the soul of the Antitrust Division.

Yes, that sounds melodramatic, but I make no apologies. As I explain below, this case has become a test case for the nature of antitrust and whether traditional metrics of concentration and market share, notably the Herfendahl-Hirschman Index (“HHI”), coupled with the concerns that such concentration predicts both the ability of the largest company to raise process and for all surviving companies to raise process (the “coordinated effects” test), will still have validity going forward.  If the court accepts the arguments from AT&T and its defenders that the traditional measures of concentration are irrelevant, then antitrust review of mergers will essentially end for the next 5-10 years while economists and antitrust enforcers struggle to develop a new set of metrics for predicting the likely impact of mergers.

More importantly, however, this case represents a clear decision of the Antitrust Division to move ahead with enforcement despite the possible political consequences. Yes, politics has always mattered, and anyone who rises to the position of Assistant Attorney General for Antitrust has a well-developed political sense. The back channels for unofficial influence remain strong, and only a brave head of the Antitrust Division, whether or Acting or confirmed Appointee, seeks to challenge the most powerful and well connected companies in Washington.

But we have not yet reached the point where the head of the Antitrust Division decides to enforce the Antitrust law and the White House tries to pull it back. This may seem a small thing, but it is what separates us as a country that can still aspire to say it follows the rule of law and a country like Russia where  law enforcement is simply the extension of the policy of the ruling oligarchy. And I assure you, oh cynical reader, that when we cross that threshold you will know the difference between a society where influence matters and a society that has abandoned any pretense of the rule of law.

I shall reserve this second point for a separate post. I address the legal significance of the case below . . .

Continue reading

DoJ Says “No” To Ma Cell; Here’s What Happens Next (and Why It’s All Over But The AT&T Screaming)

In what is undoubtedly the best Labor Day present the Department of Justice ever gave America, DOJ has filed to block the AT&T/T-Mobile Merger in court. One should not, however, expect AT&T to give up easily. AT&T can, and almost certainly will, decide to fight rather than simply abandon the deal. If nothing else, it has $6 billion in break up fees to pay if the merger does not go through. On the plus side, the odds definitely favor the DoJ, which is why so many companies simply abandon the merger once DoJ has filed.

Meanwhile, the FCC, an independent agency, still needs to make its decision on what it will do. Unlike DoJ, where the head of the Anti-Trust division makes the call (subject to the usual political checks, of course), the FCC must have a vote on an Order, which must get a majority of the Commission (3 votes). Since Congress repealed the FCC’s ability to immunize phone mergers from antitrust back in 1996, the FCC cannot approve if DoJ wins in court. OTOH, the FCC is under no time pressure, and can wait to see how the court case turns out. At the same time, however, the court may decide to stay consideration until the FCC decides, since the merger cannot proceed without FCC approval.

All of this has huge implications for AT&T and its current bluster that it will fight DoJ for the right to eat T-Mo. Normally, AT&T could hope to get this wrapped up in a few months, and continue to try to use its political muscle to force a settlement. But the interaction between DoJ’s challenge and the FCC lawsuit make it incredibly difficult for AT&T to get this done before Deutsche Telekom decides it wants it $6 billion cash ‘n spectrum break up fee. As I explain below, AT&T must simultaneously persuade the FCC not to act while convincing the court to move at super speed, despite the fact that the usual way things work is for courts to wait for agencies to finish review (because the agency may remove the need for the court to act).

I explain AT&T’s legal problems below . . .

Continue reading

The AT&T/T-Mobile Fine Print

Anyone who has a service contract with AT&T knows that there are two parts: the advertisement and the fine print.  The advertisement promises all kinds of wonderful things. The fine print explains how AT&T really has no legal obligation to provide them, and you have no recourse if AT&T doesn’t live up to its terms. The ad has a little asterix (*), to let me know to look for the fine print. For example, AT&T recently offered me a free 4G phone*. *DISCLAIMER: Provided I sign up for a minimum $15 data plan, 4G is available in limited areas, and other restrictions apply. They also promise I can download amazing videos*, DISCLAIMER: *provided I don’t exceed my capacity cap, in which case I will pay lots more money. Etc.

Unsurprisingly, the AT&T/T-Mobile deal comes with its own set of fine print. AT&T and its allies make all kind of promises about how the deal will encourage mobile broadband and create jobs ‘n stuff, while the actual FCC filings have all kinds of wonderfully crafted (from a legal perspective) fine print that explains all the limitations on these promises. Alas, AT&T doesn’t do nearly as good a job with the helpful* for fine print on it’s advertisements for approving A&T/T-MO as it does on its regular advertisements. I want to especially point this out to all the state governors that have supported the merger based on the advertising implying that the mighty AT&T lion is going to go all Aslan and spread broadband and jobs after it devours the sickly gazelle that is T-Mobile.   Based on the fine print, you have as much chance of seeing rural broadband deployment and job creation as the average AT&T iPhone user in San Francisco has of connecting a call and enjoying “unlimited downloads”* (*subject to bandwidth cap, phases of the Moon, and wicked packet-intercepting gremlins).

Advertising matched with FCC filing fine print below . . .

Continue reading

A Quick Addendum To My AWS-2/AWS-3 Prediction

Last week, I predicted the FCC would opt to auction the AWs-2/AWS-3 spectrum rather than adopt the M2Z proposal. Yesterday, the FCC issued it’s teaser for recommendations to improve broadband adoption. One of these was “[c]onsider use of spectrum for a free or very low cost wireless broadband service.”

That, of course, was M2Z’s chief selling point. They would provide a free tier for for everyone supported by adds and by the higher-speed, ad free pay tier. So do I want to revise my prediction on whether the FCC will adopt the M2Z or T-Mobile asymmetric auction proposal?

Not at this point. Sure, this tea leaf looks much more favorable to M2Z than it does to T-Mobile. But I note two things. First, the language says “consider” rather than simply “use.” The question of whether to require free service of some kind as a public interest obligation was teed up in the pending AWS-2/AWS-3 proceeding. If they were going to go with M2Z, they wouldn’t say “consider,” they’d say “use spectrum . . . .” Second, there are a number of other ways to use spectrum for free or low cost wireless. These range from expanding the use of unlicensed spectrum to facilitate creation of community wireless networks to mandating “wireless lifeline”-type programs that would require all carriers to offer cheap or free access on a needs basis. It also remains to be seen whether the FCC will actually do anything other than “consider” such an approach, or whether revenue concerns and incumbent resistance will ultimately carry the day.

So while I’m pleased to see the FCC looking at spectrum from a public interest/public welfare perspective, I’m not changing my bet on how the FCC resolves the AWS-2/AWS-3 band fight. The real questions are (a) timetable, and (b) spectrum caps, yes/no? (and no, I haven’t forgotten about Fred Campbell’s standing invite/challenge for me to justify spectrum caps generally, just haven’t gotten time yet). The FCC could conceivably issue an Order with service rules and schedule an auction date. Or it could put out a final set of rules for further notice. My personal bet is thy will move quickly — both to show they are taking action and because OMB would really like to book that revenue. But we’ll have to see.

Heck, I could be entirely wrong in my prediction and they could go with M2Z, or some variant thereof. Stranger things have been known to occur.

Stay tuned . . . .

Genachowski's Secret $15 bn Piggy Bank, or T-mobile Triumphs Over M2Z.

I’ve been rather pressed for time, hence have not had much chance to blog on the FCC’s recent spectrum policy announcements for D-Block and the broadcast migration offer. Combine these two speeches with Genachowski’s recent statement in an interview that the NBP will finance the $25 billion via existing programs and it is clear that the FCC will adopt the T-Mobile’s “asymmetric auction” proposal for the AWS-2 and AWS-3 band, leaving M2Z high and dry. The only question is whether or not there will be spectrum caps to keep AT&T and Verizon from snarfing the good stuff, but do not expect the NBP to touch something as “controversial” as spectrum caps even by veiled implication the way the DoJ did in its comments.

Mind, this is another example of the “spectrum auctions are the crack cocaine of public policy” problem. The thirst for revenue pushes all other considerations out the window. I’m not convinced the T-Mobile approach is wrong (especially if subject to spectrum caps), and I think the D-Block finesse was extremely clever. But when revenue sits in the driver’s seat, policy invariably takes a wrong turn somewhere along the road. But it is difficult to imagine how Genachowski could resist a $15 bn secret cash cow to fend off accusations that Democrats are once again writing checks against our children’s future blah blah blah.

I unpack all this below. . . .

Continue reading