Filing Deadline for 2013 Biennial Form 323 Extended Already!

Yikes, time is just screaming past us. Has it really been two years since the last biennial Ownership Report (FCC Form 323) was filed? Apparently so – and we know this because the FCC, apparently looking to get a jump on things, has already extended the deadline for the next biennial Form 323. In an order issued on its own motion (i.e., nobody even had to ask), the Media Bureau has announced that the 2013 biennial Ownership Reports will be due no later than December 2, 2013. (That’s a month later than the original deadline.)

The Commission provided a similar one-month extension the last time around, back in 2011.

These biennial reports must be filed by all commercial full-power AM, FM, TV, and LPTV stations (including Class A stations), as well as any entities that happen to have attributable interests in any such stations. While the deadline for filing has moved, the “as of” date – that is, the date as of which the information in the report must be accurate – has not moved. So this year’s Ownership Reports must reflect the reporting entity’s information as of October 1, 2013.

The Commission still has taken no action in the rulemaking proceeding it kicked off last New Year’s Eve. You may recall that, in that Sixth Notice of Proposed Rulemaking, the Commission proposed ditching the “special use FRN” (SUFRN) that has been a feature of the biennial Form 323 since late 2009. (The SUFRN has an interesting history, which you can read about here (and in the earlier links you’ll find there). It’s a device that permits some reporting individuals to avoid having to cough up their Social Security Numbers in order to get an official FCC Registration Number (FRN) to include in the Ownership Report.) The Bureau’s order doesn’t mention SUFRNs, which is par for the course. But since the Commission has not adopted that proposal, it seems at this point that it’s a reasonable bet that the SUFRN will still be available for 2013 Form 323 filers. You can never be too sure, though, so it would probably be prudent to check back here periodically between now and then.

GAO Report: In Wake of Successful Hack of FCC Computer Systems, $10 Million Fix Ineffective

Gee, do we really want to entrust our social security numbers to the FCC?

Did you know that, in September, 2011, the FCC was the victim of “a security breach on its agency network”? 

Neither did we. 

The precise nature and extent of the breach hasn’t been made public (as far as we can tell), but it must have been impressive. Did you also know that, in reaction to that breach, within a couple of months the FCC had wangled out of the Office of Management and Budget a cool $10 million to undertake an immediate “Enhanced Secured Network” (ESN) Project to improve its computer security against such cyber attacks? 

Neither did we.

And did you also know that the General Accountability Office (GAO), called in to assess the manner in which the FCC implemented its ESN Project, concluded that the FCC messed up? In particular, according to the GAO, the Commission “did not effectively implement or securely configure key security tools and devices to protect these users and its information against cyber attacks.” And did you know that, as a result, again according to the GAO, the Commission continues to face “an unnecessary risk that individuals could gain unauthorized access to its sensitive systems and information”? 

Neither did we.

This is all spelled out – circumspectly, to be sure, presumably so as not to reveal too much about the FCC’s vulnerabilities – in a GAO report sent to Congress on January 25, 2013. The report was not publicly announced until last week.

The fact that the FCC’s computer systems have been compromised is bad enough. The fact that the FCC, apparently acting in haste, cut a few too many corners in its effort to lock up the barn door after the horse had taken a hike is even more troublesome.

But what is especially galling – to this blogger, at least – is the fact that, while all that has been going on, the Commission has proposed to force a large universe of individuals to trust the FCC with their social security numbers. And in so doing, the Commission hasn’t bothered to mention that the computer systems on which those numbers would presumably be maintained have already been shown to be vulnerable to hackers.

As we reported last month, the Commission is considering the elimination of the Special Use FRN in connection with broadcast Ownership Reports (FCC Forms 323 and 323-E). If adopted, that elimination would mean that all attributable interest holders of all full-service broadcast stations (as well as LPTV and Class A TV stations) would have to cough up their social security numbers to the Commission in order to obtain an FCC Registration Number (FRN), which would have to be included in all Ownership Reports. Comments on that proposal are currently due to be filed on February 14.

The FCC’s seeming reticence relative to the fact that it suffered an apparently successful cyber attack 18 months ago, and that its efforts to fix the problem in the meantime have apparently been less than successful, is understandable, if regrettable (and also curiously contrary to this Commission’s professions of “transparency”).

But it seems extraordinarily inappropriate for the Commission, knowing of those vulnerabilities, to then propose that a huge number of folks must provide to the FCC the crown jewels of their identity, their social security numbers. In so doing, shouldn’t the Commission, at a bare minimum, have alerted us all to the fact that not only are their computers possibly vulnerable (we all know that that’s an unfortunate fact of modern-day life), but that their computers had already been successfully attacked? Oh yeah, and mightn’t it have been a good idea to spread the word that GAO had been called in to see whether the problem had been fixed? And once GAO concluded that, um, the problem hadn’t been fixed, don’t you think the FCC might have at least had some second thoughts about persisting in its proposed insistence on the submission of social security number-based FRNs?

Before you answer those questions, consider this. In 2009, when the FCC first proposed to require the submission of SSN-based FRNs for all attributable interest holders, a number of parties objected, pointing out (among other things) that such submission would increase the risk of identity theft. The Commission’s response? We quote it verbatim:

While identity theft is a serious matter, none of the comments identify a single instance of a security breach with respect to the Commission’s CORES system. Indeed, their claims are purely speculative. The FCC has a robust security architecture in place for CORES that exceeds Federal guidelines and recommendations and has deployed strict operational controls in compliance with NIST guidance. The servers are located in secured locations with strict access control. Logically, the databases are located behind several firewalls that protect the data from the Internet and the general FCC user population. All servers and communications are monitored both by automated tools and systems as well as operational procedures. The CORES application uses separate roles for various user classes, and administrative access is only permitted from limited set of known internal workstations. All transmission of non-public data is encrypted.

(You can find the entire FCC response on the OMB website. It’s the “Supplementary Document”, uploaded on 10/16/09 and titled “Response Letter to OMB on Comments Received”.)

So, according to the FCC, the notion that its oh-so-secure computer systems might be compromised was, at most, far-fetched speculation. 

Oops.

We now know that that speculation was not at all far-fetched. That being the case, the Commission may want to re-think its proposed abandonment of the Special Use FRN. And anyone who, in response to the proposal to deep-six the SUFRN, expresses concern about data security should be sure to cite to the GAO report. That way, the Commission can’t claim that such concerns are merely speculative.

Form 323 - Kissing the SUFRN Good-bye?

FCC proposal would abandon “special use FRNs” in Ownership Reports, require social security number-based FRNs instead . . . for noncommercial licensees, too!

If you’ve got an “attributable interest” in a broadcast licensee, you might want to make sure that you’ve got your social security number (SSN) handy. The FCC is trying – again – to insist that all attributable interest holders provide SSN-based FCC registration numbers (FRNs) when the time comes to file biennial Ownership Reports on FCC Forms 323 (for commercial licensees) and 323-E (for noncommercial licensees). 

In a Sixth Further Notice of Proposed Rulemaking (6th FNPRM) the Commission has proposed deep-sixing the “special use FRN” (SUFRN, as in “SUFRN succotash”) alternative that has been available since the July, 2010 filing of the biennial Form 323. The Commission has also proposed expanding the SSN-based FRN requirement to Form 323-E for noncoms, which would meant that folks on the controlling boards of NCE stations would have to get SSN-based FRNs. And the Commission has also renewed a proposal first bandied about in the Fifth Further Notice of Proposed Rulemaking (5th FNPRM) back in 2009. (In the nearly four years since the 5th FNPRM, that proposal – which would expand the FRN reporting requirement even more – apparently never made it to the Federal Register . . . until now!)

So long, SUFRN?

The history of the FCC’s efforts to require the reporting of SSN-based FRNs by all attributable interest holders in commercial licensees makes for fascinating reading. Unfortunately, the summary of those efforts as set out in the 6th FNPRM is not entirely accurate; it misses a lot of important details concerning the provenance of SUFRNs, a device made available for those not interested in providing their SSNs to the FCC. If you need to brush up on things, let us refer you to our fine collection of posts on the topic. (Note: when you click on the link, the posts – about a couple dozen – will appear in reverse chronological order, so be sure to scroll down to the May, 2009 entries before you start reading.) For a quick synopsis, check out this post, and for a good chuckle, check out this one.

In a nutshell, back in 2009 the FCC tried to insist that all attributable interest holders in commercial broadcast licensees would have to provide SSN-based FRNs. The universe of “attributable interest holders” is vast; it includes all general and many limited partnership interests, all members of LLC licensees, holders of five percent or more of a corporate licensee’s stock, and all officers and directors of a licensee. But wait, there’s more. That universe also includes individuals and entities who hold indirect interests in broadcast licensees, i.e., through intermediate holding companies. (Possibly helpful illustration: if Corporation A happens to own a 20 percent ownership interest in a corporate licensee, then all of Corporation A’s officers, directors and 25 percent or greater shareholders would be deemed to hold attributable interests in the licensee.)

Prior to 2009, a licensee had generally been responsible for, at most, its own FRN. But with the revised Form 323 introduced in 2009, that changed dramatically. Suddenly – and we do mean suddenly, since the Commission sprang the revised form on the broadcast industry in mid-August, 2009, without having made it available for public review beforehand – commercial broadcasters would have to obtain and report SSN-based FRNs not only for the licensees themselves, but also for all their attributable interest-holders. That would impose a substantial burden on many, possibly most, licensees. It also gave rise to legitimate privacy concerns. In this day and age of identity theft, we are all taught not to hand out our SSNs unnecessarily.

Not surprisingly, considerable opposition to the mandatory reporting of SSN-based FRNs arose, despite the fact that the Commission seemed bent on minimizing the opportunity for any public comment. Faced with serious resistance, the Commission initially (in December, 2009) announced that SUFRNs could be used by licensees to report interest holders for whom the licensee could not obtain SSN-based FRNs as of the deadline for filing the Ownership Report. But the licensee would still be obligated to obtain and report SSN-based FRNs for all its attributable interest holders.

Fletcher Heald, joined by a number of state broadcast associations, took that requirement to court. The day our petition was filed, the FCC announced that it was postponing the then-imminent Ownership Report deadline indefinitely. Coincidence? You make the call.

By May, 2010, the requirement was still with us, and the new filing deadline was fast approaching. Back to court we went. This time the court ordered the Commission to respond to our petition. Two days after that order came down, the FCC revised Form 323. Coincidence? You make the call. In so doing, the Commission didn’t bother to tell anybody other than the Office of Management and Budget, which rubber-stamped the change.  

The Commission then paraded into court, pointing to its revised form without mentioning to the court that the ink was still wet on the revised version. The court eventually denied our petition, but only based on the revised version of the form, which the court interpreted to say that no individual attributable interest holder would be required to submit an SSN-based FRN if he/she preferred not to. So even though our petition was technically “denied”, we had largely achieved the result we wanted.

The biennial Form 323 filings went in in 2010 and 2011 (yes, it really was “biennial”, since the 2010 report related back to 2009) without apparent problems. But now, with the 6th FNPRM, the Commission is proposing to eliminate the SUFRN option.

Why? It’s not entirely clear. The Commission speaks generally about the need to “facilitate long-term comparative studies” of broadcast “ownership”. It sees SSN-based FRNs as “essential to providing the kind of searchable and manipulable database needed to support accurate and reliable studies of ownership trends.” And now we learn that, apparently, the “fundamental objective” of the biennial Ownership Report is to “track trends in media ownership”.

As far as we know, the FCC’s interest in studying “ownership trends” is of extremely recent vintage, as is the notion that that activity is the “fundamental objective” of Ownership Reports. But even if we indulge the Commission on this point for the moment, serious questions remain about the proposal to toss the SUFRN option.

For example, the Commission seems to think that reliance on an SSN-based system will assure greater accuracy than any alternative. But that assumes that everyone obtaining an SSN-based FRN provides accurate input. That’s not necessarily a given: the potential for inadvertent slip-ups always exists, as does the possibility that folks who prefer not to provide their SSN might intentionally mis-enter it in the CORES system. How can the FCC police against that? Also, if you’re familiar with CORES, you know that it’s possible to get an FRN without entering an SSN at all. For example, you can simply indicate that you have applied for an SSN (the assumption being that you haven’t yet received it), and bingo, you can get yourself an official FRN without an underlying SSN. (In a footnote to the 6th FNPRM, the FCC itself acknowledges that the CORES FRN system can be circumvented and requires accurate input from users.)

So the FCC’s insistence on the virtues of an SSN-based approach to FRNs seems a bit over-stated.

So, too, does the Commission’s insistence on getting data from all attributable interest-holders. While rounding up that universe of respondents will for sure provide an incredibly comprehensive snapshot of essentially all participants in the broadcast industry, is that really necessary? What difference does it make if Joe and Loretta Six-Pack happen to own a five percent, or even ten percent, interest in their brother-in-law’s station down the block? Who cares if, strictly for purposes of convenience (e.g., for signing the occasional corporate document for regulatory purposes), a broadcast president/CEO has appointed one of her office staff to serve as “Assistant Secretary” of the licensee corporation? If the FCC’s goal is to chart and monitor the major veins and arteries of the broadcast industry, why bother scanning down to the capillary level, especially when that imposes a substantial burden on the scannees?

And let’s not forget the legitimate privacy concerns of everyone who would have to get an SSN-based FRN. One’s SSN is normally viewed as among the crown jewels of one’s array of personal identifying information. We are frequently encouraged not to provide our SSN unnecessarily.

The FCC initially began collecting SSNs only from those who “do business with” the Commission, as a mechanism to facilitate debt collection. While that might be a valid basis for SSN collection, does it have anything at all to do with Joe and Loretta Six-Pack or the Assistant Secretary who happens to hold a corporate officership simply for convenience purposes? The Commission can’t claim with a straight face that it might try to go after such bit players for regulatory obligations incurred by the licensee.

BTW, if you’re not sure how serious the FCC is about enforcing an SSN-based FRN requirement, check this out. According to the 6th FNPRM, if an attributable interest holder is unwilling to provide an SSN-based FRN for inclusion in an Ownership Report, the Commission will apparently expect the licensee to “report the recalcitrant attributable interest holder” so that the FCC can “use its enforcement authority to impose a forfeiture against such individuals”.   Translation (cue sinister music, lower lights menacingly): “We have our ways to get the information we want. Bwahahahaha.” Exactly how such individual forfeitures could be justified is unclear, since (as the FCC admits), its rules don’t currently require attributable interest holders to have FRNs at all. We’re guessing that that wouldn’t stand in the FCC’s way, though, at least until the matter got to court.

In summary, the FCC appears still to be wedded to the SSN-based FRN reporting requirement that it attempted to foist on the broadcast industry in 2009. That initial attempt was foiled, thanks primarily to the fact that the Commission ignored a number of obvious procedural niceties in its headlong rush to impose the requirement. But now, more than three years later, the Commission is taking a more deliberative approach presumably designed to avoid the problems it ran into the last time around. 

While we may all agree that the Commission’s proposal is flawed in a lot of ways, we must face the fact that, unless somebody comes up with an acceptable alternative, the FCC seems bound and determined to toss out the SUFRN option and to insist on SSN-based FRNs from all attributable interest-holders of each licensee. So now’s the time to put your thinking caps on. It’s hard to imagine that a suitable alternative can’t be devised, even if the FCC seems resistant to that notion. Here’s hoping that comments in response to the 6th FNPRM will provide such alternatives.

Non-coms in the FRN cross-hairs?

Also out for comment in the 6th FNPRM is a proposal that the SSN-based FRN reporting requirement be extended to attributable interest holders in noncommercial licensees. The NCE universe dodged this particular bullet back in 2009, although the issue was then teed up in a Fourth Further Notice of Proposed Rulemaking (4th FNPRM). The Commission is now soliciting more comments on it – even though, in response to the 4th FNPRM members of the public broadcasting community severely criticized it. 

Other proposals

Additionally, in the 6th FNPRM the Commission suggests that the biennial ownership reporting requirement be expanded to include entities and individuals whose interests are not otherwise attributable. If their non-attributability arises from either (a) the single majority shareholder exemption or (b) the exemption for interests held in “eligible entities” subject to a higher EDP threshold, then that non-attributabiltiy would go away under the FCC’s proposal.  (This proposal first saw the light of day back in 2009, but has not been actively pursued, until now.)

The Commission is also suggesting that the filing date for biennial Ownership Reports should be shifted back a month, to December 1 (although the “as of” date would remain October 1). The Commission probably thinks that giving broadcasters an extra 30 days to prepare their reports is doing them a favor, but hold on there. December 1 arrives immediately after the Thanksgiving holiday, and coincides with multiple other filing deadlines. Why not pick a date – July 1, for instance – that would not be similarly encumbered. Further, it’s not uncommon for broadcast transactions to be timed to close as of the December 31 of any given year. That being the case, ownership data accurate as of October 1 would often be inaccurate a mere 90 days later. For that reason a mid-year reporting deadline (again, July 1 springs to mind) might be preferable all around.

In any event, the 6th FNPRM has been published in the Federal Register, as a result of which the deadlines for comments have been established. Comments on the various proposals are due to be filed by February 14, 2013 (Happy Valentine’s Day!), and reply comments are due by March 1.

Form 323 - The Fun Begins Again

Media Bureau announces opening of 2011 Ownership Report season, but leaves out some information that many might find useful

The Media Bureau has reminded commercial broadcasters that their biennial Ownership Reports (Form 323) are due to be filed by December 1, 2011 – and that the opportunity to start filing them opens up October 1, 2011.

But the Bureau’s public notice doesn’t mention some information we kind of hoped they might, since we reminded them of it just a couple of weeks ago. Seeing as how the Commission seems less than clear about what it told the U.S. Court of Appeals for the D.C. Circuit just last year, let us help out here.

The question: Is it really true that anybody and everybody with any attributable interest in a reporting licensee must be identified, in the report, by a Social Security Number-based FCC Registration Number?

Short answer: No.

Longer answer: No, individuals with attributable interests may submit a non-SSN-based FRN – dubbed a “Special Use FRN” (we refer to it as a SUFRN) – under some circumstances. Just what those circumstances are remains a bit fuzzy, since the latest public notice fails to mention an important exchange between the Commission and the D.C. Circuit which shed considerable light on this very point.

First, a brief intro to the SUFRN.  The SUFRN option is not reflected in the instructions to Form 323 or in the form itself . . . BUT, if you get deep into completing the form, you get to the FRN question, which simply requires you to insert an FRN for each attributable interest holder. Immediately under the blank where you’re supposed to insert that FRN, the form reads: “If Respondent is unable to provide an FRN for an individual attributable interest holder reported in this listing, press above button”.

And sure enough, there’s a button labeled “Special Use FRN”. If you push that button, you get a pop-up message that instructs that you don’t need to use an SSN-based FRN. However, according to the pop-up message, eligibility to use a SUFRN arises only “if, after diligent and good faith efforts, Respondent is unable to obtain, and/or does not have permission to use, a Social Security Number in order to generate an FRN for any specific individual whose FRN must be reported on Form 323.”

The pop-up message thus limits use of an SUFRN to situations in which the respondent has made “diligent and good faith efforts” to obtain SSN-based FRNs but has been “unable to obtain, and/or does not have permission to use” such FRNs.

Omitted from the form, the pop-up message, and the FAQs found on the Bureau’s website dedicated to All Things Form 323 is the fact that respondents “are not required to provide SSN-based FRNs . . . if they object to the submission of their Social Security Numbers.” Nor does the Bureau acknowledge that “no individual attributable interest holder will be required to submit Social Security number to obtain an FRN” in order to respond to Form 323. 

But that’s precisely what the Commission and the D.C. Circuit worked out in June-July, 2010.

There’s a fair amount of backstory here. You can catch up with it by reading this series of posts chronicling L’Affaire Form 323 from 2009-2010. You can also read the Emergency Petition we filed with the Commission on September 14, 2011.   If you don’t feel like reading the entire history of the matter – entertaining though it may be – and would prefer to cut to the chase, here are direct links to the FCC’s pleading to the Court and the Court’s response.

The bottom line is that, with respect to use of SUFRNs, the Commission made a very specific representation to the Court and the Court expressly relied on that representation. According to the FCC, respondents “are not required to provide SSN-based FRNs . . . if they object to the submission of their Social Security Numbers.” And according to the Court, “no individual attributable interest holder will be required to submit Social Security number to obtain an FRN” in order to respond to Form 323.

We think that all Form 323 filers are entitled to know that. For some reason, the Commission seems unenthusiastic about that prospect.

As we read all this, inability to obtain an SSN-based FRN – which is what Form 323 suggests is a prerequisite to hitting the SUFRN button in the first place – appears to be immaterial. Ditto for making “diligent and good faith efforts” to get hold of SSN-based FRNs – a duty imposed by the pop-up message when you hit the “Special Use FRN” button. The Commission appears to have told the Court in no uncertain terms that no individual attributable interest holder has to file an SSN-based FRN is he/she objects to doing so. Period.  If the Commission disagrees with our interpretation, it might want to say so.

Another, less prominent, aspect of the SSN-based FRN question involves changes made to the form back in December, 2009, which have since been quietly tweaked. In December, 2009, the SUFRN pop-up message (as well as a public notice issued on December 4, 2009) insisted that reliance on a SUFRN for purposes of getting an Ownership Report on file by the then-operative deadline was only an interim measure. Respondents remained under an “ultimate duty to obtain a fully compliant FRN” for all folks identified in Form 323. According to the December 4, 2009 public notice, the Commission expected all filers relying on SUFRNs to “update their filed ownership reports with fully compliant FRNs when these are obtained.”

The language about some “ultimate duty” to update after the fact was deleted from the pop-up message by the Commission in March, 2010.  You may not have noticed that, since the deletion was effected without explanation or public notice from the Commission. The FCC did ask OMB for permission for the deletion, but in so doing merely characterized the change as “non-substantive”, without offering any rationale. Since the Commission didn’t bother to tell anybody about this change, much less explain it, there was no reason to believe that the concept of some continuing “ultimate duty” did not remain in place.

We mentioned this in our Emergency Petition, and the Commission appears to have taken our comments on this point to heart . . . sort of. On September 28, 2011 – that would be just a couple of weeks after we filed the Emergency Petition, and a mere three days before the form was to go “live” for the 2011 biennial filings – the Commission quietly asked OMB to authorize yet another tweak to the language in the pop-up message, and OMB obliged. Now, stuck on at the end of the pop-up message is the following sentence: “The guidance provided on Special Use FRNs in the Media Bureau’s December 4, 2009 Public Notice (DA 09-2539) has been superseded as discussed herein.”

“As discussed herein”? The problem is that there is no obvious discussion in the pop-up message (or on the FCC’s website) referring back to the December, 2009 public notice, so anyone reading that newly-added sentence wlll be hard-pressed to know what it’s supposed to mean. Our guess is that the Commission is backing away from the notion of some “ultimate duty” to follow-up with SSN-based FRNs for everybody, but the Commission sure hasn’t said that expressly. By contrast, the Commission was very explicit in imposing that duty back in December, 2009 – so if it wants now to countermand that earlier instruction, you’d think that the Commission could do so with similar clarity.

Unfortunately, the Commission appears still to be trying to shore up the multiple weaknesses in its Form 323 in a piecemeal, less-than-public way. The history of Form 323 since 2009 has not been a particularly happy one, and the most recent developments don’t suggest much improvement. With the filing window opening on October 1, the Commission has apparently not focused on problems with the form that were identified, and should have been fixed, more than a year ago. The last-minute addition of unilluminating language in the pop-up message does not suggest that the Commission has taken the time to think through the form carefully. Indeed, the manner in which that last-minute addition was submitted to OMB suggests less than careful and thoughtful preparation:

(This is a screen grab, taken from the OMB website, of a portion of the request for OMB approval submitted by the FCC on September 28, 2011.)

Maybe we’re missing something here, but a hand-written change to a form which is supposed to go “live” within a couple of days doesn’t suggest that the folks in charge of that form have the best handle on it. That’s too bad, since it’s a form that all commercial broadcasters are required to file. We had hoped that the efforts we made in 2009-2010 would have assisted the Commission to get its Form 323 act together by now. We may just have to keep trying.