South Dakota’s prison tablet provider dinged for data breach by Federal Trade Commission

The company that gave electronic tablets to South Dakota prison inmates under a contract with the state hid a 2020 data breach for nine months and then told only a fraction of affected users about it, according to a settlement filed in late February with the Federal Trade Commission.

The FTC’s decision and order in the data breach and fraud case against Global Tel Link (GTL) was issued on Feb. 27, two weeks before the South Dakota Department of Corrections suspended tablet-based phone calls and text messages for about 3,600 inmates. 

That suspension is thought to have contributed to multiple nights of unrest last month at the penitentiary in Sioux Falls, including an assault that injured an employee. Attorney General Marty Jackley has said inmates involved will be prosecuted “to the fullest extent of the law.” 

South Dakota Department of Corrections spokesman Michael Winder said via email that GTL did not inform the agency of any data breach. South Dakota Division of Criminal Investigation spokesman Tony Mangan said the Attorney General’s Consumer Protection Division has yet to hear from the company about the number of South Dakotans affected by the breach, if any.

It’s one of several legal issues faced by GTL (rebranded as ViaPath Technologies in 2022), which works with nearly 2,000 facilities across the U.S.

For years, critics have called the Virginia-based company’s business practices exploitative and called on the federal government to step in and regulate rates – something the FTC has worked on for phone calls, most recently with an interim rate cap last reviewed in September.

The tablet communication shutdown in South Dakota wasn’t announced publicly until March 20, when the DOC said it was the result of an investigation. Gov. Kristi Noem said inmates were using the GTL-provided devices for “nefarious” activities. The DOC has not responded to questions about whether tablet security was part of the problem.

One week after the DOC posted a memo on tablet restrictions to its website, media gathered outside the penitentiary on the first night of disturbances could hear inmates inside shouting “we want phones.” The following night, inmates could be heard yelling “we have rights” and “water.” 

Family members had been unable to visit inmates on “the Hill,” the area of the prison where the incidents took place, until this week. 

An April 8 memo from the DOC, posted to its visitation page, says that in-person visits will commence for those inmates on Saturdays, Sundays and the third Friday of each month. 

Since last week, inmates have been allowed to make up to five phone calls a day with 20-minute time limits, using either tablets or wall phones. Electronic messaging remains suspended.

Inmates and their families have bristled at the restrictions on tablet-based communications, and some have complained about frozen inmate accounts with unusable balances.

Advocates who argue for rate caps and regulation of communications providers say the issues in South Dakota and across the nation come as prisons have become more isolated places. During the COVID-19 pandemic, for example, many prisons and jails stopped allowing in-person visits in favor of video visitation. 

“At the end of the day, the fact that people are being exploited and still would rather have the technologies than not have them just goes to show how bad prison life is,” said Wanda Bertram of the Prison Policy Initiative, a prison reform nonprofit based in Massachusetts.

Data security, financial practices scrutinized

South Dakota is far from alone in its use of private-company tablets for inmate communications, which typically double as correctional revenue engines. The state’s contract with GTL specifies commission rates for messaging and prepaid phone calls.

The South Dakota DOC charges less than the FTC’s interim 14-cent-per-minute cap for phone calls, but messaging services aren’t capped federally, and the state has collected revenue from both messaging and phone calls. Between 2021 and February, South Dakota collected at least $1.25 million in commission payments, according to data released to South Dakota Searchlight last month. 

GTL has frequently been on the receiving end of political and legal scrutiny. In 2022, the company agreed to pay back $67 million to settle a class action lawsuit launched in U.S. District Court in Georgia over its practice of pocketing money from dormant inmate accounts.

Just last month, families in Michigan sued GTL and other communications providers, alleging they conspired with jailers to end in-person visits in favor of paid-for video visits.

The recent FTC action against the company involved a data breach in August 2020. The company and its subsidiaries had placed personally identifying and financial information into the Amazon Web Services cloud to test software. The FTC alleged in November that it did so without encrypting or otherwise protecting customer information, leaving information like the Social Security numbers, dates of birth and credit card information of inmate families and friends vulnerable to hacking.

That’s exactly what happened, according to the FTC’s complaint.

“As early as November 2020, (GTL) received multiple complaints from consumers stating that the consumers’ personally identifiable information obtained from Respondents had been located on the dark web,” the complaint reads. 

By then, a data security blog called Comparitech had asked GTL subsidiary Telmate about the incident. Telmate told the blog the issue was resolved, and that no passwords or financial information had been exposed. 

Those statements were false, the FTC said.

It took nine months for the company to inform individual users, and it only reached out to 45,000 of the approximately 650,000 people affected.

The FTC’s February order requires GTL to implement a host of security and consumer protection measures. Periodic third-party security assessments and reports back to the FTC on the results will be required for the next two decades.

The company will also need to inform all the impacted users – potentially including South Dakotans – that their personal information had been stored in an unsecure cloud computing environment later accessed by hackers, and to provide them with credit monitoring and identity protection services. 

A spokesperson for the FTC said the agency does not have any information on whether the data of South Dakotans was part of the security breach or dark web data sales, referring South Dakota Searchlight to GTL for those answers.

GTL did not respond to an email on those questions.

Reform advocate: Prepaid communications a magnet for abuse

Inmates and their families are uniquely vulnerable to being squeezed by communication providers, according to Bertram of the Prison Policy Initiative. 

Calls and messages to and from correctional institutions are tightly controlled, as they are subject to security screening by corrections officials and paid for under the terms of prison or jail contracts with providers that offer no choice on costs.

Tablets have become lifelines for people in prison and their families, Bertram said, particularly in the face of restrictions on other forms of communication. South Dakota shut down face-to-face visits for more than a year during the COVID-19 pandemic.

“In a lot of places, sending mail and visiting a loved one have become more difficult as prisons have imposed additional restrictions,” Bertram said. “And that has only increased the value and the importance to incarcerated people’s welfare that these tablets have.”

Talk of tablets, phone calls and pricing schemes are important for the general public, she said. 

Research suggests that maintaining family connections translates into a lower likelihood of continued criminal behavior after release. One study in Minnesota found that inmates who had regular visits were 13% less likely to return to prison on new felony charges. Another study of female inmates across multiple states found that “familial telephone contact was most consistently associated with reduction in recidivism.”

High prices or strict limits can put financial stress on families who aim to stay connected, she said, which can have ripple effects across communities.

“You don’t have to find space in your heart to be compassionate for people who have committed crimes,” Bertram said. “But you do have to think about the implications for broader society when there’s companies that are allowed to run rampant and do what they will with incarcerated people’s money by turning them into a captive market.”

The Prison Policy Initiative recommends free calling and messaging for inmates. Absent that, the organization argues that prisons and jails should not collect commission. Removing the financial incentive for correctional institutions tends to lower prices. 

Dallas, Texas, ceased to collect commissions and was able to negotiate lower prices, now charging a cent a minute for phone calls through its provider, Securus, a GTL competitor commonly known as JPay. 

In Connecticut, the Legislature made calls free, and barred both commission collections for its prison system and forced video visitation. California followed suit with free audio calls from tablets and wall phones.

Dropping commission payments also prevents the misuse of funds, she said. In Dauphin County, Pennsylvania, an investigation by the news outlet PennLive revealed that the county spent nearly $300,000 in phone and messaging payouts between 2019 and 2021 to purchase gun range memberships for prison staff, the sheriff’s department, the district attorney’s criminal investigation division, and probation and parole.

Fulton County, Georgia, saw commission funds used to purchase thousands of honey-baked hams.

“You shouldn’t be charging incarcerated people and their families for these basic needs and then turning around collecting money off of that,” Bertram said.

Other models in use nationwide and in South Dakota

Bill Pope isn’t so sure that dropping commission payments is always the right call. Pope is the CEO of NCIC, a Texas-based GTL competitor offering tablets that give hour-for-hour entertainment credits to inmates who use them for coursework. 

Pope pointed to California to explain why. That state offers free calls, and the state’s Public Utilities Commission opted to cap commission payments and set rates for prepaid calls in local jails at 7 cents a minute.

Pope said those moves “obliterated the inmate welfare fund” that had been propped up by payouts. That fund is meant to be “used for the benefit, education, and welfare of inmates of prisons and institutions.”

Many institutions simply want to offer the lowest possible price in a communications contract, Pope said, but others view the commission payments as reasonable ways to cover the expenses of monitoring calls and messages. The bigger problem is hidden fees, he said, like connection fees that some providers charge. Pope would like to see those regulated.

“Eliminating commissions can probably hurt the incarcerated users more than help them,” Pope said. “Unless, of course, the providers are overcharging.”

Pope says his company is the largest privately held communications provider in the U.S.

He sees his company’s approach to tablets as more beneficial for inmates, families and institutions. NCIC has contracts in South Dakota with jails in Yankton and Sioux Falls, among others. Its contract with the Minnehaha County Jail includes commission payments for the Sioux Falls facility, but inmates needn’t necessarily pay – at least for entertainment. Inmates can earn credits through coursework.

The NCIC contract charges 16 cents a minute for calls – more than double the rate listed for calls on the South Dakota DOC’s website – but Pope said the calls subsidize the entertainment that keeps inmates busy and would otherwise be paid for by their families.

“Do your homework, and then you can watch TV or play games,” Pope said.