Congress is set to grill the FCC's chairman for falsely claiming his agency was hit with a cyberattack - here's how it could affect the war over net neutrality

• Federal Communications Commission Chairman Ajit Pai should expect some tough questions at a Senate hearing last week.
• Last week, the agency's inspector general released a report into an incident last year in which the FCC's servers became unavailable during the comment period over Pai's repeal of the agency's net-neutrality rules.
• At the time of the outage, Pai and the FCC told Congress and the public that it had been caused by a cyberattack.
• The report found no evidence to back that assertion. In fact, investigators believed agency officials made false statements to Congress, and referred the case to federal prosecutors.
• The incident could play into a court case filed by activists seeking to overturn Pai's repeal.

---

Ajit Pai is going to be in the hot seat this week - as well he should be.

The chairman of the Federal Communications Commission is set to testify Thursday in front of a Senate oversight committee. He's certain to have to respond to questions while there about false statements he and some of his subordinates made to lawmakers about an incident last year in which the agency's computer systems got overwhelmed during the comment period for its then-ongoing net-neutrality proceeding.

Pai has tried to distance himself from those false statements, blaming them on the agency's former chief information officer, David Bray. But lawmakers are sure to want to know when Pai knew the statements were false and why he didn't retract them earlier.

Perhaps more importantly, lawmakers may well try to delve into the role the incident played in Pai's effort to overturn the FCC's net-neutrality rules. And the incident and Pai's answers about it could factor into ongoing court battle over his repeal of those rules.

Pai's expected grilling comes as a result of his and his agency's response to the FCC's server outage last year. At the time, the FCC was soliciting public comments for Pai's proposal to repeal the agency's net-neutrality rules.

Net neutrality is at the heart of the current controversy

As you probably know by now, net neutrality is the principle that all data on the internet should be treated the same. The FCC's rules barred internet service providers from blocking, slowing, or speeding access to particular sites and services.

While widely popular with the public, the rules were vehemently opposed by the big telecommunications companies and by some anti-regulatory Republicans - most notably Pai, who vowed to repeal them even before becoming the chairman of the FCC. He launched that effort soon after taking over as head of the agency under President Donald Trump.

After proposing his repeal last year, Pai followed agency protocol and opened up his proposal to public comment. In May of last year, comedian John Oliver made the repeal effort the focus of one of the episodes of his show, "Last Week Tonight." Oliver supports net neutrality and explained in the episode why viewers should too. At the end of the episode, he encouraged viewers to tell the FCC to abandon its effort to repeal its rules and provided a custom web site address that would redirect them to the agency's comment page.

Immediately after the episode aired, the FCC's comment system saw a spike in traffic, with the site unavailable to many users in the wake. To outside observers, it seemed clear that the site's unavailability was likely a result of "Last Week Tonight" directing its viewers to the FCC's site for the purpose of registering their objections to the net-neutrality repeal effort.

The FCC blamed the outage on a cyberattack

But that's not how the FCC portrayed things. The day after the episode aired, the agency issued a statement attributed to David Bray, its CIO, that blamed the system problems on "deliberate attempts by external actors to bombard the FCC's comment system." Bray said the effort came in the form of "multiple distributed denial-of-service attacks," better known as DDoS attacks.

The charge was a loaded one. DDoS attacks have become a fairly routine way for hackers to make a website appear offline and unavailable to its users. But launching one against a US government server is a federal crime. So by alleging that a DDoS attack had brought down the FCC's server, Bray triggered an investigation by the agency's inspector general, working in coordination with the FBI.

The DDoS charge also helped to distract attention from the popular outrage against the repeal effort. Instead of everyone talking about all the comments flooding into the FCC site opposing the repeal, the headlines focused on how the FCC site was the victim of an alleged cyberattack.

"This certainly was a potential distraction, and it certainly cast a shadow over what was a really enormous response from the public in support of net neutrality," said Harold Feld, a senior vice president at Public Knowledge, an advocacy group that opposed the repeal effort.

Despite the FCC's assertion, consumer groups and reporters who cover the agency quickly challenged its story, and Democratic senators pressed it for more details. Even though critics argued that the incident had none of the telltale signs of a DDoS attack, the agency under Pai stuck to its guns - and attempted to undermine the naysayers.

In public, it lambasted critics who reported that it didn't have any documentation of the attack. Meanwhile, Gizmodo reports that behind the scenes, the agency worked with friendly reporters to get out the notion that the FCC had seen a similar attack in 2014 when it was considering the net neutrality rules Pai was now trying to overturn.

The investigation showed otherwise

It turns out, though, that the FCC wasn't hit with a DDoS attack last year and likely wasn't affected by one in 2014. Released last week, the inspector general's report makes clear its investigation found no evidence of a such an attack last year, and the agency has released no evidence for one in 2014.

But the situation is worse than that for Pai and his agency. The investigation found that FCC officials had little basis for making their statements that there had been such an attack. Contrary to the officials' assertions to members of Congress that their analysis had led them to that conclusion, the investigation found they had done no "substantive" analysis at all.

In fact, the paucity of evidence for the attack was so clear so early on, that the investigation quickly swiveled from being an inquiry into a cyberattack into an examination of whether and why FCC officials misled Congress. In January, the inspector general's was concerned enough that a crime had occurred that it referred the matter to the Department of Justice. The DOJ later declined to prosecute.

But all of this raises questions about Pai's role in promulgating and promoting - and waiting more than a year to recant - the now discredited DDoS story.

The incident makes Pai look incompetent - or worse

At best, Pai comes across as being incompetent. The inspector general's office was able to knock down the DDoS story by just pressing the FCC's technology administrators for more details about the outage and finding that they had no evidence to support their claim.

When Bray made a similar claim about an outage in 2014, the FCC at the time didn't broadcast his conclusion. Why? Because agency officials at the time actually examined his assertion and concluded he didn't have any evidence for it, as Gigi Sohn, a counselor to then-FCC Chairman Tom Wheeler, recounted to Gizmodo.

But lawmakers this week are likely to wonder much more than why Pai didn't push Bray and his staff for more details about the outage. They're also likely to press him for more information about when he himself realized that his previous statements to Congress about the incident were false and why he didn't alert legislators earlier. If the inspector general's office had reason to believe back in January that false statements were made, there's a good chance Pai knew back then too. He didn't say anything to correct the record until last week - a day before the report was released.

In his statement, Pai blamed Bray and, in turn, the Obama administration, which hired Bray. He also gave an excuse for not speaking earlier about the misstatements - the inspector general had asked that he not say anything about the investigation while it was ongoing.

"It's almost like has a placard on his desk that says, 'the buck doesn't stop here unless I want it to,'" said Matt Wood, a policy director at Free Press, an advocacy group that also opposed the net-neutrality repeal effort.

It remains to be seen whether Pai's excuses will wash with Congress. For his part, Feld doesn't buy them, particularly when it comes to renouncing the assertion about the DDoS attack. There were plenty of ways and an ample amount of time for Pai to do that without jeopardizing the investigation, he said.

"He had a responsibility to inform the Congress as soon as he had doubts," said Feld. "He had a responsibility to inform Congress and to inform the public."

"Instead," Feld continued, "he kept quiet."

The incident could play a role not just in Congress, but the courts

The false statements about the DDoS attack and Pai's delay in retracting them could linger long past Thursday's hearing. For one thing, should the Democrats recapture one or more houses of Congress this fall, they're likely to subject Pai to much more critical scrutiny going forward than have their Republican colleagues. It also might make them more likely to press forward with legislation that would effectively overturn his repeal.

[Pai] had a responsibility to inform the Congress as soon as he had doubts

But the whole incident over the server outage could also play a role in the legal battle over the repeal. Free Press, Public Knowledge, and other groups have sued the FCC to try to overturn the new rules, which the agency passed in December and which basically remove all net-neutrality protections.

When considering new rules, the FCC is required by law to take public comments into account. As part of the case the groups are making against the rules, they plan to argue that the agency didn't, in fact, make a good-faith effort to do that. Instead, they plan to argue that it failed in its duty to seriously gather and consider the public's comments.

The groups will point at numerous examples of this, but one of the examples will be the agency's inability to handle the comments coming in from "Last Week Tonight" viewers and falsely ascribing that inability to a DDoS attack.

"If that were only thing, it wouldn't be fatal on its own," said Feld. "But it's part of a general pattern of the FCC failing to conduct the process in an above-board way that adequately gave the public a genuine opportunity to be heard."

That's why this is unlikely to be the last you hear about this incident. Although, after Thursday, Aji Pai may wish he'd never heard about it in the first place.