Former Federal Communications Commission (“Commission” or “FCC”) General Counsel
Thomas Johnson recently published a White Paper identifying serious flaws in the Commission’s
current enforcement procedures.2 The most serious are the Enforcement Bureau’s current
practice of (a) reading the Commission’s rules to create novel duties not apparent in the text of
the rules, and (b) misreading the statutory provision governing civil penalties—called
“forfeitures” —and the Commission’s Forfeiture Guidelines, resulting in unpredictable and
excessively high forfeiture amounts that far exceed the caps Congress set out in the statute.
Those flaws already were problematic, both as a legal matter for the Commission and as a
practical matter for those entities trying to conduct business while subject to potential
Commission enforcement action. Now, recent Supreme Court decisions regarding administrative
agency authority make clear that the Commission’s current enforcement regime is in legal peril
absent significant, immediate reform.
The Supreme Court’s Loper Bright3 decision limiting the deference due decisions of
federal agencies highlights the need for the Commission to reform its enforcement procedures.
If not, the courts will do so. To avoid that path, the Commission should embrace the fair notice
rules that courts have adopted, which would require the Commission to propose forfeitures only
when a company has violated a clear Commission rule and limit forfeitures amounts to conform
to the statutory requirements. Following that approach would also ensure that the Commission
has a sound basis for any forfeiture orders that it ultimately has to defend before a jury—as it
may be required to do in some cases in light of the Supreme Court’s Jarkesy4 decision.
* * * * *
I was General Counsel of the FCC in 1999, when the Enforcement Bureau was created
and the initial Forfeiture Guidelines were finalized. Over the last decade, many lawyers have
shared stories about enforcement proceedings with me that are consistent with the criticisms in
the White Paper, and I am disappointed that the Commission’s enforcement efforts have gone
so far off-track. Part of the reason for the creation of the Enforcement Bureau was to help
ensure that the Commission’s enforcement proceedings were grounded in the law and more
predictable than was the case when each Bureau had its own enforcement section. But the
Enforcement Bureau was not supposed to pursue policy goals in interpreting the regulations that
had yet to be fully defined by the substantive bureaus or the Commission—it was supposed to proceed with enforcement actions only when there was a clear violation under precedent
established by a substantive Bureau or the Commission. And the Forfeiture Guidelines were
intended to limit the discretion involved in calculating forfeitures rather than provide a basis for
justifying proposed forfeitures of unreasonable and unpredictable amounts.
The Enforcement Bureau and the Forfeiture Guidelines were part of an effort to ensure
that regulated companies have clear warnings—that is, fair notice—of what the FCC’s
regulations require and what the penalty for violating regulations will be. That is what “fair
notice” requires. And the most important step in fixing the flaws enumerated in the White Paper
is for the Commission to embrace fair notice principles.
As the Supreme Court stated: “Elementary notions of fairness enshrined in this Court’s
constitutional jurisprudence dictate that a person receive fair notice not only of the conduct that
will subject him to punishment, but also of the severity of the penalty that a State may impose.”5
While allowing agencies to clarify their rules prospectively in adjudicative proceedings
such as enforcement actions, the fair notice inquiry applies a different and more difficult
standard to justify the imposition of penalties. Thus, even if a court agrees with the Commission
that a party violated the Commission’s rules, it might at the same time conclude that the rules
were not clear enough to justify a penalty.
That happened in Trinity Broadcasting,6 a D.C. Circuit case decided while I was General
Counsel. There, the Commission determined that a non-profit broadcaster did not qualify for a
minority preference merely because a majority of its Board were minorities; rather, it had to
show that the minority members exercised de facto control. However, the regulation at issue
did not specifically state that de facto control was required. Nevertheless, applying the
“exceedingly deferential standard of review” that applied to an agency’s interpretation of its
own regulations, the court concluded that the FCC’s interpretation of the regulation to require
de facto control “represents a reasonable interpretation” of the regulation.7 Thus, that would be
the rule prospectively.
But, while agreeing with the Commission on the meaning of the rule and thus clarifying
its reach, the court went on to hold that the regulation was not clear enough to justify the
imposition of a penalty—which, in that case, was denial of the broadcaster’s request for renewal
of its license. Rather than deferring to the Commission with respect to the appropriate penalty,
the court invoked its settled precedent that a penalty is warranted only when a regulated party
“‘would be able to identify, with ascertainable certainty, the standards with which the agency
expects parties to conform.’”8 That is, as the court reiterated, when the issue is whether a
penalty is warranted, the standard is “not whether interpreting the term ‘minority-controlled’ as
requiring de facto minority control in the non-profit context is ‘plainly wrong,’ but whether that interpretation is ‘ascertainably certain.’”9 In short, even when an agency is entitled to deference
with respect to the meaning of one of its regulations, that does not mean a penalty is warranted.
Penalties are justified only when the “ascertainable certainty” standard is satisfied.
When Trinity Broadcasting was handed down, the FCC viewed it as a loss. But on
reflection, I believe it is the approach that is most consistent with the “[e]lementary notions of
fairness” cited by the Supreme Court in BMW. The Commission wins both when it clarifies its
rules and when it is prevented from penalizing companies that lacked fair notice of what the
rules require. Clarifying that a regulation ought to apply in certain circumstances, such as
denying minority preferences in the absence of de facto control, is therefore a positive step even
if the Commission simultaneously concludes, as it should have in that case, that the
“ascertainable certainty” standard was not satisfied and therefore no penalty was warranted.
Unfortunately, the Enforcement Bureau has lost sight of those due process principles. As
the White Paper shows, rather than seeking reasonable forfeitures for violations of clear rules,
the Bureau now “evaluate[s] success in terms of penalties, fines, and investigations.”10 For
example, a January 2021 report by the Bureau bragged that it had “issued more than $1.5 billion
in proposed or actual penalties, or collections via settlements,” “an increase of more than $500
million from any prior FCC administration.”11 This boasting seems particularly unwarranted
because more than 95% of those penalties were determined to be uncollectible, in part because
the Department of Justice often declines to institute collection actions.12 At the same time, even
uncollected penalties can inflict reputational and other harms on target companies, which is one
reason why a substantial amount of penalties are paid by companies that are repeat players at
the Commission and prudently choose to accept a settlement offer rather than litigate.
In fairness to the Bureau, the Commission has encouraged the Bureau’s mistaken
approach. The Commission’s 2014 decision in TerraCom13 was a key step toward focusing
enforcement efforts on proposing massive forfeitures. That case involved companies that
provided telecommunications service under the Commission’s “Lifeline” program to low-income
Americans. The providers employed a company in India to store data the companies must
collect to show that participants are eligible to receive subsidized service under the program.
After a reporter demonstrated that he could hack the Indian company’s server and obtain
personal information about participants, the Commission issued a Notice of Apparent Liability
proposing a $10 million forfeiture from the Lifeline providers—a then unprecedented amount. It
did so even though a $10 million forfeiture seems unwarranted on its face under the relevant
statutory provision, Section 503 of the Communications Act, which states that “the amount of
any forfeiture penalty determined under this section shall not exceed $100,000 for each violation or each day of a continuing violation, except that the amount assessed for any continuing violation shall not exceed a total of $1,000,000 for any single act or failure to act.”14 Even taking into account the applicable inflation adjustment, under which the $1 million cap is now about $2.5 million, $10 million is far more than what Congress authorized.
As Commissioner Pai pointed out in his dissent in TerraCom, although data breaches are
serious matters, the companies had violated no FCC regulation. In his view, that showed the
need for a rulemaking to establish rules governing data storage by Lifeline providers—which
would help ensure that data would be protected in the future. But it did not warrant the
issuance of a proposed forfeiture for the violation of “novel legal interpretations and neveradopted
rules.”15 However, rather than appeal, the Lifeline providers entered into a consent
decree, so there was never any opportunity for judicial review of the Commission’s novel
interpretation.
Part of the reason for settling may have been the Commission’s claim that it had
authority to impose a $9 billion forfeiture.16 The Commission claimed it could avoid the
statutory cap and impose such a massive forfeiture by creatively interpreting the phrase “single
act or failure to act” in Section 503. Rather than reach the common-sense conclusion that there
was a single failure to ensure that the Indian company’s server was secure, the Commission
concluded that there was a separate violation for each personal data record stored on the
server. Id. Therefore, the Commission stated, it could adopt a base forfeiture amount of
$29,000 and multiply it by the 305,065 personal data records on the server, resulting in a
forfeiture of $9 billion.17
The Commission’s claim that it could impose a $9 billion forfeiture shows that its
interpretation of the statutory cap is unreasonable. While there is room to dispute just how the
statutory cap should be construed, a statute with a $1 million cap, subject to an inflation
adjustment, cannot reasonably be interpreted to permit such a massive forfeiture. But the
Commission and the Enforcement Bureau have used similar approaches in other matters to
impose excessive forfeiture amounts or pressure regulated entities into settling for significant
figures. Now that Chevron has been overruled, courts will review interpretations such as that
without deference. Therefore, even though it has always been hard to argue that construing the
statute to allow anything like a $9 billion forfeiture was plausible, after Loper Bright even a
plausible reading involving a smaller amount that exceeds the statutory cap no longer will be
sufficient. Courts will determine what the best reading of the statute is, and the Commission’s
creative interpretations of the statute to generate higher penalty amounts will flunk that test.
In addition, the Commission’s claim that it could adopt a $9 billion forfeiture shows that it
has failed to provide fair notice of “the severity of the penalty” it may impose. If the penalty
might be $9 billion, as threatened, or $10 million, as imposed, or some lesser amount that was under the cap, there was certainly no way for a regulated company to know what the penalty
might be in advance. But that is precisely what the Supreme Court held in BMW that fair notice
requires—i.e., regulated companies are entitled to know “the severity of the penalty that a State
may impose.”
It is always difficult to state in advance exactly how a penalty scheme should work. And
here the relevant statute calls for consideration of various factors—“the nature, circumstances,
extent, and gravity of the violation and, with respect to the violator, the degree of culpability,
any history of prior offenses, ability to pay, and such other matters as justice may require,”18—
that may be difficult to quantify. It would be unreasonable to expect the Forfeiture Guidelines to
specify precisely the minimum and maximum penalty that is warranted. But the Commission
should be striving to make the Forfeiture Guidelines more predictable. In any event, the
Commission’s own claim that it has discretion to impose a penalty anywhere between $10
million and $9 billion shows that its interpretation of the statute fails any test that requires fair
notice of the severity of the penalty a regulated company might face.
TerraCom is no outlier. To the contrary, the Commission’s practice of using creative
arithmetic to calculate forfeitures has recently gone into overdrive. In January of 2024, the
Commission issued a Notice of Apparent Liability proposing a forfeiture of more than $14 million
from Tone Communications,19 a company that serves individuals who qualify for subsidized
broadband service under programs administered by the Commission. The Commission
authorized the use of a “National Verifier” to ensure that individuals are qualified for subsidies,
and Tone used the National Verifier to ensure that each of its customers qualified. However, an
employee of one of Tone’s contractors apparently fraudulently sought benefits using
applications that contained duplicate data, and the National Verifier initially failed to spot the
problem and duplicate benefits were paid for 152 people for a few weeks before they were
stopped. The statute establishes that the use of National Verifier is a “safe harbor,” so Tone had
no notice that it might be liable for duplicate payments that the National Verifier failed to catch.
With respect to the forfeiture amount, the Commission acknowledged that it had not
established base forfeiture amounts for violations of the relevant regulations, a step the
Commission should have taken in order to provide fair notice of the severity of any penalty.20
The Commission instead borrowed an arguably analogous base forfeiture amount. Then it went
very far off course. Most of the $14 million penalty—almost $10 million—came from an
“upward adjustment” that supposedly reflected the loss to the program resulting from the
overpayments.21 But the evidence showed that the overpayment totaled only about $26,000.22
Rather than using that number, the Commission inexplicably chose the total amount of payments to Tone during a three-month period, which mostly consisted of lawful payments, and
then trebled that amount, to reach the almost $10 million upward adjustment. The Commission
might as well have picked that number out of a hat, which of course does not satisfy the fair
notice requirement.
Then, in April 2024, the Commission fined the three largest wireless carriers a total of
almost $200 million with respect to their past oversight of providers of certain location-based
services which, for example, could use information from wireless providers to help persons
obtain roadside assistance or facilitate medical alert services.23 Once again, there are significant
questions as to whether the wireless carriers had fair notice that they might be penalized at all.
The most significant unlawful act involved the misuse of location data by a Missouri Sheriff who
pleaded guilty to misusing the information.24 The wireless carriers were not charged with
misusing the location information themselves, but with failing to adequately oversee the use of
location information by others with whom they contracted. And, prior to that point, the
Commission had not made clear that the type of location information at issue could be
considered subject to the Commission’s rules protecting customer proprietary network
information (“CPNI”).
Commissioner Carr, dissenting, accordingly explained that the wireless companies lacked
fair notice that their actions violated any Commission rule and, as required by fair notice
jurisprudence, concluded that “it would be inappropriate and unlawful to impose the retroactive
liability” the Commission nevertheless imposed.25
With respect to its forfeiture calculations, the Commission again evaded the statutory
maximum by finding multiple acts where it should have found a single act, as Commissioner
Simington stated in his dissent. For example, with respect to T-Mobile, the Commission found
81 separate acts because T-Mobile had “permitted 81 separate entities to access its customers’
location information in the apparent absence of reasonable safeguards.”26 The Commission did
so even while acknowledging that none of the 81 location-based service providers that had
contracted with T-Mobile had been accused of misappropriating data—it was a handful of their
customers, such as the Missouri sheriff, who misused the data. Again, the number 81—and the
resulting penalty amount—might as well have been picked out of a hat.
As in TerraCom, the Commission defended its calculations by contending that it was
“eminently conservative” to multiply its base forfeiture amount by 81 because the Commission
could have used “the total number of T-Mobile subscribers” instead.27 T-Mobile has
approximately 100 million subscribers. If 100,000,000 were used in place of 81 (which resulted in a $91 million fine for T-Mobile) in the calculation of the penalty, the result would be in the
trillions. Again, that shows that the Commission is plainly misreading the statute—it is not
plausible that Congress intended to authorize trillion-dollar forfeitures.
It also again shows that the Commission has not provided fair notice of the severity of the
penalty it might impose, as T-Mobile argued. The Commission’s response on that point was to
say that “where a statute specifies maximum penalties, the statute itself provides fair notice of
all penalties within that limit.”28 But the statute specifies a $1 million dollar maximum, with an
inflation adjustment. As Commissioner Simington stated, “It is simply not plausible that
Congress intended that the Commission may arrive at forfeitures of any size simply by
disaggregating an ‘act’ into its individual constituent parts, counting the members of whatever
class of objects may be related to the alleged violation to arrive at whatever forfeiture amount
suits a preordained outcome.”29 Commissioner Simington is correct, and now that Chevron has
been overruled, there is very little chance that the Commission can successfully defend such
interpretations of the statute.
* * * * *
In short, the Commission should recognize that its enforcement procedures have gone
off-track and that the courts are likely to reform them if the Commission does not do so itself.
The Commission should welcome the opportunity to correct its course.
Of course, regulated companies should be held accountable when they violate
regulations that meet the “ascertainable certainty” standard and, therefore, provide fair notice
of what they require. But regulations often lack clarity. When they do, and that lack of clarity
becomes apparent during an enforcement action, the Commission may use that proceeding as a
means of providing clarity, although it would often be preferable to conduct a rulemaking
proceeding to clarify the rules. In any event, as in Trinity Broadcasting, penalties may not be
imposed on a party that lacked fair notice of what a rule required before it was clarified.
In addition, fundamental due process principles require fair notice of the severity of the
penalty that may be imposed for violating a regulation. The Commission has gone very far astray
with its claims that it may impose excessively high penalties, and it should correct itself sooner
rather than later to avoid protracted legal challenges and judicially crafted remedies.
For more information, please contact Christoper J. Wright.
This article is not intended to convey legal advice. It is circulated publicly as a convenience and
does not reflect or create an attorney-client relationship.
1 Christopher J. Wright is a partner at HWG LLP. He was General Counsel of the FCC from 1997 to 2001. The paper elaborates on points Mr. Wright made at a panel discussion on May 2, 2024. CTIA—The Wireless Association funded this paper.
2 Thomas M. Johnson, Jr., White Paper on FCC Enforcement Bureau Reform, WILEY (Jan. 29, 2024),
https://www.wiley.law/article-White-Paper-on-FCC-Enforcement-Bureau-Reform (“White Paper”).
3 Loper Bright Enterprises v. Raimondo, No. 22-451 (U.S. June 28, 2024).
4 SEC v. Jarkesy, No. 22-859 (U.S. June 27, 2024).
5 BMW of North America, Inc. v. Gore, 517 U.S. 559, 574 (1996).
6 Trinity Broad. of Fla., Inc. v. FCC, 211 F.3d 618 (D.C. Cir. 2000).
7 Id. at 625.
8 Id. at 628.
9 Id.
10 White Paper at 6.
11 Id. (quoting Enforcement Bureau Accomplishments, Rosemary Harold, Bureau Chief, January 13, 2021 FCCOpen Meeting, at 1, https://docs.fcc.gov/public/attachments/DOC-369318A1.pdf).
12 Id. at 7.
13 In re TerraCom, Inc. and YourTel America, Inc.; Apparent Liability for Forfeiture, Notice of Apparent Liability for Forfeiture, 29 FCC Rcd 13,325 (2014) (“TerraCom”).
14 47 U.S.C. § 503(b)(2)(B).
15 TerraCom, supra, Dissenting Statement of Commissioner Ajit Pai.
16 Id. ¶ 52.
17Id.
18 47 U.S.C. § 503(b)(2)(E).
19 In re Tone Communications Services LLC, Notice of Apparent Liability for Forfeiture and Order Initiating Removal Proceeding, FCC No. 24-14, File No. EB-FD-22-00034228 (rel. Jan. 26, 2024).
20Id. ¶ 81.
21Id. ¶ 85.
22 Tone Communication Services LLC’s Written Statement Seeking Reduction or Cancellation of Proposed Forfeiture and Opposing Removal at 28, WC Docket No. 21-450 (filed May 6, 2024).
23 FCC Press Release, FCC Fines AT&T, Sprint, T-Mobile, and Verizon Nearly $200 Million for Illegally Sharing Access to Customers’ Location Data (Apr. 29, 2024), https://docs.fcc.gov/public/attachments/DOC-402213A1.pdf.
24 In re T-Mobile USA, Inc., Forfeiture Order, FCC No. 24-43, File No. EB-TCD-18-00027702, ¶ 15 (rel. Apr. 29, 2024).
25 Id., Dissenting Statement of Commissioner Brendan Carr.
26Id. ¶ 77.
27 Id. ¶ 80.
28 Id. ¶ 82.
29 Id., Dissenting Statement of Commissioner Nathan Simington.