Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright size-thumbnail wp-image-4354" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2015/12/FTC-iStock_000065443239_Large-150x150.jpg" alt="Federal Trade Commission Doorway Sign" width="150" height="150" />On January 6, the Federal Trade Commission (FTC) <a href="https://www.ftc.gov/news-events/press-releases/2017/01/ftc-charges-d-link-put-consumers-privacy-risk-due-inadequate">announced</a> that it had filed a complaint against Taiwanese D-Link Corp. and its U.S. subsidiary, D-Link Systems Inc. (D-Link), alleging the company made deceptive claims about the security of its products and engaged in unfair practices that put U.S. consumers’ privacy at risk. The case is noteworthy for the fact that the FTC did not cite an actual breach affecting D-Link’s devices; rather, it brought the action based on alleged potential harm to consumers that could result from security vulnerabilities associated with the devices.

Background

D-Link sells networking equipment that integrates consumers’ home networks, such as routers, internet protocol (IP) cameras, baby monitors and home security cameras. These devices allow consumers to monitor the safety of their homes, young children and even pets by allowing access to live feeds from their cameras using their mobile devices or a computer.

The FTC alleges that D-Link failed to protect against “widely known and reasonably foreseeable risks of unauthorized access” to the routers and cameras, thus endangering the privacy and security of their customers. These failures, the FTC asserts, could lead to the exploitation of the devices and exposure of consumer information to attackers.

The Complaint

The FTC’s <a href="https://www.ftc.gov/system/files/documents/cases/170105_d-link_complaint_and_exhibits.pdf">complaint</a> alleges that D-Link failed to take reasonable steps to secure the routers and IP cameras for U.S. consumers. In particular, the complaint alleges that D-Link failed to do the following:
<ul>
 	<li>Take reasonable software testing and remediation measures to protect their routers and IP cameras against well-known and easily preventable software security flaws that would potentially allow remote attackers to gain control of consumers’ devices.</li>
 	<li>Take reasonable steps to maintain the confidentiality of the “signature” key that D-Link used, which resulted in the exposure of the private key on a public website for approximately six months.</li>
 	<li>Use free software, available since at least 2008, to secure users’ mobile app login credentials, instead storing those credentials in clear, readable text on users’ mobile devices.</li>
</ul>
The FTC further alleges that D-Link made numerous false claims in its marketing materials as to the security of its routers and IP cameras. The complaint requests that the court enter a permanent injunction to prevent future violations of the FTC Act by D-Link and award costs to the FTC.

D-Link’s Response

Following the FTC complaint, D-Link posted <a href="http://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10069">a response on its website</a> stating that the company will “vigorously defend” the claims against it, and that it “maintains a robust range of procedures to address potential security issues, which exist in all Internet of Things (IoT) devices.”

Takeaways

This latest complaint follows other FTC actions focused on the privacy and security risks associated with increasingly ubiquitous IoT devices. Companies involved in IoT device design and manufacturing should take precautions and guard against potential exposure of consumer information.

In January 2015, an FTC <a href="https://www.ftc.gov/system/files/documents/reports/federal-trade-commission-staff-report-november-2013-workshop-entitled-internet-things-privacy/150127iotrpt.pdf">Staff Report on the Internet of Things</a> offered guidance for companies on best practices to address consumer privacy and security risks. Recognizing that there is no “one size fits all” approach to tackling privacy risks posed by IoT devices, the FTC indicates that companies should consider the following suggestions:
<ul>
 	<li>Build security measures into devices from the outset and at every stage of development – don’t wait to implement retroactive security measures after the devices have already been produced and sold.</li>
 	<li>Consistently maintain up-to-date software to secure consumer personal information, and ensure regular software testing. Any identified vulnerabilities should be remediated promptly, connected devices should be monitored throughout their life cycles and security patches should be issued to cover known risks.</li>
 	<li>Take steps to implement reasonable access control measures for IoT devices, including making sure proprietary device signatures remain confidential.</li>
 	<li>Accurately describe the products’ safety and security features in marketing and promotional materials.</li>
</ul>
A year and a half later, in June 2016, the FTC <a href="https://www.dataprivacymonitor.com/big-data-2/balancing-innovation-with-privacy-concerns-the-ftc-provides-comment-on-the-internet-of-things/">responded to a Request for Comments</a> on the IoT that had been issued by the National Telecommunications and Information Administration. In its response, the FTC called out safety risks and threats to personal information posed by IoT devices, as well as IoT vulnerabilities that have the capability to facilitate attacks on other systems.

FTC Goes After IoT Device Manufacturer for Alleged Security Vulnerabilities in Routers, IP Cameras