FCC becomes data security cop

Two small phone companies will be fined a combined $10 million for violating their customers’ privacy.

The Federal Communications Commission (FCC) alleged on Friday that TerraCom and YourTel America stored 300,000 subscribers’ names, addresses, Social Security numbers, driver’s licenses or other sensitive data on unguarded Internet servers that could easily be accessed anywhere in the world.

{mosads}That opened the customers up to fraud and identity theft, the FCC said.

“This is unacceptable,” FCC Enforcement Bureau Chief Travis LeBlanc told reporters on Friday. “We will not tolerate conduct that puts American consumers at risk of financial fraud and identity theft.”

In their privacy policies, both companies claimed to have secure data systems to protect people’s privacy.

But from September 2012 through April 2013, data was stored in an unprotected format accessible online by anyone around the globe without a password or firewall.

The FCC claimed that the lack of protections amounted to a violation of two portions of the Communications Act, the foundational law that gives the agency its mandate.

Friday’s action is the FCC’s first data security case, but LeBlanc said it would not be its last.

“Today’s action serves as a warning to other carriers,” he said.

The lack of digital protections at TerraCom and YourTel America were first discovered by a reporter in 2013.

The two companies used people’s personal data to check that they were eligible for the Lifeline program, a federal program that provides discounted phone service to people with low incomes.

Though sometimes referred to as the “Obama phone” program, it was first enacted under the Reagan administration and was expanded to cover cellphone service in 2005, under then-President George W. Bush.