The Committee on Foreign Investment in the United States (CFIUS), led by the US Secretary of the Treasury, announced on Wednesday (August 14) an updated list of penalties on its website. The third-largest US telecom operator, T-Mobile, has been fined $60 million for failing to timely prevent and report unauthorized access to sensitive data. This is the largest fine ever imposed by the committee.
The penalty is related to a violation of the National Security Agreement (NSA) reached between T-Mobile, a subsidiary of Deutsche Telekom, and the US CFIUS when T-Mobile acquired the fourth-largest US telecom operator, Sprint, for $23 billion in 2020.
According to the publicly released penalty list by CFIUS, from August 2020 to June 2021, T-Mobile violated a substantial provision of the National Security Agreement by failing to take adequate measures to prevent unauthorized access to certain sensitive data and not immediately reporting some unauthorized access incidents.
CFIUS stated, “This delayed the committee’s investigation and efforts to mitigate any potential harm. The committee’s conclusion is that these violations have harmed the national security interests of the United States.”
Later on Wednesday, T-Mobile stated in a release that technical issues during the integration process post-merger with Sprint affected several requests for information sharing with law enforcement agencies. The company emphasized that this data never left the law enforcement agencies and was promptly reported and handled.
According to Bloomberg News, CFIUS is a government agency known for its secrecy, and its deliberations are often classified. This is the first time the committee has disclosed a fine, and mentioning T-Mobile’s name breaks with past practices.
Considering the significant amount of the fine, CFIUS unprecedentedly made it public. The committee stated on its recently updated website that it is taking stricter enforcement measures to curb future violations.
The website shows that in the past 18 months, the fines issued by the committee have been three times higher than in its nearly 50-year history, ranging from $100,000 to $60 million.
According to a press release from the US Treasury Department, the updated CFIUS enforcement website will share more details and guidelines with the public and investment community regarding how the committee handles compliance and enforcement issues, as well as a list of its penalty actions, to continue developing and strengthening this important national security tool and enhance transparency.
Paul Rosen, Deputy Secretary of the Treasury responsible for investment security, stated in the press release, “In recent years, the Committee on Foreign Investment has doubled down on resources and focused on enforcement and accountability… If the committee requests certain commitments from companies to protect national security, and they fail to deliver, there must be consequences.”
Rosen emphasized, “Today’s penalty update underscores CFIUS’s commitment to accountability and safeguarding national security.”
The Committee on Foreign Investment in the United States (CFIUS), a multi-agency committee led by the Treasury Secretary, has the authority to review certain transactions involving foreign investment in the US to determine their impact on national security.