Cybersecurity Policy Report, Treasury Reveals $60M Penalty for T-Mobile Over Foreign-Ownership Violation, (Aug 15, 2024)

By Tom Leithauser

The Treasury Department revealed yesterday that T-Mobile US, Inc., earlier this year paid a $60 million penalty after the Committee on Foreign Investment in the U.S. (CFIUS), an interagency committee chaired by Treasury, discovered that T-Mobile had violated a national security agreement (NSA) by allowing unauthorized access to sensitive data.

The NSA was an agreement between T-Mobile and CFIUS to win approval for T-Mobile’s 2019 merger with Sprint Corp.. NSAs are commonly required for corporate transactions that include some foreign ownership, and the T-Mobile-Sprint combination involved T-Mobil’s corporate owner, Germany’s Deutsche Telekom AG, and Japan’s SoftBank Corp., which was a Sprint investor.

CFIUS issued a “notice of penalty” against T-Mobile in 2023 after determining “that between August 2020 and June 2021, in violation of a material provision of the NSA, T-Mobile failed to take appropriate measures to prevent unauthorized access to certain sensitive data and failed to report some incidents of unauthorized access promptly to CFIUS, delaying the Committee’s efforts to investigate and mitigate any potential harm,” according to a Treasury Department news release.

“CFIUS concluded that these violations resulted in harm to the national security equities of the United States,” it added.

T-Mobile paid the penalty earlier this year and “has worked with CFIUS to enhance its compliance posture and obligations and has committed to working cooperatively with the U.S. Government to ensure compliance with its obligations going forward,” the department said.

“Several years ago, we experienced technical issues during our post-merger integration with Sprint that affected information shared from a small number of law enforcement information requests out of the hundreds of thousands that we process each year,” a T-Mobile spokesperson explained.

“This was not a breach, there was no intrusion and no bad actor was involved. The noted unauthorized access was that information was sent to the wrong law enforcement agency but it never left the law enforcement ecosystem,” the spokesperson said.

“We take matters like this seriously. We reported this in a timely manner, and the issue was quickly addressed. We are glad to have reached a resolution and look forward to continuing to work cooperatively with the law enforcement community to help keep the country and our customers safe,” the spokesperson added.

The Treasury Department said it released the information about the T-Mobile case and some other CFIUS enforcement actions to provide more transparency about how the committee handles its enforcement duties.

“In the last few years, CFIUS has redoubled its resources and focus on enforcement and accountability, and that is by design: if CFIUS requires companies to make certain commitments to protect national security and they fail to do so, there must be consequences,” Paul Rosen, Treasury’s assistant secretary–investment security, said in a statement. “Today’s penalty updates underscore CFIUS’s commitment to accountability and the protection of national security.”

News: FederalLegislation DataSecurity