FTC enforcement of existing laws is certainly an alternative to new legislation. In your time as a commissioner, how effective do you think your attempts at enforcement were?

We were moving. The case with BJ’s Wholesale Club was an example. That was a settlement stemming from a case presented back in May of 2005. [The FTC charged that BJ’s did not reasonably protect sensitive customer information, leading to fraudulent purchases made with counterfeit copies of credit and debit cards.] The FTC’s Unfairness Doctrine relates to conduct that a firm might engage in, which has the consumer at a critical disadvantage. Either the consumer doesn’t know anything about it or can’t do anything to correct it, and there’s no countervailing greater good that comes from the conduct. Using the Unfairness Doctrine, the FTC basically said that BJ’s Wholesale Club, by collecting sensitive and critical information and not taking adequate steps to protect it, had committed an "unfair" act against the consumers. A subsequent case for the FTC was DSW. [The FTC charged that hackers gained access to account information of 1.4 million customers of the shoe discounter.] The FTC nailed them on the same Unfairness Doctrine.

But here’s one of the troubling things about the FTC. It’s a civil law enforcement agency. It has a hard time enforcing criminal-like penalties. To do that, it has to go to the Justice Department, and of course, their plate is just a wee bit full. The FTC can only do so much in the way of punishing, as a famous man in town would say, "the evildoers." I often out of frustration would say, Our punishment amounts only to a small line item on this guy’s financial statement: penalties paid to the FTC for this. You just wonder about the effectiveness of the penalty structure.

Should the penalty structure be changed?

We need to think about changing it in the context of what we’re dealing with today, as opposed to what we were dealing with 30 years ago. Back then, if I had an important document that I kept in my office, and you wanted to do harm to me, you could break into my office and find it and steal it. That’s a major crime. Today that document might exist in a digital format. It is within information systems that you can break into to steal the document. I’m not sure we think of that in the same way we did that physical thing. We need to rethink the nature of this type of crime and how it stacks up with those things we considered to be grievous crimes in the past.