FCC Proposes to Fine Wireless Carriers $200M for Selling Customer Location Data | Hacker News Reader

FCC Proposes to Fine Wireless Carriers $200M for Selling Customer Location Data

krebsonsecurity.com

291 pointsfeross68 comments

This should be set as a function of how much they made, and damages incurred. 10x amount they charged + $200/victim/incident (so, $200 for each record sent) seems reasonable to me.

The latter part of the fine should go to the victims, I think.

If this bankrupts them, the executives, then board, then shareholders should be the ones to take a bath. (Not pensions, etc). After that, the fine should be reduced until it leads to a net zero valuation of the company, with the difference being given to the victims by issuing stock at the resulting stock price.

I’d like the fines to be applicable to anyone selling location data (app developers, linking shady libraries, I’m looking at you), and enforceable via class action rights that can’t be waived, as well as small claims court.

The rules should also apply to data returned by any non-mandatory compliance with government requests.

For class actions, consumers should get at least $190 of the $200, regardless of any pre-trial settlements.

I think these are minimally adequate steps to end this behavior.

> 10x amount they charged + $200/victim/incident (so, $200 for each record sent) seems reasonable to me.

Why be so nice, when companies ask for $150,000 per copyright infringement? Leaking personal data is much more serious.

>The FCC proposed fining T-Mobile $91 million; AT&T faces more than $57 million in fines; Verizon is looking at more than $48 million in penalties; and the FCC said Sprint should pay more than $12 million

So that's actually $200 million split between four companies and what really amounts to not much more than cost od business for them.

Lol - T-Mobile has $40B in annual revenue, does anyone think a fine of $0.09 billion covering years of wrongdoing is going to change their behavior? I'm sure 0.2% of their annual revenue will really sting.

Something I read in another HN thread was that while $200M may not be much compared to T-Mobile's annual revenue, it's probably a lot compared to how much ISPs earn from selling user data.

This doesn't factor in the ongoing PR cost of headlines like "FCC weighing fining ISP X", "FCC fines ISP X", "ISP X appeals fine", "ISP X loses appeal", etc.

Still, I agree the fine could have been harsher.

What PR cost? We don’t have any options, we have to use one of these sleazy companies.

Fair point. Typically I'm on the side of the free market and less government regulation, but this system breaks down if consumers have no choice but to use a small set of companies, who all have an interest in doing the same thing, and creating a new competitor is difficult.

Also known as not a free market.

That's the No True Scotsman Fallacy. The only absolutely "free" market is a state of nature, without laws and where might is right. Once you impose laws, it's not completely free.

The US telecom market could be more "free" than it is, but there are lots of options, none of which are perfectly "free".

It's not a free market or anywhere near and implying such is dishonest. Coops would be everywhere if it wouldn't be for rediculous city, county, state and federal regulations. Not to mention the miles and miles of dark fiber all over the country held up in ownership litigation, not to mention the federal government created this problem in the first place by heavily subsidizing bell and continuing to do so.

The telco industry has always been a regulated monopolistic market and that is primarily caused and was created by regulation..

> It's not a free market or anywhere near

Right, agreed.

> implying such is dishonest.

/me raises eyebrow.

Making utilities into something that consensus opinion would label a "free market" is incredibly difficult. Without regulation, you get monopolies. With regulation, you get monopolies.

Implying that a "free market" can solve the utility problem is (I won't say "dishonest" because I don't believe you're arguing in bad faith) facile.

One nitpick: AFAIK the issues at the city/county level come from service contracts that guarantee exclusivity in return for things like providing service to sparsely populated (unprofitable) areas and discounted rates for the poor/disabled/etc. You can argue that those deals shouldn't have been made, but then the local government would have been allocating public resources (running wires under streets, conduits, etc) in a way that excluded their disadvantaged constituents.

Anywho I am a proponent of Local Loop Unbundling. Limited conduit/pole space and complex webs of property easements make wired telecoms natural monopolies. Have the government own the conduits and fiber cables, and rent them to service providers instead.

Often the term "free market" is used when one means "competitive market" or perhaps an "open market" or a "market without market failure".

Also, for there to be a free market, there needs to be some sort of market which probably requires a sense of property rights. Whether property rights are in the "natural" state of things is an argument for the philosophers I suppose.

No, laws are what allow a market to remain free. Otherwise, you have monopolistic behavior, cartels, price fixing, etc.

Also known as "business as usual", and "natural state of markets that aren't regulated strongly, correctly and responsively enough".

A free market isn't the equilibrium state. Even if a particular idea - like adding or removing some regulations - looks like it would create a free market in some sector, that's only a static picture of conditions just after applying the idea. When you look at that market evolving over time, you'll see it rapidly shedding its "free" status.

I'm not sure you fully grasp what your opponent means and why they mean it when they say "free markets." As an ideal in the market place of ideas, free markets as a concept aren't ever created by ADDING regulation. Free markets generally imply that a system left to itself will eventually regulate itself through market forces and will produce both more output and more freedom as a result. Unfortunately, most people learn that we have free markets in America. What we really have is nothing like a free market. It's some strange mixture of chrony capitalism, elitism, and government regulation. I know this isn't a healthcare post, but it's a perfect example of a misaligned system that sometimes tries to use the word "free market." If the market were actually free, the government wouldn't pick winners that abandon a motive based on patient and public health outcomes in favor of profit. Now that we aren't forced to buy a garbage product anymore, family doctors have been leaving HIPPA behind lately and doing a subscription model with patients and making HEALTH OUTCOMES the priority and not profit. That is a free market competitor... Not the government itself or it's regulations. Free market ideals give money to common people and let them choose. Otherwise, they are just "free" slaves and not participants in the market.

Without any regulation markets tend to be captured by large players. Once these players have enough money they become quasi governments.

Government regulation does not have to lead to regulatory capture. Though it does require vigilance.

It absolutely doesn't need to lead to negative outcome... if the government simply lays out rules for fairness and enforces them. The problem is when they get themselves so bureaucratically involved in something that there is no freedom left to do anything "free". Healthcare and ISPs are great example of this. One should have the goal of patient outcomes. The other should have the goal of high speed, highly available access. Both of those are things the government should entice through it's regulatory framework. However, the least of us always choose to become politicians... So that doesn't happen.

> One should have the goal of patient outcomes. The other should have the goal of high speed, highly available access. Both of those are things the government should entice through it's regulatory framework.

You're not describing a free market. In a free market the goal is always just to make the most amount of money possible. Once you've achieved that goal, you can just drop prices, absorb losses via debt, and freeze out competition. That's why free markets don't work and need heavy regulation.

Yes, when people lack morals, you are correct. In a world where your every word, thought, and idea isn't pre-chewed and then fed into your brain through some form of lighted rectangle, that is completely false. There's a very good reason that some people are DEEPLY inspired by the novel Atlas Shrugged. It took Ayn Rand an enormous number of pages to make her point. More than an internet comment ever will. Most people will read that and watch a lighted rectangle fill their head with what "new" ideas might be in this book. Almost nobody will read it. Even fewer will speak up. Markets can't be free if people are in mental slavery. Like Morpheus said... Most people will fight to protect the system that enslaves them.

This is hilarious. The hardest part of creating a competitor is the regulation.

Only when regulations have been captured by capitalists locking out competitors. Consider limited resources like RF spectrum, it cannot be given to everyone. So the richest companies divide the spoils and consolidate power when the government is weakest.

You should be bouncing that up against net income rather than revenue. T-Mobile was $3.5B for 2019 so a $91MM fine is 2.6% which feels like a material deterrent.

Net Income is endlessly manipulated to avoid income tax, if you want to be generous, maybe compare against operating income which is $5.7B. But remember, they've been doing this for years so the most appropriate calculation would be against their operating income for the number of years that they've been abusing people's privacy. In any case, it results in a laughably small fine.

Seems like a reasonable approach would be based on how much they made from the sale of the data rather than how deep their pockets are.

I don’t think it’s reasonable for the FCC to be levying excessively punitive fines that put businesses at risk just to make a point. The fine seems like it should be based on the violation.

And unfortunately each of the big careers was doing this sort of thing. If we don’t like it then we should look to support congress passing some form of data privacy rules for carriers.

Not only that but T-Mobile has already vowed to fight these "cost of doing business" fines. [1]

[1] https://www.wsj.com/articles/t-mobile-vows-to-fight-fcc-fine...

Not only that, the penalty only takes place IF they didn't follow the "adequate precautions to secure the data".

I wonder if these companies collectively made more than $200M selling location data. It's the only way to evaluate how penalizing this is.

I don't think the penalty should be based on the size of revenue earned, the fine should be a strong deterrent. So it should be significant compared to what they can afford.

Do you mean more profitable companies should be fined more than less profitable companies for the same scale of wrongful behavior? If one wrongdoer happens to have other lines of business that generate a lot of cash but aren’t implicated in the misbehavior, they should get a more severe punishment? I think the endgame from such a punishment regime is companies will reorganize their corporate structure to section everything off from such liabilities.

the goal is simply “fine them enough so that it hurts and works as a mea culpa, but doesn’t destroy them the first time”

The point is simply standard economic law analysis - the idea is to make (punishment * probability of being caught) > expected gain from the crime. The theory is that if you remove the incentive for the behavior you wish to discourage, people will cut out.

There are many criticisms of the approach, but those are mostly about crimes committed by individuals, not corporations. When you're talking about HugeCo abusing customers, I think seriously punitive fines can work. But you need to make them painful enough that at least the board, and preferably the shareholders, want to ask questions about how exactly they know this won't happen again.

> I think the endgame from such a punishment regime is companies will reorganize their corporate structure to section everything off from such liabilities.

Of course they will. Any time a corporate entity can construct legal structures to capture more, shed externalities or shift risk, it will. Why wouldn't it? "We have a legal obligation to maximize profit..."

But that's not the "endgame of such a regime", that's normal business.

The post I responded to said the fine “should be significant compared to what they can afford”. This isn’t the standard economic formula (which I agree with). It’s a different standard that would have companies that can afford more pay larger fines.

That's correct. If they can afford more, they should pay more. I think it's similar to speeding fines in Finland: proportional to your income. A wealthy person can ignore a $150 speeding ticket.

Deterrence is the goal.

That works for individuals and non-monetary infractions. You can't do a precise "punishment > expected profit" calculation on speeding tickets in dollars, because people don't speed for an explicit, rationally priced-in benefit. They speed for emotional reasons - overconfidence, hurry, stress, anger. Since the benefit is denominated in emotional terms, the punishment must be too - hence the idea to punish for equivalent hurt, which scales more-less linearly with income.

On the other hand, a corporation rarely if ever does anything for reasons other than "revenue > costs"; in fact, it usually employs people making sure that ideas violating that rule don't get executed. So calculating a punishment in a way that erases all profits from the infraction and then some is a very good strategy when dealing with big companies.

Two things though:

If you’re basing the punishment on profits from the infraction, you still have to take into account the percentage of those infractions that are punished. If the fine is 5x what the company would make from that behavior, but there’s only a 5% chance they get caught, they may very well choose to do it anyway.

Also, corporations are made of people. An emotional punishment may sway someone high up at the company who has the power to reform it.

Simply that a company should not be able to make money by "selling data without the proper safeguards in place" -- they sold the data illegally, so should not be able to make money by doing so. So I'd say they should be fined however much they made by doing so.

Companies will keep doing illegal things if they can make money doing so.

I don't disagree with your point. However, if they brought in a billion selling location data, and only get fined $200M, it was still profitable. If they only profited $20m, the fine is 10 times what they earned.

Without this context, it's hard to ascertain how meaningful of a deterrent the fine actually is.

That’s a good place to start but there’s more to be considered. The data could be even more valuable than the value they were able to capture from the transaction.

What if they gave it all away for free? We wouldn’t fine them $0. The revenues earned should be considered, but we have to keep in mind that price does not equal value, and if a transaction occurred then the buyer was probably willing to pay more than the list price for it, that auctions only result in the price being equal to the amount the second-highest bidder was willing to pay, and that your data once sold by the telco company could end up selling for even more in future markets than it is selling for in today’s markets.

Should we fine them how much they were able to gain from it without pricing in how much the victims lost from it? And how well can we evaluate how much the victims lost? The problem with the government getting all the money is that the focus is removed from the victims, and questions like these aren’t given complete consideration. Would we have a better valuation if the victims were to receive compensation, if only due to the conversations that would arise from such proceedings? And also since, well, they’re the victims?

They should make repeat offenses harsher. Kind of like with road infractions.

Fines should go up exponentially for repeat offenses. 10th infringement? Might as well shut down the company.

I tend to agree with something to this effect. It should also be relative to specific company's financial factors. Something like Finland's progressive fines where speeding tickets are actually based as a percentage of one's income.

Maybe based on revenue, profit, market cap, and/or something a lot more well thought out than what I throw together on my phone at a whim. Obviously when you specify certain factors like "income," they end up being gamed to minimize those factors and therefor minimize punishment so whatever factors you use need to be difficult to adjust around. Probably also need to account for recovery rates.

Earning 1% back for one person may be trivial compared to the another which makes them more likely or at least financially capable to repeat the offense.

There you have it: the price of privacy is less than 1usd per citizen.

I wish there was an app that allowed me to charge all these data companies for use of my data directly.

The app would pop up when I was signing up for any service and let me know which of my data the service be using and give me a price per month.

I would then gladly share it and collect my pennies per day or opt-out and get degraded service or no service at all.

> I would then gladly share it and collect my pennies per day or opt-out and get degraded service or no service at all.

The latter part sounds awful. Why would that be acceptable? Do you mean that your selling to them your data would be in place of paying a service charge?

This is how this might look like:

Gmail - 200$ per year. Gmail-freemium - 0$ per year.

Isn’t that basically what it’s like already?

You can have free gmail, consumer edition. With ads, no privacy, etc.

Or G Suite. Which includes gmail, docs, calendar, etc, for $6~ (I’m seeing $7.80 CAD) Per month.

Making it about half the $200 you quoted, but none the less, possible.

Seems to me that 200 dollars is what Google owes me for the privilege of selling my data to advertisers.

I don't work at Google, I might be wrong, and I strongly dislike the company. But from what I've gathered they're on my "lesser evil" side of the data-gathering game, in that they don't appear to actually sell it.

My understanding is that what they actually sell is their ability to serve and target advertisers' ads, using the massive amounts of data they gather by violating their users' privacy.

Unlike these ISPs, who just sell the data itself, or Facebook who just gave it away for free for years.

You're correct. They have never sold information as the parent commenter is claiming.

~$17 a month seems kinda steep, but I would definitely pay something to have a fresh, ad and tracking free, fully private suite of these products with a guarantee that I'm not being spied on.

G Suite costs $6 per month.

"G Suite customers own their data, not Google. The data that G Suite organizations and users put into our systems is theirs, and we do not scan it for advertisements nor sell it to third parties." "There is no advertising in the G Suite Core Services, and we have no plans to change this in the future. Google does not collect, scan or use data in G Suite Core Services for advertising purposes."

https://gsuite.google.com/learn-more/security/security-white...

I wanted proof, not promises. I want to know the they cannot scan my data if I pay, not that they promise not to.

That's why I'm so interested in projects like ProtonMail and Bitwarden. I want E2E encrypted versions of everything, and I'm willing to pay for it.

Yes, do no evil is gone.

Honestly, you'd make something like $0.04 total.

If you're in the market for buying a home with a 30-yr mortgage, then you'd be able to sell your information for $0.08

It's only valuable at scale for these large companies.

How much is the government going to charge itself for the mass surveillance and data collection?

Exact, this fine probably represents a fraction of the fee the carriers charge the NSA for a data feed of this information.

It's meaningless unless we know how much wireless carriers stand to make by selling customer location data.

If they make $20 billion and the fine is $200 million, then it's a small business expense and a tax write off.

Can someone explain how FCC fines work? I’ve always been confused by them. Are the companies breaking a law, or just some kind of regulation they agreed to? And if so, why does it take the FCC so long to do anything? It’s been well known for the years that mobile carriers have been selling location. It almost seems like the FCC lets it go on as long as they can in order to levy as big a fine as possible. Or am I just being cynical?

It'd be nice if these fines were distributed amongst the affected customers, but of course it won't.

Edit: grammar

It should be higher.

It should be shaking in their boots high.

Like a single mom getting a speeding ticket high.

AT&T generated $47.99B in 2018

They do not care too much if they are fined 200M.

How about we make it 2B? Now they are nervous, now they see where the line is drawn in the sand.

> now they see where the line is drawn in the sand.

line which should actually be carved in stone

I’m in favor of companies being fined for their screw ups, but why does only the government get the money? When do we, the victims, get our compensation?

Not enough? What are you gonna do about it, little people?

I think it's going to be the right thing to do. There should be protection of personal data

Can’t they fine the buyers?

That’s it?

JAIL!

Reply on news.ycombinator.com