Two phone companies put private data online

WASHINGTON - Two phone companies -- TerraCom and YourTel America -- unwittingly posted the Social Security numbers, driver's licenses and other sensitive data of up to 300,000 clients on the Internet, an investigation found, and federal regulators said Friday they plan to fine the companies.

As consumer data breaches go, the case -- and its $10 million fine -- is relatively small. But the incident is alarming because of how it unfolded: The companies participate in a government program called Lifeline, which subsidizes phone service for poor consumers. To crack down on fraudulent claims, federal regulators ordered carriers to collect identifiable information.

TerraCom and YourTel America, which are jointly owned, complied, but were so careless with the files that a reporter stumbled upon them during a simple Web search, according to the Federal Communications Commission.

In a written statement released Friday, Dale Schmick, chief operating officer of TerraCom and YourTel America, said the companies have since increased their data security efforts and completed "multiple security audits to prevent future breaches from taking place."

"When faced with this instance of unauthorized access, we fully complied with state laws regarding notification of affected consumers," Schmick wrote. "We look forward to working with the FCC to resolve this matter and welcome the opportunity to correct the record with regard to our security processes."

But according to FCC investigators, even after company officials learned that the information could be accessed online, they failed to notify all potentially affected consumers. This deprived consumers "of any opportunity to take steps to protect their personal information from misuse by Internet thieves," the FCC wrote in its announcement.

FCC officials said the companies were required to collect sensitive data from consumers to check their eligibility. But the FCC says the companies should have destroyed the data as soon they verified that an applicant qualified for financial assistance. Instead, the data was stored in a format accessible to the Internet from September 2012 through April 2013.

"Consumers trust that when phone companies ask for their Social Security number, driver's license and other personal information, these companies will not put that information on the Internet or otherwise expose it to the world," said Travis LeBlanc, chief of the FCC's Enforcement Bureau. "When carriers break that trust, the commission will take action to ensure that they are held accountable for unjust and unreasonable data security practices."

The FCC investigation was triggered by Isaac Wolf, a reporter with Scripps Howard News Service. According to a May 2013 story posted by the news organization, an online search into TerraCom resulted in a Lifeline application that had been filled out and was posted on a site operated by Call Centers India, under contract with TerraCom and YourTel. Eventually, Wolf and his editors discovered more than 170,000 records that included Social Security numbers, home addresses and financial accounts.

According to a letter posted by Scripps Howard, a lawyer for the phone companies accused the news organization of violating anti-hacking laws. The FCC confirmed Friday that its investigation was prompted by the Scripps Howard news report.

Proponents of the Lifeline program say the federal subsidies are critical to ensuring that households falling well-below the poverty line have access to at least one phone in case of emergency and to aid job prospects.

The program began in 1985 and expanded in 2005 to include wireless phones. Because of the explosion in wireless technology since President Barack Obama took office in 2008, conservatives have dubbed Lifeline "Obama phone" or "Uncle Sam's Unlimited Plan."

"It's a government-run, taxpayer-funded program that's running wild and costing more and more," said Rep. Tim Griffin, R-Ark., who proposed legislation to eliminate the program. On Friday, Griffin told The Associated Press in an email that "there is no excuse for violating people's privacy regardless of if it's the Lifeline program or some other program."

The $10 million fine was the FCC's first data security case and its largest privacy action. In September, the FCC reached a $7.4 million settlement with Verizon regarding alleged unlawful marketing to customers without their consent or notification of privacy rights.